Merge 4.14-rc4 into staging-next

We want the staging/iio fixes in here as well to handle merge issues.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

967 files changed, 12885 insertions, 6418 deletions

diff --git a/.mailmap b/.mailmap
index 5273cfd70ad6..c7b10caecc4e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -68,6 +68,8 @@ Jacob Shin <Jacob.Shin@amd.com>
 James Bottomley <jejb@mulgrave.(none)>
 James Bottomley <jejb@titanic.il.steeleye.com>
 James E Wilson <wilson@specifix.com>
+James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
+James Hogan <jhogan@kernel.org> <james@albanarts.com>
 James Ketrenos <jketreno@io.(none)>
 Javi Merino <javi.merino@kernel.org> <javi.merino@arm.com>
 <javier@osg.samsung.com> <javier.martinez@collabora.co.uk>
diff --git a/Documentation/ABI/testing/sysfs-power b/Documentation/ABI/testing/sysfs-power
index 713cab1d5f12..a1d1612f3651 100644
--- a/Documentation/ABI/testing/sysfs-power
+++ b/Documentation/ABI/testing/sysfs-power
@@ -127,7 +127,7 @@ Description:
 
 What;           /sys/power/pm_trace_dev_match
 Date:           October 2010
-Contact:        James Hogan <james@albanarts.com>
+Contact:        James Hogan <jhogan@kernel.org>
 Description:
                 The /sys/power/pm_trace_dev_match file contains the name of the
                 device associated with the last PM event point saved in the RTC
diff --git a/Documentation/core-api/workqueue.rst b/Documentation/core-api/workqueue.rst
index 3943b5bfa8cf..00a5ba51e63f 100644
--- a/Documentation/core-api/workqueue.rst
+++ b/Documentation/core-api/workqueue.rst
@@ -39,8 +39,8 @@ up.
 Although MT wq wasted a lot of resource, the level of concurrency
 provided was unsatisfactory.  The limitation was common to both ST and
 MT wq albeit less severe on MT.  Each wq maintained its own separate
-worker pool.  A MT wq could provide only one execution context per CPU
-while a ST wq one for the whole system.  Work items had to compete for
+worker pool.  An MT wq could provide only one execution context per CPU
+while an ST wq one for the whole system.  Work items had to compete for
 those very limited execution contexts leading to various problems
 including proneness to deadlocks around the single execution context.
 
@@ -151,7 +151,7 @@ Application Programming Interface (API)
 
 ``alloc_workqueue()`` allocates a wq.  The original
 ``create_*workqueue()`` functions are deprecated and scheduled for
-removal.  ``alloc_workqueue()`` takes three arguments - @``name``,
+removal.  ``alloc_workqueue()`` takes three arguments - ``@name``,
 ``@flags`` and ``@max_active``.  ``@name`` is the name of the wq and
 also used as the name of the rescuer thread if there is one.
 
@@ -197,7 +197,7 @@ resources, scheduled and executed.
   served by worker threads with elevated nice level.
 
   Note that normal and highpri worker-pools don't interact with
-  each other.  Each maintain its separate pool of workers and
+  each other.  Each maintains its separate pool of workers and
   implements concurrency management among its workers.
 
 ``WQ_CPU_INTENSIVE``
@@ -249,8 +249,8 @@ unbound worker-pools and only one work item could be active at any given
 time thus achieving the same ordering property as ST wq.
 
 In the current implementation the above configuration only guarantees
-ST behavior within a given NUMA node. Instead alloc_ordered_queue should
-be used to achieve system wide ST behavior.
+ST behavior within a given NUMA node. Instead ``alloc_ordered_queue()`` should
+be used to achieve system-wide ST behavior.
 
 
 Example Execution Scenarios
diff --git a/Documentation/cpu-freq/index.txt b/Documentation/cpu-freq/index.txt
index 03a7cee6ac73..c15e75386a05 100644
--- a/Documentation/cpu-freq/index.txt
+++ b/Documentation/cpu-freq/index.txt
@@ -32,8 +32,6 @@ cpufreq-stats.txt -	General description of sysfs cpufreq stats.
 
 index.txt       -       File index, Mailing list and Links (this document)
 
-intel-pstate.txt -      Intel pstate cpufreq driver specific file.
-
 pcc-cpufreq.txt -       PCC cpufreq driver specific file.
 
 
diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index 4a0a7469fdd7..32df07e29f68 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -344,3 +344,4 @@ Version History
         (wrong raid10_copies/raid10_format sequence)
 1.11.1  Add raid4/5/6 journal write-back support via journal_mode option
 1.12.1  fix for MD deadlock between mddev_suspend() and md_write_start() available
+1.13.0  Fix dev_health status at end of "recover" (was 'a', now 'A')
diff --git a/Documentation/devicetree/bindings/clock/st,stm32h7-rcc.txt b/Documentation/devicetree/bindings/clock/st,stm32h7-rcc.txt
index a135504c7d57..cac24ee10b72 100644
--- a/Documentation/devicetree/bindings/clock/st,stm32h7-rcc.txt
+++ b/Documentation/devicetree/bindings/clock/st,stm32h7-rcc.txt
@@ -32,7 +32,7 @@ Example:
                 compatible = "st,stm32h743-rcc", "st,stm32-rcc";
                 reg = <0x58024400 0x400>;
                 #reset-cells = <1>;
-                #clock-cells = <2>;
+                #clock-cells = <1>;
                 clocks = <&clk_hse>, <&clk_lse>, <&clk_i2s_ckin>;
 
                 st,syscfg = <&pwrcfg>;
diff --git a/Documentation/devicetree/bindings/leds/ams,as3645a.txt b/Documentation/devicetree/bindings/leds/ams,as3645a.txt
index 12c5ef26ec73..fdc40e354a64 100644
--- a/Documentation/devicetree/bindings/leds/ams,as3645a.txt
+++ b/Documentation/devicetree/bindings/leds/ams,as3645a.txt
@@ -15,11 +15,14 @@ Required properties
 
 compatible      : Must be "ams,as3645a".
 reg             : The I2C address of the device. Typically 0x30.
+#address-cells  : 1
+#size-cells     : 0
 
 
-Required properties of the "flash" child node
-=============================================
+Required properties of the flash child node (0)
+===============================================
 
+reg: 0
 flash-timeout-us: Flash timeout in microseconds. The value must be in
                   the range [100000, 850000] and divisible by 50000.
 flash-max-microamp: Maximum flash current in microamperes. Has to be
@@ -33,20 +36,21 @@ ams,input-max-microamp: Maximum flash controller input current. The
                         and divisible by 50000.
 
 
-Optional properties of the "flash" child node
-=============================================
+Optional properties of the flash child node
+===========================================
 
 label           : The label of the flash LED.
 
 
-Required properties of the "indicator" child node
-=================================================
+Required properties of the indicator child node (1)
+===================================================
 
+reg: 1
 led-max-microamp: Maximum indicator current. The allowed values are
                   2500, 5000, 7500 and 10000.
 
-Optional properties of the "indicator" child node
-=================================================
+Optional properties of the indicator child node
+===============================================
 
 label           : The label of the indicator LED.
 
@@ -55,16 +59,20 @@ Example
 =======
 
         as3645a@30 {
+                #address-cells: 1
+                #size-cells: 0
                 reg = <0x30>;
                 compatible = "ams,as3645a";
-                flash {
+                flash@0 {
+                        reg = <0x0>;
                         flash-timeout-us = <150000>;
                         flash-max-microamp = <320000>;
                         led-max-microamp = <60000>;
                         ams,input-max-microamp = <1750000>;
                         label = "as3645a:flash";
                 };
-                indicator {
+                indicator@1 {
+                        reg = <0x1>;
                         led-max-microamp = <10000>;
                         label = "as3645a:indicator";
                 };
diff --git a/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt b/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt
index b878a1e305af..ed1456f5c94d 100644
--- a/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt
+++ b/Documentation/devicetree/bindings/mmc/marvell,xenon-sdhci.txt
@@ -16,11 +16,13 @@ Required Properties:
 
 - clocks:
   Array of clocks required for SDHC.
-  Require at least input clock for Xenon IP core.
+  Require at least input clock for Xenon IP core. For Armada AP806 and
+  CP110, the AXI clock is also mandatory.
 
 - clock-names:
   Array of names corresponding to clocks property.
   The input clock for Xenon IP core should be named as "core".
+  The input clock for the AXI bus must be named as "axi".
 
 - reg:
   * For "marvell,armada-3700-sdhci", two register areas.
@@ -106,8 +108,8 @@ Example:
                 compatible = "marvell,armada-ap806-sdhci";
                 reg = <0xaa0000 0x1000>;
                 interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>
-                clocks = <&emmc_clk>;
-                clock-names = "core";
+                clocks = <&emmc_clk>,<&axi_clk>;
+                clock-names = "core", "axi";
                 bus-width = <4>;
                 marvell,xenon-phy-slow-mode;
                 marvell,xenon-tun-count = <11>;
@@ -126,8 +128,8 @@ Example:
                 interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>
                 vqmmc-supply = <&sd_vqmmc_regulator>;
                 vmmc-supply = <&sd_vmmc_regulator>;
-                clocks = <&sdclk>;
-                clock-names = "core";
+                clocks = <&sdclk>, <&axi_clk>;
+                clock-names = "core", "axi";
                 bus-width = <4>;
                 marvell,xenon-tun-count = <9>;
         };
diff --git a/Documentation/devicetree/bindings/net/marvell-pp2.txt b/Documentation/devicetree/bindings/net/marvell-pp2.txt
index 7e2dad08a12e..1814fa13f6ab 100644
--- a/Documentation/devicetree/bindings/net/marvell-pp2.txt
+++ b/Documentation/devicetree/bindings/net/marvell-pp2.txt
@@ -21,8 +21,9 @@ Required properties:
         - main controller clock (for both armada-375-pp2 and armada-7k-pp2)
         - GOP clock (for both armada-375-pp2 and armada-7k-pp2)
         - MG clock (only for armada-7k-pp2)
-- clock-names: names of used clocks, must be "pp_clk", "gop_clk" and
-  "mg_clk" (the latter only for armada-7k-pp2).
+        - AXI clock (only for armada-7k-pp2)
+- clock-names: names of used clocks, must be "pp_clk", "gop_clk", "mg_clk"
+  and "axi_clk" (the 2 latter only for armada-7k-pp2).
 
 The ethernet ports are represented by subnodes. At least one port is
 required.
@@ -78,8 +79,9 @@ Example for marvell,armada-7k-pp2:
 cpm_ethernet: ethernet@0 {
         compatible = "marvell,armada-7k-pp22";
         reg = <0x0 0x100000>, <0x129000 0xb000>;
-        clocks = <&cpm_syscon0 1 3>, <&cpm_syscon0 1 9>, <&cpm_syscon0 1 5>;
-        clock-names = "pp_clk", "gop_clk", "gp_clk";
+        clocks = <&cpm_syscon0 1 3>, <&cpm_syscon0 1 9>,
+                 <&cpm_syscon0 1 5>, <&cpm_syscon0 1 18>;
+        clock-names = "pp_clk", "gop_clk", "gp_clk", "axi_clk";
 
         eth0: eth0 {
                 interrupts = <ICU_GRP_NSR 39 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/Documentation/devicetree/bindings/net/rockchip-dwmac.txt b/Documentation/devicetree/bindings/net/rockchip-dwmac.txt
index 6af8eed1adeb..9c16ee2965a2 100644
--- a/Documentation/devicetree/bindings/net/rockchip-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/rockchip-dwmac.txt
@@ -4,6 +4,7 @@ The device node has following properties.
 
 Required properties:
  - compatible: should be "rockchip,<name>-gamc"
+   "rockchip,rk3128-gmac": found on RK312x SoCs
    "rockchip,rk3228-gmac": found on RK322x SoCs
    "rockchip,rk3288-gmac": found on RK3288 SoCs
    "rockchip,rk3328-gmac": found on RK3328 SoCs
diff --git a/Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt b/Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt
new file mode 100644
index 000000000000..830069b1c37c
--- /dev/null
+++ b/Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt
@@ -0,0 +1,28 @@
+Binding for the Synopsys HSDK reset controller
+
+This binding uses the common reset binding[1].
+
+[1] Documentation/devicetree/bindings/reset/reset.txt
+
+Required properties:
+- compatible: should be "snps,hsdk-reset".
+- reg: should always contain 2 pairs address - length: first for reset
+  configuration register and second for corresponding SW reset and status bits
+  register.
+- #reset-cells: from common reset binding; Should always be set to 1.
+
+Example:
+        reset: reset@880 {
+                compatible = "snps,hsdk-reset";
+                #reset-cells = <1>;
+                reg = <0x8A0 0x4>, <0xFF0 0x4>;
+        };
+
+Specifying reset lines connected to IP modules:
+        ethernet@.... {
+                ....
+                resets = <&reset HSDK_V1_ETH_RESET>;
+                ....
+        };
+
+The index could be found in <dt-bindings/reset/snps,hsdk-reset.h>
diff --git a/Documentation/devicetree/bindings/security/tpm/tpm-i2c.txt b/Documentation/devicetree/bindings/security/tpm/tpm-i2c.txt
index 3eca6de6369d..a65d7b71e81a 100644
--- a/Documentation/devicetree/bindings/security/tpm/tpm-i2c.txt
+++ b/Documentation/devicetree/bindings/security/tpm/tpm-i2c.txt
@@ -8,6 +8,12 @@ Required properties:
                    the firmware event log
 - linux,sml-size : size of the memory allocated for the firmware event log
 
+Optional properties:
+
+- powered-while-suspended: present when the TPM is left powered on between
+                           suspend and resume (makes the suspend/resume
+                           callbacks do nothing).
+
 Example (for OpenPower Systems with Nuvoton TPM 2.0 on I2C)
 ----------------------------------------------------------
 
diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
index 4fc96946f81d..cf504d0380ae 100644
--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
+++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
@@ -41,6 +41,8 @@ Required properties:
     - "renesas,hscif-r8a7795" for R8A7795 (R-Car H3) HSCIF compatible UART.
     - "renesas,scif-r8a7796" for R8A7796 (R-Car M3-W) SCIF compatible UART.
     - "renesas,hscif-r8a7796" for R8A7796 (R-Car M3-W) HSCIF compatible UART.
+    - "renesas,scif-r8a77970" for R8A77970 (R-Car V3M) SCIF compatible UART.
+    - "renesas,hscif-r8a77970" for R8A77970 (R-Car V3M) HSCIF compatible UART.
     - "renesas,scif-r8a77995" for R8A77995 (R-Car D3) SCIF compatible UART.
     - "renesas,hscif-r8a77995" for R8A77995 (R-Car D3) HSCIF compatible UART.
     - "renesas,scifa-sh73a0" for SH73A0 (SH-Mobile AG5) SCIFA compatible UART.
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 1ea1fd4232ab..1afd298eddd7 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -3,8 +3,8 @@ Device tree binding vendor prefix registry.  Keep list in alphabetical order.
 This isn't an exhaustive list, but you should add new prefixes to it before
 using them to avoid name-space collisions.
 
-abcn    Abracon Corporation
 abilis  Abilis Systems
+abracon Abracon Corporation
 actions Actions Semiconductor Co., Ltd.
 active-semi     Active-Semi International Inc
 ad      Avionic Design GmbH
diff --git a/Documentation/driver-api/pm/devices.rst b/Documentation/driver-api/pm/devices.rst
index bedd32388dac..a0dc2879a152 100644
--- a/Documentation/driver-api/pm/devices.rst
+++ b/Documentation/driver-api/pm/devices.rst
@@ -675,7 +675,7 @@ sub-domain of the parent domain.
 
 Support for power domains is provided through the :c:member:`pm_domain` field of
 |struct device|.  This field is a pointer to an object of type
-|struct dev_pm_domain|, defined in :file:`include/linux/pm.h``, providing a set
+|struct dev_pm_domain|, defined in :file:`include/linux/pm.h`, providing a set
 of power management callbacks analogous to the subsystem-level and device driver
 callbacks that are executed for the given device during all power transitions,
 instead of the respective subsystem-level callbacks.  Specifically, if a
diff --git a/Documentation/driver-model/driver.txt b/Documentation/driver-model/driver.txt
index 4421135826a2..d661e6f7e6a0 100644
--- a/Documentation/driver-model/driver.txt
+++ b/Documentation/driver-model/driver.txt
@@ -196,12 +196,13 @@ struct driver_attribute {
 };
 
 Device drivers can export attributes via their sysfs directories. 
-Drivers can declare attributes using a DRIVER_ATTR macro that works
-identically to the DEVICE_ATTR macro. 
+Drivers can declare attributes using a DRIVER_ATTR_RW and DRIVER_ATTR_RO
+macro that works identically to the DEVICE_ATTR_RW and DEVICE_ATTR_RO
+macros.
 
 Example:
 
-DRIVER_ATTR(debug,0644,show_debug,store_debug);
+DRIVER_ATTR_RW(debug);
 
 This is equivalent to declaring:
 
diff --git a/Documentation/filesystems/cifs/AUTHORS b/Documentation/filesystems/cifs/AUTHORS
index c98800df677f..9f4f87e16240 100644
--- a/Documentation/filesystems/cifs/AUTHORS
+++ b/Documentation/filesystems/cifs/AUTHORS
@@ -41,6 +41,11 @@ Igor Mammedov (DFS support)
 Jeff Layton (many, many fixes, as well as great work on the cifs Kerberos code)
 Scott Lovenberg
 Pavel Shilovsky (for great work adding SMB2 support, and various SMB3 features)
+Aurelien Aptel (for DFS SMB3 work and some key bug fixes)
+Ronnie Sahlberg (for SMB3 xattr work and bug fixes)
+Shirish Pargaonkar (for many ACL patches over the years)
+Sachin Prabhu (many bug fixes, including for reconnect, copy offload and security)
+
 
 Test case and Bug Report contributors
 -------------------------------------
diff --git a/Documentation/filesystems/cifs/README b/Documentation/filesystems/cifs/README
index a54788405429..a9da51553ba3 100644
--- a/Documentation/filesystems/cifs/README
+++ b/Documentation/filesystems/cifs/README
@@ -1,10 +1,14 @@
-The CIFS VFS support for Linux supports many advanced network filesystem 
-features such as hierarchical dfs like namespace, hardlinks, locking and more.  
+This module supports the SMB3 family of advanced network protocols (as well
+as older dialects, originally called "CIFS" or SMB1).
+
+The CIFS VFS module for Linux supports many advanced network filesystem
+features such as hierarchical DFS like namespace, hardlinks, locking and more.
 It was designed to comply with the SNIA CIFS Technical Reference (which 
 supersedes the 1992 X/Open SMB Standard) as well as to perform best practice 
 practical interoperability with Windows 2000, Windows XP, Samba and equivalent 
 servers.  This code was developed in participation with the Protocol Freedom
-Information Foundation.
+Information Foundation.  CIFS and now SMB3 has now become a defacto
+standard for interoperating between Macs and Windows and major NAS appliances.
 
 Please see
   http://protocolfreedom.org/ and
@@ -15,30 +19,11 @@ for more details.
 For questions or bug reports please contact:
     sfrench@samba.org (sfrench@us.ibm.com) 
 
+See the project page at: https://wiki.samba.org/index.php/LinuxCIFS_utils
+
 Build instructions:
 ==================
-For Linux 2.4:
-1) Get the kernel source (e.g.from http://www.kernel.org)
-and download the cifs vfs source (see the project page
-at http://us1.samba.org/samba/Linux_CIFS_client.html)
-and change directory into the top of the kernel directory
-then patch the kernel (e.g. "patch -p1 < cifs_24.patch") 
-to add the cifs vfs to your kernel configure options if
-it has not already been added (e.g. current SuSE and UL
-users do not need to apply the cifs_24.patch since the cifs vfs is
-already in the kernel configure menu) and then
-mkdir linux/fs/cifs and then copy the current cifs vfs files from
-the cifs download to your kernel build directory e.g.
-
-        cp <cifs_download_dir>/fs/cifs/* to <kernel_download_dir>/fs/cifs
-        
-2) make menuconfig (or make xconfig)
-3) select cifs from within the network filesystem choices
-4) save and exit
-5) make dep
-6) make modules (or "make" if CIFS VFS not to be built as a module)
-
-For Linux 2.6:
+For Linux:
 1) Download the kernel (e.g. from http://www.kernel.org)
 and change directory into the top of the kernel directory tree
 (e.g. /usr/src/linux-2.5.73)
@@ -61,16 +46,13 @@ would simply type "make install").
 If you do not have the utility mount.cifs (in the Samba 3.0 source tree and on 
 the CIFS VFS web site) copy it to the same directory in which mount.smbfs and 
 similar files reside (usually /sbin).  Although the helper software is not  
-required, mount.cifs is recommended.  Eventually the Samba 3.0 utility program 
-"net" may also be helpful since it may someday provide easier mount syntax for
-users who are used to Windows e.g.
-        net use <mount point> <UNC name or cifs URL>
+required, mount.cifs is recommended.  Most distros include a "cifs-utils"
+package that includes this utility so it is recommended to install this.
+
 Note that running the Winbind pam/nss module (logon service) on all of your
 Linux clients is useful in mapping Uids and Gids consistently across the
 domain to the proper network user.  The mount.cifs mount helper can be
-trivially built from Samba 3.0 or later source e.g. by executing:
-
-        gcc samba/source/client/mount.cifs.c -o mount.cifs
+found at cifs-utils.git on git.samba.org
 
 If cifs is built as a module, then the size and number of network buffers
 and maximum number of simultaneous requests to one server can be configured.
@@ -79,6 +61,18 @@ Changing these from their defaults is not recommended. By executing modinfo
 on kernel/fs/cifs/cifs.ko the list of configuration changes that can be made
 at module initialization time (by running insmod cifs.ko) can be seen.
 
+Recommendations
+===============
+To improve security the SMB2.1 dialect or later (usually will get SMB3) is now
+the new default. To use old dialects (e.g. to mount Windows XP) use "vers=1.0"
+on mount (or vers=2.0 for Windows Vista).  Note that the CIFS (vers=1.0) is
+much older and less secure than the default dialect SMB3 which includes
+many advanced security features such as downgrade attack detection
+and encrypted shares and stronger signing and authentication algorithms.
+There are additional mount options that may be helpful for SMB3 to get
+improved POSIX behavior (NB: can use vers=3.0 to force only SMB3, never 2.1):
+     "mfsymlinks" and "cifsacl" and "idsfromsid"
+
 Allowing User Mounts
 ====================
 To permit users to mount and unmount over directories they own is possible
@@ -98,9 +92,7 @@ and execution of suid programs on the remote target would be enabled
 by default. This can be changed, as with nfs and other filesystems, 
 by simply specifying "nosuid" among the mount options. For user mounts 
 though to be able to pass the suid flag to mount requires rebuilding 
-mount.cifs with the following flag: 
- 
-        gcc samba/source/client/mount.cifs.c -DCIFS_ALLOW_USR_SUID -o mount.cifs
+mount.cifs with the following flag: CIFS_ALLOW_USR_SUID
 
 There is a corresponding manual page for cifs mounting in the Samba 3.0 and
 later source tree in docs/manpages/mount.cifs.8 
@@ -189,18 +181,18 @@ applications running on the same server as Samba.
 Use instructions:
 ================
 Once the CIFS VFS support is built into the kernel or installed as a module 
-(cifs.o), you can use mount syntax like the following to access Samba or Windows 
-servers: 
+(cifs.ko), you can use mount syntax like the following to access Samba or
+Mac or Windows servers:
 
-  mount -t cifs //9.53.216.11/e$ /mnt -o user=myname,pass=mypassword
+  mount -t cifs //9.53.216.11/e$ /mnt -o username=myname,password=mypassword
 
 Before -o the option -v may be specified to make the mount.cifs
 mount helper display the mount steps more verbosely.  
 After -o the following commonly used cifs vfs specific options
 are supported:
 
-  user=<username>
-  pass=<password>
+  username=<username>
+  password=<password>
   domain=<domain name>
   
 Other cifs mount options are described below.  Use of TCP names (in addition to
@@ -246,13 +238,16 @@ the Server's registry.  Samba starting with version 3.10 will allow such
 filenames (ie those which contain valid Linux characters, which normally
 would be forbidden for Windows/CIFS semantics) as long as the server is
 configured for Unix Extensions (and the client has not disabled
-/proc/fs/cifs/LinuxExtensionsEnabled).
-  
+/proc/fs/cifs/LinuxExtensionsEnabled). In addition the mount option
+"mapposix" can be used on CIFS (vers=1.0) to force the mapping of
+illegal Windows/NTFS/SMB characters to a remap range (this mount parm
+is the default for SMB3). This remap ("mapposix") range is also
+compatible with Mac (and "Services for Mac" on some older Windows).
 
 CIFS VFS Mount Options
 ======================
 A partial list of the supported mount options follows:
-  user          The user name to use when trying to establish
+  username      The user name to use when trying to establish
                 the CIFS session.
   password      The user password.  If the mount helper is
                 installed, the user will be prompted for password
diff --git a/Documentation/filesystems/cifs/TODO b/Documentation/filesystems/cifs/TODO
index 066ffddc3964..396ecfd6ff4a 100644
--- a/Documentation/filesystems/cifs/TODO
+++ b/Documentation/filesystems/cifs/TODO
@@ -1,4 +1,4 @@
-Version 2.03 August 1, 2014
+Version 2.04 September 13, 2017
 
 A Partial List of Missing Features
 ==================================
@@ -8,73 +8,69 @@ for visible, important contributions to this module.  Here
 is a partial list of the known problems and missing features:
 
 a) SMB3 (and SMB3.02) missing optional features:
-   - RDMA
+   - RDMA (started)
    - multichannel (started)
    - directory leases (improved metadata caching)
    - T10 copy offload (copy chunk is only mechanism supported)
-   - encrypted shares
 
 b) improved sparse file support
 
 c) Directory entry caching relies on a 1 second timer, rather than
-using FindNotify or equivalent.  - (started)
+using Directory Leases
 
 d) quota support (needs minor kernel change since quota calls
 to make it to network filesystems or deviceless filesystems)
 
-e) improve support for very old servers (OS/2 and Win9x for example)
-Including support for changing the time remotely (utimes command).
+e) Better optimize open to reduce redundant opens (using reference
+counts more) and to improve use of compounding in SMB3 to reduce
+number of roundtrips.
 
-f) hook lower into the sockets api (as NFS/SunRPC does) to avoid the
-extra copy in/out of the socket buffers in some cases.
-
-g) Better optimize open (and pathbased setfilesize) to reduce the
-oplock breaks coming from windows srv.  Piggyback identical file
-opens on top of each other by incrementing reference count rather
-than resending (helps reduce server resource utilization and avoid
-spurious oplock breaks).
-
-h) Add support for storing symlink info to Windows servers
-in the Extended Attribute format their SFU clients would recognize.
-
-i) Finish inotify support so kde and gnome file list windows
+f) Finish inotify support so kde and gnome file list windows
 will autorefresh (partially complete by Asser). Needs minor kernel
 vfs change to support removing D_NOTIFY on a file.   
 
-j) Add GUI tool to configure /proc/fs/cifs settings and for display of
+g) Add GUI tool to configure /proc/fs/cifs settings and for display of
 the CIFS statistics (started)
 
-k) implement support for security and trusted categories of xattrs
+h) implement support for security and trusted categories of xattrs
 (requires minor protocol extension) to enable better support for SELINUX
 
-l) Implement O_DIRECT flag on open (already supported on mount)
+i) Implement O_DIRECT flag on open (already supported on mount)
 
-m) Create UID mapping facility so server UIDs can be mapped on a per
+j) Create UID mapping facility so server UIDs can be mapped on a per
 mount or a per server basis to client UIDs or nobody if no mapping
-exists.  This is helpful when Unix extensions are negotiated to
-allow better permission checking when UIDs differ on the server
-and client.  Add new protocol request to the CIFS protocol 
-standard for asking the server for the corresponding name of a
-particular uid.
+exists. Also better integration with winbind for resolving SID owners
+
+k) Add tools to take advantage of more smb3 specific ioctls and features
+
+l) encrypted file support
+
+m) improved stats gathering, tools (perhaps integration with nfsometer?)
 
-n) DOS attrs - returned as pseudo-xattr in Samba format (check VFAT and NTFS for this too)
+n) allow setting more NTFS/SMB3 file attributes remotely (currently limited to compressed
+file attribute via chflags) and improve user space tools for managing and
+viewing them.
 
-o) mount check for unmatched uids
+o) mount helper GUI (to simplify the various configuration options on mount)
 
-p) Add support for new vfs entry point for fallocate
+p) autonegotiation of dialects (offering more than one dialect ie SMB3.02,
+SMB3, SMB2.1 not just SMB3).
 
-q) Add tools to take advantage of cifs/smb3 specific ioctls and features
-such as "CopyChunk" (fast server side file copy)
+q) Allow mount.cifs to be more verbose in reporting errors with dialect
+or unsupported feature errors.
 
-r) encrypted file support
+r) updating cifs documentation, and user guid.
 
-s) improved stats gathering, tools (perhaps integration with nfsometer?)
+s) Addressing bugs found by running a broader set of xfstests in standard
+file system xfstest suite.
 
-t) allow setting more NTFS/SMB3 file attributes remotely (currently limited to compressed
-file attribute via chflags)
+t) split cifs and smb3 support into separate modules so legacy (and less
+secure) CIFS dialect can be disabled in environments that don't need it
+and simplify the code.
 
-u) mount helper GUI (to simplify the various configuration options on mount)
+u) Finish up SMB3.1.1 dialect support
 
+v) POSIX Extensions for SMB3.1.1
 
 KNOWN BUGS
 ====================================
diff --git a/Documentation/filesystems/cifs/cifs.txt b/Documentation/filesystems/cifs/cifs.txt
index 2fac91ac96cf..67756607246e 100644
--- a/Documentation/filesystems/cifs/cifs.txt
+++ b/Documentation/filesystems/cifs/cifs.txt
@@ -1,24 +1,28 @@
-  This is the client VFS module for the Common Internet File System
-  (CIFS) protocol which is the successor to the Server Message Block 
+  This is the client VFS module for the SMB3 NAS protocol as well
+  older dialects such as the Common Internet File System (CIFS)
+  protocol which was the successor to the Server Message Block
   (SMB) protocol, the native file sharing mechanism for most early
   PC operating systems. New and improved versions of CIFS are now
   called SMB2 and SMB3. These dialects are also supported by the
   CIFS VFS module. CIFS is fully supported by network
-  file servers such as Windows 2000, 2003, 2008 and 2012
+  file servers such as Windows 2000, 2003, 2008, 2012 and 2016
   as well by Samba (which provides excellent CIFS
-  server support for Linux and many other operating systems), so
+  server support for Linux and many other operating systems), Apple
+  systems, as well as most Network Attached Storage vendors, so
   this network filesystem client can mount to a wide variety of
   servers.
 
   The intent of this module is to provide the most advanced network
-  file system function for CIFS compliant servers, including better
-  POSIX compliance, secure per-user session establishment, high
-  performance safe distributed caching (oplock), optional packet
+  file system function for SMB3 compliant servers, including advanced
+  security features, excellent parallelized high performance i/o, better
+  POSIX compliance, secure per-user session establishment, encryption,
+  high performance safe distributed caching (leases/oplocks), optional packet
   signing, large files, Unicode support and other internationalization
   improvements. Since both Samba server and this filesystem client support
-  the CIFS Unix extensions, the combination can provide a reasonable 
-  alternative to NFSv4 for fileserving in some Linux to Linux environments,
-  not just in Linux to Windows environments.
+  the CIFS Unix extensions (and in the future SMB3 POSIX extensions),
+  the combination can provide a reasonable alternative to other network and
+  cluster file systems for fileserving in some Linux to Linux environments,
+  not just in Linux to Windows (or Linux to Mac) environments.
 
   This filesystem has an mount utility (mount.cifs) that can be obtained from
 
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index 36f528a7fdd6..8caa60734647 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -210,8 +210,11 @@ path as another overlay mount and it may use a lower layer path that is
 beneath or above the path of another overlay lower layer path.
 
 Using an upper layer path and/or a workdir path that are already used by
-another overlay mount is not allowed and will fail with EBUSY.  Using
+another overlay mount is not allowed and may fail with EBUSY.  Using
 partially overlapping paths is not allowed but will not fail with EBUSY.
+If files are accessed from two overlayfs mounts which share or overlap the
+upper layer and/or workdir path the behavior of the overlay is undefined,
+though it will not result in a crash or deadlock.
 
 Mounting an overlay using an upper layer path, where the upper layer path
 was previously used by another mounted overlay in combination with a
diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
index 24da7b32c489..9a3658cc399e 100644
--- a/Documentation/filesystems/sysfs.txt
+++ b/Documentation/filesystems/sysfs.txt
@@ -366,7 +366,8 @@ struct driver_attribute {
 
 Declaring:
 
-DRIVER_ATTR(_name, _mode, _show, _store)
+DRIVER_ATTR_RO(_name)
+DRIVER_ATTR_RW(_name)
 
 Creation/Removal:
 
diff --git a/Documentation/i2c/busses/i2c-i801 b/Documentation/i2c/busses/i2c-i801
index 0500193434cb..d47702456926 100644
--- a/Documentation/i2c/busses/i2c-i801
+++ b/Documentation/i2c/busses/i2c-i801
@@ -36,6 +36,7 @@ Supported adapters:
   * Intel Gemini Lake (SOC)
   * Intel Cannon Lake-H (PCH)
   * Intel Cannon Lake-LP (PCH)
+  * Intel Cedar Fork (PCH)
    Datasheets: Publicly available at the Intel website
 
 On Intel Patsburg and later chipsets, both the normal host SMBus controller
diff --git a/Documentation/networking/filter.txt b/Documentation/networking/filter.txt
index 789b74dbe1d9..87814859cfc2 100644
--- a/Documentation/networking/filter.txt
+++ b/Documentation/networking/filter.txt
@@ -337,7 +337,7 @@ Examples for low-level BPF:
   jeq #14, good           /* __NR_rt_sigprocmask */
   jeq #13, good           /* __NR_rt_sigaction */
   jeq #35, good           /* __NR_nanosleep */
-  bad: ret #0             /* SECCOMP_RET_KILL */
+  bad: ret #0             /* SECCOMP_RET_KILL_THREAD */
   good: ret #0x7fff0000   /* SECCOMP_RET_ALLOW */
 
 The above example code can be placed into a file (here called "foo"), and
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index b3345d0fe0a6..77f4de59dc9c 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1680,6 +1680,9 @@ accept_dad - INTEGER
         2: Enable DAD, and disable IPv6 operation if MAC-based duplicate
            link-local address has been found.
 
+        DAD operation and mode on a given interface will be selected according
+        to the maximum value of conf/{all,interface}/accept_dad.
+
 force_tllao - BOOLEAN
         Enable sending the target link-layer address option even when
         responding to a unicast neighbor solicitation.
@@ -1727,16 +1730,23 @@ suppress_frag_ndisc - INTEGER
 
 optimistic_dad - BOOLEAN
         Whether to perform Optimistic Duplicate Address Detection (RFC 4429).
-                0: disabled (default)
-                1: enabled
+        0: disabled (default)
+        1: enabled
+
+        Optimistic Duplicate Address Detection for the interface will be enabled
+        if at least one of conf/{all,interface}/optimistic_dad is set to 1,
+        it will be disabled otherwise.
 
 use_optimistic - BOOLEAN
         If enabled, do not classify optimistic addresses as deprecated during
         source address selection.  Preferred addresses will still be chosen
         before optimistic addresses, subject to other ranking in the source
         address selection algorithm.
-                0: disabled (default)
-                1: enabled
+        0: disabled (default)
+        1: enabled
+
+        This will be enabled if at least one of
+        conf/{all,interface}/use_optimistic is set to 1, disabled otherwise.
 
 stable_secret - IPv6 address
         This IPv6 address will be used as a secret to generate IPv6
diff --git a/Documentation/networking/switchdev.txt b/Documentation/networking/switchdev.txt
index 5e40e1f68873..82236a17b5e6 100644
--- a/Documentation/networking/switchdev.txt
+++ b/Documentation/networking/switchdev.txt
@@ -13,42 +13,42 @@ an example setup using a data-center-class switch ASIC chip.  Other setups
 with SR-IOV or soft switches, such as OVS, are possible.
 
 
-                             User-space tools
-
-       user space                   |
-      +-------------------------------------------------------------------+
-       kernel                       | Netlink
-                                    |
-                     +--------------+-------------------------------+
-                     |         Network stack                        |
-                     |           (Linux)                            |
-                     |                                              |
-                     +----------------------------------------------+
+                             User-space tools
+
+       user space                   |
+      +-------------------------------------------------------------------+
+       kernel                       | Netlink
+                                    |
+                     +--------------+-------------------------------+
+                     |         Network stack                        |
+                     |           (Linux)                            |
+                     |                                              |
+                     +----------------------------------------------+
 
                            sw1p2     sw1p4     sw1p6
-                      sw1p1  +  sw1p3  +  sw1p5  +          eth1
-                        +    |    +    |    +    |            +
-                        |    |    |    |    |    |            |
-                     +--+----+----+----+-+--+----+---+  +-----+-----+
-                     |         Switch driver         |  |    mgmt   |
-                     |        (this document)        |  |   driver  |
-                     |                               |  |           |
-                     +--------------+----------------+  +-----------+
-                                    |
-       kernel                       | HW bus (eg PCI)
-      +-------------------------------------------------------------------+
-       hardware                     |
-                     +--------------+---+------------+
-                     |         Switch device (sw1)   |
-                     |  +----+                       +--------+
-                     |  |    v offloaded data path   | mgmt port
-                     |  |    |                       |
-                     +--|----|----+----+----+----+---+
-                        |    |    |    |    |    |
-                        +    +    +    +    +    +
-                       p1   p2   p3   p4   p5   p6
-
-                             front-panel ports
+                      sw1p1  +  sw1p3  +  sw1p5  +          eth1
+                        +    |    +    |    +    |            +
+                        |    |    |    |    |    |            |
+                     +--+----+----+----+----+----+---+  +-----+-----+
+                     |         Switch driver         |  |    mgmt   |
+                     |        (this document)        |  |   driver  |
+                     |                               |  |           |
+                     +--------------+----------------+  +-----------+
+                                    |
+       kernel                       | HW bus (eg PCI)
+      +-------------------------------------------------------------------+
+       hardware                     |
+                     +--------------+----------------+
+                     |         Switch device (sw1)   |
+                     |  +----+                       +--------+
+                     |  |    v offloaded data path   | mgmt port
+                     |  |    |                       |
+                     +--|----|----+----+----+----+---+
+                        |    |    |    |    |    |
+                        +    +    +    +    +    +
+                       p1   p2   p3   p4   p5   p6
+
+                             front-panel ports
 
 
                                     Fig 1.
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index ce61d1fe08ca..694968c7523c 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -75,6 +75,7 @@ show up in /proc/sys/kernel:
 - reboot-cmd                  [ SPARC only ]
 - rtsig-max
 - rtsig-nr
+- seccomp/                    ==> Documentation/userspace-api/seccomp_filter.rst
 - sem
 - sem_next_id                 [ sysv ipc ]
 - sg-big-buff                 [ generic SCSI device (sg) ]
diff --git a/Documentation/userspace-api/seccomp_filter.rst b/Documentation/userspace-api/seccomp_filter.rst
index f71eb5ef1f2d..099c412951d6 100644
--- a/Documentation/userspace-api/seccomp_filter.rst
+++ b/Documentation/userspace-api/seccomp_filter.rst
@@ -87,11 +87,16 @@ Return values
 A seccomp filter may return any of the following values. If multiple
 filters exist, the return value for the evaluation of a given system
 call will always use the highest precedent value. (For example,
-``SECCOMP_RET_KILL`` will always take precedence.)
+``SECCOMP_RET_KILL_PROCESS`` will always take precedence.)
 
 In precedence order, they are:
 
-``SECCOMP_RET_KILL``:
+``SECCOMP_RET_KILL_PROCESS``:
+        Results in the entire process exiting immediately without executing
+        the system call.  The exit status of the task (``status & 0x7f``)
+        will be ``SIGSYS``, not ``SIGKILL``.
+
+``SECCOMP_RET_KILL_THREAD``:
         Results in the task exiting immediately without executing the
         system call.  The exit status of the task (``status & 0x7f``) will
         be ``SIGSYS``, not ``SIGKILL``.
@@ -141,6 +146,15 @@ In precedence order, they are:
         allow use of ptrace, even of other sandboxed processes, without
         extreme care; ptracers can use this mechanism to escape.)
 
+``SECCOMP_RET_LOG``:
+        Results in the system call being executed after it is logged. This
+        should be used by application developers to learn which syscalls their
+        application needs without having to iterate through multiple test and
+        development cycles to build the list.
+
+        This action will only be logged if "log" is present in the
+        actions_logged sysctl string.
+
 ``SECCOMP_RET_ALLOW``:
         Results in the system call being executed.
 
@@ -169,7 +183,41 @@ The ``samples/seccomp/`` directory contains both an x86-specific example
 and a more generic example of a higher level macro interface for BPF
 program generation.
 
+Sysctls
+=======
 
+Seccomp's sysctl files can be found in the ``/proc/sys/kernel/seccomp/``
+directory. Here's a description of each file in that directory:
+
+``actions_avail``:
+        A read-only ordered list of seccomp return values (refer to the
+        ``SECCOMP_RET_*`` macros above) in string form. The ordering, from
+        left-to-right, is the least permissive return value to the most
+        permissive return value.
+
+        The list represents the set of seccomp return values supported
+        by the kernel. A userspace program may use this list to
+        determine if the actions found in the ``seccomp.h``, when the
+        program was built, differs from the set of actions actually
+        supported in the current running kernel.
+
+``actions_logged``:
+        A read-write ordered list of seccomp return values (refer to the
+        ``SECCOMP_RET_*`` macros above) that are allowed to be logged. Writes
+        to the file do not need to be in ordered form but reads from the file
+        will be ordered in the same way as the actions_avail sysctl.
+
+        It is important to note that the value of ``actions_logged`` does not
+        prevent certain actions from being logged when the audit subsystem is
+        configured to audit a task. If the action is not found in
+        ``actions_logged`` list, the final decision on whether to audit the
+        action for that task is ultimately left up to the audit subsystem to
+        decide for all seccomp return values other than ``SECCOMP_RET_ALLOW``.
+
+        The ``allow`` string is not accepted in the ``actions_logged`` sysctl
+        as it is not possible to log ``SECCOMP_RET_ALLOW`` actions. Attempting
+        to write ``allow`` to the sysctl will result in an EINVAL being
+        returned.
 
 Adding architecture support
 ===========================
diff --git a/MAINTAINERS b/MAINTAINERS
index 2281af4b41b6..2d3d750b19c0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -352,6 +352,18 @@ L:	linux-acpi@vger.kernel.org
 S:      Maintained
 F:      drivers/acpi/arm64
 
+ACPI PMIC DRIVERS
+M:      "Rafael J. Wysocki" <rjw@rjwysocki.net>
+M:      Len Brown <lenb@kernel.org>
+R:      Andy Shevchenko <andy@infradead.org>
+R:      Mika Westerberg <mika.westerberg@linux.intel.com>
+L:      linux-acpi@vger.kernel.org
+Q:      https://patchwork.kernel.org/project/linux-acpi/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
+B:      https://bugzilla.kernel.org
+S:      Supported
+F:      drivers/acpi/pmic/
+
 ACPI THERMAL DRIVER
 M:      Zhang Rui <rui.zhang@intel.com>
 L:      linux-acpi@vger.kernel.org
@@ -2853,7 +2865,6 @@ S:	Supported
 F:      drivers/scsi/bnx2i/
 
 BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
-M:      Yuval Mintz <Yuval.Mintz@cavium.com>
 M:      Ariel Elior <ariel.elior@cavium.com>
 M:      everest-linux-l2@cavium.com
 L:      netdev@vger.kernel.org
@@ -5248,7 +5259,8 @@ S:	Maintained
 F:      drivers/iommu/exynos-iommu.c
 
 EZchip NPS platform support
-M:      Noam Camus <noamc@ezchip.com>
+M:      Elad Kanfi <eladkan@mellanox.com>
+M:      Vineet Gupta <vgupta@synopsys.com>
 S:      Supported
 F:      arch/arc/plat-eznps
 F:      arch/arc/boot/dts/eznps.dts
@@ -6643,8 +6655,8 @@ M:	Alexander Aring <alex.aring@gmail.com>
 M:      Stefan Schmidt <stefan@osg.samsung.com>
 L:      linux-wpan@vger.kernel.org
 W:      http://wpan.cakelab.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next.git
 S:      Maintained
 F:      net/ieee802154/
 F:      net/mac802154/
@@ -6727,7 +6739,7 @@ F:	Documentation/devicetree/bindings/auxdisplay/img-ascii-lcd.txt
 F:      drivers/auxdisplay/img-ascii-lcd.c
 
 IMGTEC IR DECODER DRIVER
-M:      James Hogan <james.hogan@imgtec.com>
+M:      James Hogan <jhogan@kernel.org>
 S:      Maintained
 F:      drivers/media/rc/img-ir/
 
@@ -7551,7 +7563,7 @@ F:	arch/arm64/include/asm/kvm*
 F:      arch/arm64/kvm/
 
 KERNEL VIRTUAL MACHINE FOR MIPS (KVM/mips)
-M:      James Hogan <james.hogan@imgtec.com>
+M:      James Hogan <jhogan@kernel.org>
 L:      linux-mips@linux-mips.org
 S:      Supported
 F:      arch/mips/include/uapi/asm/kvm*
@@ -8253,6 +8265,12 @@ L:	libertas-dev@lists.infradead.org
 S:      Orphan
 F:      drivers/net/wireless/marvell/libertas/
 
+MARVELL MACCHIATOBIN SUPPORT
+M:      Russell King <rmk@armlinux.org.uk>
+L:      linux-arm-kernel@lists.infradead.org
+S:      Maintained
+F:      arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts
+
 MARVELL MV643XX ETHERNET DRIVER
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      netdev@vger.kernel.org
@@ -8586,6 +8604,12 @@ M:	Sean Wang <sean.wang@mediatek.com>
 S:      Maintained
 F:      drivers/media/rc/mtk-cir.c
 
+MEDIATEK PMIC LED DRIVER
+M:      Sean Wang <sean.wang@mediatek.com>
+S:      Maintained
+F:      drivers/leds/leds-mt6323.c
+F:      Documentation/devicetree/bindings/leds/leds-mt6323.txt
+
 MEDIATEK ETHERNET DRIVER
 M:      Felix Fietkau <nbd@openwrt.org>
 M:      John Crispin <john@phrozen.org>
@@ -8868,7 +8892,7 @@ F:	Documentation/devicetree/bindings/media/meson-ao-cec.txt
 T:      git git://linuxtv.org/media_tree.git
 
 METAG ARCHITECTURE
-M:      James Hogan <james.hogan@imgtec.com>
+M:      James Hogan <jhogan@kernel.org>
 L:      linux-metag@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag.git
 S:      Odd Fixes
@@ -9337,7 +9361,7 @@ NETWORK BLOCK DEVICE (NBD)
 M:      Josef Bacik <jbacik@fb.com>
 S:      Maintained
 L:      linux-block@vger.kernel.org
-L:      nbd-general@lists.sourceforge.net
+L:      nbd@other.debian.org
 F:      Documentation/blockdev/nbd.txt
 F:      drivers/block/nbd.c
 F:      include/uapi/linux/nbd.h
@@ -11047,7 +11071,6 @@ S:	Supported
 F:      drivers/scsi/qedi/
 
 QLOGIC QL4xxx ETHERNET DRIVER
-M:      Yuval Mintz <Yuval.Mintz@cavium.com>
 M:      Ariel Elior <Ariel.Elior@cavium.com>
 M:      everest-linux-l2@cavium.com
 L:      netdev@vger.kernel.org
@@ -12915,9 +12938,9 @@ F:	drivers/mmc/host/dw_mmc*
 SYNOPSYS HSDK RESET CONTROLLER DRIVER
 M:      Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
 S:      Supported
-F:      drivers/reset/reset-hsdk-v1.c
-F:      include/dt-bindings/reset/snps,hsdk-v1-reset.h
-F:      Documentation/devicetree/bindings/reset/snps,hsdk-v1-reset.txt
+F:      drivers/reset/reset-hsdk.c
+F:      include/dt-bindings/reset/snps,hsdk-reset.h
+F:      Documentation/devicetree/bindings/reset/snps,hsdk-reset.txt
 
 SYSTEM CONFIGURATION (SYSCON)
 M:      Lee Jones <lee.jones@linaro.org>
diff --git a/Makefile b/Makefile
index 64cbc66cebca..2835863bdd5a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 14
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc4
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -1172,11 +1172,11 @@ headers_check: headers_install
 
 PHONY += kselftest
 kselftest:
-        $(Q)$(MAKE) -C tools/testing/selftests run_tests
+        $(Q)$(MAKE) -C $(srctree)/tools/testing/selftests run_tests
 
 PHONY += kselftest-clean
 kselftest-clean:
-        $(Q)$(MAKE) -C tools/testing/selftests clean
+        $(Q)$(MAKE) -C $(srctree)/tools/testing/selftests clean
 
 PHONY += kselftest-merge
 kselftest-merge:
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index 384bd47b5187..45c020a0fe76 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -8,6 +8,7 @@
  */
 
 #include <linux/mm_types.h>
+#include <linux/sched.h>
 
 #include <asm/machvec.h>
 #include <asm/compiler.h>
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index a598641eed98..c84e67fdea09 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -24,7 +24,7 @@ config ARC
         select GENERIC_SMP_IDLE_THREAD
         select HAVE_ARCH_KGDB
         select HAVE_ARCH_TRACEHOOK
-        select HAVE_FUTEX_CMPXCHG
+        select HAVE_FUTEX_CMPXCHG if FUTEX
         select HAVE_IOREMAP_PROT
         select HAVE_KPROBES
         select HAVE_KRETPROBES
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 3a4b52b7e09d..d37f49d6a27f 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -6,8 +6,6 @@
 # published by the Free Software Foundation.
 #
 
-UTS_MACHINE := arc
-
 ifeq ($(CROSS_COMPILE),)
 ifndef CONFIG_CPU_BIG_ENDIAN
 CROSS_COMPILE := arc-linux-
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 2367a67c5f10..e114000a84f5 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -44,7 +44,14 @@
 
                         mmcclk: mmcclk {
                                 compatible = "fixed-clock";
-                                clock-frequency = <50000000>;
+                                /*
+                                 * DW sdio controller has external ciu clock divider
+                                 * controlled via register in SDIO IP. It divides
+                                 * sdio_ref_clk (which comes from CGU) by 16 for
+                                 * default. So default mmcclk clock (which comes
+                                 * to sdk_in) is 25000000 Hz.
+                                 */
+                                clock-frequency = <25000000>;
                                 #clock-cells = <0>;
                         };
 
diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 229d13adbce4..8adde1b492f1 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts
@@ -12,6 +12,7 @@
 /dts-v1/;
 
 #include <dt-bindings/net/ti-dp83867.h>
+#include <dt-bindings/reset/snps,hsdk-reset.h>
 
 / {
         model = "snps,hsdk";
@@ -57,10 +58,10 @@
                 };
         };
 
-        core_clk: core-clk {
+        input_clk: input-clk {
                 #clock-cells = <0>;
                 compatible = "fixed-clock";
-                clock-frequency = <500000000>;
+                clock-frequency = <33333333>;
         };
 
         cpu_intc: cpu-interrupt-controller {
@@ -102,6 +103,19 @@
 
                 ranges = <0x00000000 0xf0000000 0x10000000>;
 
+                cgu_rst: reset-controller@8a0 {
+                        compatible = "snps,hsdk-reset";
+                        #reset-cells = <1>;
+                        reg = <0x8A0 0x4>, <0xFF0 0x4>;
+                };
+
+                core_clk: core-clk@0 {
+                        compatible = "snps,hsdk-core-pll-clock";
+                        reg = <0x00 0x10>, <0x14B8 0x4>;
+                        #clock-cells = <0>;
+                        clocks = <&input_clk>;
+                };
+
                 serial: serial@5000 {
                         compatible = "snps,dw-apb-uart";
                         reg = <0x5000 0x100>;
@@ -120,7 +134,17 @@
 
                 mmcclk_ciu: mmcclk-ciu {
                         compatible = "fixed-clock";
-                        clock-frequency = <100000000>;
+                        /*
+                         * DW sdio controller has external ciu clock divider
+                         * controlled via register in SDIO IP. Due to its
+                         * unexpected default value (it should devide by 1
+                         * but it devides by 8) SDIO IP uses wrong clock and
+                         * works unstable (see STAR 9001204800)
+                         * So add temporary fix and change clock frequency
+                         * from 100000000 to 12500000 Hz until we fix dw sdio
+                         * driver itself.
+                         */
+                        clock-frequency = <12500000>;
                         #clock-cells = <0>;
                 };
 
@@ -141,6 +165,8 @@
                         clocks = <&gmacclk>;
                         clock-names = "stmmaceth";
                         phy-handle = <&phy0>;
+                        resets = <&cgu_rst HSDK_ETH_RESET>;
+                        reset-names = "stmmaceth";
 
                         mdio {
                                 #address-cells = <1>;
diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
index 6980b966a364..ec7c849a5c8e 100644
--- a/arch/arc/configs/axs101_defconfig
+++ b/arch/arc/configs/axs101_defconfig
@@ -105,7 +105,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
index 2233f5777a71..63d3cf69e0b0 100644
--- a/arch/arc/configs/axs103_defconfig
+++ b/arch/arc/configs/axs103_defconfig
@@ -104,7 +104,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
index 30a3d4cf53d2..f613ecac14a7 100644
--- a/arch/arc/configs/axs103_smp_defconfig
+++ b/arch/arc/configs/axs103_smp_defconfig
@@ -107,7 +107,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index 821a2e562f3f..3507be2af6fe 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -84,5 +84,5 @@ CONFIG_TMPFS=y
 CONFIG_NFS_FS=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig
index 9a3fcf446388..15f0f6b5fec1 100644
--- a/arch/arc/configs/hsdk_defconfig
+++ b/arch/arc/configs/hsdk_defconfig
@@ -63,6 +63,7 @@ CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
 CONFIG_MMC_DW=y
 # CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RESET_HSDK=y
 CONFIG_EXT3_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
@@ -72,7 +73,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_WARN_DEPRECATED is not set
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
index c0d6a010751a..4fcf4f2503f6 100644
--- a/arch/arc/configs/vdk_hs38_defconfig
+++ b/arch/arc/configs/vdk_hs38_defconfig
@@ -94,7 +94,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_DEBUG_SHIRQ=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
index 5c0971787acf..7b71464f6c2f 100644
--- a/arch/arc/configs/vdk_hs38_smp_defconfig
+++ b/arch/arc/configs/vdk_hs38_smp_defconfig
@@ -98,7 +98,7 @@ CONFIG_NLS_ISO8859_1=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_DEBUG_SHIRQ=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
 CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_DEBUG_PREEMPT is not set
diff --git a/arch/arc/include/asm/arcregs.h b/arch/arc/include/asm/arcregs.h
index ba8e802dba80..b1c56d35f2a9 100644
--- a/arch/arc/include/asm/arcregs.h
+++ b/arch/arc/include/asm/arcregs.h
@@ -98,6 +98,7 @@
 
 /* Auxiliary registers */
 #define AUX_IDENTITY            4
+#define AUX_EXEC_CTRL           8
 #define AUX_INTR_VEC_BASE       0x25
 #define AUX_VOL                 0x5e
 
@@ -135,12 +136,12 @@ struct bcr_identity {
 #endif
 };
 
-struct bcr_isa {
+struct bcr_isa_arcv2 {
 #ifdef CONFIG_CPU_BIG_ENDIAN
         unsigned int div_rem:4, pad2:4, ldd:1, unalign:1, atomic:1, be:1,
-                     pad1:11, atomic1:1, ver:8;
+                     pad1:12, ver:8;
 #else
-        unsigned int ver:8, atomic1:1, pad1:11, be:1, atomic:1, unalign:1,
+        unsigned int ver:8, pad1:12, be:1, atomic:1, unalign:1,
                      ldd:1, pad2:4, div_rem:4;
 #endif
 };
@@ -263,13 +264,13 @@ struct cpuinfo_arc {
         struct cpuinfo_arc_mmu mmu;
         struct cpuinfo_arc_bpu bpu;
         struct bcr_identity core;
-        struct bcr_isa isa;
+        struct bcr_isa_arcv2 isa;
         const char *details, *name;
         unsigned int vec_base;
         struct cpuinfo_arc_ccm iccm, dccm;
         struct {
                 unsigned int swap:1, norm:1, minmax:1, barrel:1, crc:1, swape:1, pad1:2,
-                             fpu_sp:1, fpu_dp:1, pad2:6,
+                             fpu_sp:1, fpu_dp:1, dual_iss_enb:1, dual_iss_exist:1, pad2:4,
                              debug:1, ap:1, smart:1, rtt:1, pad3:4,
                              timer0:1, timer1:1, rtc:1, gfrc:1, pad4:4;
         } extn;
diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h
index d400a2161935..8ee41e988169 100644
--- a/arch/arc/include/asm/processor.h
+++ b/arch/arc/include/asm/processor.h
@@ -78,9 +78,6 @@ struct task_struct;
 
 #endif
 
-#define copy_segments(tsk, mm)      do { } while (0)
-#define release_segments(mm)        do { } while (0)
-
 #define KSTK_EIP(tsk)   (task_pt_regs(tsk)->ret)
 #define KSTK_ESP(tsk)   (task_pt_regs(tsk)->sp)
 
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 877cec8f5ea2..fb83844daeea 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -51,6 +51,7 @@ static const struct id_to_str arc_cpu_rel[] = {
         { 0x51, "R2.0" },
         { 0x52, "R2.1" },
         { 0x53, "R3.0" },
+        { 0x54, "R4.0" },
 #endif
         { 0x00, NULL   }
 };
@@ -62,6 +63,7 @@ static const struct id_to_str arc_cpu_nm[] = {
 #else
         { 0x40, "ARC EM"  },
         { 0x50, "ARC HS38"  },
+        { 0x54, "ARC HS48"  },
 #endif
         { 0x00, "Unknown"   }
 };
@@ -119,11 +121,11 @@ static void read_arc_build_cfg_regs(void)
         struct bcr_generic bcr;
         struct cpuinfo_arc *cpu = &cpuinfo_arc700[smp_processor_id()];
         const struct id_to_str *tbl;
+        struct bcr_isa_arcv2 isa;
 
         FIX_PTR(cpu);
 
         READ_BCR(AUX_IDENTITY, cpu->core);
-        READ_BCR(ARC_REG_ISA_CFG_BCR, cpu->isa);
 
         for (tbl = &arc_cpu_rel[0]; tbl->id != 0; tbl++) {
                 if (cpu->core.family == tbl->id) {
@@ -133,7 +135,7 @@ static void read_arc_build_cfg_regs(void)
         }
 
         for (tbl = &arc_cpu_nm[0]; tbl->id != 0; tbl++) {
-                if ((cpu->core.family & 0xF0) == tbl->id)
+                if ((cpu->core.family & 0xF4) == tbl->id)
                         break;
         }
         cpu->name = tbl->str;
@@ -192,6 +194,14 @@ static void read_arc_build_cfg_regs(void)
                 cpu->bpu.full = bpu.ft;
                 cpu->bpu.num_cache = 256 << bpu.bce;
                 cpu->bpu.num_pred = 2048 << bpu.pte;
+
+                if (cpu->core.family >= 0x54) {
+                        unsigned int exec_ctrl;
+
+                        READ_BCR(AUX_EXEC_CTRL, exec_ctrl);
+                        cpu->extn.dual_iss_exist = 1;
+                        cpu->extn.dual_iss_enb = exec_ctrl & 1;
+                }
         }
 
         READ_BCR(ARC_REG_AP_BCR, bcr);
@@ -205,18 +215,25 @@ static void read_arc_build_cfg_regs(void)
 
         cpu->extn.debug = cpu->extn.ap | cpu->extn.smart | cpu->extn.rtt;
 
+        READ_BCR(ARC_REG_ISA_CFG_BCR, isa);
+
         /* some hacks for lack of feature BCR info in old ARC700 cores */
         if (is_isa_arcompact()) {
-                if (!cpu->isa.ver)      /* ISA BCR absent, use Kconfig info */
+                if (!isa.ver)   /* ISA BCR absent, use Kconfig info */
                         cpu->isa.atomic = IS_ENABLED(CONFIG_ARC_HAS_LLSC);
-                else
-                        cpu->isa.atomic = cpu->isa.atomic1;
+                else {
+                        /* ARC700_BUILD only has 2 bits of isa info */
+                        struct bcr_generic bcr = *(struct bcr_generic *)&isa;
+                        cpu->isa.atomic = bcr.info & 1;
+                }
 
                 cpu->isa.be = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN);
 
                  /* there's no direct way to distinguish 750 vs. 770 */
                 if (unlikely(cpu->core.family < 0x34 || cpu->mmu.ver < 3))
                         cpu->name = "ARC750";
+        } else {
+                cpu->isa = isa;
         }
 }
 
@@ -232,10 +249,11 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                        "\nIDENTITY\t: ARCVER [%#02x] ARCNUM [%#02x] CHIPID [%#4x]\n",
                        core->family, core->cpu_id, core->chip_id);
 
-        n += scnprintf(buf + n, len - n, "processor [%d]\t: %s %s (%s ISA) %s\n",
+        n += scnprintf(buf + n, len - n, "processor [%d]\t: %s %s (%s ISA) %s%s%s\n",
                        cpu_id, cpu->name, cpu->details,
                        is_isa_arcompact() ? "ARCompact" : "ARCv2",
-                       IS_AVAIL1(cpu->isa.be, "[Big-Endian]"));
+                       IS_AVAIL1(cpu->isa.be, "[Big-Endian]"),
+                       IS_AVAIL3(cpu->extn.dual_iss_exist, cpu->extn.dual_iss_enb, " Dual-Issue"));
 
         n += scnprintf(buf + n, len - n, "Timers\t\t: %s%s%s%s%s%s\nISA Extn\t: ",
                        IS_AVAIL1(cpu->extn.timer0, "Timer0 "),
diff --git a/arch/arc/plat-axs10x/axs10x.c b/arch/arc/plat-axs10x/axs10x.c
index f1ac6790da5f..cf14ebc36916 100644
--- a/arch/arc/plat-axs10x/axs10x.c
+++ b/arch/arc/plat-axs10x/axs10x.c
@@ -111,6 +111,13 @@ static void __init axs10x_early_init(void)
 
         axs10x_enable_gpio_intc_wire();
 
+        /*
+         * Reset ethernet IP core.
+         * TODO: get rid of this quirk after axs10x reset driver (or simple
+         * reset driver) will be available in upstream.
+         */
+        iowrite32((1 << 5), (void __iomem *) CREG_MB_SW_RESET);
+
         scnprintf(mb, 32, "MainBoard v%d", mb_rev);
         axs10x_print_board_ver(CREG_MB_VER, mb);
 }
diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
index 5a6ed5afb009..bd08de4be75e 100644
--- a/arch/arc/plat-hsdk/Kconfig
+++ b/arch/arc/plat-hsdk/Kconfig
@@ -6,4 +6,5 @@
 #
 
 menuconfig ARC_SOC_HSDK
-       bool "ARC HS Development Kit SOC"
+        bool "ARC HS Development Kit SOC"
+        select CLK_HSDK
diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
index a2e7fd17e36d..744e62e58788 100644
--- a/arch/arc/plat-hsdk/platform.c
+++ b/arch/arc/plat-hsdk/platform.c
@@ -38,6 +38,42 @@ static void __init hsdk_init_per_cpu(unsigned int cpu)
 #define CREG_PAE                (CREG_BASE + 0x180)
 #define CREG_PAE_UPDATE         (CREG_BASE + 0x194)
 
+#define CREG_CORE_IF_CLK_DIV    (CREG_BASE + 0x4B8)
+#define CREG_CORE_IF_CLK_DIV_2  0x1
+#define CGU_BASE                ARC_PERIPHERAL_BASE
+#define CGU_PLL_STATUS          (ARC_PERIPHERAL_BASE + 0x4)
+#define CGU_PLL_CTRL            (ARC_PERIPHERAL_BASE + 0x0)
+#define CGU_PLL_STATUS_LOCK     BIT(0)
+#define CGU_PLL_STATUS_ERR      BIT(1)
+#define CGU_PLL_CTRL_1GHZ       0x3A10
+#define HSDK_PLL_LOCK_TIMEOUT   500
+
+#define HSDK_PLL_LOCKED() \
+        !!(ioread32((void __iomem *) CGU_PLL_STATUS) & CGU_PLL_STATUS_LOCK)
+
+#define HSDK_PLL_ERR() \
+        !!(ioread32((void __iomem *) CGU_PLL_STATUS) & CGU_PLL_STATUS_ERR)
+
+static void __init hsdk_set_cpu_freq_1ghz(void)
+{
+        u32 timeout = HSDK_PLL_LOCK_TIMEOUT;
+
+        /*
+         * As we set cpu clock which exceeds 500MHz, the divider for the interface
+         * clock must be programmed to div-by-2.
+         */
+        iowrite32(CREG_CORE_IF_CLK_DIV_2, (void __iomem *) CREG_CORE_IF_CLK_DIV);
+
+        /* Set cpu clock to 1GHz */
+        iowrite32(CGU_PLL_CTRL_1GHZ, (void __iomem *) CGU_PLL_CTRL);
+
+        while (!HSDK_PLL_LOCKED() && timeout--)
+                cpu_relax();
+
+        if (!HSDK_PLL_LOCKED() || HSDK_PLL_ERR())
+                pr_err("Failed to setup CPU frequency to 1GHz!");
+}
+
 static void __init hsdk_init_early(void)
 {
         /*
@@ -52,6 +88,12 @@ static void __init hsdk_init_early(void)
 
         /* Really apply settings made above */
         writel(1, (void __iomem *) CREG_PAE_UPDATE);
+
+        /*
+         * Setup CPU frequency to 1GHz.
+         * TODO: remove it after smart hsdk pll driver will be introduced.
+         */
+        hsdk_set_cpu_freq_1ghz();
 }
 
 static const char *hsdk_compat[] __initconst = {
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 7d7ca054c557..e58fab8aec5d 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -36,6 +36,8 @@
                 phy1 = &usb1_phy;
                 ethernet0 = &cpsw_emac0;
                 ethernet1 = &cpsw_emac1;
+                spi0 = &spi0;
+                spi1 = &spi1;
         };
 
         cpus {
diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
index 9d276af7c539..081fa68b6f98 100644
--- a/arch/arm/boot/dts/am43x-epos-evm.dts
+++ b/arch/arm/boot/dts/am43x-epos-evm.dts
@@ -388,6 +388,7 @@
         pinctrl-0 = <&cpsw_default>;
         pinctrl-1 = <&cpsw_sleep>;
         status = "okay";
+        slaves = <1>;
 };
 
 &davinci_mdio {
@@ -402,11 +403,6 @@
         phy-mode = "rmii";
 };
 
-&cpsw_emac1 {
-        phy_id = <&davinci_mdio>, <1>;
-        phy-mode = "rmii";
-};
-
 &phy_sel {
         rmii-clock-ext;
 };
diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
index 9c9088c99cc4..60cb084a8d92 100644
--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
@@ -67,7 +67,10 @@
 
                 usb1: ohci@00400000 {
                         num-ports = <3>;
-                        atmel,vbus-gpio = <&pioA PIN_PA10 GPIO_ACTIVE_HIGH>;
+                        atmel,vbus-gpio = <0 /* &pioA PIN_PD20 GPIO_ACTIVE_HIGH */
+                                           &pioA PIN_PA27 GPIO_ACTIVE_HIGH
+                                           0
+                                          >;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_usb_default>;
                         status = "okay";
@@ -120,7 +123,7 @@
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&pinctrl_mikrobus2_uart>;
                                 atmel,use-dma-rx;
-                                atmel-use-dma-tx;
+                                atmel,use-dma-tx;
                                 status = "okay";
                         };
 
@@ -178,7 +181,7 @@
                         uart4: serial@fc00c000 {
                                 atmel,use-dma-rx;
                                 atmel,use-dma-tx;
-                                pinctrl-name = "default";
+                                pinctrl-names = "default";
                                 pinctrl-0 = <&pinctrl_mikrobus1_uart>;
                                 status = "okay";
                         };
@@ -330,7 +333,7 @@
                                 };
 
                                 pinctrl_led_gpio_default: led_gpio_default {
-                                        pinmux = <PIN_PA27__GPIO>,
+                                        pinmux = <PIN_PA10__GPIO>,
                                                  <PIN_PB1__GPIO>,
                                                  <PIN_PA31__GPIO>;
                                         bias-pull-up;
@@ -396,7 +399,7 @@
                                 };
 
                                 pinctrl_usb_default: usb_default {
-                                        pinmux = <PIN_PA10__GPIO>,
+                                        pinmux = <PIN_PA27__GPIO>,
                                                  <PIN_PD19__GPIO>;
                                         bias-disable;
                                 };
@@ -520,17 +523,17 @@
 
                 red {
                         label = "red";
-                        gpios = <&pioA PIN_PA27 GPIO_ACTIVE_LOW>;
+                        gpios = <&pioA PIN_PA10 GPIO_ACTIVE_HIGH>;
                 };
 
                 green {
                         label = "green";
-                        gpios = <&pioA PIN_PB1 GPIO_ACTIVE_LOW>;
+                        gpios = <&pioA PIN_PB1 GPIO_ACTIVE_HIGH>;
                 };
 
                 blue {
                         label = "blue";
-                        gpios = <&pioA PIN_PA31 GPIO_ACTIVE_LOW>;
+                        gpios = <&pioA PIN_PA31 GPIO_ACTIVE_HIGH>;
                         linux,default-trigger = "heartbeat";
                 };
         };
diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
index 67e72bc72e80..c75507922f7d 100644
--- a/arch/arm/boot/dts/da850-evm.dts
+++ b/arch/arm/boot/dts/da850-evm.dts
@@ -15,6 +15,13 @@
         compatible = "ti,da850-evm", "ti,da850";
         model = "DA850/AM1808/OMAP-L138 EVM";
 
+        aliases {
+                serial0 = &serial0;
+                serial1 = &serial1;
+                serial2 = &serial2;
+                ethernet0 = &eth0;
+        };
+
         soc@1c00000 {
                 pmx_core: pinmux@14120 {
                         status = "okay";
diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
index cf229dfabf61..e62b62875cba 100644
--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
@@ -1817,6 +1817,8 @@
                 clocks = <&abe_24m_fclk>, <&abe_sys_clk_div>, <&func_24m_clk>, <&atl_clkin3_ck>, <&atl_clkin2_ck>, <&atl_clkin1_ck>, <&atl_clkin0_ck>, <&sys_clkin2>, <&ref_clkin0_ck>, <&ref_clkin1_ck>, <&ref_clkin2_ck>, <&ref_clkin3_ck>, <&mlb_clk>, <&mlbp_clk>;
                 ti,bit-shift = <24>;
                 reg = <0x1868>;
+                assigned-clocks = <&mcasp3_ahclkx_mux>;
+                assigned-clock-parents = <&abe_24m_fclk>;
         };
 
         mcasp3_aux_gfclk_mux: mcasp3_aux_gfclk_mux@1868 {
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 26c20e1167b9..4acd32a1c4ef 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -144,15 +144,6 @@
                 io-channel-names = "temp", "bsi", "vbat";
         };
 
-        rear_camera: camera@0 {
-                compatible = "linux,camera";
-
-                module {
-                        model = "TCM8341MD";
-                        sensor = <&cam1>;
-                };
-        };
-
         pwm9: dmtimer-pwm {
                 compatible = "ti,omap-dmtimer-pwm";
                 #pwm-cells = <3>;
@@ -189,10 +180,8 @@
                                 clock-lanes = <1>;
                                 data-lanes = <0>;
                                 lane-polarity = <0 0>;
-                                clock-inv = <0>;
                                 /* Select strobe = <1> for back camera, <0> for front camera */
                                 strobe = <1>;
-                                crc = <0>;
                         };
                 };
         };
diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
index cb47ae79a5f9..1b0bd72945f2 100644
--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
@@ -267,15 +267,19 @@
         clock-frequency = <400000>;
 
         as3645a@30 {
+                #address-cells = <1>;
+                #size-cells = <0>;
                 reg = <0x30>;
                 compatible = "ams,as3645a";
-                flash {
+                flash@0 {
+                        reg = <0x0>;
                         flash-timeout-us = <150000>;
                         flash-max-microamp = <320000>;
                         led-max-microamp = <60000>;
-                        peak-current-limit = <1750000>;
+                        ams,input-max-microamp = <1750000>;
                 };
-                indicator {
+                indicator@1 {
+                        reg = <0x1>;
                         led-max-microamp = <10000>;
                 };
         };
diff --git a/arch/arm/boot/dts/stm32429i-eval.dts b/arch/arm/boot/dts/stm32429i-eval.dts
index 97b1c2321ba9..293ecb957227 100644
--- a/arch/arm/boot/dts/stm32429i-eval.dts
+++ b/arch/arm/boot/dts/stm32429i-eval.dts
@@ -47,6 +47,7 @@
 
 /dts-v1/;
 #include "stm32f429.dtsi"
+#include "stm32f429-pinctrl.dtsi"
 #include <dt-bindings/input/input.h>
 #include <dt-bindings/gpio/gpio.h>
 
@@ -202,10 +203,8 @@
         stmpe1600: stmpe1600@42 {
                 compatible = "st,stmpe1600";
                 reg = <0x42>;
-                irq-gpio = <&gpioi 8 0>;
-                irq-trigger = <3>;
                 interrupts = <8 3>;
-                interrupt-parent = <&exti>;
+                interrupt-parent = <&gpioi>;
                 interrupt-controller;
                 wakeup-source;
 
diff --git a/arch/arm/boot/dts/stm32f4-pinctrl.dtsi b/arch/arm/boot/dts/stm32f4-pinctrl.dtsi
new file mode 100644
index 000000000000..7f3560c0211d
--- /dev/null
+++ b/arch/arm/boot/dts/stm32f4-pinctrl.dtsi
@@ -0,0 +1,343 @@
+/*
+ * Copyright 2017 - Alexandre Torgue <alexandre.torgue@st.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License as
+ *     published by the Free Software Foundation; either version 2 of the
+ *     License, or (at your option) any later version.
+ *
+ *     This file is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <dt-bindings/pinctrl/stm32f429-pinfunc.h>
+#include <dt-bindings/mfd/stm32f4-rcc.h>
+
+/ {
+        soc {
+                pinctrl: pin-controller {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        ranges = <0 0x40020000 0x3000>;
+                        interrupt-parent = <&exti>;
+                        st,syscfg = <&syscfg 0x8>;
+                        pins-are-numbered;
+
+                        gpioa: gpio@40020000 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x0 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOA)>;
+                                st,bank-name = "GPIOA";
+                        };
+
+                        gpiob: gpio@40020400 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x400 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOB)>;
+                                st,bank-name = "GPIOB";
+                        };
+
+                        gpioc: gpio@40020800 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x800 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOC)>;
+                                st,bank-name = "GPIOC";
+                        };
+
+                        gpiod: gpio@40020c00 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0xc00 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOD)>;
+                                st,bank-name = "GPIOD";
+                        };
+
+                        gpioe: gpio@40021000 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1000 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOE)>;
+                                st,bank-name = "GPIOE";
+                        };
+
+                        gpiof: gpio@40021400 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1400 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOF)>;
+                                st,bank-name = "GPIOF";
+                        };
+
+                        gpiog: gpio@40021800 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1800 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOG)>;
+                                st,bank-name = "GPIOG";
+                        };
+
+                        gpioh: gpio@40021c00 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x1c00 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOH)>;
+                                st,bank-name = "GPIOH";
+                        };
+
+                        gpioi: gpio@40022000 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x2000 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOI)>;
+                                st,bank-name = "GPIOI";
+                        };
+
+                        gpioj: gpio@40022400 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x2400 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOJ)>;
+                                st,bank-name = "GPIOJ";
+                        };
+
+                        gpiok: gpio@40022800 {
+                                gpio-controller;
+                                #gpio-cells = <2>;
+                                interrupt-controller;
+                                #interrupt-cells = <2>;
+                                reg = <0x2800 0x400>;
+                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOK)>;
+                                st,bank-name = "GPIOK";
+                        };
+
+                        usart1_pins_a: usart1@0 {
+                                pins1 {
+                                        pinmux = <STM32F429_PA9_FUNC_USART1_TX>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <0>;
+                                };
+                                pins2 {
+                                        pinmux = <STM32F429_PA10_FUNC_USART1_RX>;
+                                        bias-disable;
+                                };
+                        };
+
+                        usart3_pins_a: usart3@0 {
+                                pins1 {
+                                        pinmux = <STM32F429_PB10_FUNC_USART3_TX>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <0>;
+                                };
+                                pins2 {
+                                        pinmux = <STM32F429_PB11_FUNC_USART3_RX>;
+                                        bias-disable;
+                                };
+                        };
+
+                        usbotg_fs_pins_a: usbotg_fs@0 {
+                                pins {
+                                        pinmux = <STM32F429_PA10_FUNC_OTG_FS_ID>,
+                                                 <STM32F429_PA11_FUNC_OTG_FS_DM>,
+                                                 <STM32F429_PA12_FUNC_OTG_FS_DP>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        usbotg_fs_pins_b: usbotg_fs@1 {
+                                pins {
+                                        pinmux = <STM32F429_PB12_FUNC_OTG_HS_ID>,
+                                                 <STM32F429_PB14_FUNC_OTG_HS_DM>,
+                                                 <STM32F429_PB15_FUNC_OTG_HS_DP>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        usbotg_hs_pins_a: usbotg_hs@0 {
+                                pins {
+                                        pinmux = <STM32F429_PH4_FUNC_OTG_HS_ULPI_NXT>,
+                                                 <STM32F429_PI11_FUNC_OTG_HS_ULPI_DIR>,
+                                                 <STM32F429_PC0_FUNC_OTG_HS_ULPI_STP>,
+                                                 <STM32F429_PA5_FUNC_OTG_HS_ULPI_CK>,
+                                                 <STM32F429_PA3_FUNC_OTG_HS_ULPI_D0>,
+                                                 <STM32F429_PB0_FUNC_OTG_HS_ULPI_D1>,
+                                                 <STM32F429_PB1_FUNC_OTG_HS_ULPI_D2>,
+                                                 <STM32F429_PB10_FUNC_OTG_HS_ULPI_D3>,
+                                                 <STM32F429_PB11_FUNC_OTG_HS_ULPI_D4>,
+                                                 <STM32F429_PB12_FUNC_OTG_HS_ULPI_D5>,
+                                                 <STM32F429_PB13_FUNC_OTG_HS_ULPI_D6>,
+                                                 <STM32F429_PB5_FUNC_OTG_HS_ULPI_D7>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        ethernet_mii: mii@0 {
+                                pins {
+                                        pinmux = <STM32F429_PG13_FUNC_ETH_MII_TXD0_ETH_RMII_TXD0>,
+                                                 <STM32F429_PG14_FUNC_ETH_MII_TXD1_ETH_RMII_TXD1>,
+                                                 <STM32F429_PC2_FUNC_ETH_MII_TXD2>,
+                                                 <STM32F429_PB8_FUNC_ETH_MII_TXD3>,
+                                                 <STM32F429_PC3_FUNC_ETH_MII_TX_CLK>,
+                                                 <STM32F429_PG11_FUNC_ETH_MII_TX_EN_ETH_RMII_TX_EN>,
+                                                 <STM32F429_PA2_FUNC_ETH_MDIO>,
+                                                 <STM32F429_PC1_FUNC_ETH_MDC>,
+                                                 <STM32F429_PA1_FUNC_ETH_MII_RX_CLK_ETH_RMII_REF_CLK>,
+                                                 <STM32F429_PA7_FUNC_ETH_MII_RX_DV_ETH_RMII_CRS_DV>,
+                                                 <STM32F429_PC4_FUNC_ETH_MII_RXD0_ETH_RMII_RXD0>,
+                                                 <STM32F429_PC5_FUNC_ETH_MII_RXD1_ETH_RMII_RXD1>,
+                                                 <STM32F429_PH6_FUNC_ETH_MII_RXD2>,
+                                                 <STM32F429_PH7_FUNC_ETH_MII_RXD3>;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        adc3_in8_pin: adc@200 {
+                                pins {
+                                        pinmux = <STM32F429_PF10_FUNC_ANALOG>;
+                                };
+                        };
+
+                        pwm1_pins: pwm@1 {
+                                pins {
+                                        pinmux = <STM32F429_PA8_FUNC_TIM1_CH1>,
+                                                 <STM32F429_PB13_FUNC_TIM1_CH1N>,
+                                                 <STM32F429_PB12_FUNC_TIM1_BKIN>;
+                                };
+                        };
+
+                        pwm3_pins: pwm@3 {
+                                pins {
+                                        pinmux = <STM32F429_PB4_FUNC_TIM3_CH1>,
+                                                 <STM32F429_PB5_FUNC_TIM3_CH2>;
+                                };
+                        };
+
+                        i2c1_pins: i2c1@0 {
+                                pins {
+                                        pinmux = <STM32F429_PB9_FUNC_I2C1_SDA>,
+                                                 <STM32F429_PB6_FUNC_I2C1_SCL>;
+                                        bias-disable;
+                                        drive-open-drain;
+                                        slew-rate = <3>;
+                                };
+                        };
+
+                        ltdc_pins: ltdc@0 {
+                                pins {
+                                        pinmux = <STM32F429_PI12_FUNC_LCD_HSYNC>,
+                                                 <STM32F429_PI13_FUNC_LCD_VSYNC>,
+                                                 <STM32F429_PI14_FUNC_LCD_CLK>,
+                                                 <STM32F429_PI15_FUNC_LCD_R0>,
+                                                 <STM32F429_PJ0_FUNC_LCD_R1>,
+                                                 <STM32F429_PJ1_FUNC_LCD_R2>,
+                                                 <STM32F429_PJ2_FUNC_LCD_R3>,
+                                                 <STM32F429_PJ3_FUNC_LCD_R4>,
+                                                 <STM32F429_PJ4_FUNC_LCD_R5>,
+                                                 <STM32F429_PJ5_FUNC_LCD_R6>,
+                                                 <STM32F429_PJ6_FUNC_LCD_R7>,
+                                                 <STM32F429_PJ7_FUNC_LCD_G0>,
+                                                 <STM32F429_PJ8_FUNC_LCD_G1>,
+                                                 <STM32F429_PJ9_FUNC_LCD_G2>,
+                                                 <STM32F429_PJ10_FUNC_LCD_G3>,
+                                                 <STM32F429_PJ11_FUNC_LCD_G4>,
+                                                 <STM32F429_PJ12_FUNC_LCD_B0>,
+                                                 <STM32F429_PJ13_FUNC_LCD_B1>,
+                                                 <STM32F429_PJ14_FUNC_LCD_B2>,
+                                                 <STM32F429_PJ15_FUNC_LCD_B3>,
+                                                 <STM32F429_PK0_FUNC_LCD_G5>,
+                                                 <STM32F429_PK1_FUNC_LCD_G6>,
+                                                 <STM32F429_PK2_FUNC_LCD_G7>,
+                                                 <STM32F429_PK3_FUNC_LCD_B4>,
+                                                 <STM32F429_PK4_FUNC_LCD_B5>,
+                                                 <STM32F429_PK5_FUNC_LCD_B6>,
+                                                 <STM32F429_PK6_FUNC_LCD_B7>,
+                                                 <STM32F429_PK7_FUNC_LCD_DE>;
+                                        slew-rate = <2>;
+                                };
+                        };
+
+                        dcmi_pins: dcmi@0 {
+                                pins {
+                                        pinmux = <STM32F429_PA4_FUNC_DCMI_HSYNC>,
+                                                 <STM32F429_PB7_FUNC_DCMI_VSYNC>,
+                                                 <STM32F429_PA6_FUNC_DCMI_PIXCLK>,
+                                                 <STM32F429_PC6_FUNC_DCMI_D0>,
+                                                 <STM32F429_PC7_FUNC_DCMI_D1>,
+                                                 <STM32F429_PC8_FUNC_DCMI_D2>,
+                                                 <STM32F429_PC9_FUNC_DCMI_D3>,
+                                                 <STM32F429_PC11_FUNC_DCMI_D4>,
+                                                 <STM32F429_PD3_FUNC_DCMI_D5>,
+                                                 <STM32F429_PB8_FUNC_DCMI_D6>,
+                                                 <STM32F429_PE6_FUNC_DCMI_D7>,
+                                                 <STM32F429_PC10_FUNC_DCMI_D8>,
+                                                 <STM32F429_PC12_FUNC_DCMI_D9>,
+                                                 <STM32F429_PD6_FUNC_DCMI_D10>,
+                                                 <STM32F429_PD2_FUNC_DCMI_D11>;
+                                        bias-disable;
+                                        drive-push-pull;
+                                        slew-rate = <3>;
+                                };
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/stm32f429-disco.dts b/arch/arm/boot/dts/stm32f429-disco.dts
index c66d617e4245..5ceb2cf3777f 100644
--- a/arch/arm/boot/dts/stm32f429-disco.dts
+++ b/arch/arm/boot/dts/stm32f429-disco.dts
@@ -47,6 +47,7 @@
 
 /dts-v1/;
 #include "stm32f429.dtsi"
+#include "stm32f429-pinctrl.dtsi"
 #include <dt-bindings/input/input.h>
 
 / {
diff --git a/arch/arm/boot/dts/stm32f429-pinctrl.dtsi b/arch/arm/boot/dts/stm32f429-pinctrl.dtsi
new file mode 100644
index 000000000000..3e7a17d9112e
--- /dev/null
+++ b/arch/arm/boot/dts/stm32f429-pinctrl.dtsi
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2017 - Alexandre Torgue <alexandre.torgue@st.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License as
+ *     published by the Free Software Foundation; either version 2 of the
+ *     License, or (at your option) any later version.
+ *
+ *     This file is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "stm32f4-pinctrl.dtsi"
+
+/ {
+        soc {
+                pinctrl: pin-controller {
+                        compatible = "st,stm32f429-pinctrl";
+
+                        gpioa: gpio@40020000 {
+                                gpio-ranges = <&pinctrl 0 0 16>;
+                        };
+
+                        gpiob: gpio@40020400 {
+                                gpio-ranges = <&pinctrl 0 16 16>;
+                        };
+
+                        gpioc: gpio@40020800 {
+                                gpio-ranges = <&pinctrl 0 32 16>;
+                        };
+
+                        gpiod: gpio@40020c00 {
+                                gpio-ranges = <&pinctrl 0 48 16>;
+                        };
+
+                        gpioe: gpio@40021000 {
+                                gpio-ranges = <&pinctrl 0 64 16>;
+                        };
+
+                        gpiof: gpio@40021400 {
+                                gpio-ranges = <&pinctrl 0 80 16>;
+                        };
+
+                        gpiog: gpio@40021800 {
+                                gpio-ranges = <&pinctrl 0 96 16>;
+                        };
+
+                        gpioh: gpio@40021c00 {
+                                gpio-ranges = <&pinctrl 0 112 16>;
+                        };
+
+                        gpioi: gpio@40022000 {
+                                gpio-ranges = <&pinctrl 0 128 16>;
+                        };
+
+                        gpioj: gpio@40022400 {
+                                gpio-ranges = <&pinctrl 0 144 16>;
+                        };
+
+                        gpiok: gpio@40022800 {
+                                gpio-ranges = <&pinctrl 0 160 8>;
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/stm32f429.dtsi b/arch/arm/boot/dts/stm32f429.dtsi
index dd7e99b1f43b..5b36eb114ddc 100644
--- a/arch/arm/boot/dts/stm32f429.dtsi
+++ b/arch/arm/boot/dts/stm32f429.dtsi
@@ -47,7 +47,6 @@
 
 #include "skeleton.dtsi"
 #include "armv7-m.dtsi"
-#include <dt-bindings/pinctrl/stm32f429-pinfunc.h>
 #include <dt-bindings/clock/stm32fx-clock.h>
 #include <dt-bindings/mfd/stm32f4-rcc.h>
 
@@ -591,302 +590,6 @@
                         status = "disabled";
                 };
 
-                pinctrl: pin-controller {
-                        #address-cells = <1>;
-                        #size-cells = <1>;
-                        compatible = "st,stm32f429-pinctrl";
-                        ranges = <0 0x40020000 0x3000>;
-                        interrupt-parent = <&exti>;
-                        st,syscfg = <&syscfg 0x8>;
-                        pins-are-numbered;
-
-                        gpioa: gpio@40020000 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x0 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOA)>;
-                                st,bank-name = "GPIOA";
-                        };
-
-                        gpiob: gpio@40020400 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x400 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOB)>;
-                                st,bank-name = "GPIOB";
-                        };
-
-                        gpioc: gpio@40020800 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x800 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOC)>;
-                                st,bank-name = "GPIOC";
-                        };
-
-                        gpiod: gpio@40020c00 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0xc00 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOD)>;
-                                st,bank-name = "GPIOD";
-                        };
-
-                        gpioe: gpio@40021000 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1000 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOE)>;
-                                st,bank-name = "GPIOE";
-                        };
-
-                        gpiof: gpio@40021400 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1400 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOF)>;
-                                st,bank-name = "GPIOF";
-                        };
-
-                        gpiog: gpio@40021800 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1800 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOG)>;
-                                st,bank-name = "GPIOG";
-                        };
-
-                        gpioh: gpio@40021c00 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x1c00 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOH)>;
-                                st,bank-name = "GPIOH";
-                        };
-
-                        gpioi: gpio@40022000 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x2000 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOI)>;
-                                st,bank-name = "GPIOI";
-                        };
-
-                        gpioj: gpio@40022400 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x2400 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOJ)>;
-                                st,bank-name = "GPIOJ";
-                        };
-
-                        gpiok: gpio@40022800 {
-                                gpio-controller;
-                                #gpio-cells = <2>;
-                                interrupt-controller;
-                                #interrupt-cells = <2>;
-                                reg = <0x2800 0x400>;
-                                clocks = <&rcc 0 STM32F4_AHB1_CLOCK(GPIOK)>;
-                                st,bank-name = "GPIOK";
-                        };
-
-                        usart1_pins_a: usart1@0 {
-                                pins1 {
-                                        pinmux = <STM32F429_PA9_FUNC_USART1_TX>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <0>;
-                                };
-                                pins2 {
-                                        pinmux = <STM32F429_PA10_FUNC_USART1_RX>;
-                                        bias-disable;
-                                };
-                        };
-
-                        usart3_pins_a: usart3@0 {
-                                pins1 {
-                                        pinmux = <STM32F429_PB10_FUNC_USART3_TX>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <0>;
-                                };
-                                pins2 {
-                                        pinmux = <STM32F429_PB11_FUNC_USART3_RX>;
-                                        bias-disable;
-                                };
-                        };
-
-                        usbotg_fs_pins_a: usbotg_fs@0 {
-                                pins {
-                                        pinmux = <STM32F429_PA10_FUNC_OTG_FS_ID>,
-                                                 <STM32F429_PA11_FUNC_OTG_FS_DM>,
-                                                 <STM32F429_PA12_FUNC_OTG_FS_DP>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        usbotg_fs_pins_b: usbotg_fs@1 {
-                                pins {
-                                        pinmux = <STM32F429_PB12_FUNC_OTG_HS_ID>,
-                                                 <STM32F429_PB14_FUNC_OTG_HS_DM>,
-                                                 <STM32F429_PB15_FUNC_OTG_HS_DP>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        usbotg_hs_pins_a: usbotg_hs@0 {
-                                pins {
-                                        pinmux = <STM32F429_PH4_FUNC_OTG_HS_ULPI_NXT>,
-                                                 <STM32F429_PI11_FUNC_OTG_HS_ULPI_DIR>,
-                                                 <STM32F429_PC0_FUNC_OTG_HS_ULPI_STP>,
-                                                 <STM32F429_PA5_FUNC_OTG_HS_ULPI_CK>,
-                                                 <STM32F429_PA3_FUNC_OTG_HS_ULPI_D0>,
-                                                 <STM32F429_PB0_FUNC_OTG_HS_ULPI_D1>,
-                                                 <STM32F429_PB1_FUNC_OTG_HS_ULPI_D2>,
-                                                 <STM32F429_PB10_FUNC_OTG_HS_ULPI_D3>,
-                                                 <STM32F429_PB11_FUNC_OTG_HS_ULPI_D4>,
-                                                 <STM32F429_PB12_FUNC_OTG_HS_ULPI_D5>,
-                                                 <STM32F429_PB13_FUNC_OTG_HS_ULPI_D6>,
-                                                 <STM32F429_PB5_FUNC_OTG_HS_ULPI_D7>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        ethernet_mii: mii@0 {
-                                pins {
-                                        pinmux = <STM32F429_PG13_FUNC_ETH_MII_TXD0_ETH_RMII_TXD0>,
-                                                 <STM32F429_PG14_FUNC_ETH_MII_TXD1_ETH_RMII_TXD1>,
-                                                 <STM32F429_PC2_FUNC_ETH_MII_TXD2>,
-                                                 <STM32F429_PB8_FUNC_ETH_MII_TXD3>,
-                                                 <STM32F429_PC3_FUNC_ETH_MII_TX_CLK>,
-                                                 <STM32F429_PG11_FUNC_ETH_MII_TX_EN_ETH_RMII_TX_EN>,
-                                                 <STM32F429_PA2_FUNC_ETH_MDIO>,
-                                                 <STM32F429_PC1_FUNC_ETH_MDC>,
-                                                 <STM32F429_PA1_FUNC_ETH_MII_RX_CLK_ETH_RMII_REF_CLK>,
-                                                 <STM32F429_PA7_FUNC_ETH_MII_RX_DV_ETH_RMII_CRS_DV>,
-                                                 <STM32F429_PC4_FUNC_ETH_MII_RXD0_ETH_RMII_RXD0>,
-                                                 <STM32F429_PC5_FUNC_ETH_MII_RXD1_ETH_RMII_RXD1>,
-                                                 <STM32F429_PH6_FUNC_ETH_MII_RXD2>,
-                                                 <STM32F429_PH7_FUNC_ETH_MII_RXD3>;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        adc3_in8_pin: adc@200 {
-                                pins {
-                                        pinmux = <STM32F429_PF10_FUNC_ANALOG>;
-                                };
-                        };
-
-                        pwm1_pins: pwm@1 {
-                                pins {
-                                        pinmux = <STM32F429_PA8_FUNC_TIM1_CH1>,
-                                                 <STM32F429_PB13_FUNC_TIM1_CH1N>,
-                                                 <STM32F429_PB12_FUNC_TIM1_BKIN>;
-                                };
-                        };
-
-                        pwm3_pins: pwm@3 {
-                                pins {
-                                        pinmux = <STM32F429_PB4_FUNC_TIM3_CH1>,
-                                                 <STM32F429_PB5_FUNC_TIM3_CH2>;
-                                };
-                        };
-
-                        i2c1_pins: i2c1@0 {
-                                pins {
-                                        pinmux = <STM32F429_PB9_FUNC_I2C1_SDA>,
-                                                 <STM32F429_PB6_FUNC_I2C1_SCL>;
-                                        bias-disable;
-                                        drive-open-drain;
-                                        slew-rate = <3>;
-                                };
-                        };
-
-                        ltdc_pins: ltdc@0 {
-                                pins {
-                                        pinmux = <STM32F429_PI12_FUNC_LCD_HSYNC>,
-                                                 <STM32F429_PI13_FUNC_LCD_VSYNC>,
-                                                 <STM32F429_PI14_FUNC_LCD_CLK>,
-                                                 <STM32F429_PI15_FUNC_LCD_R0>,
-                                                 <STM32F429_PJ0_FUNC_LCD_R1>,
-                                                 <STM32F429_PJ1_FUNC_LCD_R2>,
-                                                 <STM32F429_PJ2_FUNC_LCD_R3>,
-                                                 <STM32F429_PJ3_FUNC_LCD_R4>,
-                                                 <STM32F429_PJ4_FUNC_LCD_R5>,
-                                                 <STM32F429_PJ5_FUNC_LCD_R6>,
-                                                 <STM32F429_PJ6_FUNC_LCD_R7>,
-                                                 <STM32F429_PJ7_FUNC_LCD_G0>,
-                                                 <STM32F429_PJ8_FUNC_LCD_G1>,
-                                                 <STM32F429_PJ9_FUNC_LCD_G2>,
-                                                 <STM32F429_PJ10_FUNC_LCD_G3>,
-                                                 <STM32F429_PJ11_FUNC_LCD_G4>,
-                                                 <STM32F429_PJ12_FUNC_LCD_B0>,
-                                                 <STM32F429_PJ13_FUNC_LCD_B1>,
-                                                 <STM32F429_PJ14_FUNC_LCD_B2>,
-                                                 <STM32F429_PJ15_FUNC_LCD_B3>,
-                                                 <STM32F429_PK0_FUNC_LCD_G5>,
-                                                 <STM32F429_PK1_FUNC_LCD_G6>,
-                                                 <STM32F429_PK2_FUNC_LCD_G7>,
-                                                 <STM32F429_PK3_FUNC_LCD_B4>,
-                                                 <STM32F429_PK4_FUNC_LCD_B5>,
-                                                 <STM32F429_PK5_FUNC_LCD_B6>,
-                                                 <STM32F429_PK6_FUNC_LCD_B7>,
-                                                 <STM32F429_PK7_FUNC_LCD_DE>;
-                                        slew-rate = <2>;
-                                };
-                        };
-
-                        dcmi_pins: dcmi@0 {
-                                pins {
-                                        pinmux = <STM32F429_PA4_FUNC_DCMI_HSYNC>,
-                                                 <STM32F429_PB7_FUNC_DCMI_VSYNC>,
-                                                 <STM32F429_PA6_FUNC_DCMI_PIXCLK>,
-                                                 <STM32F429_PC6_FUNC_DCMI_D0>,
-                                                 <STM32F429_PC7_FUNC_DCMI_D1>,
-                                                 <STM32F429_PC8_FUNC_DCMI_D2>,
-                                                 <STM32F429_PC9_FUNC_DCMI_D3>,
-                                                 <STM32F429_PC11_FUNC_DCMI_D4>,
-                                                 <STM32F429_PD3_FUNC_DCMI_D5>,
-                                                 <STM32F429_PB8_FUNC_DCMI_D6>,
-                                                 <STM32F429_PE6_FUNC_DCMI_D7>,
-                                                 <STM32F429_PC10_FUNC_DCMI_D8>,
-                                                 <STM32F429_PC12_FUNC_DCMI_D9>,
-                                                 <STM32F429_PD6_FUNC_DCMI_D10>,
-                                                 <STM32F429_PD2_FUNC_DCMI_D11>;
-                                        bias-disable;
-                                        drive-push-pull;
-                                        slew-rate = <3>;
-                                };
-                        };
-                };
-
                 crc: crc@40023000 {
                         compatible = "st,stm32f4-crc";
                         reg = <0x40023000 0x400>;
diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
index 6ae1f037f3f0..c18acbe4cf4e 100644
--- a/arch/arm/boot/dts/stm32f469-disco.dts
+++ b/arch/arm/boot/dts/stm32f469-disco.dts
@@ -47,6 +47,7 @@
 
 /dts-v1/;
 #include "stm32f429.dtsi"
+#include "stm32f469-pinctrl.dtsi"
 
 / {
         model = "STMicroelectronics STM32F469i-DISCO board";
diff --git a/arch/arm/boot/dts/stm32f469-pinctrl.dtsi b/arch/arm/boot/dts/stm32f469-pinctrl.dtsi
new file mode 100644
index 000000000000..fff542662eea
--- /dev/null
+++ b/arch/arm/boot/dts/stm32f469-pinctrl.dtsi
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2017 - Alexandre Torgue <alexandre.torgue@st.com>
+ *
+ * This file is dual-licensed: you can use it either under the terms
+ * of the GPL or the X11 license, at your option. Note that this dual
+ * licensing only applies to this file, and not this project as a
+ * whole.
+ *
+ *  a) This file is free software; you can redistribute it and/or
+ *     modify it under the terms of the GNU General Public License as
+ *     published by the Free Software Foundation; either version 2 of the
+ *     License, or (at your option) any later version.
+ *
+ *     This file is distributed in the hope that it will be useful,
+ *     but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *     GNU General Public License for more details.
+ *
+ * Or, alternatively,
+ *
+ *  b) Permission is hereby granted, free of charge, to any person
+ *     obtaining a copy of this software and associated documentation
+ *     files (the "Software"), to deal in the Software without
+ *     restriction, including without limitation the rights to use,
+ *     copy, modify, merge, publish, distribute, sublicense, and/or
+ *     sell copies of the Software, and to permit persons to whom the
+ *     Software is furnished to do so, subject to the following
+ *     conditions:
+ *
+ *     The above copyright notice and this permission notice shall be
+ *     included in all copies or substantial portions of the Software.
+ *
+ *     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ *     EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+ *     OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ *     NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+ *     HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ *     WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ *     FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ *     OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "stm32f4-pinctrl.dtsi"
+
+/ {
+        soc {
+                pinctrl: pin-controller {
+                        compatible = "st,stm32f469-pinctrl";
+
+                        gpioa: gpio@40020000 {
+                                gpio-ranges = <&pinctrl 0 0 16>;
+                        };
+
+                        gpiob: gpio@40020400 {
+                                gpio-ranges = <&pinctrl 0 16 16>;
+                        };
+
+                        gpioc: gpio@40020800 {
+                                gpio-ranges = <&pinctrl 0 32 16>;
+                        };
+
+                        gpiod: gpio@40020c00 {
+                                gpio-ranges = <&pinctrl 0 48 16>;
+                        };
+
+                        gpioe: gpio@40021000 {
+                                gpio-ranges = <&pinctrl 0 64 16>;
+                        };
+
+                        gpiof: gpio@40021400 {
+                                gpio-ranges = <&pinctrl 0 80 16>;
+                        };
+
+                        gpiog: gpio@40021800 {
+                                gpio-ranges = <&pinctrl 0 96 16>;
+                        };
+
+                        gpioh: gpio@40021c00 {
+                                gpio-ranges = <&pinctrl 0 112 16>;
+                        };
+
+                        gpioi: gpio@40022000 {
+                                gpio-ranges = <&pinctrl 0 128 16>;
+                        };
+
+                        gpioj: gpio@40022400 {
+                                gpio-ranges = <&pinctrl 0 144 6>,
+                                              <&pinctrl 12 156 4>;
+                        };
+
+                        gpiok: gpio@40022800 {
+                                gpio-ranges = <&pinctrl 3 163 5>;
+                        };
+                };
+        };
+};
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
index d2d75fa664a6..2a63fa10c813 100644
--- a/arch/arm/configs/gemini_defconfig
+++ b/arch/arm/configs/gemini_defconfig
@@ -32,6 +32,7 @@ CONFIG_BLK_DEV_RAM_SIZE=16384
 CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=y
+CONFIG_PATA_FTIDE010=y
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
@@ -55,8 +56,8 @@ CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
-CONFIG_RTC_DRV_GEMINI=y
 CONFIG_DMADEVICES=y
+CONFIG_AMBA_PL08X=y
 # CONFIG_DNOTIFY is not set
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
diff --git a/arch/arm/configs/pxa_defconfig b/arch/arm/configs/pxa_defconfig
index 1a608ec04e17..830e817a028a 100644
--- a/arch/arm/configs/pxa_defconfig
+++ b/arch/arm/configs/pxa_defconfig
@@ -472,7 +472,7 @@ CONFIG_LCD_PLATFORM=m
 CONFIG_LCD_TOSA=m
 CONFIG_BACKLIGHT_PWM=m
 CONFIG_BACKLIGHT_TOSA=m
-CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
diff --git a/arch/arm/configs/viper_defconfig b/arch/arm/configs/viper_defconfig
index 44d4fa57ba0a..070e5074f1ee 100644
--- a/arch/arm/configs/viper_defconfig
+++ b/arch/arm/configs/viper_defconfig
@@ -113,7 +113,7 @@ CONFIG_FB_PXA_PARAMETERS=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BACKLIGHT_PWM=m
 # CONFIG_VGA_CONSOLE is not set
-CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
diff --git a/arch/arm/configs/zeus_defconfig b/arch/arm/configs/zeus_defconfig
index 8d4c0c926c34..09e7050d5653 100644
--- a/arch/arm/configs/zeus_defconfig
+++ b/arch/arm/configs/zeus_defconfig
@@ -112,7 +112,7 @@ CONFIG_FB_PXA=m
 CONFIG_FB_PXA_PARAMETERS=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 # CONFIG_VGA_CONSOLE is not set
-CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index 1d468b527b7b..776757d1604a 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -139,11 +139,10 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define TIF_NEED_RESCHED        1       /* rescheduling necessary */
 #define TIF_NOTIFY_RESUME       2       /* callback before returning to user */
 #define TIF_UPROBE              3       /* breakpointed or singlestepping */
-#define TIF_FSCHECK             4       /* Check FS is USER_DS on return */
-#define TIF_SYSCALL_TRACE       5       /* syscall trace active */
-#define TIF_SYSCALL_AUDIT       6       /* syscall auditing active */
-#define TIF_SYSCALL_TRACEPOINT  7       /* syscall tracepoint instrumentation */
-#define TIF_SECCOMP             8       /* seccomp syscall filtering active */
+#define TIF_SYSCALL_TRACE       4       /* syscall trace active */
+#define TIF_SYSCALL_AUDIT       5       /* syscall auditing active */
+#define TIF_SYSCALL_TRACEPOINT  6       /* syscall tracepoint instrumentation */
+#define TIF_SECCOMP             7       /* seccomp syscall filtering active */
 
 #define TIF_NOHZ                12      /* in adaptive nohz mode */
 #define TIF_USING_IWMMXT        17
@@ -154,7 +153,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define _TIF_NEED_RESCHED       (1 << TIF_NEED_RESCHED)
 #define _TIF_NOTIFY_RESUME      (1 << TIF_NOTIFY_RESUME)
 #define _TIF_UPROBE             (1 << TIF_UPROBE)
-#define _TIF_FSCHECK            (1 << TIF_FSCHECK)
 #define _TIF_SYSCALL_TRACE      (1 << TIF_SYSCALL_TRACE)
 #define _TIF_SYSCALL_AUDIT      (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
@@ -168,9 +166,8 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 /*
  * Change these and you break ASM code in entry-common.S
  */
-#define _TIF_WORK_MASK          (_TIF_NEED_RESCHED | _TIF_SIGPENDING |  \
-                                 _TIF_NOTIFY_RESUME | _TIF_UPROBE |     \
-                                 _TIF_FSCHECK)
+#define _TIF_WORK_MASK          (_TIF_NEED_RESCHED | _TIF_SIGPENDING | \
+                                 _TIF_NOTIFY_RESUME | _TIF_UPROBE)
 
 #endif /* __KERNEL__ */
 #endif /* __ASM_ARM_THREAD_INFO_H */
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 87936dd5d151..0bf2347495f1 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -70,8 +70,6 @@ static inline void set_fs(mm_segment_t fs)
 {
         current_thread_info()->addr_limit = fs;
         modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
-        /* On user-mode return, check fs is correct */
-        set_thread_flag(TIF_FSCHECK);
 }
 
 #define segment_eq(a, b)        ((a) == (b))
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index ca3614dc6938..99c908226065 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -12,6 +12,7 @@
 #include <asm/unistd.h>
 #include <asm/ftrace.h>
 #include <asm/unwind.h>
+#include <asm/memory.h>
 #ifdef CONFIG_AEABI
 #include <asm/unistd-oabi.h>
 #endif
@@ -48,12 +49,14 @@ ret_fast_syscall:
  UNWIND(.fnstart        )
  UNWIND(.cantunwind     )
         disable_irq_notrace                     @ disable interrupts
+        ldr     r2, [tsk, #TI_ADDR_LIMIT]
+        cmp     r2, #TASK_SIZE
+        blne    addr_limit_check_failed
         ldr     r1, [tsk, #TI_FLAGS]            @ re-check for syscall tracing
-        tst     r1, #_TIF_SYSCALL_WORK
-        bne     fast_work_pending
-        tst     r1, #_TIF_WORK_MASK
+        tst     r1, #_TIF_SYSCALL_WORK | _TIF_WORK_MASK
         bne     fast_work_pending
 
+
         /* perform architecture specific actions before user return */
         arch_ret_to_user r1, lr
 
@@ -76,16 +79,16 @@ ret_fast_syscall:
  UNWIND(.cantunwind     )
         str     r0, [sp, #S_R0 + S_OFF]!        @ save returned r0
         disable_irq_notrace                     @ disable interrupts
+        ldr     r2, [tsk, #TI_ADDR_LIMIT]
+        cmp     r2, #TASK_SIZE
+        blne    addr_limit_check_failed
         ldr     r1, [tsk, #TI_FLAGS]            @ re-check for syscall tracing
-        tst     r1, #_TIF_SYSCALL_WORK
-        bne     fast_work_pending
-        tst     r1, #_TIF_WORK_MASK
+        tst     r1, #_TIF_SYSCALL_WORK | _TIF_WORK_MASK
         beq     no_work_pending
  UNWIND(.fnend          )
 ENDPROC(ret_fast_syscall)
 
         /* Slower path - fall through to work_pending */
-fast_work_pending:
 #endif
 
         tst     r1, #_TIF_SYSCALL_WORK
@@ -111,6 +114,9 @@ ENTRY(ret_to_user)
 ret_slow_syscall:
         disable_irq_notrace                     @ disable interrupts
 ENTRY(ret_to_user_from_irq)
+        ldr     r2, [tsk, #TI_ADDR_LIMIT]
+        cmp     r2, #TASK_SIZE
+        blne    addr_limit_check_failed
         ldr     r1, [tsk, #TI_FLAGS]
         tst     r1, #_TIF_WORK_MASK
         bne     slow_work_pending
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index e2de50bf8742..b67ae12503f3 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -614,10 +614,6 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
          * Update the trace code with the current status.
          */
         trace_hardirqs_off();
-
-        /* Check valid user FS if needed */
-        addr_limit_user_check();
-
         do {
                 if (likely(thread_flags & _TIF_NEED_RESCHED)) {
                         schedule();
@@ -678,3 +674,9 @@ struct page *get_signal_page(void)
 
         return page;
 }
+
+/* Defer to generic check */
+asmlinkage void addr_limit_check_failed(void)
+{
+        addr_limit_user_check();
+}
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 5036f996e694..849014c01cf4 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -533,8 +533,8 @@ static void __init at91_pm_backup_init(void)
         }
 
         pm_bu->suspended = 0;
-        pm_bu->canary = virt_to_phys(&canary);
-        pm_bu->resume = virt_to_phys(cpu_resume);
+        pm_bu->canary = __pa_symbol(&canary);
+        pm_bu->resume = __pa_symbol(cpu_resume);
 
         return;
 
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index 5b614388d72f..6d28aa20a7d3 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -58,10 +58,10 @@ void omap_hsmmc_late_init(struct omap2_hsmmc_info *c)
         struct platform_device *pdev;
         int res;
 
-        if (omap_hsmmc_done != 1)
+        if (omap_hsmmc_done)
                 return;
 
-        omap_hsmmc_done++;
+        omap_hsmmc_done = 1;
 
         for (; c->mmc; c++) {
                 pdev = c->pdev;
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index f040244c57e7..2f4f7002f38d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -839,6 +839,7 @@ static struct omap_hwmod dra7xx_gpio1_hwmod = {
         .name           = "gpio1",
         .class          = &dra7xx_gpio_hwmod_class,
         .clkdm_name     = "wkupaon_clkdm",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .main_clk       = "wkupaon_iclk_mux",
         .prcm = {
                 .omap4 = {
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 9b41f1e3b1a0..939b310913cf 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -50,17 +50,22 @@ KBUILD_CFLAGS	+= -fno-asynchronous-unwind-tables
 KBUILD_CFLAGS   += $(call cc-option, -mpc-relative-literal-loads)
 KBUILD_AFLAGS   += $(lseinstr) $(brokengasinst)
 
+KBUILD_CFLAGS   += $(call cc-option,-mabi=lp64)
+KBUILD_AFLAGS   += $(call cc-option,-mabi=lp64)
+
 ifeq ($(CONFIG_CPU_BIG_ENDIAN), y)
 KBUILD_CPPFLAGS += -mbig-endian
 CHECKFLAGS      += -D__AARCH64EB__
 AS              += -EB
 LD              += -EB
+LDFLAGS         += -maarch64linuxb
 UTS_MACHINE     := aarch64_be
 else
 KBUILD_CPPFLAGS += -mlittle-endian
 CHECKFLAGS      += -D__AARCH64EL__
 AS              += -EL
 LD              += -EL
+LDFLAGS         += -maarch64linux
 UTS_MACHINE     := aarch64
 endif
 
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index c89010e56488..4157987f4a3d 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -168,7 +168,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -194,7 +195,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -212,10 +214,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
index 9697a7a79464..4b17a76959b2 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
@@ -107,6 +107,9 @@
 
                 states = <3300000 0>,
                          <1800000 1>;
+
+                regulator-settling-time-up-us = <100>;
+                regulator-settling-time-down-us = <5000>;
         };
 
         wifi_32k: wifi-32k {
@@ -250,7 +253,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>, <&sdio_irq_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -276,11 +280,16 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
-        max-frequency = <100000000>;
+        sd-uhs-sdr12;
+        sd-uhs-sdr25;
+        sd-uhs-sdr50;
+        sd-uhs-sdr104;
+        max-frequency = <200000000>;
         disable-wp;
 
         cd-gpios = <&gpio CARD_6 GPIO_ACTIVE_HIGH>;
@@ -294,10 +303,10 @@
 &sd_emmc_c {
         status = "disabled";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         max-frequency = <200000000>;
         non-removable;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
index 9c59c3c6d1b6..38dfdde5c147 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
@@ -51,7 +51,7 @@
 / {
         compatible = "nexbox,a95x", "amlogic,meson-gxbb";
         model = "NEXBOX A95X";
-        
+
         aliases {
                 serial0 = &uart_AO;
         };
@@ -232,7 +232,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -253,7 +254,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -271,10 +273,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index d147c853ab05..1ffa1c238a72 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -50,7 +50,7 @@
 / {
         compatible = "hardkernel,odroid-c2", "amlogic,meson-gxbb";
         model = "Hardkernel ODROID-C2";
-        
+
         aliases {
                 serial0 = &uart_AO;
         };
@@ -253,7 +253,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -271,10 +272,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         max-frequency = <200000000>;
         non-removable;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
index 81ffc689a5bf..23c08c3afd0a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
@@ -194,7 +194,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -220,10 +221,14 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
+        sd-uhs-sdr12;
+        sd-uhs-sdr25;
+        sd-uhs-sdr50;
         max-frequency = <100000000>;
         disable-wp;
 
@@ -238,10 +243,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
index 346753fb6324..f2bc6dea1fc6 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi
@@ -155,7 +155,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins &sdio_irq_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -181,7 +182,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -198,10 +200,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index 52f1687e7a09..af834cdbba79 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -392,6 +392,17 @@
                         };
                 };
 
+                emmc_clk_gate_pins: emmc_clk_gate {
+                        mux {
+                                groups = "BOOT_8";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "BOOT_8";
+                                bias-pull-down;
+                        };
+                };
+
                 nor_pins: nor {
                         mux {
                                 groups = "nor_d",
@@ -430,6 +441,17 @@
                         };
                 };
 
+                sdcard_clk_gate_pins: sdcard_clk_gate {
+                        mux {
+                                groups = "CARD_2";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "CARD_2";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_pins: sdio {
                         mux {
                                 groups = "sdio_d0",
@@ -442,6 +464,17 @@
                         };
                 };
 
+                sdio_clk_gate_pins: sdio_clk_gate {
+                        mux {
+                                groups = "GPIOX_4";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "GPIOX_4";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_irq_pins: sdio_irq {
                         mux {
                                 groups = "sdio_irq";
@@ -661,21 +694,21 @@
 
 &sd_emmc_a {
         clocks = <&clkc CLKID_SD_EMMC_A>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_A_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_b {
         clocks = <&clkc CLKID_SD_EMMC_B>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_B_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_c {
         clocks = <&clkc CLKID_SD_EMMC_C>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_C_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
index 2a5804ce7f4b..977b4240f3c1 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
@@ -123,7 +123,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -141,10 +142,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <100000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index 69ca14ac10fa..64c54c92e214 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -91,6 +91,9 @@
 
                 states = <3300000 0>,
                          <1800000 1>;
+
+                regulator-settling-time-up-us = <200>;
+                regulator-settling-time-down-us = <50000>;
         };
 
         vddio_boot: regulator-vddio_boot {
@@ -197,10 +200,14 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
+        sd-uhs-sdr12;
+        sd-uhs-sdr25;
+        sd-uhs-sdr50;
         max-frequency = <100000000>;
         disable-wp;
 
@@ -215,10 +222,12 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
         cap-mmc-highspeed;
+        mmc-ddr-3_3v;
         max-frequency = <50000000>;
         non-removable;
         disable-wp;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 4c2ac7650fcd..1b8f32867aa1 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -189,7 +189,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -210,7 +211,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -228,10 +230,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index f3eea8e89d12..129af9068814 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -95,7 +95,8 @@
 &sd_emmc_a {
         status = "okay";
         pinctrl-0 = <&sdio_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdio_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
         #address-cells = <1>;
         #size-cells = <0>;
 
@@ -116,7 +117,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -134,10 +136,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index d6876e64979e..d8dd3298b15c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -281,6 +281,17 @@
                         };
                 };
 
+                emmc_clk_gate_pins: emmc_clk_gate {
+                        mux {
+                                groups = "BOOT_8";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "BOOT_8";
+                                bias-pull-down;
+                        };
+                };
+
                 nor_pins: nor {
                         mux {
                                 groups = "nor_d",
@@ -319,6 +330,17 @@
                         };
                 };
 
+                sdcard_clk_gate_pins: sdcard_clk_gate {
+                        mux {
+                                groups = "CARD_2";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "CARD_2";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_pins: sdio {
                         mux {
                                 groups = "sdio_d0",
@@ -331,6 +353,17 @@
                         };
                 };
 
+                sdio_clk_gate_pins: sdio_clk_gate {
+                        mux {
+                                groups = "GPIOX_4";
+                                function = "gpio_periphs";
+                        };
+                        cfg-pull-down {
+                                pins = "GPIOX_4";
+                                bias-pull-down;
+                        };
+                };
+
                 sdio_irq_pins: sdio_irq {
                         mux {
                                 groups = "sdio_irq";
@@ -603,21 +636,21 @@
 
 &sd_emmc_a {
         clocks = <&clkc CLKID_SD_EMMC_A>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_A_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_b {
         clocks = <&clkc CLKID_SD_EMMC_B>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_B_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
        clock-names = "core", "clkin0", "clkin1";
 };
 
 &sd_emmc_c {
         clocks = <&clkc CLKID_SD_EMMC_C>,
-                 <&xtal>,
+                 <&clkc CLKID_SD_EMMC_C_CLK0>,
                  <&clkc CLKID_FCLK_DIV2>;
         clock-names = "core", "clkin0", "clkin1";
 };
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
index 9b10c5f4f8c0..22c697732f66 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts
@@ -175,7 +175,8 @@
 &sd_emmc_b {
         status = "okay";
         pinctrl-0 = <&sdcard_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&sdcard_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <4>;
         cap-sd-highspeed;
@@ -193,10 +194,10 @@
 &sd_emmc_c {
         status = "okay";
         pinctrl-0 = <&emmc_pins>;
-        pinctrl-names = "default";
+        pinctrl-1 = <&emmc_clk_gate_pins>;
+        pinctrl-names = "default", "clk-gate";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
index 08f1dd69b679..470f72bb863c 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts
@@ -220,7 +220,6 @@
         pinctrl-names = "default";
 
         bus-width = <8>;
-        cap-sd-highspeed;
         cap-mmc-highspeed;
         max-frequency = <200000000>;
         non-removable;
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
index 4d360713ed12..30d48ecf46e0 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
@@ -254,7 +254,7 @@
 
                         ap_syscon: system-controller@6f4000 {
                                 compatible = "syscon", "simple-mfd";
-                                reg = <0x6f4000 0x1000>;
+                                reg = <0x6f4000 0x2000>;
 
                                 ap_clk: clock {
                                         compatible = "marvell,ap806-clock";
@@ -265,7 +265,7 @@
                                         compatible = "marvell,ap806-pinctrl";
                                 };
 
-                                ap_gpio: gpio {
+                                ap_gpio: gpio@1040 {
                                         compatible = "marvell,armada-8k-gpio";
                                         offset = <0x1040>;
                                         ngpios = <20>;
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index e0518b4bc6c2..19fbaa5e7bdd 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -113,8 +113,7 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x0>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
+
                         #cooling-cells = <2>; /* min followed by max */
                 };
 
@@ -123,8 +122,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x1>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
                 };
 
                 cpu_l2: cpu@2 {
@@ -132,8 +129,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x2>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
                 };
 
                 cpu_l3: cpu@3 {
@@ -141,8 +136,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x3>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKL>;
-                        operating-points-v2 = <&cluster0_opp>;
                 };
 
                 cpu_b0: cpu@100 {
@@ -150,8 +143,7 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x100>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
+
                         #cooling-cells = <2>; /* min followed by max */
                 };
 
@@ -160,8 +152,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x101>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
                 };
 
                 cpu_b2: cpu@102 {
@@ -169,8 +159,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x102>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
                 };
 
                 cpu_b3: cpu@103 {
@@ -178,62 +166,6 @@
                         compatible = "arm,cortex-a53", "arm,armv8";
                         reg = <0x0 0x103>;
                         enable-method = "psci";
-                        clocks = <&cru ARMCLKB>;
-                        operating-points-v2 = <&cluster1_opp>;
-                };
-        };
-
-        cluster0_opp: opp-table0 {
-                compatible = "operating-points-v2";
-                opp-shared;
-
-                opp00 {
-                        opp-hz = /bits/ 64 <312000000>;
-                        opp-microvolt = <950000>;
-                        clock-latency-ns = <40000>;
-                };
-                opp01 {
-                        opp-hz = /bits/ 64 <408000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp02 {
-                        opp-hz = /bits/ 64 <600000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp03 {
-                        opp-hz = /bits/ 64 <816000000>;
-                        opp-microvolt = <1025000>;
-                };
-                opp04 {
-                        opp-hz = /bits/ 64 <1008000000>;
-                        opp-microvolt = <1125000>;
-                };
-        };
-
-        cluster1_opp: opp-table1 {
-                compatible = "operating-points-v2";
-                opp-shared;
-
-                opp00 {
-                        opp-hz = /bits/ 64 <312000000>;
-                        opp-microvolt = <950000>;
-                        clock-latency-ns = <40000>;
-                };
-                opp01 {
-                        opp-hz = /bits/ 64 <408000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp02 {
-                        opp-hz = /bits/ 64 <600000000>;
-                        opp-microvolt = <950000>;
-                };
-                opp03 {
-                        opp-hz = /bits/ 64 <816000000>;
-                        opp-microvolt = <975000>;
-                };
-                opp04 {
-                        opp-hz = /bits/ 64 <1008000000>;
-                        opp-microvolt = <1050000>;
                 };
         };
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index d79e9b3265b9..ab7629c5b856 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -1629,9 +1629,9 @@
                 compatible = "rockchip,rk3399-mipi-dsi", "snps,dw-mipi-dsi";
                 reg = <0x0 0xff960000 0x0 0x8000>;
                 interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH 0>;
-                clocks = <&cru SCLK_MIPIDPHY_REF>, <&cru PCLK_MIPI_DSI0>,
-                         <&cru SCLK_DPHY_TX0_CFG>;
-                clock-names = "ref", "pclk", "phy_cfg";
+                clocks = <&cru SCLK_DPHY_PLL>, <&cru PCLK_MIPI_DSI0>,
+                         <&cru SCLK_DPHY_TX0_CFG>, <&cru PCLK_VIO_GRF>;
+                clock-names = "ref", "pclk", "phy_cfg", "grf";
                 power-domains = <&power RK3399_PD_VIO>;
                 rockchip,grf = <&grf>;
                 status = "disabled";
diff --git a/arch/arm64/include/asm/linkage.h b/arch/arm64/include/asm/linkage.h
index 636c1bced7d4..1b266292f0be 100644
--- a/arch/arm64/include/asm/linkage.h
+++ b/arch/arm64/include/asm/linkage.h
@@ -1,7 +1,7 @@
 #ifndef __ASM_LINKAGE_H
 #define __ASM_LINKAGE_H
 
-#define __ALIGN         .align 4
-#define __ALIGN_STR     ".align 4"
+#define __ALIGN         .align 2
+#define __ALIGN_STR     ".align 2"
 
 #endif
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 3585a5e26151..f7c4d2146aed 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -95,16 +95,19 @@
 #define KERNEL_END        _end
 
 /*
- * The size of the KASAN shadow region. This should be 1/8th of the
- * size of the entire kernel virtual address space.
+ * KASAN requires 1/8th of the kernel virtual address space for the shadow
+ * region. KASAN can bloat the stack significantly, so double the (minimum)
+ * stack size when KASAN is in use.
  */
 #ifdef CONFIG_KASAN
 #define KASAN_SHADOW_SIZE       (UL(1) << (VA_BITS - 3))
+#define KASAN_THREAD_SHIFT      1
 #else
 #define KASAN_SHADOW_SIZE       (0)
+#define KASAN_THREAD_SHIFT      0
 #endif
 
-#define MIN_THREAD_SHIFT        14
+#define MIN_THREAD_SHIFT        (14 + KASAN_THREAD_SHIFT)
 
 /*
  * VMAP'd stacks are allocated at page granularity, so we must ensure that such
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index bc4e92337d16..b46e54c2399b 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -401,7 +401,7 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 /* Find an entry in the third-level page table. */
 #define pte_index(addr)         (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
 
-#define pte_offset_phys(dir,addr)       (pmd_page_paddr(*(dir)) + pte_index(addr) * sizeof(pte_t))
+#define pte_offset_phys(dir,addr)       (pmd_page_paddr(READ_ONCE(*(dir))) + pte_index(addr) * sizeof(pte_t))
 #define pte_offset_kernel(dir,addr)     ((pte_t *)__va(pte_offset_phys((dir), (addr))))
 
 #define pte_offset_map(dir,addr)        pte_offset_kernel((dir), (addr))
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index f0e6d717885b..d06fbe4cd38d 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -649,4 +649,4 @@ static int __init armv8_deprecated_init(void)
         return 0;
 }
 
-late_initcall(armv8_deprecated_init);
+core_initcall(armv8_deprecated_init);
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index cd52d365d1f0..21e2c95d24e7 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1307,4 +1307,4 @@ static int __init enable_mrs_emulation(void)
         return 0;
 }
 
-late_initcall(enable_mrs_emulation);
+core_initcall(enable_mrs_emulation);
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 3a68cf38a6b3..5d547deb6996 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -321,6 +321,8 @@ void kernel_neon_end(void)
 }
 EXPORT_SYMBOL(kernel_neon_end);
 
+#ifdef CONFIG_EFI
+
 static DEFINE_PER_CPU(struct fpsimd_state, efi_fpsimd_state);
 static DEFINE_PER_CPU(bool, efi_fpsimd_state_used);
 
@@ -370,6 +372,8 @@ void __efi_fpsimd_end(void)
                 kernel_neon_end();
 }
 
+#endif /* CONFIG_EFI */
+
 #endif /* CONFIG_KERNEL_MODE_NEON */
 
 #ifdef CONFIG_CPU_PM
@@ -440,4 +444,4 @@ static int __init fpsimd_init(void)
 
         return 0;
 }
-late_initcall(fpsimd_init);
+core_initcall(fpsimd_init);
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 7434ec0c7a27..0b243ecaf7ac 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -384,6 +384,7 @@ ENTRY(kimage_vaddr)
  * booted in EL1 or EL2 respectively.
  */
 ENTRY(el2_setup)
+        msr     SPsel, #1                       // We want to use SP_EL{1,2}
         mrs     x0, CurrentEL
         cmp     x0, #CurrentEL_EL2
         b.eq    1f
diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c
index c45214f8fb54..0bdc96c61bc0 100644
--- a/arch/arm64/kernel/signal.c
+++ b/arch/arm64/kernel/signal.c
@@ -751,10 +751,10 @@ asmlinkage void do_notify_resume(struct pt_regs *regs,
          */
         trace_hardirqs_off();
 
-        /* Check valid user FS if needed */
-        addr_limit_user_check();
-
         do {
+                /* Check valid user FS if needed */
+                addr_limit_user_check();
+
                 if (thread_flags & _TIF_NEED_RESCHED) {
                         schedule();
                 } else {
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 89993c4be1be..b64958b23a7f 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -97,7 +97,7 @@ static void data_abort_decode(unsigned int esr)
                          (esr & ESR_ELx_SF) >> ESR_ELx_SF_SHIFT,
                          (esr & ESR_ELx_AR) >> ESR_ELx_AR_SHIFT);
         } else {
-                pr_alert("  ISV = 0, ISS = 0x%08lu\n", esr & ESR_ELx_ISS_MASK);
+                pr_alert("  ISV = 0, ISS = 0x%08lx\n", esr & ESR_ELx_ISS_MASK);
         }
 
         pr_alert("  CM = %lu, WnR = %lu\n",
@@ -651,7 +651,7 @@ static const struct fault_info fault_info[] = {
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 0 translation fault"     },
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 1 translation fault"     },
         { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 2 translation fault"     },
-        { do_page_fault,        SIGSEGV, SEGV_MAPERR,   "level 3 translation fault"     },
+        { do_translation_fault, SIGSEGV, SEGV_MAPERR,   "level 3 translation fault"     },
         { do_bad,               SIGBUS,  0,             "unknown 8"                     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 1 access flag fault"     },
         { do_page_fault,        SIGSEGV, SEGV_ACCERR,   "level 2 access flag fault"     },
diff --git a/arch/c6x/include/asm/processor.h b/arch/c6x/include/asm/processor.h
index 7c87b5be53b5..8f7cce829f8e 100644
--- a/arch/c6x/include/asm/processor.h
+++ b/arch/c6x/include/asm/processor.h
@@ -92,9 +92,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-#define copy_segments(tsk, mm)          do { } while (0)
-#define release_segments(mm)            do { } while (0)
-
 /*
  * saved kernel SP and DP of a blocked thread.
  */
diff --git a/arch/frv/include/asm/processor.h b/arch/frv/include/asm/processor.h
index e4d08d74ed9f..021cce78b401 100644
--- a/arch/frv/include/asm/processor.h
+++ b/arch/frv/include/asm/processor.h
@@ -92,10 +92,6 @@ static inline void release_thread(struct task_struct *dead_task)
 extern asmlinkage void save_user_regs(struct user_context *target);
 extern asmlinkage void *restore_user_regs(const struct user_context *target, ...);
 
-#define copy_segments(tsk, mm)          do { } while (0)
-#define release_segments(mm)            do { } while (0)
-#define forget_segments()               do { } while (0)
-
 unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)   ((tsk)->thread.frame0->pc)
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 87cde1e4b38c..0777f3a8a1f3 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -194,6 +194,10 @@ config TIMER_DIVIDE
         int "Timer divider (integer)"
         default "128"
 
+config CPU_BIG_ENDIAN
+        bool "Generate big endian code"
+        default n
+
 config CPU_LITTLE_ENDIAN
         bool "Generate little endian code"
         default n
diff --git a/arch/m32r/include/asm/processor.h b/arch/m32r/include/asm/processor.h
index 657874eeeccc..c70fa9ac7169 100644
--- a/arch/m32r/include/asm/processor.h
+++ b/arch/m32r/include/asm/processor.h
@@ -118,14 +118,6 @@ struct mm_struct;
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
 
-/* Copy and release all segment info associated with a VM */
-extern void copy_segments(struct task_struct *p, struct mm_struct * mm);
-extern void release_segments(struct mm_struct * mm);
-
-/* Copy and release all segment info associated with a VM */
-#define copy_segments(p, mm)  do { } while (0)
-#define release_segments(mm)  do { } while (0)
-
 unsigned long get_wchan(struct task_struct *p);
 #define KSTK_EIP(tsk)  ((tsk)->thread.lr)
 #define KSTK_ESP(tsk)  ((tsk)->thread.sp)
diff --git a/arch/m32r/kernel/traps.c b/arch/m32r/kernel/traps.c
index 647dd94a0c39..72b96f282689 100644
--- a/arch/m32r/kernel/traps.c
+++ b/arch/m32r/kernel/traps.c
@@ -114,6 +114,15 @@ static void set_eit_vector_entries(void)
         _flush_cache_copyback_all();
 }
 
+void abort(void)
+{
+        BUG();
+
+        /* if that doesn't kill us, halt */
+        panic("Oops failed to kill thread");
+}
+EXPORT_SYMBOL(abort);
+
 void __init trap_init(void)
 {
         set_eit_vector_entries();
diff --git a/arch/metag/include/asm/processor.h b/arch/metag/include/asm/processor.h
index ec6a49076980..8ae92d6abfd2 100644
--- a/arch/metag/include/asm/processor.h
+++ b/arch/metag/include/asm/processor.h
@@ -131,9 +131,6 @@ static inline void release_thread(struct task_struct *dead_task)
 {
 }
 
-#define copy_segments(tsk, mm)          do { } while (0)
-#define release_segments(mm)            do { } while (0)
-
 /*
  * Return saved PC of a blocked thread.
  */
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 9d26abdf0dc1..4f798aa671dd 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -39,7 +39,7 @@ config MICROBLAZE
 # Endianness selection
 choice
         prompt "Endianness selection"
-        default CPU_BIG_ENDIAN
+        default CPU_LITTLE_ENDIAN
         help
           microblaze architectures can be configured for either little or
           big endian formats. Be sure to select the appropriate mode.
diff --git a/arch/microblaze/include/uapi/asm/Kbuild b/arch/microblaze/include/uapi/asm/Kbuild
index e77a596f3f1e..06609ca36115 100644
--- a/arch/microblaze/include/uapi/asm/Kbuild
+++ b/arch/microblaze/include/uapi/asm/Kbuild
@@ -7,6 +7,7 @@ generic-y += fcntl.h
 generic-y += ioctl.h
 generic-y += ioctls.h
 generic-y += ipcbuf.h
+generic-y += kvm_para.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += param.h
diff --git a/arch/microblaze/kernel/dma.c b/arch/microblaze/kernel/dma.c
index e45ada8fb006..94700c5270a9 100644
--- a/arch/microblaze/kernel/dma.c
+++ b/arch/microblaze/kernel/dma.c
@@ -165,7 +165,7 @@ int dma_direct_mmap_coherent(struct device *dev, struct vm_area_struct *vma,
                              unsigned long attrs)
 {
 #ifdef CONFIG_MMU
-        unsigned long user_count = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        unsigned long user_count = vma_pages(vma);
         unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         unsigned long off = vma->vm_pgoff;
         unsigned long pfn;
diff --git a/arch/mips/ath79/pci.c b/arch/mips/ath79/pci.c
index 730c0b03060d..b816cb4a25ff 100644
--- a/arch/mips/ath79/pci.c
+++ b/arch/mips/ath79/pci.c
@@ -22,10 +22,10 @@
 #include "pci.h"
 
 static int (*ath79_pci_plat_dev_init)(struct pci_dev *dev);
-static const struct ath79_pci_irq *ath79_pci_irq_map __initdata;
-static unsigned ath79_pci_nr_irqs __initdata;
+static const struct ath79_pci_irq *ath79_pci_irq_map;
+static unsigned ath79_pci_nr_irqs;
 
-static const struct ath79_pci_irq ar71xx_pci_irq_map[] __initconst = {
+static const struct ath79_pci_irq ar71xx_pci_irq_map[] = {
         {
                 .slot   = 17,
                 .pin    = 1,
@@ -41,7 +41,7 @@ static const struct ath79_pci_irq ar71xx_pci_irq_map[] __initconst = {
         }
 };
 
-static const struct ath79_pci_irq ar724x_pci_irq_map[] __initconst = {
+static const struct ath79_pci_irq ar724x_pci_irq_map[] = {
         {
                 .slot   = 0,
                 .pin    = 1,
@@ -49,7 +49,7 @@ static const struct ath79_pci_irq ar724x_pci_irq_map[] __initconst = {
         }
 };
 
-static const struct ath79_pci_irq qca955x_pci_irq_map[] __initconst = {
+static const struct ath79_pci_irq qca955x_pci_irq_map[] = {
         {
                 .bus    = 0,
                 .slot   = 0,
@@ -64,7 +64,7 @@ static const struct ath79_pci_irq qca955x_pci_irq_map[] __initconst = {
         },
 };
 
-int __init pcibios_map_irq(const struct pci_dev *dev, uint8_t slot, uint8_t pin)
+int pcibios_map_irq(const struct pci_dev *dev, uint8_t slot, uint8_t pin)
 {
         int irq = -1;
         int i;
diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
index e4ed1bc9a734..a6810923b3f0 100644
--- a/arch/mips/include/asm/mipsregs.h
+++ b/arch/mips/include/asm/mipsregs.h
@@ -1377,29 +1377,32 @@ do {									\
 
 #define __write_64bit_c0_split(source, sel, val)                        \
 do {                                                                    \
+        unsigned long long __tmp;                                       \
         unsigned long __flags;                                          \
                                                                         \
         local_irq_save(__flags);                                        \
         if (sel == 0)                                                   \
                 __asm__ __volatile__(                                   \
                         ".set\tmips64\n\t"                              \
-                        "dsll\t%L0, %L0, 32\n\t"                        \
+                        "dsll\t%L0, %L1, 32\n\t"                        \
                         "dsrl\t%L0, %L0, 32\n\t"                        \
-                        "dsll\t%M0, %M0, 32\n\t"                        \
+                        "dsll\t%M0, %M1, 32\n\t"                        \
                         "or\t%L0, %L0, %M0\n\t"                         \
                         "dmtc0\t%L0, " #source "\n\t"                   \
                         ".set\tmips0"                                   \
-                        : : "r" (val));                                 \
+                        : "=&r,r" (__tmp)                               \
+                        : "r,0" (val));                                 \
         else                                                            \
                 __asm__ __volatile__(                                   \
                         ".set\tmips64\n\t"                              \
-                        "dsll\t%L0, %L0, 32\n\t"                        \
+                        "dsll\t%L0, %L1, 32\n\t"                        \
                         "dsrl\t%L0, %L0, 32\n\t"                        \
-                        "dsll\t%M0, %M0, 32\n\t"                        \
+                        "dsll\t%M0, %M1, 32\n\t"                        \
                         "or\t%L0, %L0, %M0\n\t"                         \
                         "dmtc0\t%L0, " #source ", " #sel "\n\t"         \
                         ".set\tmips0"                                   \
-                        : : "r" (val));                                 \
+                        : "=&r,r" (__tmp)                               \
+                        : "r,0" (val));                                 \
         local_irq_restore(__flags);                                     \
 } while (0)
 
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 9e6c74bf66c4..6668f67a61c3 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -618,8 +618,7 @@ static int mipspmu_event_init(struct perf_event *event)
                 return -ENOENT;
         }
 
-        if ((unsigned int)event->cpu >= nr_cpumask_bits ||
-            (event->cpu >= 0 && !cpu_online(event->cpu)))
+        if (event->cpu >= 0 && !cpu_online(event->cpu))
                 return -ENODEV;
 
         if (!atomic_inc_not_zero(&active_events)) {
diff --git a/arch/mips/pci/fixup-capcella.c b/arch/mips/pci/fixup-capcella.c
index 1c02f5737367..b4c263f16b15 100644
--- a/arch/mips/pci/fixup-capcella.c
+++ b/arch/mips/pci/fixup-capcella.c
@@ -32,13 +32,13 @@
 #define INTC    PC104PLUS_INTC_IRQ
 #define INTD    PC104PLUS_INTD_IRQ
 
-static char irq_tab_capcella[][5] __initdata = {
+static char irq_tab_capcella[][5] = {
  [11] = { -1, INT1, INT1, INT1, INT1 },
  [12] = { -1, INT2, INT2, INT2, INT2 },
  [14] = { -1, INTA, INTB, INTC, INTD }
 };
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return irq_tab_capcella[slot][pin];
 }
diff --git a/arch/mips/pci/fixup-cobalt.c b/arch/mips/pci/fixup-cobalt.c
index b3ab59318d91..44be65c3e6bb 100644
--- a/arch/mips/pci/fixup-cobalt.c
+++ b/arch/mips/pci/fixup-cobalt.c
@@ -147,7 +147,7 @@ static void qube_raq_via_board_id_fixup(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_0,
          qube_raq_via_board_id_fixup);
 
-static char irq_tab_qube1[] __initdata = {
+static char irq_tab_qube1[] = {
   [COBALT_PCICONF_CPU]     = 0,
   [COBALT_PCICONF_ETH0]    = QUBE1_ETH0_IRQ,
   [COBALT_PCICONF_RAQSCSI] = SCSI_IRQ,
@@ -156,7 +156,7 @@ static char irq_tab_qube1[] __initdata = {
   [COBALT_PCICONF_ETH1]    = 0
 };
 
-static char irq_tab_cobalt[] __initdata = {
+static char irq_tab_cobalt[] = {
   [COBALT_PCICONF_CPU]     = 0,
   [COBALT_PCICONF_ETH0]    = ETH0_IRQ,
   [COBALT_PCICONF_RAQSCSI] = SCSI_IRQ,
@@ -165,7 +165,7 @@ static char irq_tab_cobalt[] __initdata = {
   [COBALT_PCICONF_ETH1]    = ETH1_IRQ
 };
 
-static char irq_tab_raq2[] __initdata = {
+static char irq_tab_raq2[] = {
   [COBALT_PCICONF_CPU]     = 0,
   [COBALT_PCICONF_ETH0]    = ETH0_IRQ,
   [COBALT_PCICONF_RAQSCSI] = RAQ2_SCSI_IRQ,
@@ -174,7 +174,7 @@ static char irq_tab_raq2[] __initdata = {
   [COBALT_PCICONF_ETH1]    = ETH1_IRQ
 };
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         if (cobalt_board_id <= COBALT_BRD_ID_QUBE1)
                 return irq_tab_qube1[slot];
diff --git a/arch/mips/pci/fixup-emma2rh.c b/arch/mips/pci/fixup-emma2rh.c
index 19caf775c206..c31cb6af1cd0 100644
--- a/arch/mips/pci/fixup-emma2rh.c
+++ b/arch/mips/pci/fixup-emma2rh.c
@@ -43,7 +43,7 @@
  */
 
 #define MAX_SLOT_NUM 10
-static unsigned char irq_map[][5] __initdata = {
+static unsigned char irq_map[][5] = {
         [3] = {0, MARKEINS_PCI_IRQ_INTB, MARKEINS_PCI_IRQ_INTC,
                MARKEINS_PCI_IRQ_INTD, 0,},
         [4] = {0, MARKEINS_PCI_IRQ_INTA, 0, 0, 0,},
@@ -85,7 +85,7 @@ static void emma2rh_pci_host_fixup(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NEC, PCI_DEVICE_ID_NEC_EMMA2RH,
                          emma2rh_pci_host_fixup);
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return irq_map[slot][pin];
 }
diff --git a/arch/mips/pci/fixup-fuloong2e.c b/arch/mips/pci/fixup-fuloong2e.c
index 50da773faede..b47c2771dc99 100644
--- a/arch/mips/pci/fixup-fuloong2e.c
+++ b/arch/mips/pci/fixup-fuloong2e.c
@@ -19,7 +19,7 @@
 /* South bridge slot number is set by the pci probe process */
 static u8 sb_slot = 5;
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq = 0;
 
diff --git a/arch/mips/pci/fixup-ip32.c b/arch/mips/pci/fixup-ip32.c
index 133685e215ee..c6ec18a07e63 100644
--- a/arch/mips/pci/fixup-ip32.c
+++ b/arch/mips/pci/fixup-ip32.c
@@ -21,7 +21,7 @@
 #define INTB   MACEPCI_SHARED0_IRQ
 #define INTC   MACEPCI_SHARED1_IRQ
 #define INTD   MACEPCI_SHARED2_IRQ
-static char irq_tab_mace[][5] __initdata = {
+static char irq_tab_mace[][5] = {
       /* Dummy  INT#A  INT#B  INT#C  INT#D */
         {0,         0,     0,     0,     0}, /* This is placeholder row - never used */
         {0,     SCSI0, SCSI0, SCSI0, SCSI0},
@@ -39,7 +39,7 @@ static char irq_tab_mace[][5] __initdata = {
  * irqs.  I suppose a device without a pin A will thank us for doing it
  * right if there exists such a broken piece of crap.
  */
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return irq_tab_mace[slot][pin];
 }
diff --git a/arch/mips/pci/fixup-jmr3927.c b/arch/mips/pci/fixup-jmr3927.c
index 0f1069527cba..d3102eeea898 100644
--- a/arch/mips/pci/fixup-jmr3927.c
+++ b/arch/mips/pci/fixup-jmr3927.c
@@ -31,7 +31,7 @@
 #include <asm/txx9/pci.h>
 #include <asm/txx9/jmr3927.h>
 
-int __init jmr3927_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int jmr3927_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         unsigned char irq = pin;
 
diff --git a/arch/mips/pci/fixup-lantiq.c b/arch/mips/pci/fixup-lantiq.c
index 2b5427d3f35c..81530a13b349 100644
--- a/arch/mips/pci/fixup-lantiq.c
+++ b/arch/mips/pci/fixup-lantiq.c
@@ -23,7 +23,7 @@ int pcibios_plat_dev_init(struct pci_dev *dev)
         return 0;
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return of_irq_parse_and_map_pci(dev, slot, pin);
 }
diff --git a/arch/mips/pci/fixup-lemote2f.c b/arch/mips/pci/fixup-lemote2f.c
index 95ab9a1bd010..20cdfdc08938 100644
--- a/arch/mips/pci/fixup-lemote2f.c
+++ b/arch/mips/pci/fixup-lemote2f.c
@@ -30,7 +30,7 @@
 #define PCID            7
 
 /* all the pci device has the PCIA pin, check the datasheet. */
-static char irq_tab[][5] __initdata = {
+static char irq_tab[][5] = {
         /*      INTA    INTB    INTC    INTD */
         {0, 0, 0, 0, 0},        /*  11: Unused */
         {0, 0, 0, 0, 0},        /*  12: Unused */
@@ -51,7 +51,7 @@ static char irq_tab[][5] __initdata = {
         {0, 0, 0, 0, 0},        /*  27: Unused */
 };
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int virq;
 
diff --git a/arch/mips/pci/fixup-loongson3.c b/arch/mips/pci/fixup-loongson3.c
index 2b6d5e196f99..8a741c2c6685 100644
--- a/arch/mips/pci/fixup-loongson3.c
+++ b/arch/mips/pci/fixup-loongson3.c
@@ -32,7 +32,7 @@ static void print_fixup_info(const struct pci_dev *pdev)
                         pdev->vendor, pdev->device, pdev->irq);
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         print_fixup_info(dev);
         return dev->irq;
diff --git a/arch/mips/pci/fixup-malta.c b/arch/mips/pci/fixup-malta.c
index 40e920c653cc..3ec85331795e 100644
--- a/arch/mips/pci/fixup-malta.c
+++ b/arch/mips/pci/fixup-malta.c
@@ -12,7 +12,7 @@
 static char pci_irq[5] = {
 };
 
-static char irq_tab[][5] __initdata = {
+static char irq_tab[][5] = {
         /*      INTA    INTB    INTC    INTD */
         {0,     0,      0,      0,      0 },    /*  0: GT64120 PCI bridge */
         {0,     0,      0,      0,      0 },    /*  1: Unused */
@@ -38,7 +38,7 @@ static char irq_tab[][5] __initdata = {
         {0,     PCID,   PCIA,   PCIB,   PCIC }  /* 21: PCI Slot 4 */
 };
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int virq;
         virq = irq_tab[slot][pin];
diff --git a/arch/mips/pci/fixup-mpc30x.c b/arch/mips/pci/fixup-mpc30x.c
index 8e4f8288eca2..66eaf456bc89 100644
--- a/arch/mips/pci/fixup-mpc30x.c
+++ b/arch/mips/pci/fixup-mpc30x.c
@@ -22,19 +22,19 @@
 
 #include <asm/vr41xx/mpc30x.h>
 
-static const int internal_func_irqs[] __initconst = {
+static const int internal_func_irqs[] = {
         VRC4173_CASCADE_IRQ,
         VRC4173_AC97_IRQ,
         VRC4173_USB_IRQ,
 };
 
-static const int irq_tab_mpc30x[] __initconst = {
+static const int irq_tab_mpc30x[] = {
  [12] = VRC4173_PCMCIA1_IRQ,
  [13] = VRC4173_PCMCIA2_IRQ,
  [29] = MQ200_IRQ,
 };
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         if (slot == 30)
                 return internal_func_irqs[PCI_FUNC(dev->devfn)];
diff --git a/arch/mips/pci/fixup-pmcmsp.c b/arch/mips/pci/fixup-pmcmsp.c
index fab405c21c2f..4ad2ef02087b 100644
--- a/arch/mips/pci/fixup-pmcmsp.c
+++ b/arch/mips/pci/fixup-pmcmsp.c
@@ -47,7 +47,7 @@
 
 #if defined(CONFIG_PMC_MSP7120_GW)
 /* Garibaldi Board IRQ wiring to PCI slots */
-static char irq_tab[][5] __initdata = {
+static char irq_tab[][5] = {
         /* INTA    INTB    INTC    INTD */
         {0,     0,      0,      0,      0 },    /*    (AD[0]): Unused */
         {0,     0,      0,      0,      0 },    /*    (AD[1]): Unused */
@@ -86,7 +86,7 @@ static char irq_tab[][5] __initdata = {
 #elif defined(CONFIG_PMC_MSP7120_EVAL)
 
 /* MSP7120 Eval Board IRQ wiring to PCI slots */
-static char irq_tab[][5] __initdata = {
+static char irq_tab[][5] = {
         /* INTA    INTB    INTC    INTD */
         {0,     0,      0,      0,      0 },    /*    (AD[0]): Unused */
         {0,     0,      0,      0,      0 },    /*    (AD[1]): Unused */
@@ -125,7 +125,7 @@ static char irq_tab[][5] __initdata = {
 #else
 
 /* Unknown board -- don't assign any IRQs */
-static char irq_tab[][5] __initdata = {
+static char irq_tab[][5] = {
         /* INTA    INTB    INTC    INTD */
         {0,     0,      0,      0,      0 },    /*    (AD[0]): Unused */
         {0,     0,      0,      0,      0 },    /*    (AD[1]): Unused */
@@ -202,7 +202,7 @@ int pcibios_plat_dev_init(struct pci_dev *dev)
  *  RETURNS:     IRQ number
  *
  ****************************************************************************/
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
 #if !defined(CONFIG_PMC_MSP7120_GW) && !defined(CONFIG_PMC_MSP7120_EVAL)
         printk(KERN_WARNING "PCI: unknown board, no PCI IRQs assigned.\n");
diff --git a/arch/mips/pci/fixup-rbtx4927.c b/arch/mips/pci/fixup-rbtx4927.c
index 321db265829c..d6aaed1d6be9 100644
--- a/arch/mips/pci/fixup-rbtx4927.c
+++ b/arch/mips/pci/fixup-rbtx4927.c
@@ -36,7 +36,7 @@
 #include <asm/txx9/pci.h>
 #include <asm/txx9/rbtx4927.h>
 
-int __init rbtx4927_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int rbtx4927_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         unsigned char irq = pin;
 
diff --git a/arch/mips/pci/fixup-rbtx4938.c b/arch/mips/pci/fixup-rbtx4938.c
index a80579af609b..ff22a22db73e 100644
--- a/arch/mips/pci/fixup-rbtx4938.c
+++ b/arch/mips/pci/fixup-rbtx4938.c
@@ -13,7 +13,7 @@
 #include <asm/txx9/pci.h>
 #include <asm/txx9/rbtx4938.h>
 
-int __init rbtx4938_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int rbtx4938_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq = tx4938_pcic1_map_irq(dev, slot);
 
diff --git a/arch/mips/pci/fixup-sni.c b/arch/mips/pci/fixup-sni.c
index f67ebeeb4200..adb9a58641e8 100644
--- a/arch/mips/pci/fixup-sni.c
+++ b/arch/mips/pci/fixup-sni.c
@@ -40,7 +40,7 @@
  * seem to be a documentation error.  At least on my RM200C the Cirrus
  * Logic CL-GD5434 VGA is device 3.
  */
-static char irq_tab_rm200[8][5] __initdata = {
+static char irq_tab_rm200[8][5] = {
         /*       INTA  INTB  INTC  INTD */
         {     0,    0,    0,    0,    0 },      /* EISA bridge */
         {  SCSI, SCSI, SCSI, SCSI, SCSI },      /* SCSI */
@@ -57,7 +57,7 @@ static char irq_tab_rm200[8][5] __initdata = {
  *
  * The VGA card is optional for RM300 systems.
  */
-static char irq_tab_rm300d[8][5] __initdata = {
+static char irq_tab_rm300d[8][5] = {
         /*       INTA  INTB  INTC  INTD */
         {     0,    0,    0,    0,    0 },      /* EISA bridge */
         {  SCSI, SCSI, SCSI, SCSI, SCSI },      /* SCSI */
@@ -69,7 +69,7 @@ static char irq_tab_rm300d[8][5] __initdata = {
         {     0, INTD, INTA, INTB, INTC },      /* Slot 4 */
 };
 
-static char irq_tab_rm300e[5][5] __initdata = {
+static char irq_tab_rm300e[5][5] = {
         /*       INTA  INTB  INTC  INTD */
         {     0,    0,    0,    0,    0 },      /* HOST bridge */
         {  SCSI, SCSI, SCSI, SCSI, SCSI },      /* SCSI */
@@ -96,7 +96,7 @@ static char irq_tab_rm300e[5][5] __initdata = {
 #define INTC    PCIT_IRQ_INTC
 #define INTD    PCIT_IRQ_INTD
 
-static char irq_tab_pcit[13][5] __initdata = {
+static char irq_tab_pcit[13][5] = {
         /*       INTA  INTB  INTC  INTD */
         {     0,     0,     0,     0,     0 },  /* HOST bridge */
         { SCSI0, SCSI0, SCSI0, SCSI0, SCSI0 },  /* SCSI */
@@ -113,7 +113,7 @@ static char irq_tab_pcit[13][5] __initdata = {
         {     0,  INTA,  INTB,  INTC,  INTD },  /* Slot 5 */
 };
 
-static char irq_tab_pcit_cplus[13][5] __initdata = {
+static char irq_tab_pcit_cplus[13][5] = {
         /*       INTA  INTB  INTC  INTD */
         {     0,     0,     0,     0,     0 },  /* HOST bridge */
         {     0,  INTB,  INTC,  INTD,  INTA },  /* PCI Slot 9 */
@@ -130,7 +130,7 @@ static inline int is_rm300_revd(void)
         return (csmsr & 0xa0) == 0x20;
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         switch (sni_brd_type) {
         case SNI_BRD_PCI_TOWER_CPLUS:
diff --git a/arch/mips/pci/fixup-tb0219.c b/arch/mips/pci/fixup-tb0219.c
index d0b0083fbd27..cc581535f257 100644
--- a/arch/mips/pci/fixup-tb0219.c
+++ b/arch/mips/pci/fixup-tb0219.c
@@ -23,7 +23,7 @@
 
 #include <asm/vr41xx/tb0219.h>
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq = -1;
 
diff --git a/arch/mips/pci/fixup-tb0226.c b/arch/mips/pci/fixup-tb0226.c
index 4196ccf3ea3d..b827b5cad5fd 100644
--- a/arch/mips/pci/fixup-tb0226.c
+++ b/arch/mips/pci/fixup-tb0226.c
@@ -23,7 +23,7 @@
 #include <asm/vr41xx/giu.h>
 #include <asm/vr41xx/tb0226.h>
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq = -1;
 
diff --git a/arch/mips/pci/fixup-tb0287.c b/arch/mips/pci/fixup-tb0287.c
index 8c5039ed75d7..98f26285f2e3 100644
--- a/arch/mips/pci/fixup-tb0287.c
+++ b/arch/mips/pci/fixup-tb0287.c
@@ -22,7 +22,7 @@
 
 #include <asm/vr41xx/tb0287.h>
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         unsigned char bus;
         int irq = -1;
diff --git a/arch/mips/pci/pci-alchemy.c b/arch/mips/pci/pci-alchemy.c
index e99ca7702d8a..f15ec98de2de 100644
--- a/arch/mips/pci/pci-alchemy.c
+++ b/arch/mips/pci/pci-alchemy.c
@@ -522,7 +522,7 @@ static int __init alchemy_pci_init(void)
 arch_initcall(alchemy_pci_init);
 
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         struct alchemy_pci_context *ctx = dev->sysdata;
         if (ctx && ctx->board_map_irq)
diff --git a/arch/mips/pci/pci-bcm47xx.c b/arch/mips/pci/pci-bcm47xx.c
index 76f16eaed0ad..230d7dd273e2 100644
--- a/arch/mips/pci/pci-bcm47xx.c
+++ b/arch/mips/pci/pci-bcm47xx.c
@@ -28,7 +28,7 @@
 #include <linux/bcma/bcma.h>
 #include <bcm47xx.h>
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return 0;
 }
diff --git a/arch/mips/pci/pci-lasat.c b/arch/mips/pci/pci-lasat.c
index 40d2797d2bc4..47f4ee6bbb3b 100644
--- a/arch/mips/pci/pci-lasat.c
+++ b/arch/mips/pci/pci-lasat.c
@@ -61,7 +61,7 @@ arch_initcall(lasat_pci_setup);
 #define LASAT_IRQ_PCIC   (LASAT_IRQ_BASE + 7)
 #define LASAT_IRQ_PCID   (LASAT_IRQ_BASE + 8)
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         switch (slot) {
         case 1:
diff --git a/arch/mips/pci/pci-mt7620.c b/arch/mips/pci/pci-mt7620.c
index 4e633c1e7ff3..90fba9bf98da 100644
--- a/arch/mips/pci/pci-mt7620.c
+++ b/arch/mips/pci/pci-mt7620.c
@@ -361,7 +361,7 @@ static int mt7620_pci_probe(struct platform_device *pdev)
         return 0;
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         u16 cmd;
         u32 val;
diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
index 9ee01936862e..3e92a06fa772 100644
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
@@ -59,8 +59,7 @@ union octeon_pci_address {
         } s;
 };
 
-int __initconst (*octeon_pcibios_map_irq)(const struct pci_dev *dev,
-                                         u8 slot, u8 pin);
+int (*octeon_pcibios_map_irq)(const struct pci_dev *dev, u8 slot, u8 pin);
 enum octeon_dma_bar_type octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_INVALID;
 
 /**
@@ -74,7 +73,7 @@ enum octeon_dma_bar_type octeon_dma_bar_type = OCTEON_DMA_BAR_TYPE_INVALID;
  *               as it goes through each bridge.
  * Returns Interrupt number for the device
  */
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         if (octeon_pcibios_map_irq)
                 return octeon_pcibios_map_irq(dev, slot, pin);
diff --git a/arch/mips/pci/pci-rt2880.c b/arch/mips/pci/pci-rt2880.c
index d6360fe73d05..711cdccdf65b 100644
--- a/arch/mips/pci/pci-rt2880.c
+++ b/arch/mips/pci/pci-rt2880.c
@@ -181,7 +181,7 @@ static inline void rt2880_pci_write_u32(unsigned long reg, u32 val)
         spin_unlock_irqrestore(&rt2880_pci_lock, flags);
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         u16 cmd;
         int irq = -1;
diff --git a/arch/mips/pci/pci-rt3883.c b/arch/mips/pci/pci-rt3883.c
index 04f8ea953297..958899ffe99c 100644
--- a/arch/mips/pci/pci-rt3883.c
+++ b/arch/mips/pci/pci-rt3883.c
@@ -564,7 +564,7 @@ err_put_intc_node:
         return err;
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return of_irq_parse_and_map_pci(dev, slot, pin);
 }
diff --git a/arch/mips/pci/pci-tx4938.c b/arch/mips/pci/pci-tx4938.c
index 000c0e1f9ef8..a6418460e3c4 100644
--- a/arch/mips/pci/pci-tx4938.c
+++ b/arch/mips/pci/pci-tx4938.c
@@ -112,7 +112,7 @@ int __init tx4938_pciclk66_setup(void)
         return pciclk;
 }
 
-int __init tx4938_pcic1_map_irq(const struct pci_dev *dev, u8 slot)
+int tx4938_pcic1_map_irq(const struct pci_dev *dev, u8 slot)
 {
         if (get_tx4927_pcicptr(dev->bus->sysdata) == tx4938_pcic1ptr) {
                 switch (slot) {
diff --git a/arch/mips/pci/pci-tx4939.c b/arch/mips/pci/pci-tx4939.c
index 9d6acc00f348..09a65f7dbe7c 100644
--- a/arch/mips/pci/pci-tx4939.c
+++ b/arch/mips/pci/pci-tx4939.c
@@ -48,7 +48,7 @@ void __init tx4939_report_pci1clk(void)
                 ((pciclk + 50000) / 100000) % 10);
 }
 
-int __init tx4939_pcic1_map_irq(const struct pci_dev *dev, u8 slot)
+int tx4939_pcic1_map_irq(const struct pci_dev *dev, u8 slot)
 {
         if (get_tx4927_pcicptr(dev->bus->sysdata) == tx4939_pcic1ptr) {
                 switch (slot) {
@@ -68,7 +68,7 @@ int __init tx4939_pcic1_map_irq(const struct pci_dev *dev, u8 slot)
         return -1;
 }
 
-int __init tx4939_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int tx4939_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         int irq = tx4939_pcic1_map_irq(dev, slot);
 
diff --git a/arch/mips/pci/pci-xlp.c b/arch/mips/pci/pci-xlp.c
index 7babf01600cb..9eff9137f78e 100644
--- a/arch/mips/pci/pci-xlp.c
+++ b/arch/mips/pci/pci-xlp.c
@@ -205,7 +205,7 @@ int xlp_socdev_to_node(const struct pci_dev *lnkdev)
                 return PCI_SLOT(lnkdev->devfn) / 8;
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         struct pci_dev *lnkdev;
         int lnkfunc, node;
diff --git a/arch/mips/pci/pci-xlr.c b/arch/mips/pci/pci-xlr.c
index 26d2dabef281..2a1c81a129ba 100644
--- a/arch/mips/pci/pci-xlr.c
+++ b/arch/mips/pci/pci-xlr.c
@@ -315,7 +315,7 @@ static void xls_pcie_ack_b(struct irq_data *d)
         }
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         return get_irq_vector(dev);
 }
diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
index ad3584dbc9d7..fd2887415bc8 100644
--- a/arch/mips/pci/pcie-octeon.c
+++ b/arch/mips/pci/pcie-octeon.c
@@ -1464,8 +1464,7 @@ static int cvmx_pcie_rc_initialize(int pcie_port)
  *               as it goes through each bridge.
  * Returns Interrupt number for the device
  */
-int __init octeon_pcie_pcibios_map_irq(const struct pci_dev *dev,
-                                       u8 slot, u8 pin)
+int octeon_pcie_pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
         /*
          * The EBH5600 board with the PCI to PCIe bridge mistakenly
diff --git a/arch/mips/pmcs-msp71xx/msp_smp.c b/arch/mips/pmcs-msp71xx/msp_smp.c
index ffa0f7101a97..2b08242ade62 100644
--- a/arch/mips/pmcs-msp71xx/msp_smp.c
+++ b/arch/mips/pmcs-msp71xx/msp_smp.c
@@ -22,6 +22,8 @@
 #include <linux/smp.h>
 #include <linux/interrupt.h>
 
+#include <asm/setup.h>
+
 #ifdef CONFIG_MIPS_MT_SMP
 #define MIPS_CPU_IPI_RESCHED_IRQ 0      /* SW int 0 for resched */
 #define MIPS_CPU_IPI_CALL_IRQ 1         /* SW int 1 for call */
diff --git a/arch/mips/txx9/generic/pci.c b/arch/mips/txx9/generic/pci.c
index 0bd2a1e1ff9a..fb998726bd5d 100644
--- a/arch/mips/txx9/generic/pci.c
+++ b/arch/mips/txx9/generic/pci.c
@@ -386,9 +386,10 @@ int pcibios_plat_dev_init(struct pci_dev *dev)
         return 0;
 }
 
-int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+static int (*txx9_pci_map_irq)(const struct pci_dev *dev, u8 slot, u8 pin);
+int pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
-        return txx9_board_vec->pci_map_irq(dev, slot, pin);
+        return txx9_pci_map_irq(dev, slot, pin);
 }
 
 char * (*txx9_board_pcibios_setup)(char *str) __initdata;
@@ -424,5 +425,8 @@ char *__init txx9_pcibios_setup(char *str)
                         txx9_pci_err_action = TXX9_PCI_ERR_IGNORE;
                 return NULL;
         }
+
+        txx9_pci_map_irq = txx9_board_vec->pci_map_irq;
+
         return str;
 }
diff --git a/arch/mn10300/kernel/process.c b/arch/mn10300/kernel/process.c
index 89e8027e07fb..7c475fd99c46 100644
--- a/arch/mn10300/kernel/process.c
+++ b/arch/mn10300/kernel/process.c
@@ -59,10 +59,6 @@ void arch_cpu_idle(void)
 }
 #endif
 
-void release_segments(struct mm_struct *mm)
-{
-}
-
 void machine_restart(char *cmd)
 {
 #ifdef CONFIG_KERNEL_DEBUGGER
@@ -113,14 +109,6 @@ void release_thread(struct task_struct *dead_task)
 }
 
 /*
- * we do not have to muck with descriptors here, that is
- * done in switch_mm() as needed.
- */
-void copy_segments(struct task_struct *p, struct mm_struct *new_mm)
-{
-}
-
-/*
  * this gets called so that we can store lazy state into memory and copy the
  * current task into the new thread.
  */
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index ba7b7ddc3844..a57dedbfc7b7 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -257,6 +257,18 @@ config PARISC_PAGE_SIZE_64KB
 
 endchoice
 
+config PARISC_SELF_EXTRACT
+        bool "Build kernel as self-extracting executable"
+        default y
+        help
+          Say Y if you want to build the parisc kernel as a kind of
+          self-extracting executable.
+
+          If you say N here, the kernel will be compressed with gzip
+          which can be loaded by the palo bootloader directly too.
+
+          If you don't know what to do here, say Y.
+
 config SMP
         bool "Symmetric multi-processing support"
         ---help---
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index 58fae5d2449d..01946ebaff72 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -129,8 +129,13 @@ Image: vmlinux
 bzImage: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
+ifdef CONFIG_PARISC_SELF_EXTRACT
 vmlinuz: bzImage
         $(OBJCOPY) $(boot)/bzImage $@
+else
+vmlinuz: vmlinux
+        @gzip -cf -9 $< > $@
+endif
 
 install:
         $(CONFIG_SHELL) $(src)/arch/parisc/install.sh \
diff --git a/arch/parisc/boot/compressed/Makefile b/arch/parisc/boot/compressed/Makefile
index 5450a11c9d10..7d7e594bda36 100644
--- a/arch/parisc/boot/compressed/Makefile
+++ b/arch/parisc/boot/compressed/Makefile
@@ -15,7 +15,7 @@ targets += misc.o piggy.o sizes.h head.o real2.o firmware.o
 KBUILD_CFLAGS := -D__KERNEL__ -O2 -DBOOTLOADER
 KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
 KBUILD_CFLAGS += $(cflags-y) -fno-delete-null-pointer-checks
-KBUILD_CFLAGS += -fno-PIE -mno-space-regs -mdisable-fpregs
+KBUILD_CFLAGS += -fno-PIE -mno-space-regs -mdisable-fpregs -Os
 ifndef CONFIG_64BIT
 KBUILD_CFLAGS += -mfast-indirect-calls
 endif
diff --git a/arch/parisc/boot/compressed/misc.c b/arch/parisc/boot/compressed/misc.c
index 13a4bf9ac4da..9345b44b86f0 100644
--- a/arch/parisc/boot/compressed/misc.c
+++ b/arch/parisc/boot/compressed/misc.c
@@ -24,7 +24,8 @@
 /* Symbols defined by linker scripts */
 extern char input_data[];
 extern int input_len;
-extern __le32 output_len;       /* at unaligned address, little-endian */
+/* output_len is inserted by the linker possibly at an unaligned address */
+extern __le32 output_len __aligned(1);
 extern char _text, _end;
 extern char _bss, _ebss;
 extern char _startcode_end;
diff --git a/arch/parisc/include/asm/pdc.h b/arch/parisc/include/asm/pdc.h
index 26b4455baa83..510341f62d97 100644
--- a/arch/parisc/include/asm/pdc.h
+++ b/arch/parisc/include/asm/pdc.h
@@ -280,6 +280,7 @@ void setup_pdc(void);		/* in inventory.c */
 /* wrapper-functions from pdc.c */
 
 int pdc_add_valid(unsigned long address);
+int pdc_instr(unsigned int *instr);
 int pdc_chassis_info(struct pdc_chassis_info *chassis_info, void *led_info, unsigned long len);
 int pdc_chassis_disp(unsigned long disp);
 int pdc_chassis_warn(unsigned long *warn);
diff --git a/arch/parisc/include/asm/smp.h b/arch/parisc/include/asm/smp.h
index a5dc9066c6d8..ad9c9c3b4136 100644
--- a/arch/parisc/include/asm/smp.h
+++ b/arch/parisc/include/asm/smp.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SMP_H
 #define __ASM_SMP_H
 
+extern int init_per_cpu(int cpuid);
 
 #if defined(CONFIG_SMP)
 
diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
index ab80e5c6f651..6d471c00c71a 100644
--- a/arch/parisc/kernel/firmware.c
+++ b/arch/parisc/kernel/firmware.c
@@ -233,6 +233,26 @@ int pdc_add_valid(unsigned long address)
 EXPORT_SYMBOL(pdc_add_valid);
 
 /**
+ * pdc_instr - Get instruction that invokes PDCE_CHECK in HPMC handler.
+ * @instr: Pointer to variable which will get instruction opcode.
+ *
+ * The return value is PDC_OK (0) in case call succeeded.
+ */
+int __init pdc_instr(unsigned int *instr)
+{
+        int retval;
+        unsigned long flags;
+
+        spin_lock_irqsave(&pdc_lock, flags);
+        retval = mem_pdc_call(PDC_INSTR, 0UL, __pa(pdc_result));
+        convert_to_wide(pdc_result);
+        *instr = pdc_result[0];
+        spin_unlock_irqrestore(&pdc_lock, flags);
+
+        return retval;
+}
+
+/**
  * pdc_chassis_info - Return chassis information.
  * @result: The return buffer.
  * @chassis_info: The memory buffer address.
diff --git a/arch/parisc/kernel/pdt.c b/arch/parisc/kernel/pdt.c
index 05730a83895c..00aed082969b 100644
--- a/arch/parisc/kernel/pdt.c
+++ b/arch/parisc/kernel/pdt.c
@@ -15,6 +15,7 @@
 #include <linux/memblock.h>
 #include <linux/seq_file.h>
 #include <linux/kthread.h>
+#include <linux/initrd.h>
 
 #include <asm/pdc.h>
 #include <asm/pdcpat.h>
@@ -216,8 +217,16 @@ void __init pdc_pdt_init(void)
         }
 
         for (i = 0; i < pdt_status.pdt_entries; i++) {
+                unsigned long addr;
+
                 report_mem_err(pdt_entry[i]);
 
+                addr = pdt_entry[i] & PDT_ADDR_PHYS_MASK;
+                if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) &&
+                        addr >= initrd_start && addr < initrd_end)
+                        pr_crit("CRITICAL: initrd possibly broken "
+                                "due to bad memory!\n");
+
                 /* mark memory page bad */
                 memblock_reserve(pdt_entry[i] & PAGE_MASK, PAGE_SIZE);
         }
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index a45a67d526f8..30f92391a93e 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -146,7 +146,7 @@ void machine_power_off(void)
 
         /* prevent soft lockup/stalled CPU messages for endless loop. */
         rcu_sysrq_start();
-        lockup_detector_suspend();
+        lockup_detector_soft_poweroff();
         for (;;);
 }
 
diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
index a778bd3c107c..e120d63c1b28 100644
--- a/arch/parisc/kernel/processor.c
+++ b/arch/parisc/kernel/processor.c
@@ -317,7 +317,7 @@ void __init collect_boot_cpu_data(void)
  *
  * o Enable CPU profiling hooks.
  */
-int init_per_cpu(int cpunum)
+int __init init_per_cpu(int cpunum)
 {
         int ret;
         struct pdc_coproc_cfg coproc_cfg;
diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
index dee6f9d6a153..f7d0c3b33d70 100644
--- a/arch/parisc/kernel/setup.c
+++ b/arch/parisc/kernel/setup.c
@@ -38,6 +38,7 @@
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/sched/clock.h>
+#include <linux/start_kernel.h>
 
 #include <asm/processor.h>
 #include <asm/sections.h>
@@ -48,6 +49,7 @@
 #include <asm/io.h>
 #include <asm/setup.h>
 #include <asm/unwind.h>
+#include <asm/smp.h>
 
 static char __initdata command_line[COMMAND_LINE_SIZE];
 
@@ -115,7 +117,6 @@ void __init dma_ops_init(void)
 }
 #endif
 
-extern int init_per_cpu(int cpuid);
 extern void collect_boot_cpu_data(void);
 
 void __init setup_arch(char **cmdline_p)
@@ -398,9 +399,8 @@ static int __init parisc_init(void)
 }
 arch_initcall(parisc_init);
 
-void start_parisc(void)
+void __init start_parisc(void)
 {
-        extern void start_kernel(void);
         extern void early_trap_init(void);
 
         int ret, cpunum;
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 63365106ea19..30c28ab14540 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -255,12 +255,11 @@ void arch_send_call_function_single_ipi(int cpu)
 static void __init
 smp_cpu_init(int cpunum)
 {
-        extern int init_per_cpu(int);  /* arch/parisc/kernel/processor.c */
         extern void init_IRQ(void);    /* arch/parisc/kernel/irq.c */
         extern void start_cpu_itimer(void); /* arch/parisc/kernel/time.c */
 
         /* Set modes and Enable floating point coprocessor */
-        (void) init_per_cpu(cpunum);
+        init_per_cpu(cpunum);
 
         disable_sr_hashing();
 
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 991654c88eec..230333157fe3 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -817,7 +817,7 @@ void __init initialize_ivt(const void *iva)
         u32 check = 0;
         u32 *ivap;
         u32 *hpmcp;
-        u32 length;
+        u32 length, instr;
 
         if (strcmp((const char *)iva, "cows can fly"))
                 panic("IVT invalid");
@@ -827,6 +827,14 @@ void __init initialize_ivt(const void *iva)
         for (i = 0; i < 8; i++)
             *ivap++ = 0;
 
+        /*
+         * Use PDC_INSTR firmware function to get instruction that invokes
+         * PDCE_CHECK in HPMC handler.  See programming note at page 1-31 of
+         * the PA 1.1 Firmware Architecture document.
+         */
+        if (pdc_instr(&instr) == PDC_OK)
+                ivap[0] = instr;
+
         /* Compute Checksum for HPMC handler */
         length = os_hpmc_size;
         ivap[7] = length;
diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 48dc7d4d20bb..caab39dfa95d 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/kallsyms.h>
 #include <linux/sort.h>
+#include <linux/sched.h>
 
 #include <linux/uaccess.h>
 #include <asm/assembly.h>
@@ -279,6 +280,17 @@ static void unwind_frame_regs(struct unwind_frame_info *info)
 
                         info->prev_sp = sp - 64;
                         info->prev_ip = 0;
+
+                        /* The stack is at the end inside the thread_union
+                         * struct. If we reach data, we have reached the
+                         * beginning of the stack and should stop unwinding. */
+                        if (info->prev_sp >= (unsigned long) task_thread_info(info->t) &&
+                            info->prev_sp < ((unsigned long) task_thread_info(info->t)
+                                                + THREAD_SZ_ALGN)) {
+                                info->prev_sp = 0;
+                                break;
+                        }
+
                         if (get_user(tmp, (unsigned long *)(info->prev_sp - RP_OFFSET))) 
                                 break;
                         info->prev_ip = tmp;
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 5b101f6a5607..e247edbca68e 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -17,6 +17,7 @@
 #include <linux/interrupt.h>
 #include <linux/extable.h>
 #include <linux/uaccess.h>
+#include <linux/hugetlb.h>
 
 #include <asm/traps.h>
 
@@ -261,7 +262,7 @@ void do_page_fault(struct pt_regs *regs, unsigned long code,
         struct task_struct *tsk;
         struct mm_struct *mm;
         unsigned long acc_type;
-        int fault;
+        int fault = 0;
         unsigned int flags;
 
         if (faulthandler_disabled())
@@ -315,7 +316,8 @@ good_area:
                         goto out_of_memory;
                 else if (fault & VM_FAULT_SIGSEGV)
                         goto bad_area;
-                else if (fault & VM_FAULT_SIGBUS)
+                else if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
+                                  VM_FAULT_HWPOISON_LARGE))
                         goto bad_area;
                 BUG();
         }
@@ -352,8 +354,7 @@ bad_area:
 
         if (user_mode(regs)) {
                 struct siginfo si;
-
-                show_signal_msg(regs, code, address, tsk, vma);
+                unsigned int lsb = 0;
 
                 switch (code) {
                 case 15:        /* Data TLB miss fault/Data page fault */
@@ -386,6 +387,30 @@ bad_area:
                         si.si_code = (code == 26) ? SEGV_ACCERR : SEGV_MAPERR;
                         break;
                 }
+
+#ifdef CONFIG_MEMORY_FAILURE
+                if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
+                        printk(KERN_ERR
+        "MCE: Killing %s:%d due to hardware memory corruption fault at %08lx\n",
+                        tsk->comm, tsk->pid, address);
+                        si.si_signo = SIGBUS;
+                        si.si_code = BUS_MCEERR_AR;
+                }
+#endif
+
+                /*
+                 * Either small page or large page may be poisoned.
+                 * In other words, VM_FAULT_HWPOISON_LARGE and
+                 * VM_FAULT_HWPOISON are mutually exclusive.
+                 */
+                if (fault & VM_FAULT_HWPOISON_LARGE)
+                        lsb = hstate_index_to_shift(VM_FAULT_GET_HINDEX(fault));
+                else if (fault & VM_FAULT_HWPOISON)
+                        lsb = PAGE_SHIFT;
+                else
+                        show_signal_msg(regs, code, address, tsk, vma);
+                si.si_addr_lsb = lsb;
+
                 si.si_errno = 0;
                 si.si_addr = (void __user *) address;
                 force_sig_info(si.si_signo, &si, current);
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index e084fa548d73..063817fee61c 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -138,10 +138,11 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQUENCER_OSS=m
 CONFIG_SND_POWERMAC=m
 CONFIG_SND_AOA=m
 CONFIG_SND_AOA_FABRIC_LAYOUT=m
diff --git a/arch/powerpc/configs/gamecube_defconfig b/arch/powerpc/configs/gamecube_defconfig
index 79bbc8238b32..805b0f87653c 100644
--- a/arch/powerpc/configs/gamecube_defconfig
+++ b/arch/powerpc/configs/gamecube_defconfig
@@ -64,11 +64,12 @@ CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_CLUT224 is not set
 CONFIG_SOUND=y
 CONFIG_SND=y
-CONFIG_SND_SEQUENCER=y
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
-CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_VERBOSE_PROCFS is not set
+CONFIG_SND_SEQUENCER=y
+CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_USB_SUPPORT is not set
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=y
diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
index 8cf4a46bef86..6daa56f8895c 100644
--- a/arch/powerpc/configs/pasemi_defconfig
+++ b/arch/powerpc/configs/pasemi_defconfig
@@ -115,9 +115,10 @@ CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_LOGO=y
 CONFIG_SOUND=y
 CONFIG_SND=y
-CONFIG_SND_SEQUENCER=y
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
+CONFIG_SND_SEQUENCER=y
 CONFIG_SND_SEQUENCER_OSS=y
 CONFIG_SND_USB_AUDIO=y
 CONFIG_SND_USB_USX2Y=y
diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
index 8e798b1fbc99..1aab9a62a681 100644
--- a/arch/powerpc/configs/pmac32_defconfig
+++ b/arch/powerpc/configs/pmac32_defconfig
@@ -227,11 +227,12 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
-CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_SEQUENCER_OSS=m
 CONFIG_SND_DUMMY=m
 CONFIG_SND_POWERMAC=m
 CONFIG_SND_AOA=m
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 791db775a09c..6ddca80c52c3 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -222,11 +222,12 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
-CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_SEQUENCER_OSS=m
 CONFIG_SND_POWERMAC=m
 CONFIG_SND_AOA=m
 CONFIG_SND_AOA_FABRIC_LAYOUT=m
diff --git a/arch/powerpc/configs/ppc64e_defconfig b/arch/powerpc/configs/ppc64e_defconfig
index d0fe0f8f77c2..41d85cb3c9a2 100644
--- a/arch/powerpc/configs/ppc64e_defconfig
+++ b/arch/powerpc/configs/ppc64e_defconfig
@@ -141,11 +141,12 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
 CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
-CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_SEQUENCER_OSS=m
 CONFIG_HID_DRAGONRISE=y
 CONFIG_HID_GYRATION=y
 CONFIG_HID_TWINHAN=y
diff --git a/arch/powerpc/configs/ppc6xx_defconfig b/arch/powerpc/configs/ppc6xx_defconfig
index ae6eba482d75..da0e8d535eb8 100644
--- a/arch/powerpc/configs/ppc6xx_defconfig
+++ b/arch/powerpc/configs/ppc6xx_defconfig
@@ -789,17 +789,18 @@ CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_VGA16 is not set
 CONFIG_SOUND=m
 CONFIG_SND=m
-CONFIG_SND_SEQUENCER=m
-CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
-CONFIG_SND_SEQUENCER_OSS=y
 CONFIG_SND_DYNAMIC_MINORS=y
 # CONFIG_SND_SUPPORT_OLD_API is not set
 CONFIG_SND_VERBOSE_PRINTK=y
 CONFIG_SND_DEBUG=y
 CONFIG_SND_DEBUG_VERBOSE=y
 CONFIG_SND_PCM_XRUN_DEBUG=y
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_SEQUENCER_OSS=m
 CONFIG_SND_DUMMY=m
 CONFIG_SND_VIRMIDI=m
 CONFIG_SND_MTPAV=m
diff --git a/arch/powerpc/configs/wii_defconfig b/arch/powerpc/configs/wii_defconfig
index aef41b17a8bc..9c7400a19e9d 100644
--- a/arch/powerpc/configs/wii_defconfig
+++ b/arch/powerpc/configs/wii_defconfig
@@ -79,11 +79,12 @@ CONFIG_FB=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_SOUND=y
 CONFIG_SND=y
-CONFIG_SND_SEQUENCER=y
+CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
-CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_VERBOSE_PROCFS is not set
+CONFIG_SND_SEQUENCER=y
+CONFIG_SND_SEQUENCER_OSS=y
 CONFIG_HID_APPLE=m
 CONFIG_HID_WACOM=m
 CONFIG_MMC=y
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index 1df770e8cbe0..7275fed271af 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -102,10 +102,10 @@ static void cpufeatures_flush_tlb(void)
         case PVR_POWER8:
         case PVR_POWER8E:
         case PVR_POWER8NVL:
-                __flush_tlb_power8(POWER8_TLB_SETS);
+                __flush_tlb_power8(TLB_INVAL_SCOPE_GLOBAL);
                 break;
         case PVR_POWER9:
-                __flush_tlb_power9(POWER9_TLB_SETS_HASH);
+                __flush_tlb_power9(TLB_INVAL_SCOPE_GLOBAL);
                 break;
         default:
                 pr_err("unknown CPU version for boot TLB flush\n");
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 9e816787c0d4..116000b45531 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -1019,6 +1019,10 @@ int eeh_init(void)
         } else if ((ret = eeh_ops->init()))
                 return ret;
 
+        /* Initialize PHB PEs */
+        list_for_each_entry_safe(hose, tmp, &hose_list, list_node)
+                eeh_dev_phb_init_dynamic(hose);
+
         /* Initialize EEH event */
         ret = eeh_event_init();
         if (ret)
diff --git a/arch/powerpc/kernel/eeh_dev.c b/arch/powerpc/kernel/eeh_dev.c
index ad04ecd63c20..a34e6912c15e 100644
--- a/arch/powerpc/kernel/eeh_dev.c
+++ b/arch/powerpc/kernel/eeh_dev.c
@@ -78,21 +78,3 @@ void eeh_dev_phb_init_dynamic(struct pci_controller *phb)
         /* EEH PE for PHB */
         eeh_phb_pe_create(phb);
 }
-
-/**
- * eeh_dev_phb_init - Create EEH devices for devices included in existing PHBs
- *
- * Scan all the existing PHBs and create EEH devices for their OF
- * nodes and their children OF nodes
- */
-static int __init eeh_dev_phb_init(void)
-{
-        struct pci_controller *phb, *tmp;
-
-        list_for_each_entry_safe(phb, tmp, &hose_list, list_node)
-                eeh_dev_phb_init_dynamic(phb);
-
-        return 0;
-}
-
-core_initcall(eeh_dev_phb_init);
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index b76ca198e09c..72f153c6f3fa 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -624,5 +624,18 @@ long __machine_check_early_realmode_p8(struct pt_regs *regs)
 
 long __machine_check_early_realmode_p9(struct pt_regs *regs)
 {
+        /*
+         * On POWER9 DD2.1 and below, it's possible to get a machine check
+         * caused by a paste instruction where only DSISR bit 25 is set. This
+         * will result in the MCE handler seeing an unknown event and the kernel
+         * crashing. An MCE that occurs like this is spurious, so we don't need
+         * to do anything in terms of servicing it. If there is something that
+         * needs to be serviced, the CPU will raise the MCE again with the
+         * correct DSISR so that it can be serviced properly. So detect this
+         * case and mark it as handled.
+         */
+        if (SRR1_MC_LOADSTORE(regs->msr) && regs->dsisr == 0x02000000)
+                return 1;
+
         return mce_handle_error(regs, mce_p9_derror_table, mce_p9_ierror_table);
 }
diff --git a/arch/powerpc/kernel/optprobes.c b/arch/powerpc/kernel/optprobes.c
index 6f8273f5e988..91e037ab20a1 100644
--- a/arch/powerpc/kernel/optprobes.c
+++ b/arch/powerpc/kernel/optprobes.c
@@ -104,8 +104,10 @@ static unsigned long can_optimize(struct kprobe *p)
          * and that can be emulated.
          */
         if (!is_conditional_branch(*p->ainsn.insn) &&
-                        analyse_instr(&op, &regs, *p->ainsn.insn))
+                        analyse_instr(&op, &regs, *p->ainsn.insn) == 1) {
+                emulate_update_regs(&regs, &op);
                 nip = regs.nip;
+        }
 
         return nip;
 }
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 07cd22e35405..f52ad5bb7109 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -131,7 +131,7 @@ static void flush_tmregs_to_thread(struct task_struct *tsk)
          * in the appropriate thread structures from live.
          */
 
-        if (tsk != current)
+        if ((!cpu_has_feature(CPU_FTR_TM)) || (tsk != current))
                 return;
 
         if (MSR_TM_SUSPENDED(mfmsr())) {
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 0ac741fae90e..2e3bc16d02b2 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -904,9 +904,6 @@ void __init setup_arch(char **cmdline_p)
 #endif
 #endif
 
-#ifdef CONFIG_PPC_64K_PAGES
-        init_mm.context.pte_frag = NULL;
-#endif
 #ifdef CONFIG_SPAPR_TCE_IOMMU
         mm_iommu_init(&init_mm);
 #endif
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index ec74e203ee04..13c9dcdcba69 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -437,6 +437,7 @@ static inline int check_io_access(struct pt_regs *regs)
 int machine_check_e500mc(struct pt_regs *regs)
 {
         unsigned long mcsr = mfspr(SPRN_MCSR);
+        unsigned long pvr = mfspr(SPRN_PVR);
         unsigned long reason = mcsr;
         int recoverable = 1;
 
@@ -478,8 +479,15 @@ int machine_check_e500mc(struct pt_regs *regs)
                  * may still get logged and cause a machine check.  We should
                  * only treat the non-write shadow case as non-recoverable.
                  */
-                if (!(mfspr(SPRN_L1CSR2) & L1CSR2_DCWS))
-                        recoverable = 0;
+                /* On e6500 core, L1 DCWS (Data cache write shadow mode) bit
+                 * is not implemented but L1 data cache always runs in write
+                 * shadow mode. Hence on data cache parity errors HW will
+                 * automatically invalidate the L1 Data Cache.
+                 */
+                if (PVR_VER(pvr) != PVR_VER_E6500) {
+                        if (!(mfspr(SPRN_L1CSR2) & L1CSR2_DCWS))
+                                recoverable = 0;
+                }
         }
 
         if (reason & MCSR_L2MMU_MHIT) {
diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
index 2f6eadd9408d..c702a8981452 100644
--- a/arch/powerpc/kernel/watchdog.c
+++ b/arch/powerpc/kernel/watchdog.c
@@ -310,9 +310,6 @@ static int start_wd_on_cpu(unsigned int cpu)
         if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
                 return 0;
 
-        if (watchdog_suspended)
-                return 0;
-
         if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
                 return 0;
 
@@ -358,36 +355,39 @@ static void watchdog_calc_timeouts(void)
         wd_timer_period_ms = watchdog_thresh * 1000 * 2 / 5;
 }
 
-void watchdog_nmi_reconfigure(void)
+void watchdog_nmi_stop(void)
 {
         int cpu;
 
-        watchdog_calc_timeouts();
-
         for_each_cpu(cpu, &wd_cpus_enabled)
                 stop_wd_on_cpu(cpu);
+}
 
+void watchdog_nmi_start(void)
+{
+        int cpu;
+
+        watchdog_calc_timeouts();
         for_each_cpu_and(cpu, cpu_online_mask, &watchdog_cpumask)
                 start_wd_on_cpu(cpu);
 }
 
 /*
- * This runs after lockup_detector_init() which sets up watchdog_cpumask.
+ * Invoked from core watchdog init.
  */
-static int __init powerpc_watchdog_init(void)
+int __init watchdog_nmi_probe(void)
 {
         int err;
 
-        watchdog_calc_timeouts();
-
-        err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "powerpc/watchdog:online",
-                                start_wd_on_cpu, stop_wd_on_cpu);
-        if (err < 0)
+        err = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
+                                        "powerpc/watchdog:online",
+                                        start_wd_on_cpu, stop_wd_on_cpu);
+        if (err < 0) {
                 pr_warn("Watchdog could not be initialized");
-
+                return err;
+        }
         return 0;
 }
-arch_initcall(powerpc_watchdog_init);
 
 static void handle_backtrace_ipi(struct pt_regs *regs)
 {
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 17936f82d3c7..ec69fa45d5a2 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1121,6 +1121,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
 BEGIN_FTR_SECTION
         mtspr   SPRN_PPR, r0
 END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+
+/* Move canary into DSISR to check for later */
+BEGIN_FTR_SECTION
+        li      r0, 0x7fff
+        mtspr   SPRN_HDSISR, r0
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+
         ld      r0, VCPU_GPR(R0)(r4)
         ld      r4, VCPU_GPR(R4)(r4)
 
@@ -1956,9 +1963,14 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
 kvmppc_hdsi:
         ld      r3, VCPU_KVM(r9)
         lbz     r0, KVM_RADIX(r3)
-        cmpwi   r0, 0
         mfspr   r4, SPRN_HDAR
         mfspr   r6, SPRN_HDSISR
+BEGIN_FTR_SECTION
+        /* Look for DSISR canary. If we find it, retry instruction */
+        cmpdi   r6, 0x7fff
+        beq     6f
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+        cmpwi   r0, 0
         bne     .Lradix_hdsi            /* on radix, just save DAR/DSISR/ASDR */
         /* HPTE not found fault or protection fault? */
         andis.  r0, r6, (DSISR_NOHPTE | DSISR_PROTFAULT)@h
diff --git a/arch/powerpc/kvm/book3s_xive.c b/arch/powerpc/kvm/book3s_xive.c
index 13304622ab1c..bf457843e032 100644
--- a/arch/powerpc/kvm/book3s_xive.c
+++ b/arch/powerpc/kvm/book3s_xive.c
@@ -622,7 +622,7 @@ int kvmppc_xive_get_xive(struct kvm *kvm, u32 irq, u32 *server,
                 return -EINVAL;
         state = &sb->irq_state[idx];
         arch_spin_lock(&sb->lock);
-        *server = state->guest_server;
+        *server = state->act_server;
         *priority = state->guest_priority;
         arch_spin_unlock(&sb->lock);
 
@@ -1331,7 +1331,7 @@ static int xive_get_source(struct kvmppc_xive *xive, long irq, u64 addr)
         xive->saved_src_count++;
 
         /* Convert saved state into something compatible with xics */
-        val = state->guest_server;
+        val = state->act_server;
         prio = state->saved_scan_prio;
 
         if (prio == MASKED) {
@@ -1507,7 +1507,6 @@ static int xive_set_source(struct kvmppc_xive *xive, long irq, u64 addr)
         /* First convert prio and mark interrupt as untargetted */
         act_prio = xive_prio_from_guest(guest_prio);
         state->act_priority = MASKED;
-        state->guest_server = server;
 
         /*
          * We need to drop the lock due to the mutex below. Hopefully
diff --git a/arch/powerpc/kvm/book3s_xive.h b/arch/powerpc/kvm/book3s_xive.h
index 5938f7644dc1..6ba63f8e8a61 100644
--- a/arch/powerpc/kvm/book3s_xive.h
+++ b/arch/powerpc/kvm/book3s_xive.h
@@ -35,7 +35,6 @@ struct kvmppc_xive_irq_state {
         struct xive_irq_data *pt_data;  /* XIVE Pass-through associated data */
 
         /* Targetting as set by guest */
-        u32 guest_server;               /* Current guest selected target */
         u8 guest_priority;              /* Guest set priority */
         u8 saved_priority;              /* Saved priority when masking */
 
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index fb9f58b868e7..5e8418c28bd8 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -944,9 +944,9 @@ NOKPROBE_SYMBOL(emulate_dcbz);
                 : "r" (addr), "i" (-EFAULT), "0" (err))
 
 static nokprobe_inline void set_cr0(const struct pt_regs *regs,
-                                    struct instruction_op *op, int rd)
+                                    struct instruction_op *op)
 {
-        long val = regs->gpr[rd];
+        long val = op->val;
 
         op->type |= SETCC;
         op->ccval = (regs->ccr & 0x0fffffff) | ((regs->xer >> 3) & 0x10000000);
@@ -1326,7 +1326,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
         case 13:        /* addic. */
                 imm = (short) instr;
                 add_with_carry(regs, op, rd, regs->gpr[ra], imm, 0);
-                set_cr0(regs, op, rd);
+                set_cr0(regs, op);
                 return 1;
 
         case 14:        /* addi */
@@ -1397,13 +1397,13 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 
         case 28:        /* andi. */
                 op->val = regs->gpr[rd] & (unsigned short) instr;
-                set_cr0(regs, op, ra);
+                set_cr0(regs, op);
                 goto logical_done_nocc;
 
         case 29:        /* andis. */
                 imm = (unsigned short) instr;
                 op->val = regs->gpr[rd] & (imm << 16);
-                set_cr0(regs, op, ra);
+                set_cr0(regs, op);
                 goto logical_done_nocc;
 
 #ifdef __powerpc64__
@@ -1513,10 +1513,10 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
                         op->type = COMPUTE + SETCC;
                         imm = 0xf0000000UL;
                         val = regs->gpr[rd];
-                        op->val = regs->ccr;
+                        op->ccval = regs->ccr;
                         for (sh = 0; sh < 8; ++sh) {
                                 if (instr & (0x80000 >> sh))
-                                        op->val = (op->val & ~imm) |
+                                        op->ccval = (op->ccval & ~imm) |
                                                 (val & imm);
                                 imm >>= 4;
                         }
@@ -1651,8 +1651,9 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
                         goto arith_done;
 
                 case 235:       /* mullw */
-                        op->val = (unsigned int) regs->gpr[ra] *
-                                (unsigned int) regs->gpr[rb];
+                        op->val = (long)(int) regs->gpr[ra] *
+                                (int) regs->gpr[rb];
+
                         goto arith_done;
 
                 case 266:       /* add */
@@ -2526,7 +2527,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 
  logical_done:
         if (instr & 1)
-                set_cr0(regs, op, ra);
+                set_cr0(regs, op);
  logical_done_nocc:
         op->reg = ra;
         op->type |= SETREG;
@@ -2534,7 +2535,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
 
  arith_done:
         if (instr & 1)
-                set_cr0(regs, op, rd);
+                set_cr0(regs, op);
  compute_done:
         op->reg = rd;
         op->type |= SETREG;
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 65eda1997c3f..f6c7f54c0515 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -361,9 +361,9 @@ static int change_page_attr(struct page *page, int numpages, pgprot_t prot)
                         break;
         }
         wmb();
+        local_irq_restore(flags);
         flush_tlb_kernel_range((unsigned long)page_address(start),
                                (unsigned long)page_address(page));
-        local_irq_restore(flags);
         return err;
 }
 
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 2e3eb7431571..9e3da168d54c 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -793,6 +793,11 @@ void perf_event_print_debug(void)
         u32 pmcs[MAX_HWEVENTS];
         int i;
 
+        if (!ppmu) {
+                pr_info("Performance monitor hardware not registered.\n");
+                return;
+        }
+
         if (!ppmu->n_counter)
                 return;
 
diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c
index 9f59041a172b..443d5ca71995 100644
--- a/arch/powerpc/platforms/powernv/idle.c
+++ b/arch/powerpc/platforms/powernv/idle.c
@@ -393,7 +393,13 @@ static void pnv_program_cpu_hotplug_lpcr(unsigned int cpu, u64 lpcr_val)
         u64 pir = get_hard_smp_processor_id(cpu);
 
         mtspr(SPRN_LPCR, lpcr_val);
-        opal_slw_set_reg(pir, SPRN_LPCR, lpcr_val);
+
+        /*
+         * Program the LPCR via stop-api only if the deepest stop state
+         * can lose hypervisor context.
+         */
+        if (supported_cpuidle_states & OPAL_PM_LOSE_FULL_CONTEXT)
+                opal_slw_set_reg(pir, SPRN_LPCR, lpcr_val);
 }
 
 /*
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 897aa1400eb8..bbb73aa0eb8f 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -272,7 +272,15 @@ static void pnv_kexec_cpu_down(int crash_shutdown, int secondary)
 #ifdef CONFIG_MEMORY_HOTPLUG_SPARSE
 static unsigned long pnv_memory_block_size(void)
 {
-        return 256UL * 1024 * 1024;
+        /*
+         * We map the kernel linear region with 1GB large pages on radix. For
+         * memory hot unplug to work our memory block size must be at least
+         * this size.
+         */
+        if (radix_enabled())
+                return 1UL * 1024 * 1024 * 1024;
+        else
+                return 256UL * 1024 * 1024;
 }
 #endif
 
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 783f36364690..e45b5f10645a 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -266,7 +266,6 @@ int dlpar_attach_node(struct device_node *dn, struct device_node *parent)
                 return rc;
         }
 
-        of_node_put(dn->parent);
         return 0;
 }
 
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index fc0d8f97c03a..fadb95efbb9e 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -462,15 +462,19 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
         }
 
         dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
-        of_node_put(parent);
         if (!dn) {
                 pr_warn("Failed call to configure-connector, drc index: %x\n",
                         drc_index);
                 dlpar_release_drc(drc_index);
+                of_node_put(parent);
                 return -EINVAL;
         }
 
         rc = dlpar_attach_node(dn, parent);
+
+        /* Regardless we are done with parent now */
+        of_node_put(parent);
+
         if (rc) {
                 saved_rc = rc;
                 pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
index 210ce632d63e..f7042ad492ba 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -226,8 +226,10 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
                 return -ENOENT;
 
         dn = dlpar_configure_connector(drc_index, parent_dn);
-        if (!dn)
+        if (!dn) {
+                of_node_put(parent_dn);
                 return -ENOENT;
+        }
 
         rc = dlpar_attach_node(dn, parent_dn);
         if (rc)
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 9234be1e66f5..5011ffea4e4b 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -71,6 +71,8 @@
 #define RIWAR_WRTYP_ALLOC       0x00006000
 #define RIWAR_SIZE_MASK         0x0000003F
 
+static DEFINE_SPINLOCK(fsl_rio_config_lock);
+
 #define __fsl_read_rio_config(x, addr, err, op)         \
         __asm__ __volatile__(                           \
                 "1:     "op" %1,0(%2)\n"                \
@@ -184,6 +186,7 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
                         u8 hopcount, u32 offset, int len, u32 *val)
 {
         struct rio_priv *priv = mport->priv;
+        unsigned long flags;
         u8 *data;
         u32 rval, err = 0;
 
@@ -197,6 +200,8 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
         if (offset > (0x1000000 - len) || !IS_ALIGNED(offset, len))
                 return -EINVAL;
 
+        spin_lock_irqsave(&fsl_rio_config_lock, flags);
+
         out_be32(&priv->maint_atmu_regs->rowtar,
                  (destid << 22) | (hopcount << 12) | (offset >> 12));
         out_be32(&priv->maint_atmu_regs->rowtear, (destid >> 10));
@@ -213,6 +218,7 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
                 __fsl_read_rio_config(rval, data, err, "lwz");
                 break;
         default:
+                spin_unlock_irqrestore(&fsl_rio_config_lock, flags);
                 return -EINVAL;
         }
 
@@ -221,6 +227,7 @@ fsl_rio_config_read(struct rio_mport *mport, int index, u16 destid,
                          err, destid, hopcount, offset);
         }
 
+        spin_unlock_irqrestore(&fsl_rio_config_lock, flags);
         *val = rval;
 
         return err;
@@ -244,7 +251,10 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
                         u8 hopcount, u32 offset, int len, u32 val)
 {
         struct rio_priv *priv = mport->priv;
+        unsigned long flags;
         u8 *data;
+        int ret = 0;
+
         pr_debug
                 ("fsl_rio_config_write:"
                 " index %d destid %d hopcount %d offset %8.8x len %d val %8.8x\n",
@@ -255,6 +265,8 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
         if (offset > (0x1000000 - len) || !IS_ALIGNED(offset, len))
                 return -EINVAL;
 
+        spin_lock_irqsave(&fsl_rio_config_lock, flags);
+
         out_be32(&priv->maint_atmu_regs->rowtar,
                  (destid << 22) | (hopcount << 12) | (offset >> 12));
         out_be32(&priv->maint_atmu_regs->rowtear, (destid >> 10));
@@ -271,10 +283,11 @@ fsl_rio_config_write(struct rio_mport *mport, int index, u16 destid,
                 out_be32((u32 *) data, val);
                 break;
         default:
-                return -EINVAL;
+                ret = -EINVAL;
         }
+        spin_unlock_irqrestore(&fsl_rio_config_lock, flags);
 
-        return 0;
+        return ret;
 }
 
 static void fsl_rio_inbound_mem_init(struct rio_priv *priv)
diff --git a/arch/powerpc/sysdev/fsl_rmu.c b/arch/powerpc/sysdev/fsl_rmu.c
index ab7a74c75be8..88b35a3dcdc5 100644
--- a/arch/powerpc/sysdev/fsl_rmu.c
+++ b/arch/powerpc/sysdev/fsl_rmu.c
@@ -104,6 +104,8 @@
 
 #define DOORBELL_MESSAGE_SIZE   0x08
 
+static DEFINE_SPINLOCK(fsl_rio_doorbell_lock);
+
 struct rio_msg_regs {
         u32 omr;
         u32 osr;
@@ -626,9 +628,13 @@ err_out:
 int fsl_rio_doorbell_send(struct rio_mport *mport,
                                 int index, u16 destid, u16 data)
 {
+        unsigned long flags;
+
         pr_debug("fsl_doorbell_send: index %d destid %4.4x data %4.4x\n",
                  index, destid, data);
 
+        spin_lock_irqsave(&fsl_rio_doorbell_lock, flags);
+
         /* In the serial version silicons, such as MPC8548, MPC8641,
          * below operations is must be.
          */
@@ -638,6 +644,8 @@ int fsl_rio_doorbell_send(struct rio_mport *mport,
         out_be32(&dbell->dbell_regs->oddatr, (index << 20) | data);
         out_be32(&dbell->dbell_regs->odmr, 0x00000001);
 
+        spin_unlock_irqrestore(&fsl_rio_doorbell_lock, flags);
+
         return 0;
 }
 
diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index f387318678b9..a3b8d7d1316e 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1402,6 +1402,14 @@ void xive_teardown_cpu(void)
 
         if (xive_ops->teardown_cpu)
                 xive_ops->teardown_cpu(cpu, xc);
+
+#ifdef CONFIG_SMP
+        /* Get rid of IPI */
+        xive_cleanup_cpu_ipi(cpu, xc);
+#endif
+
+        /* Disable and free the queues */
+        xive_cleanup_cpu_queues(cpu, xc);
 }
 
 void xive_kexec_teardown_cpu(int secondary)
diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index f24a70bc6855..d9c4c9366049 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -431,7 +431,11 @@ static int xive_spapr_get_ipi(unsigned int cpu, struct xive_cpu *xc)
 
 static void xive_spapr_put_ipi(unsigned int cpu, struct xive_cpu *xc)
 {
+        if (!xc->hw_ipi)
+                return;
+
         xive_irq_bitmap_free(xc->hw_ipi);
+        xc->hw_ipi = 0;
 }
 #endif /* CONFIG_SMP */
 
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index dce708e061ea..20e75a2ca93a 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1507,7 +1507,9 @@ static inline pmd_t pmdp_huge_clear_flush(struct vm_area_struct *vma,
 static inline void pmdp_invalidate(struct vm_area_struct *vma,
                                    unsigned long addr, pmd_t *pmdp)
 {
-        pmdp_xchg_direct(vma->vm_mm, addr, pmdp, __pmd(_SEGMENT_ENTRY_EMPTY));
+        pmd_t pmd = __pmd(pmd_val(*pmdp) | _SEGMENT_ENTRY_INVALID);
+
+        pmdp_xchg_direct(vma->vm_mm, addr, pmdp, pmd);
 }
 
 #define __HAVE_ARCH_PMDP_SET_WRPROTECT
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index ca8cd80e8feb..60181caf8e8a 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -404,18 +404,6 @@ static inline void save_vector_registers(void)
 #endif
 }
 
-static int __init topology_setup(char *str)
-{
-        bool enabled;
-        int rc;
-
-        rc = kstrtobool(str, &enabled);
-        if (!rc && !enabled)
-                S390_lowcore.machine_flags &= ~MACHINE_FLAG_TOPOLOGY;
-        return rc;
-}
-early_param("topology", topology_setup);
-
 static int __init disable_vector_extension(char *str)
 {
         S390_lowcore.machine_flags &= ~MACHINE_FLAG_VX;
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index c1bf75ffb875..7e1e40323b78 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -823,9 +823,12 @@ static int cpumsf_pmu_event_init(struct perf_event *event)
         }
 
         /* Check online status of the CPU to which the event is pinned */
-        if ((unsigned int)event->cpu >= nr_cpumask_bits ||
-            (event->cpu >= 0 && !cpu_online(event->cpu)))
-                return -ENODEV;
+        if (event->cpu >= 0) {
+                if ((unsigned int)event->cpu >= nr_cpumask_bits)
+                        return -ENODEV;
+                if (!cpu_online(event->cpu))
+                        return -ENODEV;
+        }
 
         /* Force reset of idle/hv excludes regardless of what the
          * user requested.
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index bb47c92476f0..ed0bdd220e1a 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -8,6 +8,8 @@
 
 #include <linux/workqueue.h>
 #include <linux/bootmem.h>
+#include <linux/uaccess.h>
+#include <linux/sysctl.h>
 #include <linux/cpuset.h>
 #include <linux/device.h>
 #include <linux/export.h>
@@ -29,12 +31,20 @@
 #define PTF_VERTICAL    (1UL)
 #define PTF_CHECK       (2UL)
 
+enum {
+        TOPOLOGY_MODE_HW,
+        TOPOLOGY_MODE_SINGLE,
+        TOPOLOGY_MODE_PACKAGE,
+        TOPOLOGY_MODE_UNINITIALIZED
+};
+
 struct mask_info {
         struct mask_info *next;
         unsigned char id;
         cpumask_t mask;
 };
 
+static int topology_mode = TOPOLOGY_MODE_UNINITIALIZED;
 static void set_topology_timer(void);
 static void topology_work_fn(struct work_struct *work);
 static struct sysinfo_15_1_x *tl_info;
@@ -59,11 +69,26 @@ static cpumask_t cpu_group_map(struct mask_info *info, unsigned int cpu)
         cpumask_t mask;
 
         cpumask_copy(&mask, cpumask_of(cpu));
-        if (!MACHINE_HAS_TOPOLOGY)
-                return mask;
-        for (; info; info = info->next) {
-                if (cpumask_test_cpu(cpu, &info->mask))
-                        return info->mask;
+        switch (topology_mode) {
+        case TOPOLOGY_MODE_HW:
+                while (info) {
+                        if (cpumask_test_cpu(cpu, &info->mask)) {
+                                mask = info->mask;
+                                break;
+                        }
+                        info = info->next;
+                }
+                if (cpumask_empty(&mask))
+                        cpumask_copy(&mask, cpumask_of(cpu));
+                break;
+        case TOPOLOGY_MODE_PACKAGE:
+                cpumask_copy(&mask, cpu_present_mask);
+                break;
+        default:
+                /* fallthrough */
+        case TOPOLOGY_MODE_SINGLE:
+                cpumask_copy(&mask, cpumask_of(cpu));
+                break;
         }
         return mask;
 }
@@ -74,7 +99,7 @@ static cpumask_t cpu_thread_map(unsigned int cpu)
         int i;
 
         cpumask_copy(&mask, cpumask_of(cpu));
-        if (!MACHINE_HAS_TOPOLOGY)
+        if (topology_mode != TOPOLOGY_MODE_HW)
                 return mask;
         cpu -= cpu % (smp_cpu_mtid + 1);
         for (i = 0; i <= smp_cpu_mtid; i++)
@@ -184,10 +209,8 @@ static void topology_update_polarization_simple(void)
 {
         int cpu;
 
-        mutex_lock(&smp_cpu_state_mutex);
         for_each_possible_cpu(cpu)
                 smp_cpu_set_polarization(cpu, POLARIZATION_HRZ);
-        mutex_unlock(&smp_cpu_state_mutex);
 }
 
 static int ptf(unsigned long fc)
@@ -223,7 +246,7 @@ int topology_set_cpu_management(int fc)
 static void update_cpu_masks(void)
 {
         struct cpu_topology_s390 *topo;
-        int cpu;
+        int cpu, id;
 
         for_each_possible_cpu(cpu) {
                 topo = &cpu_topology[cpu];
@@ -231,12 +254,13 @@ static void update_cpu_masks(void)
                 topo->core_mask = cpu_group_map(&socket_info, cpu);
                 topo->book_mask = cpu_group_map(&book_info, cpu);
                 topo->drawer_mask = cpu_group_map(&drawer_info, cpu);
-                if (!MACHINE_HAS_TOPOLOGY) {
+                if (topology_mode != TOPOLOGY_MODE_HW) {
+                        id = topology_mode == TOPOLOGY_MODE_PACKAGE ? 0 : cpu;
                         topo->thread_id = cpu;
                         topo->core_id = cpu;
-                        topo->socket_id = cpu;
-                        topo->book_id = cpu;
-                        topo->drawer_id = cpu;
+                        topo->socket_id = id;
+                        topo->book_id = id;
+                        topo->drawer_id = id;
                         if (cpu_present(cpu))
                                 cpumask_set_cpu(cpu, &cpus_with_topology);
                 }
@@ -254,6 +278,7 @@ static int __arch_update_cpu_topology(void)
         struct sysinfo_15_1_x *info = tl_info;
         int rc = 0;
 
+        mutex_lock(&smp_cpu_state_mutex);
         cpumask_clear(&cpus_with_topology);
         if (MACHINE_HAS_TOPOLOGY) {
                 rc = 1;
@@ -263,6 +288,7 @@ static int __arch_update_cpu_topology(void)
         update_cpu_masks();
         if (!MACHINE_HAS_TOPOLOGY)
                 topology_update_polarization_simple();
+        mutex_unlock(&smp_cpu_state_mutex);
         return rc;
 }
 
@@ -289,6 +315,11 @@ void topology_schedule_update(void)
         schedule_work(&topology_work);
 }
 
+static void topology_flush_work(void)
+{
+        flush_work(&topology_work);
+}
+
 static void topology_timer_fn(unsigned long ignored)
 {
         if (ptf(PTF_CHECK))
@@ -459,6 +490,12 @@ void __init topology_init_early(void)
         struct sysinfo_15_1_x *info;
 
         set_sched_topology(s390_topology);
+        if (topology_mode == TOPOLOGY_MODE_UNINITIALIZED) {
+                if (MACHINE_HAS_TOPOLOGY)
+                        topology_mode = TOPOLOGY_MODE_HW;
+                else
+                        topology_mode = TOPOLOGY_MODE_SINGLE;
+        }
         if (!MACHINE_HAS_TOPOLOGY)
                 goto out;
         tl_info = memblock_virt_alloc(PAGE_SIZE, PAGE_SIZE);
@@ -474,12 +511,97 @@ out:
         __arch_update_cpu_topology();
 }
 
+static inline int topology_get_mode(int enabled)
+{
+        if (!enabled)
+                return TOPOLOGY_MODE_SINGLE;
+        return MACHINE_HAS_TOPOLOGY ? TOPOLOGY_MODE_HW : TOPOLOGY_MODE_PACKAGE;
+}
+
+static inline int topology_is_enabled(void)
+{
+        return topology_mode != TOPOLOGY_MODE_SINGLE;
+}
+
+static int __init topology_setup(char *str)
+{
+        bool enabled;
+        int rc;
+
+        rc = kstrtobool(str, &enabled);
+        if (rc)
+                return rc;
+        topology_mode = topology_get_mode(enabled);
+        return 0;
+}
+early_param("topology", topology_setup);
+
+static int topology_ctl_handler(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        unsigned int len;
+        int new_mode;
+        char buf[2];
+
+        if (!*lenp || *ppos) {
+                *lenp = 0;
+                return 0;
+        }
+        if (!write) {
+                strncpy(buf, topology_is_enabled() ? "1\n" : "0\n",
+                        ARRAY_SIZE(buf));
+                len = strnlen(buf, ARRAY_SIZE(buf));
+                if (len > *lenp)
+                        len = *lenp;
+                if (copy_to_user(buffer, buf, len))
+                        return -EFAULT;
+                goto out;
+        }
+        len = *lenp;
+        if (copy_from_user(buf, buffer, len > sizeof(buf) ? sizeof(buf) : len))
+                return -EFAULT;
+        if (buf[0] != '0' && buf[0] != '1')
+                return -EINVAL;
+        mutex_lock(&smp_cpu_state_mutex);
+        new_mode = topology_get_mode(buf[0] == '1');
+        if (topology_mode != new_mode) {
+                topology_mode = new_mode;
+                topology_schedule_update();
+        }
+        mutex_unlock(&smp_cpu_state_mutex);
+        topology_flush_work();
+out:
+        *lenp = len;
+        *ppos += len;
+        return 0;
+}
+
+static struct ctl_table topology_ctl_table[] = {
+        {
+                .procname       = "topology",
+                .mode           = 0644,
+                .proc_handler   = topology_ctl_handler,
+        },
+        { },
+};
+
+static struct ctl_table topology_dir_table[] = {
+        {
+                .procname       = "s390",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = topology_ctl_table,
+        },
+        { },
+};
+
 static int __init topology_init(void)
 {
         if (MACHINE_HAS_TOPOLOGY)
                 set_topology_timer();
         else
                 topology_update_polarization_simple();
+        register_sysctl_table(topology_dir_table);
         return device_create_file(cpu_subsys.dev_root, &dev_attr_dispatching);
 }
 device_initcall(topology_init);
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 8ecc25e760fa..98ffe3ee9411 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -56,13 +56,12 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
 static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
                 unsigned long end, int write, struct page **pages, int *nr)
 {
-        unsigned long mask, result;
         struct page *head, *page;
+        unsigned long mask;
         int refs;
 
-        result = write ? 0 : _SEGMENT_ENTRY_PROTECT;
-        mask = result | _SEGMENT_ENTRY_INVALID;
-        if ((pmd_val(pmd) & mask) != result)
+        mask = (write ? _SEGMENT_ENTRY_PROTECT : 0) | _SEGMENT_ENTRY_INVALID;
+        if ((pmd_val(pmd) & mask) != 0)
                 return 0;
         VM_BUG_ON(!pfn_valid(pmd_val(pmd) >> PAGE_SHIFT));
 
diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h
index 18e0377f72bb..88ce1e22237b 100644
--- a/arch/sh/include/asm/processor_32.h
+++ b/arch/sh/include/asm/processor_32.h
@@ -136,10 +136,6 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_pc, unsigned lo
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
 
-/* Copy and release all segment info associated with a VM */
-#define copy_segments(p, mm)    do { } while(0)
-#define release_segments(mm)    do { } while(0)
-
 /*
  * FPU lazy state save handling.
  */
diff --git a/arch/sh/include/asm/processor_64.h b/arch/sh/include/asm/processor_64.h
index eedd4f625d07..777a16318aff 100644
--- a/arch/sh/include/asm/processor_64.h
+++ b/arch/sh/include/asm/processor_64.h
@@ -170,10 +170,6 @@ struct mm_struct;
 /* Free all resources held by a thread. */
 extern void release_thread(struct task_struct *);
 
-/* Copy and release all segment info associated with a VM */
-#define copy_segments(p, mm)    do { } while (0)
-#define release_segments(mm)    do { } while (0)
-#define forget_segments()       do { } while (0)
 /*
  * FPU lazy state save handling.
  */
diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7264.h b/arch/sh/include/cpu-sh2a/cpu/sh7264.h
index 4d1ef6d74bd6..2ae0e938b657 100644
--- a/arch/sh/include/cpu-sh2a/cpu/sh7264.h
+++ b/arch/sh/include/cpu-sh2a/cpu/sh7264.h
@@ -43,9 +43,7 @@ enum {
         GPIO_PG7, GPIO_PG6, GPIO_PG5, GPIO_PG4,
         GPIO_PG3, GPIO_PG2, GPIO_PG1, GPIO_PG0,
 
-        /* Port H */
-        GPIO_PH7, GPIO_PH6, GPIO_PH5, GPIO_PH4,
-        GPIO_PH3, GPIO_PH2, GPIO_PH1, GPIO_PH0,
+        /* Port H - Port H does not have a Data Register */
 
         /* Port I - not on device */
 
diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7269.h b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
index 2a0ca8780f0d..13c495a9fc00 100644
--- a/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+++ b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
@@ -45,9 +45,7 @@ enum {
         GPIO_PG7, GPIO_PG6, GPIO_PG5, GPIO_PG4,
         GPIO_PG3, GPIO_PG2, GPIO_PG1, GPIO_PG0,
 
-        /* Port H */
-        GPIO_PH7, GPIO_PH6, GPIO_PH5, GPIO_PH4,
-        GPIO_PH3, GPIO_PH2, GPIO_PH1, GPIO_PH0,
+        /* Port H - Port H does not have a Data Register */
 
         /* Port I - not on device */
 
diff --git a/arch/sh/include/cpu-sh4/cpu/sh7722.h b/arch/sh/include/cpu-sh4/cpu/sh7722.h
index 3bb74e534d0f..78961ab78a5a 100644
--- a/arch/sh/include/cpu-sh4/cpu/sh7722.h
+++ b/arch/sh/include/cpu-sh4/cpu/sh7722.h
@@ -67,7 +67,7 @@ enum {
         GPIO_PTN3, GPIO_PTN2, GPIO_PTN1, GPIO_PTN0,
 
         /* PTQ */
-        GPIO_PTQ7, GPIO_PTQ6, GPIO_PTQ5, GPIO_PTQ4,
+        GPIO_PTQ6, GPIO_PTQ5, GPIO_PTQ4,
         GPIO_PTQ3, GPIO_PTQ2, GPIO_PTQ1, GPIO_PTQ0,
 
         /* PTR */
diff --git a/arch/sh/include/cpu-sh4/cpu/sh7757.h b/arch/sh/include/cpu-sh4/cpu/sh7757.h
index 5340f3bc1863..b40fb541e72a 100644
--- a/arch/sh/include/cpu-sh4/cpu/sh7757.h
+++ b/arch/sh/include/cpu-sh4/cpu/sh7757.h
@@ -40,7 +40,7 @@ enum {
 
         /* PTJ */
         GPIO_PTJ0, GPIO_PTJ1, GPIO_PTJ2, GPIO_PTJ3,
-        GPIO_PTJ4, GPIO_PTJ5, GPIO_PTJ6, GPIO_PTJ7_RESV,
+        GPIO_PTJ4, GPIO_PTJ5, GPIO_PTJ6,
 
         /* PTK */
         GPIO_PTK0, GPIO_PTK1, GPIO_PTK2, GPIO_PTK3,
@@ -48,7 +48,7 @@ enum {
 
         /* PTL */
         GPIO_PTL0, GPIO_PTL1, GPIO_PTL2, GPIO_PTL3,
-        GPIO_PTL4, GPIO_PTL5, GPIO_PTL6, GPIO_PTL7_RESV,
+        GPIO_PTL4, GPIO_PTL5, GPIO_PTL6,
 
         /* PTM */
         GPIO_PTM0, GPIO_PTM1, GPIO_PTM2, GPIO_PTM3,
@@ -56,7 +56,7 @@ enum {
 
         /* PTN */
         GPIO_PTN0, GPIO_PTN1, GPIO_PTN2, GPIO_PTN3,
-        GPIO_PTN4, GPIO_PTN5, GPIO_PTN6, GPIO_PTN7_RESV,
+        GPIO_PTN4, GPIO_PTN5, GPIO_PTN6,
 
         /* PTO */
         GPIO_PTO0, GPIO_PTO1, GPIO_PTO2, GPIO_PTO3,
@@ -68,7 +68,7 @@ enum {
 
         /* PTQ */
         GPIO_PTQ0, GPIO_PTQ1, GPIO_PTQ2, GPIO_PTQ3,
-        GPIO_PTQ4, GPIO_PTQ5, GPIO_PTQ6, GPIO_PTQ7_RESV,
+        GPIO_PTQ4, GPIO_PTQ5, GPIO_PTQ6,
 
         /* PTR */
         GPIO_PTR0, GPIO_PTR1, GPIO_PTR2, GPIO_PTR3,
diff --git a/arch/tile/configs/tilegx_defconfig b/arch/tile/configs/tilegx_defconfig
index 0d925fa0f0c1..9f94435cc44f 100644
--- a/arch/tile/configs/tilegx_defconfig
+++ b/arch/tile/configs/tilegx_defconfig
@@ -409,5 +409,4 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
diff --git a/arch/tile/configs/tilepro_defconfig b/arch/tile/configs/tilepro_defconfig
index 149d8e8eacb8..1c5bd4f8ffca 100644
--- a/arch/tile/configs/tilepro_defconfig
+++ b/arch/tile/configs/tilepro_defconfig
@@ -189,7 +189,6 @@ CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=y
 CONFIG_IP_NF_TARGET_REJECT=y
-CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_ECN=m
 CONFIG_IP_NF_TARGET_TTL=m
@@ -521,7 +520,6 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRC_CCITT=m
 CONFIG_CRC7=m
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 6becb96c60a0..ad83c1e66dbd 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -140,7 +140,7 @@ static int __init setup_maxnodemem(char *str)
 {
         char *endp;
         unsigned long long maxnodemem;
-        long node;
+        unsigned long node;
 
         node = str ? simple_strtoul(str, &endp, 0) : INT_MAX;
         if (node >= MAX_NUMNODES || *endp != ':')
diff --git a/arch/um/include/asm/processor-generic.h b/arch/um/include/asm/processor-generic.h
index f6d1a3f747a9..86942a492454 100644
--- a/arch/um/include/asm/processor-generic.h
+++ b/arch/um/include/asm/processor-generic.h
@@ -58,11 +58,6 @@ static inline void release_thread(struct task_struct *task)
 {
 }
 
-static inline void mm_copy_segments(struct mm_struct *from_mm,
-                                    struct mm_struct *new_mm)
-{
-}
-
 #define init_stack      (init_thread_union.stack)
 
 /*
diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c
index 0b034ebbda2a..7f69d17de354 100644
--- a/arch/um/kernel/time.c
+++ b/arch/um/kernel/time.c
@@ -98,7 +98,7 @@ static struct clocksource timer_clocksource = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-static void __init timer_setup(void)
+static void __init um_timer_setup(void)
 {
         int err;
 
@@ -132,5 +132,5 @@ void read_persistent_clock(struct timespec *ts)
 void __init time_init(void)
 {
         timer_set_signal_handler();
-        late_time_init = timer_setup;
+        late_time_init = um_timer_setup;
 }
diff --git a/arch/x86/crypto/blowfish-x86_64-asm_64.S b/arch/x86/crypto/blowfish-x86_64-asm_64.S
index 246c67006ed0..8c1fcb6bad21 100644
--- a/arch/x86/crypto/blowfish-x86_64-asm_64.S
+++ b/arch/x86/crypto/blowfish-x86_64-asm_64.S
@@ -33,7 +33,7 @@
 #define s3      ((16 + 2 + (3 * 256)) * 4)
 
 /* register macros */
-#define CTX %rdi
+#define CTX %r12
 #define RIO %rsi
 
 #define RX0 %rax
@@ -56,12 +56,12 @@
 #define RX2bh %ch
 #define RX3bh %dh
 
-#define RT0 %rbp
+#define RT0 %rdi
 #define RT1 %rsi
 #define RT2 %r8
 #define RT3 %r9
 
-#define RT0d %ebp
+#define RT0d %edi
 #define RT1d %esi
 #define RT2d %r8d
 #define RT3d %r9d
@@ -120,13 +120,14 @@
 
 ENTRY(__blowfish_enc_blk)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          *      %rcx: bool, if true: xor output
          */
-        movq %rbp, %r11;
+        movq %r12, %r11;
 
+        movq %rdi, CTX;
         movq %rsi, %r10;
         movq %rdx, RIO;
 
@@ -142,7 +143,7 @@ ENTRY(__blowfish_enc_blk)
         round_enc(14);
         add_roundkey_enc(16);
 
-        movq %r11, %rbp;
+        movq %r11, %r12;
 
         movq %r10, RIO;
         test %cl, %cl;
@@ -157,12 +158,13 @@ ENDPROC(__blowfish_enc_blk)
 
 ENTRY(blowfish_dec_blk)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
-        movq %rbp, %r11;
+        movq %r12, %r11;
 
+        movq %rdi, CTX;
         movq %rsi, %r10;
         movq %rdx, RIO;
 
@@ -181,7 +183,7 @@ ENTRY(blowfish_dec_blk)
         movq %r10, RIO;
         write_block();
 
-        movq %r11, %rbp;
+        movq %r11, %r12;
 
         ret;
 ENDPROC(blowfish_dec_blk)
@@ -298,20 +300,21 @@ ENDPROC(blowfish_dec_blk)
 
 ENTRY(__blowfish_enc_blk_4way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          *      %rcx: bool, if true: xor output
          */
-        pushq %rbp;
+        pushq %r12;
         pushq %rbx;
         pushq %rcx;
 
-        preload_roundkey_enc(0);
-
+        movq %rdi, CTX
         movq %rsi, %r11;
         movq %rdx, RIO;
 
+        preload_roundkey_enc(0);
+
         read_block4();
 
         round_enc4(0);
@@ -324,39 +327,40 @@ ENTRY(__blowfish_enc_blk_4way)
         round_enc4(14);
         add_preloaded_roundkey4();
 
-        popq %rbp;
+        popq %r12;
         movq %r11, RIO;
 
-        test %bpl, %bpl;
+        test %r12b, %r12b;
         jnz .L__enc_xor4;
 
         write_block4();
 
         popq %rbx;
-        popq %rbp;
+        popq %r12;
         ret;
 
 .L__enc_xor4:
         xor_block4();
 
         popq %rbx;
-        popq %rbp;
+        popq %r12;
         ret;
 ENDPROC(__blowfish_enc_blk_4way)
 
 ENTRY(blowfish_dec_blk_4way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
-        pushq %rbp;
+        pushq %r12;
         pushq %rbx;
-        preload_roundkey_dec(17);
 
-        movq %rsi, %r11;
+        movq %rdi, CTX;
+        movq %rsi, %r11
         movq %rdx, RIO;
 
+        preload_roundkey_dec(17);
         read_block4();
 
         round_dec4(17);
@@ -373,7 +377,7 @@ ENTRY(blowfish_dec_blk_4way)
         write_block4();
 
         popq %rbx;
-        popq %rbp;
+        popq %r12;
 
         ret;
 ENDPROC(blowfish_dec_blk_4way)
diff --git a/arch/x86/crypto/camellia-x86_64-asm_64.S b/arch/x86/crypto/camellia-x86_64-asm_64.S
index 310319c601ed..95ba6956a7f6 100644
--- a/arch/x86/crypto/camellia-x86_64-asm_64.S
+++ b/arch/x86/crypto/camellia-x86_64-asm_64.S
@@ -75,17 +75,17 @@
 #define RCD1bh %dh
 
 #define RT0 %rsi
-#define RT1 %rbp
+#define RT1 %r12
 #define RT2 %r8
 
 #define RT0d %esi
-#define RT1d %ebp
+#define RT1d %r12d
 #define RT2d %r8d
 
 #define RT2bl %r8b
 
 #define RXOR %r9
-#define RRBP %r10
+#define RR12 %r10
 #define RDST %r11
 
 #define RXORd %r9d
@@ -197,7 +197,7 @@ ENTRY(__camellia_enc_blk)
          *      %rdx: src
          *      %rcx: bool xor
          */
-        movq %rbp, RRBP;
+        movq %r12, RR12;
 
         movq %rcx, RXOR;
         movq %rsi, RDST;
@@ -227,13 +227,13 @@ ENTRY(__camellia_enc_blk)
 
         enc_outunpack(mov, RT1);
 
-        movq RRBP, %rbp;
+        movq RR12, %r12;
         ret;
 
 .L__enc_xor:
         enc_outunpack(xor, RT1);
 
-        movq RRBP, %rbp;
+        movq RR12, %r12;
         ret;
 ENDPROC(__camellia_enc_blk)
 
@@ -248,7 +248,7 @@ ENTRY(camellia_dec_blk)
         movl $24, RXORd;
         cmovel RXORd, RT2d; /* max */
 
-        movq %rbp, RRBP;
+        movq %r12, RR12;
         movq %rsi, RDST;
         movq %rdx, RIO;
 
@@ -271,7 +271,7 @@ ENTRY(camellia_dec_blk)
 
         dec_outunpack();
 
-        movq RRBP, %rbp;
+        movq RR12, %r12;
         ret;
 ENDPROC(camellia_dec_blk)
 
@@ -433,7 +433,7 @@ ENTRY(__camellia_enc_blk_2way)
          */
         pushq %rbx;
 
-        movq %rbp, RRBP;
+        movq %r12, RR12;
         movq %rcx, RXOR;
         movq %rsi, RDST;
         movq %rdx, RIO;
@@ -461,14 +461,14 @@ ENTRY(__camellia_enc_blk_2way)
 
         enc_outunpack2(mov, RT2);
 
-        movq RRBP, %rbp;
+        movq RR12, %r12;
         popq %rbx;
         ret;
 
 .L__enc2_xor:
         enc_outunpack2(xor, RT2);
 
-        movq RRBP, %rbp;
+        movq RR12, %r12;
         popq %rbx;
         ret;
 ENDPROC(__camellia_enc_blk_2way)
@@ -485,7 +485,7 @@ ENTRY(camellia_dec_blk_2way)
         cmovel RXORd, RT2d; /* max */
 
         movq %rbx, RXOR;
-        movq %rbp, RRBP;
+        movq %r12, RR12;
         movq %rsi, RDST;
         movq %rdx, RIO;
 
@@ -508,7 +508,7 @@ ENTRY(camellia_dec_blk_2way)
 
         dec_outunpack2();
 
-        movq RRBP, %rbp;
+        movq RR12, %r12;
         movq RXOR, %rbx;
         ret;
 ENDPROC(camellia_dec_blk_2way)
diff --git a/arch/x86/crypto/cast5-avx-x86_64-asm_64.S b/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
index b4a8806234ea..86107c961bb4 100644
--- a/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
+++ b/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
@@ -47,7 +47,7 @@
 /**********************************************************************
   16-way AVX cast5
  **********************************************************************/
-#define CTX %rdi
+#define CTX %r15
 
 #define RL1 %xmm0
 #define RR1 %xmm1
@@ -70,8 +70,8 @@
 
 #define RTMP %xmm15
 
-#define RID1  %rbp
-#define RID1d %ebp
+#define RID1  %rdi
+#define RID1d %edi
 #define RID2  %rsi
 #define RID2d %esi
 
@@ -226,7 +226,7 @@
 .align 16
 __cast5_enc_blk16:
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      RL1: blocks 1 and 2
          *      RR1: blocks 3 and 4
          *      RL2: blocks 5 and 6
@@ -246,9 +246,11 @@ __cast5_enc_blk16:
          *      RR4: encrypted blocks 15 and 16
          */
 
-        pushq %rbp;
+        pushq %r15;
         pushq %rbx;
 
+        movq %rdi, CTX;
+
         vmovdqa .Lbswap_mask, RKM;
         vmovd .Lfirst_mask, R1ST;
         vmovd .L32_mask, R32;
@@ -283,7 +285,7 @@ __cast5_enc_blk16:
 
 .L__skip_enc:
         popq %rbx;
-        popq %rbp;
+        popq %r15;
 
         vmovdqa .Lbswap_mask, RKM;
 
@@ -298,7 +300,7 @@ ENDPROC(__cast5_enc_blk16)
 .align 16
 __cast5_dec_blk16:
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      RL1: encrypted blocks 1 and 2
          *      RR1: encrypted blocks 3 and 4
          *      RL2: encrypted blocks 5 and 6
@@ -318,9 +320,11 @@ __cast5_dec_blk16:
          *      RR4: decrypted blocks 15 and 16
          */
 
-        pushq %rbp;
+        pushq %r15;
         pushq %rbx;
 
+        movq %rdi, CTX;
+
         vmovdqa .Lbswap_mask, RKM;
         vmovd .Lfirst_mask, R1ST;
         vmovd .L32_mask, R32;
@@ -356,7 +360,7 @@ __cast5_dec_blk16:
 
         vmovdqa .Lbswap_mask, RKM;
         popq %rbx;
-        popq %rbp;
+        popq %r15;
 
         outunpack_blocks(RR1, RL1, RTMP, RX, RKM);
         outunpack_blocks(RR2, RL2, RTMP, RX, RKM);
@@ -372,12 +376,14 @@ ENDPROC(__cast5_dec_blk16)
 
 ENTRY(cast5_ecb_enc_16way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
         FRAME_BEGIN
+        pushq %r15;
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
 
         vmovdqu (0*4*4)(%rdx), RL1;
@@ -400,18 +406,22 @@ ENTRY(cast5_ecb_enc_16way)
         vmovdqu RR4, (6*4*4)(%r11);
         vmovdqu RL4, (7*4*4)(%r11);
 
+        popq %r15;
         FRAME_END
         ret;
 ENDPROC(cast5_ecb_enc_16way)
 
 ENTRY(cast5_ecb_dec_16way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
 
         FRAME_BEGIN
+        pushq %r15;
+
+        movq %rdi, CTX;
         movq %rsi, %r11;
 
         vmovdqu (0*4*4)(%rdx), RL1;
@@ -434,20 +444,22 @@ ENTRY(cast5_ecb_dec_16way)
         vmovdqu RR4, (6*4*4)(%r11);
         vmovdqu RL4, (7*4*4)(%r11);
 
+        popq %r15;
         FRAME_END
         ret;
 ENDPROC(cast5_ecb_dec_16way)
 
 ENTRY(cast5_cbc_dec_16way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
         FRAME_BEGIN
-
         pushq %r12;
+        pushq %r15;
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
         movq %rdx, %r12;
 
@@ -483,23 +495,24 @@ ENTRY(cast5_cbc_dec_16way)
         vmovdqu RR4, (6*16)(%r11);
         vmovdqu RL4, (7*16)(%r11);
 
+        popq %r15;
         popq %r12;
-
         FRAME_END
         ret;
 ENDPROC(cast5_cbc_dec_16way)
 
 ENTRY(cast5_ctr_16way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          *      %rcx: iv (big endian, 64bit)
          */
         FRAME_BEGIN
-
         pushq %r12;
+        pushq %r15;
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
         movq %rdx, %r12;
 
@@ -558,8 +571,8 @@ ENTRY(cast5_ctr_16way)
         vmovdqu RR4, (6*16)(%r11);
         vmovdqu RL4, (7*16)(%r11);
 
+        popq %r15;
         popq %r12;
-
         FRAME_END
         ret;
 ENDPROC(cast5_ctr_16way)
diff --git a/arch/x86/crypto/cast6-avx-x86_64-asm_64.S b/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
index 952d3156a933..7f30b6f0d72c 100644
--- a/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
+++ b/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
@@ -47,7 +47,7 @@
 /**********************************************************************
   8-way AVX cast6
  **********************************************************************/
-#define CTX %rdi
+#define CTX %r15
 
 #define RA1 %xmm0
 #define RB1 %xmm1
@@ -70,8 +70,8 @@
 
 #define RTMP %xmm15
 
-#define RID1  %rbp
-#define RID1d %ebp
+#define RID1  %rdi
+#define RID1d %edi
 #define RID2  %rsi
 #define RID2d %esi
 
@@ -264,15 +264,17 @@
 .align 8
 __cast6_enc_blk8:
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2: blocks
          * output:
          *      RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2: encrypted blocks
          */
 
-        pushq %rbp;
+        pushq %r15;
         pushq %rbx;
 
+        movq %rdi, CTX;
+
         vmovdqa .Lbswap_mask, RKM;
         vmovd .Lfirst_mask, R1ST;
         vmovd .L32_mask, R32;
@@ -297,7 +299,7 @@ __cast6_enc_blk8:
         QBAR(11);
 
         popq %rbx;
-        popq %rbp;
+        popq %r15;
 
         vmovdqa .Lbswap_mask, RKM;
 
@@ -310,15 +312,17 @@ ENDPROC(__cast6_enc_blk8)
 .align 8
 __cast6_dec_blk8:
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2: encrypted blocks
          * output:
          *      RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2: decrypted blocks
          */
 
-        pushq %rbp;
+        pushq %r15;
         pushq %rbx;
 
+        movq %rdi, CTX;
+
         vmovdqa .Lbswap_mask, RKM;
         vmovd .Lfirst_mask, R1ST;
         vmovd .L32_mask, R32;
@@ -343,7 +347,7 @@ __cast6_dec_blk8:
         QBAR(0);
 
         popq %rbx;
-        popq %rbp;
+        popq %r15;
 
         vmovdqa .Lbswap_mask, RKM;
         outunpack_blocks(RA1, RB1, RC1, RD1, RTMP, RX, RKRF, RKM);
@@ -354,12 +358,14 @@ ENDPROC(__cast6_dec_blk8)
 
 ENTRY(cast6_ecb_enc_8way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
         FRAME_BEGIN
+        pushq %r15;
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
 
         load_8way(%rdx, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
@@ -368,18 +374,21 @@ ENTRY(cast6_ecb_enc_8way)
 
         store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
 
+        popq %r15;
         FRAME_END
         ret;
 ENDPROC(cast6_ecb_enc_8way)
 
 ENTRY(cast6_ecb_dec_8way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
         FRAME_BEGIN
+        pushq %r15;
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
 
         load_8way(%rdx, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
@@ -388,20 +397,22 @@ ENTRY(cast6_ecb_dec_8way)
 
         store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
 
+        popq %r15;
         FRAME_END
         ret;
 ENDPROC(cast6_ecb_dec_8way)
 
 ENTRY(cast6_cbc_dec_8way)
         /* input:
-         *      %rdi: ctx, CTX
+         *      %rdi: ctx
          *      %rsi: dst
          *      %rdx: src
          */
         FRAME_BEGIN
-
         pushq %r12;
+        pushq %r15;
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
         movq %rdx, %r12;
 
@@ -411,8 +422,8 @@ ENTRY(cast6_cbc_dec_8way)
 
         store_cbc_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
 
+        popq %r15;
         popq %r12;
-
         FRAME_END
         ret;
 ENDPROC(cast6_cbc_dec_8way)
@@ -425,9 +436,10 @@ ENTRY(cast6_ctr_8way)
          *      %rcx: iv (little endian, 128bit)
          */
         FRAME_BEGIN
-
         pushq %r12;
+        pushq %r15
 
+        movq %rdi, CTX;
         movq %rsi, %r11;
         movq %rdx, %r12;
 
@@ -438,8 +450,8 @@ ENTRY(cast6_ctr_8way)
 
         store_ctr_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
 
+        popq %r15;
         popq %r12;
-
         FRAME_END
         ret;
 ENDPROC(cast6_ctr_8way)
@@ -452,7 +464,9 @@ ENTRY(cast6_xts_enc_8way)
          *      %rcx: iv (t ⊕ αⁿ ∈ GF(2¹²⁸))
          */
         FRAME_BEGIN
+        pushq %r15;
 
+        movq %rdi, CTX
         movq %rsi, %r11;
 
         /* regs <= src, dst <= IVs, regs <= regs xor IVs */
@@ -464,6 +478,7 @@ ENTRY(cast6_xts_enc_8way)
         /* dst <= regs xor IVs(in dst) */
         store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
 
+        popq %r15;
         FRAME_END
         ret;
 ENDPROC(cast6_xts_enc_8way)
@@ -476,7 +491,9 @@ ENTRY(cast6_xts_dec_8way)
          *      %rcx: iv (t ⊕ αⁿ ∈ GF(2¹²⁸))
          */
         FRAME_BEGIN
+        pushq %r15;
 
+        movq %rdi, CTX
         movq %rsi, %r11;
 
         /* regs <= src, dst <= IVs, regs <= regs xor IVs */
@@ -488,6 +505,7 @@ ENTRY(cast6_xts_dec_8way)
         /* dst <= regs xor IVs(in dst) */
         store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
 
+        popq %r15;
         FRAME_END
         ret;
 ENDPROC(cast6_xts_dec_8way)
diff --git a/arch/x86/crypto/des3_ede-asm_64.S b/arch/x86/crypto/des3_ede-asm_64.S
index f3e91647ca27..8e49ce117494 100644
--- a/arch/x86/crypto/des3_ede-asm_64.S
+++ b/arch/x86/crypto/des3_ede-asm_64.S
@@ -64,12 +64,12 @@
 #define RW2bh %ch
 
 #define RT0 %r15
-#define RT1 %rbp
+#define RT1 %rsi
 #define RT2 %r14
 #define RT3 %rdx
 
 #define RT0d %r15d
-#define RT1d %ebp
+#define RT1d %esi
 #define RT2d %r14d
 #define RT3d %edx
 
@@ -177,13 +177,14 @@ ENTRY(des3_ede_x86_64_crypt_blk)
          *      %rsi: dst
          *      %rdx: src
          */
-        pushq %rbp;
         pushq %rbx;
         pushq %r12;
         pushq %r13;
         pushq %r14;
         pushq %r15;
 
+        pushq %rsi; /* dst */
+
         read_block(%rdx, RL0, RR0);
         initial_permutation(RL0, RR0);
 
@@ -241,6 +242,8 @@ ENTRY(des3_ede_x86_64_crypt_blk)
         round1(32+15, RL0, RR0, dummy2);
 
         final_permutation(RR0, RL0);
+
+        popq %rsi /* dst */
         write_block(%rsi, RR0, RL0);
 
         popq %r15;
@@ -248,7 +251,6 @@ ENTRY(des3_ede_x86_64_crypt_blk)
         popq %r13;
         popq %r12;
         popq %rbx;
-        popq %rbp;
 
         ret;
 ENDPROC(des3_ede_x86_64_crypt_blk)
@@ -432,13 +434,14 @@ ENTRY(des3_ede_x86_64_crypt_blk_3way)
          *      %rdx: src (3 blocks)
          */
 
-        pushq %rbp;
         pushq %rbx;
         pushq %r12;
         pushq %r13;
         pushq %r14;
         pushq %r15;
 
+        pushq %rsi /* dst */
+
         /* load input */
         movl 0 * 4(%rdx), RL0d;
         movl 1 * 4(%rdx), RR0d;
@@ -520,6 +523,7 @@ ENTRY(des3_ede_x86_64_crypt_blk_3way)
         bswapl RR2d;
         bswapl RL2d;
 
+        popq %rsi /* dst */
         movl RR0d, 0 * 4(%rsi);
         movl RL0d, 1 * 4(%rsi);
         movl RR1d, 2 * 4(%rsi);
@@ -532,7 +536,6 @@ ENTRY(des3_ede_x86_64_crypt_blk_3way)
         popq %r13;
         popq %r12;
         popq %rbx;
-        popq %rbp;
 
         ret;
 ENDPROC(des3_ede_x86_64_crypt_blk_3way)
diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
index 1eab79c9ac48..9f712a7dfd79 100644
--- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S
+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
@@ -89,7 +89,7 @@
 #define REG_RE  %rdx
 #define REG_RTA %r12
 #define REG_RTB %rbx
-#define REG_T1  %ebp
+#define REG_T1  %r11d
 #define xmm_mov vmovups
 #define avx2_zeroupper  vzeroupper
 #define RND_F1  1
@@ -637,7 +637,6 @@ _loop3:
         ENTRY(\name)
 
         push    %rbx
-        push    %rbp
         push    %r12
         push    %r13
         push    %r14
@@ -673,7 +672,6 @@ _loop3:
         pop     %r14
         pop     %r13
         pop     %r12
-        pop     %rbp
         pop     %rbx
 
         ret
diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
index a4109506a5e8..6204bd53528c 100644
--- a/arch/x86/crypto/sha1_ssse3_asm.S
+++ b/arch/x86/crypto/sha1_ssse3_asm.S
@@ -37,7 +37,7 @@
 #define REG_A   %ecx
 #define REG_B   %esi
 #define REG_C   %edi
-#define REG_D   %ebp
+#define REG_D   %r12d
 #define REG_E   %edx
 
 #define REG_T1  %eax
@@ -74,10 +74,10 @@
         ENTRY(\name)
 
         push    %rbx
-        push    %rbp
         push    %r12
+        push    %rbp
+        mov     %rsp, %rbp
 
-        mov     %rsp, %r12
         sub     $64, %rsp               # allocate workspace
         and     $~15, %rsp              # align stack
 
@@ -99,10 +99,9 @@
         xor     %rax, %rax
         rep stosq
 
-        mov     %r12, %rsp              # deallocate workspace
-
-        pop     %r12
+        mov     %rbp, %rsp              # deallocate workspace
         pop     %rbp
+        pop     %r12
         pop     %rbx
         ret
 
diff --git a/arch/x86/crypto/sha256-avx-asm.S b/arch/x86/crypto/sha256-avx-asm.S
index e08888a1a5f2..001bbcf93c79 100644
--- a/arch/x86/crypto/sha256-avx-asm.S
+++ b/arch/x86/crypto/sha256-avx-asm.S
@@ -103,7 +103,7 @@ SRND = %rsi       # clobbers INP
 c = %ecx
 d = %r8d
 e = %edx
-TBL = %rbp
+TBL = %r12
 a = %eax
 b = %ebx
 
@@ -350,13 +350,13 @@ a = TMP_
 ENTRY(sha256_transform_avx)
 .align 32
         pushq   %rbx
-        pushq   %rbp
+        pushq   %r12
         pushq   %r13
         pushq   %r14
         pushq   %r15
-        pushq   %r12
+        pushq   %rbp
+        movq    %rsp, %rbp
 
-        mov     %rsp, %r12
         subq    $STACK_SIZE, %rsp       # allocate stack space
         and     $~15, %rsp              # align stack pointer
 
@@ -452,13 +452,12 @@ loop2:
 
 done_hash:
 
-        mov     %r12, %rsp
-
-        popq    %r12
+        mov     %rbp, %rsp
+        popq    %rbp
         popq    %r15
         popq    %r14
         popq    %r13
-        popq    %rbp
+        popq    %r12
         popq    %rbx
         ret
 ENDPROC(sha256_transform_avx)
diff --git a/arch/x86/crypto/sha256-avx2-asm.S b/arch/x86/crypto/sha256-avx2-asm.S
index 89c8f09787d2..1420db15dcdd 100644
--- a/arch/x86/crypto/sha256-avx2-asm.S
+++ b/arch/x86/crypto/sha256-avx2-asm.S
@@ -98,8 +98,6 @@ d	= %r8d
 e       = %edx  # clobbers NUM_BLKS
 y3      = %esi  # clobbers INP
 
-
-TBL     = %rbp
 SRND    = CTX   # SRND is same register as CTX
 
 a = %eax
@@ -531,7 +529,6 @@ STACK_SIZE	= _RSP      + _RSP_SIZE
 ENTRY(sha256_transform_rorx)
 .align 32
         pushq   %rbx
-        pushq   %rbp
         pushq   %r12
         pushq   %r13
         pushq   %r14
@@ -568,8 +565,6 @@ ENTRY(sha256_transform_rorx)
         mov     CTX, _CTX(%rsp)
 
 loop0:
-        lea     K256(%rip), TBL
-
         ## Load first 16 dwords from two blocks
         VMOVDQ  0*32(INP),XTMP0
         VMOVDQ  1*32(INP),XTMP1
@@ -597,19 +592,19 @@ last_block_enter:
 
 .align 16
 loop1:
-        vpaddd  0*32(TBL, SRND), X0, XFER
+        vpaddd  K256+0*32(SRND), X0, XFER
         vmovdqa XFER, 0*32+_XFER(%rsp, SRND)
         FOUR_ROUNDS_AND_SCHED   _XFER + 0*32
 
-        vpaddd  1*32(TBL, SRND), X0, XFER
+        vpaddd  K256+1*32(SRND), X0, XFER
         vmovdqa XFER, 1*32+_XFER(%rsp, SRND)
         FOUR_ROUNDS_AND_SCHED   _XFER + 1*32
 
-        vpaddd  2*32(TBL, SRND), X0, XFER
+        vpaddd  K256+2*32(SRND), X0, XFER
         vmovdqa XFER, 2*32+_XFER(%rsp, SRND)
         FOUR_ROUNDS_AND_SCHED   _XFER + 2*32
 
-        vpaddd  3*32(TBL, SRND), X0, XFER
+        vpaddd  K256+3*32(SRND), X0, XFER
         vmovdqa XFER, 3*32+_XFER(%rsp, SRND)
         FOUR_ROUNDS_AND_SCHED   _XFER + 3*32
 
@@ -619,10 +614,11 @@ loop1:
 
 loop2:
         ## Do last 16 rounds with no scheduling
-        vpaddd  0*32(TBL, SRND), X0, XFER
+        vpaddd  K256+0*32(SRND), X0, XFER
         vmovdqa XFER, 0*32+_XFER(%rsp, SRND)
         DO_4ROUNDS      _XFER + 0*32
-        vpaddd  1*32(TBL, SRND), X1, XFER
+
+        vpaddd  K256+1*32(SRND), X1, XFER
         vmovdqa XFER, 1*32+_XFER(%rsp, SRND)
         DO_4ROUNDS      _XFER + 1*32
         add     $2*32, SRND
@@ -676,9 +672,6 @@ loop3:
         ja      done_hash
 
 do_last_block:
-        #### do last block
-        lea     K256(%rip), TBL
-
         VMOVDQ  0*16(INP),XWORD0
         VMOVDQ  1*16(INP),XWORD1
         VMOVDQ  2*16(INP),XWORD2
@@ -718,7 +711,6 @@ done_hash:
         popq    %r14
         popq    %r13
         popq    %r12
-        popq    %rbp
         popq    %rbx
         ret
 ENDPROC(sha256_transform_rorx)
diff --git a/arch/x86/crypto/sha256-ssse3-asm.S b/arch/x86/crypto/sha256-ssse3-asm.S
index 39b83c93e7fd..c6c05ed2c16a 100644
--- a/arch/x86/crypto/sha256-ssse3-asm.S
+++ b/arch/x86/crypto/sha256-ssse3-asm.S
@@ -95,7 +95,7 @@ SRND = %rsi       # clobbers INP
 c = %ecx
 d = %r8d
 e = %edx
-TBL = %rbp
+TBL = %r12
 a = %eax
 b = %ebx
 
@@ -356,13 +356,13 @@ a = TMP_
 ENTRY(sha256_transform_ssse3)
 .align 32
         pushq   %rbx
-        pushq   %rbp
+        pushq   %r12
         pushq   %r13
         pushq   %r14
         pushq   %r15
-        pushq   %r12
+        pushq   %rbp
+        mov     %rsp, %rbp
 
-        mov     %rsp, %r12
         subq    $STACK_SIZE, %rsp
         and     $~15, %rsp
 
@@ -462,13 +462,12 @@ loop2:
 
 done_hash:
 
-        mov     %r12, %rsp
-
-        popq    %r12
+        mov     %rbp, %rsp
+        popq    %rbp
         popq    %r15
         popq    %r14
         popq    %r13
-        popq    %rbp
+        popq    %r12
         popq    %rbx
 
         ret
diff --git a/arch/x86/crypto/sha512-avx2-asm.S b/arch/x86/crypto/sha512-avx2-asm.S
index 7f5f6c6ec72e..b16d56005162 100644
--- a/arch/x86/crypto/sha512-avx2-asm.S
+++ b/arch/x86/crypto/sha512-avx2-asm.S
@@ -69,8 +69,9 @@ XFER  = YTMP0
 
 BYTE_FLIP_MASK  = %ymm9
 
-# 1st arg
-CTX         = %rdi
+# 1st arg is %rdi, which is saved to the stack and accessed later via %r12
+CTX1        = %rdi
+CTX2        = %r12
 # 2nd arg
 INP         = %rsi
 # 3rd arg
@@ -81,7 +82,7 @@ d           = %r8
 e           = %rdx
 y3          = %rsi
 
-TBL   = %rbp
+TBL   = %rdi # clobbers CTX1
 
 a     = %rax
 b     = %rbx
@@ -91,26 +92,26 @@ g     = %r10
 h     = %r11
 old_h = %r11
 
-T1    = %r12
+T1    = %r12 # clobbers CTX2
 y0    = %r13
 y1    = %r14
 y2    = %r15
 
-y4    = %r12
-
 # Local variables (stack frame)
 XFER_SIZE = 4*8
 SRND_SIZE = 1*8
 INP_SIZE = 1*8
 INPEND_SIZE = 1*8
+CTX_SIZE = 1*8
 RSPSAVE_SIZE = 1*8
-GPRSAVE_SIZE = 6*8
+GPRSAVE_SIZE = 5*8
 
 frame_XFER = 0
 frame_SRND = frame_XFER + XFER_SIZE
 frame_INP = frame_SRND + SRND_SIZE
 frame_INPEND = frame_INP + INP_SIZE
-frame_RSPSAVE = frame_INPEND + INPEND_SIZE
+frame_CTX = frame_INPEND + INPEND_SIZE
+frame_RSPSAVE = frame_CTX + CTX_SIZE
 frame_GPRSAVE = frame_RSPSAVE + RSPSAVE_SIZE
 frame_size = frame_GPRSAVE + GPRSAVE_SIZE
 
@@ -576,12 +577,11 @@ ENTRY(sha512_transform_rorx)
         mov     %rax, frame_RSPSAVE(%rsp)
 
         # Save GPRs
-        mov     %rbp, frame_GPRSAVE(%rsp)
-        mov     %rbx, 8*1+frame_GPRSAVE(%rsp)
-        mov     %r12, 8*2+frame_GPRSAVE(%rsp)
-        mov     %r13, 8*3+frame_GPRSAVE(%rsp)
-        mov     %r14, 8*4+frame_GPRSAVE(%rsp)
-        mov     %r15, 8*5+frame_GPRSAVE(%rsp)
+        mov     %rbx, 8*0+frame_GPRSAVE(%rsp)
+        mov     %r12, 8*1+frame_GPRSAVE(%rsp)
+        mov     %r13, 8*2+frame_GPRSAVE(%rsp)
+        mov     %r14, 8*3+frame_GPRSAVE(%rsp)
+        mov     %r15, 8*4+frame_GPRSAVE(%rsp)
 
         shl     $7, NUM_BLKS    # convert to bytes
         jz      done_hash
@@ -589,14 +589,17 @@ ENTRY(sha512_transform_rorx)
         mov     NUM_BLKS, frame_INPEND(%rsp)
 
         ## load initial digest
-        mov     8*0(CTX),a
-        mov     8*1(CTX),b
-        mov     8*2(CTX),c
-        mov     8*3(CTX),d
-        mov     8*4(CTX),e
-        mov     8*5(CTX),f
-        mov     8*6(CTX),g
-        mov     8*7(CTX),h
+        mov     8*0(CTX1), a
+        mov     8*1(CTX1), b
+        mov     8*2(CTX1), c
+        mov     8*3(CTX1), d
+        mov     8*4(CTX1), e
+        mov     8*5(CTX1), f
+        mov     8*6(CTX1), g
+        mov     8*7(CTX1), h
+
+        # save %rdi (CTX) before it gets clobbered
+        mov     %rdi, frame_CTX(%rsp)
 
         vmovdqa PSHUFFLE_BYTE_FLIP_MASK(%rip), BYTE_FLIP_MASK
 
@@ -652,14 +655,15 @@ loop2:
         subq    $1, frame_SRND(%rsp)
         jne     loop2
 
-        addm    8*0(CTX),a
-        addm    8*1(CTX),b
-        addm    8*2(CTX),c
-        addm    8*3(CTX),d
-        addm    8*4(CTX),e
-        addm    8*5(CTX),f
-        addm    8*6(CTX),g
-        addm    8*7(CTX),h
+        mov     frame_CTX(%rsp), CTX2
+        addm    8*0(CTX2), a
+        addm    8*1(CTX2), b
+        addm    8*2(CTX2), c
+        addm    8*3(CTX2), d
+        addm    8*4(CTX2), e
+        addm    8*5(CTX2), f
+        addm    8*6(CTX2), g
+        addm    8*7(CTX2), h
 
         mov     frame_INP(%rsp), INP
         add     $128, INP
@@ -669,12 +673,11 @@ loop2:
 done_hash:
 
 # Restore GPRs
-        mov     frame_GPRSAVE(%rsp)     ,%rbp
-        mov     8*1+frame_GPRSAVE(%rsp) ,%rbx
-        mov     8*2+frame_GPRSAVE(%rsp) ,%r12
-        mov     8*3+frame_GPRSAVE(%rsp) ,%r13
-        mov     8*4+frame_GPRSAVE(%rsp) ,%r14
-        mov     8*5+frame_GPRSAVE(%rsp) ,%r15
+        mov     8*0+frame_GPRSAVE(%rsp), %rbx
+        mov     8*1+frame_GPRSAVE(%rsp), %r12
+        mov     8*2+frame_GPRSAVE(%rsp), %r13
+        mov     8*3+frame_GPRSAVE(%rsp), %r14
+        mov     8*4+frame_GPRSAVE(%rsp), %r15
 
         # Restore Stack Pointer
         mov     frame_RSPSAVE(%rsp), %rsp
diff --git a/arch/x86/crypto/twofish-avx-x86_64-asm_64.S b/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
index b3f49d286348..73b471da3622 100644
--- a/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
+++ b/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
@@ -76,8 +76,8 @@
 #define RT %xmm14
 #define RR %xmm15
 
-#define RID1  %rbp
-#define RID1d %ebp
+#define RID1  %r13
+#define RID1d %r13d
 #define RID2  %rsi
 #define RID2d %esi
 
@@ -259,7 +259,7 @@ __twofish_enc_blk8:
 
         vmovdqu w(CTX), RK1;
 
-        pushq %rbp;
+        pushq %r13;
         pushq %rbx;
         pushq %rcx;
 
@@ -282,7 +282,7 @@ __twofish_enc_blk8:
 
         popq %rcx;
         popq %rbx;
-        popq %rbp;
+        popq %r13;
 
         outunpack_blocks(RC1, RD1, RA1, RB1, RK1, RX0, RY0, RK2);
         outunpack_blocks(RC2, RD2, RA2, RB2, RK1, RX0, RY0, RK2);
@@ -301,7 +301,7 @@ __twofish_dec_blk8:
 
         vmovdqu (w+4*4)(CTX), RK1;
 
-        pushq %rbp;
+        pushq %r13;
         pushq %rbx;
 
         inpack_blocks(RC1, RD1, RA1, RB1, RK1, RX0, RY0, RK2);
@@ -322,7 +322,7 @@ __twofish_dec_blk8:
         vmovdqu (w)(CTX), RK1;
 
         popq %rbx;
-        popq %rbp;
+        popq %r13;
 
         outunpack_blocks(RA1, RB1, RC1, RD1, RK1, RX0, RY0, RK2);
         outunpack_blocks(RA2, RB2, RC2, RD2, RK1, RX0, RY0, RK2);
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 829e89cfcee2..9fb9a1f1e47b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4409,10 +4409,9 @@ static __init int fixup_ht_bug(void)
                 return 0;
         }
 
-        if (lockup_detector_suspend() != 0) {
-                pr_debug("failed to disable PMU erratum BJ122, BV98, HSD29 workaround\n");
-                return 0;
-        }
+        cpus_read_lock();
+
+        hardlockup_detector_perf_stop();
 
         x86_pmu.flags &= ~(PMU_FL_EXCL_CNTRS | PMU_FL_EXCL_ENABLED);
 
@@ -4420,9 +4419,7 @@ static __init int fixup_ht_bug(void)
         x86_pmu.commit_scheduling = NULL;
         x86_pmu.stop_scheduling = NULL;
 
-        lockup_detector_resume();
-
-        cpus_read_lock();
+        hardlockup_detector_perf_restart();
 
         for_each_online_cpu(c)
                 free_excl_cntrs(c);
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 4cf100ff2a37..72db0664a53d 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -552,6 +552,7 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
 
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_MOBILE,  snb_cstates),
         X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_DESKTOP, snb_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_SKYLAKE_X, snb_cstates),
 
         X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_MOBILE,  snb_cstates),
         X86_CSTATES_MODEL(INTEL_FAM6_KABYLAKE_DESKTOP, snb_cstates),
@@ -560,6 +561,9 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
         X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNM, knl_cstates),
 
         X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT, glm_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_ATOM_DENVERTON, glm_cstates),
+
+        X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GEMINI_LAKE, glm_cstates),
         { },
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 8e2457cb6b4a..005908ee9333 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -775,6 +775,9 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = {
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_KABYLAKE_DESKTOP, skl_rapl_init),
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GOLDMONT, hsw_rapl_init),
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_DENVERTON, hsw_rapl_init),
+
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_ATOM_GEMINI_LAKE, hsw_rapl_init),
         {},
 };
 
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index db1fe377e6dd..a7196818416a 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3462,7 +3462,7 @@ static struct intel_uncore_ops skx_uncore_iio_ops = {
 static struct intel_uncore_type skx_uncore_iio = {
         .name                   = "iio",
         .num_counters           = 4,
-        .num_boxes              = 5,
+        .num_boxes              = 6,
         .perf_ctr_bits          = 48,
         .event_ctl              = SKX_IIO0_MSR_PMON_CTL0,
         .perf_ctr               = SKX_IIO0_MSR_PMON_CTR0,
@@ -3492,7 +3492,7 @@ static const struct attribute_group skx_uncore_format_group = {
 static struct intel_uncore_type skx_uncore_irp = {
         .name                   = "irp",
         .num_counters           = 2,
-        .num_boxes              = 5,
+        .num_boxes              = 6,
         .perf_ctr_bits          = 48,
         .event_ctl              = SKX_IRP0_MSR_PMON_CTL0,
         .perf_ctr               = SKX_IRP0_MSR_PMON_CTR0,
diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
index 4bb3ec69e8ea..06723671ae4e 100644
--- a/arch/x86/events/msr.c
+++ b/arch/x86/events/msr.c
@@ -63,6 +63,14 @@ static bool test_intel(int idx)
         case INTEL_FAM6_ATOM_SILVERMONT1:
         case INTEL_FAM6_ATOM_SILVERMONT2:
         case INTEL_FAM6_ATOM_AIRMONT:
+
+        case INTEL_FAM6_ATOM_GOLDMONT:
+        case INTEL_FAM6_ATOM_DENVERTON:
+
+        case INTEL_FAM6_ATOM_GEMINI_LAKE:
+
+        case INTEL_FAM6_XEON_PHI_KNL:
+        case INTEL_FAM6_XEON_PHI_KNM:
                 if (idx == PERF_MSR_SMI)
                         return true;
                 break;
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index e0bb46c02857..0e2a5edbce00 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -231,7 +231,7 @@ static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
                  ksig->ka.sa.sa_restorer)
                 sp = (unsigned long) ksig->ka.sa.sa_restorer;
 
-        if (fpu->fpstate_active) {
+        if (fpu->initialized) {
                 unsigned long fx_aligned, math_size;
 
                 sp = fpu__alloc_mathframe(sp, 1, &fx_aligned, &math_size);
diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
index 1b020381ab38..c096624137ae 100644
--- a/arch/x86/include/asm/alternative.h
+++ b/arch/x86/include/asm/alternative.h
@@ -218,10 +218,9 @@ static inline int alternatives_text_reserved(void *start, void *end)
 #define alternative_call_2(oldfunc, newfunc1, feature1, newfunc2, feature2,   \
                            output, input...)                                  \
 {                                                                             \
-        register void *__sp asm(_ASM_SP);                                     \
         asm volatile (ALTERNATIVE_2("call %P[old]", "call %P[new1]", feature1,\
                 "call %P[new2]", feature2)                                    \
-                : output, "+r" (__sp)                                         \
+                : output, ASM_CALL_CONSTRAINT                                 \
                 : [old] "i" (oldfunc), [new1] "i" (newfunc1),                 \
                   [new2] "i" (newfunc2), ## input);                           \
 }
diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
index 676ee5807d86..b0dc91f4bedc 100644
--- a/arch/x86/include/asm/asm.h
+++ b/arch/x86/include/asm/asm.h
@@ -11,10 +11,12 @@
 # define __ASM_FORM_COMMA(x) " " #x ","
 #endif
 
-#ifdef CONFIG_X86_32
+#ifndef __x86_64__
+/* 32 bit */
 # define __ASM_SEL(a,b) __ASM_FORM(a)
 # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a)
 #else
+/* 64 bit */
 # define __ASM_SEL(a,b) __ASM_FORM(b)
 # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(b)
 #endif
@@ -132,4 +134,15 @@
 /* For C file, we already have NOKPROBE_SYMBOL macro */
 #endif
 
+#ifndef __ASSEMBLY__
+/*
+ * This output constraint should be used for any inline asm which has a "call"
+ * instruction.  Otherwise the asm may be inserted before the frame pointer
+ * gets set up by the containing function.  If you forget to do this, objtool
+ * may print a "call without frame pointer save/setup" warning.
+ */
+register unsigned long current_stack_pointer asm(_ASM_SP);
+#define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
+#endif
+
 #endif /* _ASM_X86_ASM_H */
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 554cdb205d17..e3221ffa304e 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -23,11 +23,9 @@
 /*
  * High level FPU state handling functions:
  */
-extern void fpu__activate_curr(struct fpu *fpu);
-extern void fpu__activate_fpstate_read(struct fpu *fpu);
-extern void fpu__activate_fpstate_write(struct fpu *fpu);
-extern void fpu__current_fpstate_write_begin(void);
-extern void fpu__current_fpstate_write_end(void);
+extern void fpu__initialize(struct fpu *fpu);
+extern void fpu__prepare_read(struct fpu *fpu);
+extern void fpu__prepare_write(struct fpu *fpu);
 extern void fpu__save(struct fpu *fpu);
 extern void fpu__restore(struct fpu *fpu);
 extern int  fpu__restore_sig(void __user *buf, int ia32_frame);
@@ -120,20 +118,11 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
         err;                                                            \
 })
 
-#define check_insn(insn, output, input...)                              \
-({                                                                      \
-        int err;                                                        \
+#define kernel_insn(insn, output, input...)                             \
         asm volatile("1:" #insn "\n\t"                                  \
                      "2:\n"                                             \
-                     ".section .fixup,\"ax\"\n"                         \
-                     "3:  movl $-1,%[err]\n"                            \
-                     "    jmp  2b\n"                                    \
-                     ".previous\n"                                      \
-                     _ASM_EXTABLE(1b, 3b)                               \
-                     : [err] "=r" (err), output                         \
-                     : "0"(0), input);                                  \
-        err;                                                            \
-})
+                     _ASM_EXTABLE_HANDLE(1b, 2b, ex_handler_fprestore)  \
+                     : output : input)
 
 static inline int copy_fregs_to_user(struct fregs_state __user *fx)
 {
@@ -153,20 +142,16 @@ static inline int copy_fxregs_to_user(struct fxregs_state __user *fx)
 
 static inline void copy_kernel_to_fxregs(struct fxregs_state *fx)
 {
-        int err;
-
         if (IS_ENABLED(CONFIG_X86_32)) {
-                err = check_insn(fxrstor %[fx], "=m" (*fx), [fx] "m" (*fx));
+                kernel_insn(fxrstor %[fx], "=m" (*fx), [fx] "m" (*fx));
         } else {
                 if (IS_ENABLED(CONFIG_AS_FXSAVEQ)) {
-                        err = check_insn(fxrstorq %[fx], "=m" (*fx), [fx] "m" (*fx));
+                        kernel_insn(fxrstorq %[fx], "=m" (*fx), [fx] "m" (*fx));
                 } else {
                         /* See comment in copy_fxregs_to_kernel() below. */
-                        err = check_insn(rex64/fxrstor (%[fx]), "=m" (*fx), [fx] "R" (fx), "m" (*fx));
+                        kernel_insn(rex64/fxrstor (%[fx]), "=m" (*fx), [fx] "R" (fx), "m" (*fx));
                 }
         }
-        /* Copying from a kernel buffer to FPU registers should never fail: */
-        WARN_ON_FPU(err);
 }
 
 static inline int copy_user_to_fxregs(struct fxregs_state __user *fx)
@@ -183,9 +168,7 @@ static inline int copy_user_to_fxregs(struct fxregs_state __user *fx)
 
 static inline void copy_kernel_to_fregs(struct fregs_state *fx)
 {
-        int err = check_insn(frstor %[fx], "=m" (*fx), [fx] "m" (*fx));
-
-        WARN_ON_FPU(err);
+        kernel_insn(frstor %[fx], "=m" (*fx), [fx] "m" (*fx));
 }
 
 static inline int copy_user_to_fregs(struct fregs_state __user *fx)
@@ -281,18 +264,13 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu)
  * Use XRSTORS to restore context if it is enabled. XRSTORS supports compact
  * XSAVE area format.
  */
-#define XSTATE_XRESTORE(st, lmask, hmask, err)                          \
+#define XSTATE_XRESTORE(st, lmask, hmask)                               \
         asm volatile(ALTERNATIVE(XRSTOR,                                \
                                  XRSTORS, X86_FEATURE_XSAVES)           \
                      "\n"                                               \
-                     "xor %[err], %[err]\n"                             \
                      "3:\n"                                             \
-                     ".pushsection .fixup,\"ax\"\n"                     \
-                     "4: movl $-2, %[err]\n"                            \
-                     "jmp 3b\n"                                         \
-                     ".popsection\n"                                    \
-                     _ASM_EXTABLE(661b, 4b)                             \
-                     : [err] "=r" (err)                                 \
+                     _ASM_EXTABLE_HANDLE(661b, 3b, ex_handler_fprestore)\
+                     :                                                  \
                      : "D" (st), "m" (*st), "a" (lmask), "d" (hmask)    \
                      : "memory")
 
@@ -336,7 +314,10 @@ static inline void copy_kernel_to_xregs_booting(struct xregs_state *xstate)
         else
                 XSTATE_OP(XRSTOR, xstate, lmask, hmask, err);
 
-        /* We should never fault when copying from a kernel buffer: */
+        /*
+         * We should never fault when copying from a kernel buffer, and the FPU
+         * state we set at boot time should be valid.
+         */
         WARN_ON_FPU(err);
 }
 
@@ -350,7 +331,7 @@ static inline void copy_xregs_to_kernel(struct xregs_state *xstate)
         u32 hmask = mask >> 32;
         int err;
 
-        WARN_ON(!alternatives_patched);
+        WARN_ON_FPU(!alternatives_patched);
 
         XSTATE_XSAVE(xstate, lmask, hmask, err);
 
@@ -365,12 +346,8 @@ static inline void copy_kernel_to_xregs(struct xregs_state *xstate, u64 mask)
 {
         u32 lmask = mask;
         u32 hmask = mask >> 32;
-        int err;
-
-        XSTATE_XRESTORE(xstate, lmask, hmask, err);
 
-        /* We should never fault when copying from a kernel buffer: */
-        WARN_ON_FPU(err);
+        XSTATE_XRESTORE(xstate, lmask, hmask);
 }
 
 /*
@@ -526,38 +503,17 @@ static inline int fpregs_state_valid(struct fpu *fpu, unsigned int cpu)
  */
 static inline void fpregs_deactivate(struct fpu *fpu)
 {
-        WARN_ON_FPU(!fpu->fpregs_active);
-
-        fpu->fpregs_active = 0;
         this_cpu_write(fpu_fpregs_owner_ctx, NULL);
         trace_x86_fpu_regs_deactivated(fpu);
 }
 
 static inline void fpregs_activate(struct fpu *fpu)
 {
-        WARN_ON_FPU(fpu->fpregs_active);
-
-        fpu->fpregs_active = 1;
         this_cpu_write(fpu_fpregs_owner_ctx, fpu);
         trace_x86_fpu_regs_activated(fpu);
 }
 
 /*
- * The question "does this thread have fpu access?"
- * is slightly racy, since preemption could come in
- * and revoke it immediately after the test.
- *
- * However, even in that very unlikely scenario,
- * we can just assume we have FPU access - typically
- * to save the FP state - we'll just take a #NM
- * fault and get the FPU access back.
- */
-static inline int fpregs_active(void)
-{
-        return current->thread.fpu.fpregs_active;
-}
-
-/*
  * FPU state switching for scheduling.
  *
  * This is a two-stage process:
@@ -571,14 +527,13 @@ static inline int fpregs_active(void)
 static inline void
 switch_fpu_prepare(struct fpu *old_fpu, int cpu)
 {
-        if (old_fpu->fpregs_active) {
+        if (old_fpu->initialized) {
                 if (!copy_fpregs_to_fpstate(old_fpu))
                         old_fpu->last_cpu = -1;
                 else
                         old_fpu->last_cpu = cpu;
 
                 /* But leave fpu_fpregs_owner_ctx! */
-                old_fpu->fpregs_active = 0;
                 trace_x86_fpu_regs_deactivated(old_fpu);
         } else
                 old_fpu->last_cpu = -1;
@@ -595,7 +550,7 @@ switch_fpu_prepare(struct fpu *old_fpu, int cpu)
 static inline void switch_fpu_finish(struct fpu *new_fpu, int cpu)
 {
         bool preload = static_cpu_has(X86_FEATURE_FPU) &&
-                       new_fpu->fpstate_active;
+                       new_fpu->initialized;
 
         if (preload) {
                 if (!fpregs_state_valid(new_fpu, cpu))
@@ -617,8 +572,7 @@ static inline void user_fpu_begin(void)
         struct fpu *fpu = &current->thread.fpu;
 
         preempt_disable();
-        if (!fpregs_active())
-                fpregs_activate(fpu);
+        fpregs_activate(fpu);
         preempt_enable();
 }
 
diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h
index 3c80f5b9c09d..a1520575d86b 100644
--- a/arch/x86/include/asm/fpu/types.h
+++ b/arch/x86/include/asm/fpu/types.h
@@ -68,6 +68,9 @@ struct fxregs_state {
 /* Default value for fxregs_state.mxcsr: */
 #define MXCSR_DEFAULT           0x1f80
 
+/* Copy both mxcsr & mxcsr_flags with a single u64 memcpy: */
+#define MXCSR_AND_FLAGS_SIZE sizeof(u64)
+
 /*
  * Software based FPU emulation state. This is arbitrary really,
  * it matches the x87 format to make it easier to understand:
@@ -290,36 +293,13 @@ struct fpu {
         unsigned int                    last_cpu;
 
         /*
-         * @fpstate_active:
+         * @initialized:
          *
-         * This flag indicates whether this context is active: if the task
+         * This flag indicates whether this context is initialized: if the task
          * is not running then we can restore from this context, if the task
          * is running then we should save into this context.
          */
-        unsigned char                   fpstate_active;
-
-        /*
-         * @fpregs_active:
-         *
-         * This flag determines whether a given context is actively
-         * loaded into the FPU's registers and that those registers
-         * represent the task's current FPU state.
-         *
-         * Note the interaction with fpstate_active:
-         *
-         *   # task does not use the FPU:
-         *   fpstate_active == 0
-         *
-         *   # task uses the FPU and regs are active:
-         *   fpstate_active == 1 && fpregs_active == 1
-         *
-         *   # the regs are inactive but still match fpstate:
-         *   fpstate_active == 1 && fpregs_active == 0 && fpregs_owner == fpu
-         *
-         * The third state is what we use for the lazy restore optimization
-         * on lazy-switching CPUs.
-         */
-        unsigned char                   fpregs_active;
+        unsigned char                   initialized;
 
         /*
          * @state:
diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h
index 1b2799e0699a..83fee2469eb7 100644
--- a/arch/x86/include/asm/fpu/xstate.h
+++ b/arch/x86/include/asm/fpu/xstate.h
@@ -48,8 +48,12 @@ void fpu__xstate_clear_all_cpu_caps(void);
 void *get_xsave_addr(struct xregs_state *xsave, int xstate);
 const void *get_xsave_field_ptr(int xstate_field);
 int using_compacted_format(void);
-int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
-                        void __user *ubuf, struct xregs_state *xsave);
-int copyin_to_xsaves(const void *kbuf, const void __user *ubuf,
-                     struct xregs_state *xsave);
+int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset, unsigned int size);
+int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned int offset, unsigned int size);
+int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf);
+int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf);
+
+/* Validate an xstate header supplied by userspace (ptrace or sigreturn) */
+extern int validate_xstate_header(const struct xstate_header *hdr);
+
 #endif
diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index bc62e7cbf1b1..59ad3d132353 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h
@@ -88,7 +88,7 @@ static inline long kvm_hypercall4(unsigned int nr, unsigned long p1,
 bool kvm_para_available(void);
 unsigned int kvm_arch_para_features(void);
 void __init kvm_guest_init(void);
-void kvm_async_pf_task_wait(u32 token);
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel);
 void kvm_async_pf_task_wake(u32 token);
 u32 kvm_read_and_reset_pf_reason(void);
 extern void kvm_disable_steal_time(void);
@@ -103,7 +103,7 @@ static inline void kvm_spinlock_init(void)
 
 #else /* CONFIG_KVM_GUEST */
 #define kvm_guest_init() do {} while (0)
-#define kvm_async_pf_task_wait(T) do {} while(0)
+#define kvm_async_pf_task_wait(T, I) do {} while(0)
 #define kvm_async_pf_task_wake(T) do {} while(0)
 
 static inline bool kvm_para_available(void)
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 7ae318c340d9..c120b5db178a 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -286,6 +286,32 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
         return __pkru_allows_pkey(vma_pkey(vma), write);
 }
 
+/*
+ * If PCID is on, ASID-aware code paths put the ASID+1 into the PCID
+ * bits.  This serves two purposes.  It prevents a nasty situation in
+ * which PCID-unaware code saves CR3, loads some other value (with PCID
+ * == 0), and then restores CR3, thus corrupting the TLB for ASID 0 if
+ * the saved ASID was nonzero.  It also means that any bugs involving
+ * loading a PCID-enabled CR3 with CR4.PCIDE off will trigger
+ * deterministically.
+ */
+
+static inline unsigned long build_cr3(struct mm_struct *mm, u16 asid)
+{
+        if (static_cpu_has(X86_FEATURE_PCID)) {
+                VM_WARN_ON_ONCE(asid > 4094);
+                return __sme_pa(mm->pgd) | (asid + 1);
+        } else {
+                VM_WARN_ON_ONCE(asid != 0);
+                return __sme_pa(mm->pgd);
+        }
+}
+
+static inline unsigned long build_cr3_noflush(struct mm_struct *mm, u16 asid)
+{
+        VM_WARN_ON_ONCE(asid > 4094);
+        return __sme_pa(mm->pgd) | (asid + 1) | CR3_NOFLUSH;
+}
 
 /*
  * This can be used from process context to figure out what the value of
@@ -296,10 +322,8 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
  */
 static inline unsigned long __get_current_cr3_fast(void)
 {
-        unsigned long cr3 = __pa(this_cpu_read(cpu_tlbstate.loaded_mm)->pgd);
-
-        if (static_cpu_has(X86_FEATURE_PCID))
-                cr3 |= this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+        unsigned long cr3 = build_cr3(this_cpu_read(cpu_tlbstate.loaded_mm),
+                this_cpu_read(cpu_tlbstate.loaded_mm_asid));
 
         /* For now, be very restrictive about when this can be called. */
         VM_WARN_ON(in_nmi() || preemptible());
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index 63cc96f064dc..738503e1f80c 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -179,7 +179,6 @@ static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
         u64 input_address = input ? virt_to_phys(input) : 0;
         u64 output_address = output ? virt_to_phys(output) : 0;
         u64 hv_status;
-        register void *__sp asm(_ASM_SP);
 
 #ifdef CONFIG_X86_64
         if (!hv_hypercall_pg)
@@ -187,7 +186,7 @@ static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
 
         __asm__ __volatile__("mov %4, %%r8\n"
                              "call *%5"
-                             : "=a" (hv_status), "+r" (__sp),
+                             : "=a" (hv_status), ASM_CALL_CONSTRAINT,
                                "+c" (control), "+d" (input_address)
                              :  "r" (output_address), "m" (hv_hypercall_pg)
                              : "cc", "memory", "r8", "r9", "r10", "r11");
@@ -202,7 +201,7 @@ static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
 
         __asm__ __volatile__("call *%7"
                              : "=A" (hv_status),
-                               "+c" (input_address_lo), "+r" (__sp)
+                               "+c" (input_address_lo), ASM_CALL_CONSTRAINT
                              : "A" (control),
                                "b" (input_address_hi),
                                "D"(output_address_hi), "S"(output_address_lo),
@@ -224,12 +223,11 @@ static inline u64 hv_do_hypercall(u64 control, void *input, void *output)
 static inline u64 hv_do_fast_hypercall8(u16 code, u64 input1)
 {
         u64 hv_status, control = (u64)code | HV_HYPERCALL_FAST_BIT;
-        register void *__sp asm(_ASM_SP);
 
 #ifdef CONFIG_X86_64
         {
                 __asm__ __volatile__("call *%4"
-                                     : "=a" (hv_status), "+r" (__sp),
+                                     : "=a" (hv_status), ASM_CALL_CONSTRAINT,
                                        "+c" (control), "+d" (input1)
                                      : "m" (hv_hypercall_pg)
                                      : "cc", "r8", "r9", "r10", "r11");
@@ -242,7 +240,7 @@ static inline u64 hv_do_fast_hypercall8(u16 code, u64 input1)
                 __asm__ __volatile__ ("call *%5"
                                       : "=A"(hv_status),
                                         "+c"(input1_lo),
-                                        "+r"(__sp)
+                                        ASM_CALL_CONSTRAINT
                                       : "A" (control),
                                         "b" (input1_hi),
                                         "m" (hv_hypercall_pg)
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 42873edd9f9d..280d94c36dad 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -459,8 +459,8 @@ int paravirt_disable_iospace(void);
  */
 #ifdef CONFIG_X86_32
 #define PVOP_VCALL_ARGS                                                 \
-        unsigned long __eax = __eax, __edx = __edx, __ecx = __ecx;      \
-        register void *__sp asm("esp")
+        unsigned long __eax = __eax, __edx = __edx, __ecx = __ecx;
+
 #define PVOP_CALL_ARGS                  PVOP_VCALL_ARGS
 
 #define PVOP_CALL_ARG1(x)               "a" ((unsigned long)(x))
@@ -480,8 +480,8 @@ int paravirt_disable_iospace(void);
 /* [re]ax isn't an arg, but the return val */
 #define PVOP_VCALL_ARGS                                         \
         unsigned long __edi = __edi, __esi = __esi,             \
-                __edx = __edx, __ecx = __ecx, __eax = __eax;    \
-        register void *__sp asm("rsp")
+                __edx = __edx, __ecx = __ecx, __eax = __eax;
+
 #define PVOP_CALL_ARGS          PVOP_VCALL_ARGS
 
 #define PVOP_CALL_ARG1(x)               "D" ((unsigned long)(x))
@@ -532,7 +532,7 @@ int paravirt_disable_iospace(void);
                         asm volatile(pre                                \
                                      paravirt_alt(PARAVIRT_CALL)        \
                                      post                               \
-                                     : call_clbr, "+r" (__sp)           \
+                                     : call_clbr, ASM_CALL_CONSTRAINT   \
                                      : paravirt_type(op),               \
                                        paravirt_clobber(clbr),          \
                                        ##__VA_ARGS__                    \
@@ -542,7 +542,7 @@ int paravirt_disable_iospace(void);
                         asm volatile(pre                                \
                                      paravirt_alt(PARAVIRT_CALL)        \
                                      post                               \
-                                     : call_clbr, "+r" (__sp)           \
+                                     : call_clbr, ASM_CALL_CONSTRAINT   \
                                      : paravirt_type(op),               \
                                        paravirt_clobber(clbr),          \
                                        ##__VA_ARGS__                    \
@@ -569,7 +569,7 @@ int paravirt_disable_iospace(void);
                 asm volatile(pre                                        \
                              paravirt_alt(PARAVIRT_CALL)                \
                              post                                       \
-                             : call_clbr, "+r" (__sp)                   \
+                             : call_clbr, ASM_CALL_CONSTRAINT           \
                              : paravirt_type(op),                       \
                                paravirt_clobber(clbr),                  \
                                ##__VA_ARGS__                            \
diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
index ec1f3c651150..4f44505dbf87 100644
--- a/arch/x86/include/asm/preempt.h
+++ b/arch/x86/include/asm/preempt.h
@@ -100,19 +100,14 @@ static __always_inline bool should_resched(int preempt_offset)
 
 #ifdef CONFIG_PREEMPT
   extern asmlinkage void ___preempt_schedule(void);
-# define __preempt_schedule()                                   \
-({                                                              \
-        register void *__sp asm(_ASM_SP);                       \
-        asm volatile ("call ___preempt_schedule" : "+r"(__sp)); \
-})
+# define __preempt_schedule() \
+        asm volatile ("call ___preempt_schedule" : ASM_CALL_CONSTRAINT)
 
   extern asmlinkage void preempt_schedule(void);
   extern asmlinkage void ___preempt_schedule_notrace(void);
-# define __preempt_schedule_notrace()                                   \
-({                                                                      \
-        register void *__sp asm(_ASM_SP);                               \
-        asm volatile ("call ___preempt_schedule_notrace" : "+r"(__sp)); \
-})
+# define __preempt_schedule_notrace() \
+        asm volatile ("call ___preempt_schedule_notrace" : ASM_CALL_CONSTRAINT)
+
   extern asmlinkage void preempt_schedule_notrace(void);
 #endif
 
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 3fa26a61eabc..b390ff76e58f 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -677,8 +677,6 @@ static inline void sync_core(void)
          * Like all of Linux's memory ordering operations, this is a
          * compiler barrier as well.
          */
-        register void *__sp asm(_ASM_SP);
-
 #ifdef CONFIG_X86_32
         asm volatile (
                 "pushfl\n\t"
@@ -686,7 +684,7 @@ static inline void sync_core(void)
                 "pushl $1f\n\t"
                 "iret\n\t"
                 "1:"
-                : "+r" (__sp) : : "memory");
+                : ASM_CALL_CONSTRAINT : : "memory");
 #else
         unsigned int tmp;
 
@@ -703,7 +701,7 @@ static inline void sync_core(void)
                 "iretq\n\t"
                 UNWIND_HINT_RESTORE
                 "1:"
-                : "=&r" (tmp), "+r" (__sp) : : "cc", "memory");
+                : "=&r" (tmp), ASM_CALL_CONSTRAINT : : "cc", "memory");
 #endif
 }
 
diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
index a34e0d4b957d..7116b7931c7b 100644
--- a/arch/x86/include/asm/rwsem.h
+++ b/arch/x86/include/asm/rwsem.h
@@ -103,7 +103,6 @@ static inline bool __down_read_trylock(struct rw_semaphore *sem)
 ({                                                      \
         long tmp;                                       \
         struct rw_semaphore* ret;                       \
-        register void *__sp asm(_ASM_SP);               \
                                                         \
         asm volatile("# beginning down_write\n\t"       \
                      LOCK_PREFIX "  xadd      %1,(%4)\n\t"      \
@@ -114,7 +113,8 @@ static inline bool __down_read_trylock(struct rw_semaphore *sem)
                      "  call " slow_path "\n"           \
                      "1:\n"                             \
                      "# ending down_write"              \
-                     : "+m" (sem->count), "=d" (tmp), "=a" (ret), "+r" (__sp) \
+                     : "+m" (sem->count), "=d" (tmp),   \
+                       "=a" (ret), ASM_CALL_CONSTRAINT  \
                      : "a" (sem), "1" (RWSEM_ACTIVE_WRITE_BIAS) \
                      : "memory", "cc");                 \
         ret;                                            \
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 5161da1a0fa0..89e7eeb5cec1 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -158,17 +158,6 @@ struct thread_info {
  */
 #ifndef __ASSEMBLY__
 
-static inline unsigned long current_stack_pointer(void)
-{
-        unsigned long sp;
-#ifdef CONFIG_X86_64
-        asm("mov %%rsp,%0" : "=g" (sp));
-#else
-        asm("mov %%esp,%0" : "=g" (sp));
-#endif
-        return sp;
-}
-
 /*
  * Walks up the stack frames to make sure that the specified object is
  * entirely contained by a single stack frame.
diff --git a/arch/x86/include/asm/trace/fpu.h b/arch/x86/include/asm/trace/fpu.h
index 342e59789fcd..39f7a27bef13 100644
--- a/arch/x86/include/asm/trace/fpu.h
+++ b/arch/x86/include/asm/trace/fpu.h
@@ -12,25 +12,22 @@ DECLARE_EVENT_CLASS(x86_fpu,
 
         TP_STRUCT__entry(
                 __field(struct fpu *, fpu)
-                __field(bool, fpregs_active)
-                __field(bool, fpstate_active)
+                __field(bool, initialized)
                 __field(u64, xfeatures)
                 __field(u64, xcomp_bv)
                 ),
 
         TP_fast_assign(
                 __entry->fpu            = fpu;
-                __entry->fpregs_active  = fpu->fpregs_active;
-                __entry->fpstate_active = fpu->fpstate_active;
+                __entry->initialized    = fpu->initialized;
                 if (boot_cpu_has(X86_FEATURE_OSXSAVE)) {
                         __entry->xfeatures = fpu->state.xsave.header.xfeatures;
                         __entry->xcomp_bv  = fpu->state.xsave.header.xcomp_bv;
                 }
         ),
-        TP_printk("x86/fpu: %p fpregs_active: %d fpstate_active: %d xfeatures: %llx xcomp_bv: %llx",
+        TP_printk("x86/fpu: %p initialized: %d xfeatures: %llx xcomp_bv: %llx",
                         __entry->fpu,
-                        __entry->fpregs_active,
-                        __entry->fpstate_active,
+                        __entry->initialized,
                         __entry->xfeatures,
                         __entry->xcomp_bv
         )
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 184eb9894dae..4b892917edeb 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -166,11 +166,11 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
 ({                                                                      \
         int __ret_gu;                                                   \
         register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX);            \
-        register void *__sp asm(_ASM_SP);                               \
         __chk_user_ptr(ptr);                                            \
         might_fault();                                                  \
         asm volatile("call __get_user_%P4"                              \
-                     : "=a" (__ret_gu), "=r" (__val_gu), "+r" (__sp)    \
+                     : "=a" (__ret_gu), "=r" (__val_gu),                \
+                        ASM_CALL_CONSTRAINT                             \
                      : "0" (ptr), "i" (sizeof(*(ptr))));                \
         (x) = (__force __typeof__(*(ptr))) __val_gu;                    \
         __builtin_expect(__ret_gu, 0);                                  \
@@ -337,7 +337,7 @@ do {									\
                      _ASM_EXTABLE(1b, 4b)                               \
                      _ASM_EXTABLE(2b, 4b)                               \
                      : "=r" (retval), "=&A"(x)                          \
-                     : "m" (__m(__ptr)), "m" __m(((u32 *)(__ptr)) + 1), \
+                     : "m" (__m(__ptr)), "m" __m(((u32 __user *)(__ptr)) + 1),  \
                        "i" (errret), "0" (retval));                     \
 })
 
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 9606688caa4b..7cb282e9e587 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -113,10 +113,9 @@ extern struct { char _entry[32]; } hypercall_page[];
         register unsigned long __arg2 asm(__HYPERCALL_ARG2REG) = __arg2; \
         register unsigned long __arg3 asm(__HYPERCALL_ARG3REG) = __arg3; \
         register unsigned long __arg4 asm(__HYPERCALL_ARG4REG) = __arg4; \
-        register unsigned long __arg5 asm(__HYPERCALL_ARG5REG) = __arg5; \
-        register void *__sp asm(_ASM_SP);
+        register unsigned long __arg5 asm(__HYPERCALL_ARG5REG) = __arg5;
 
-#define __HYPERCALL_0PARAM      "=r" (__res), "+r" (__sp)
+#define __HYPERCALL_0PARAM      "=r" (__res), ASM_CALL_CONSTRAINT
 #define __HYPERCALL_1PARAM      __HYPERCALL_0PARAM, "+r" (__arg1)
 #define __HYPERCALL_2PARAM      __HYPERCALL_1PARAM, "+r" (__arg2)
 #define __HYPERCALL_3PARAM      __HYPERCALL_2PARAM, "+r" (__arg3)
@@ -552,13 +551,13 @@ static inline void
 MULTI_update_descriptor(struct multicall_entry *mcl, u64 maddr,
                         struct desc_struct desc)
 {
-        u32 *p = (u32 *) &desc;
-
         mcl->op = __HYPERVISOR_update_descriptor;
         if (sizeof(maddr) == sizeof(long)) {
                 mcl->args[0] = maddr;
                 mcl->args[1] = *(unsigned long *)&desc;
         } else {
+                u32 *p = (u32 *)&desc;
+
                 mcl->args[0] = maddr;
                 mcl->args[1] = maddr >> 32;
                 mcl->args[2] = *p++;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 9862e2cd6d93..d58184b7cd44 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -763,6 +763,16 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
         }
 }
 
+static void init_amd_zn(struct cpuinfo_x86 *c)
+{
+        /*
+         * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects
+         * all up to and including B1.
+         */
+        if (c->x86_model <= 1 && c->x86_mask <= 1)
+                set_cpu_cap(c, X86_FEATURE_CPB);
+}
+
 static void init_amd(struct cpuinfo_x86 *c)
 {
         early_init_amd(c);
@@ -791,6 +801,7 @@ static void init_amd(struct cpuinfo_x86 *c)
         case 0x10: init_amd_gh(c); break;
         case 0x12: init_amd_ln(c); break;
         case 0x15: init_amd_bd(c); break;
+        case 0x17: init_amd_zn(c); break;
         }
 
         /* Enable workaround for FXSAVE leak */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index db684880d74a..0af86d9242da 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -21,14 +21,6 @@
 
 void __init check_bugs(void)
 {
-#ifdef CONFIG_X86_32
-        /*
-         * Regardless of whether PCID is enumerated, the SDM says
-         * that it can't be enabled in 32-bit mode.
-         */
-        setup_clear_cpu_cap(X86_FEATURE_PCID);
-#endif
-
         identify_boot_cpu();
 
         if (!IS_ENABLED(CONFIG_SMP)) {
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 775f10100d7f..c9176bae7fd8 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -904,6 +904,14 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
 
         setup_force_cpu_cap(X86_FEATURE_ALWAYS);
         fpu__init_system(c);
+
+#ifdef CONFIG_X86_32
+        /*
+         * Regardless of whether PCID is enumerated, the SDM says
+         * that it can't be enabled in 32-bit mode.
+         */
+        setup_clear_cpu_cap(X86_FEATURE_PCID);
+#endif
 }
 
 void __init early_cpu_init(void)
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index e1114f070c2d..f92a6593de1e 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -100,7 +100,7 @@ void __kernel_fpu_begin(void)
 
         kernel_fpu_disable();
 
-        if (fpu->fpregs_active) {
+        if (fpu->initialized) {
                 /*
                  * Ignore return value -- we don't care if reg state
                  * is clobbered.
@@ -116,7 +116,7 @@ void __kernel_fpu_end(void)
 {
         struct fpu *fpu = &current->thread.fpu;
 
-        if (fpu->fpregs_active)
+        if (fpu->initialized)
                 copy_kernel_to_fpregs(&fpu->state);
 
         kernel_fpu_enable();
@@ -148,7 +148,7 @@ void fpu__save(struct fpu *fpu)
 
         preempt_disable();
         trace_x86_fpu_before_save(fpu);
-        if (fpu->fpregs_active) {
+        if (fpu->initialized) {
                 if (!copy_fpregs_to_fpstate(fpu)) {
                         copy_kernel_to_fpregs(&fpu->state);
                 }
@@ -189,10 +189,9 @@ EXPORT_SYMBOL_GPL(fpstate_init);
 
 int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu)
 {
-        dst_fpu->fpregs_active = 0;
         dst_fpu->last_cpu = -1;
 
-        if (!src_fpu->fpstate_active || !static_cpu_has(X86_FEATURE_FPU))
+        if (!src_fpu->initialized || !static_cpu_has(X86_FEATURE_FPU))
                 return 0;
 
         WARN_ON_FPU(src_fpu != &current->thread.fpu);
@@ -206,26 +205,14 @@ int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu)
         /*
          * Save current FPU registers directly into the child
          * FPU context, without any memory-to-memory copying.
-         * In lazy mode, if the FPU context isn't loaded into
-         * fpregs, CR0.TS will be set and do_device_not_available
-         * will load the FPU context.
          *
-         * We have to do all this with preemption disabled,
-         * mostly because of the FNSAVE case, because in that
-         * case we must not allow preemption in the window
-         * between the FNSAVE and us marking the context lazy.
-         *
-         * It shouldn't be an issue as even FNSAVE is plenty
-         * fast in terms of critical section length.
+         * ( The function 'fails' in the FNSAVE case, which destroys
+         *   register contents so we have to copy them back. )
          */
-        preempt_disable();
         if (!copy_fpregs_to_fpstate(dst_fpu)) {
-                memcpy(&src_fpu->state, &dst_fpu->state,
-                       fpu_kernel_xstate_size);
-
+                memcpy(&src_fpu->state, &dst_fpu->state, fpu_kernel_xstate_size);
                 copy_kernel_to_fpregs(&src_fpu->state);
         }
-        preempt_enable();
 
         trace_x86_fpu_copy_src(src_fpu);
         trace_x86_fpu_copy_dst(dst_fpu);
@@ -237,45 +224,48 @@ int fpu__copy(struct fpu *dst_fpu, struct fpu *src_fpu)
  * Activate the current task's in-memory FPU context,
  * if it has not been used before:
  */
-void fpu__activate_curr(struct fpu *fpu)
+void fpu__initialize(struct fpu *fpu)
 {
         WARN_ON_FPU(fpu != &current->thread.fpu);
 
-        if (!fpu->fpstate_active) {
+        if (!fpu->initialized) {
                 fpstate_init(&fpu->state);
                 trace_x86_fpu_init_state(fpu);
 
                 trace_x86_fpu_activate_state(fpu);
                 /* Safe to do for the current task: */
-                fpu->fpstate_active = 1;
+                fpu->initialized = 1;
         }
 }
-EXPORT_SYMBOL_GPL(fpu__activate_curr);
+EXPORT_SYMBOL_GPL(fpu__initialize);
 
 /*
  * This function must be called before we read a task's fpstate.
  *
- * If the task has not used the FPU before then initialize its
- * fpstate.
+ * There's two cases where this gets called:
+ *
+ * - for the current task (when coredumping), in which case we have
+ *   to save the latest FPU registers into the fpstate,
+ *
+ * - or it's called for stopped tasks (ptrace), in which case the
+ *   registers were already saved by the context-switch code when
+ *   the task scheduled out - we only have to initialize the registers
+ *   if they've never been initialized.
  *
  * If the task has used the FPU before then save it.
  */
-void fpu__activate_fpstate_read(struct fpu *fpu)
+void fpu__prepare_read(struct fpu *fpu)
 {
-        /*
-         * If fpregs are active (in the current CPU), then
-         * copy them to the fpstate:
-         */
-        if (fpu->fpregs_active) {
+        if (fpu == &current->thread.fpu) {
                 fpu__save(fpu);
         } else {
-                if (!fpu->fpstate_active) {
+                if (!fpu->initialized) {
                         fpstate_init(&fpu->state);
                         trace_x86_fpu_init_state(fpu);
 
                         trace_x86_fpu_activate_state(fpu);
                         /* Safe to do for current and for stopped child tasks: */
-                        fpu->fpstate_active = 1;
+                        fpu->initialized = 1;
                 }
         }
 }
@@ -283,17 +273,17 @@ void fpu__activate_fpstate_read(struct fpu *fpu)
 /*
  * This function must be called before we write a task's fpstate.
  *
- * If the task has used the FPU before then unlazy it.
+ * If the task has used the FPU before then invalidate any cached FPU registers.
  * If the task has not used the FPU before then initialize its fpstate.
  *
  * After this function call, after registers in the fpstate are
  * modified and the child task has woken up, the child task will
  * restore the modified FPU state from the modified context. If we
- * didn't clear its lazy status here then the lazy in-registers
+ * didn't clear its cached status here then the cached in-registers
  * state pending on its former CPU could be restored, corrupting
  * the modifications.
  */
-void fpu__activate_fpstate_write(struct fpu *fpu)
+void fpu__prepare_write(struct fpu *fpu)
 {
         /*
          * Only stopped child tasks can be used to modify the FPU
@@ -301,8 +291,8 @@ void fpu__activate_fpstate_write(struct fpu *fpu)
          */
         WARN_ON_FPU(fpu == &current->thread.fpu);
 
-        if (fpu->fpstate_active) {
-                /* Invalidate any lazy state: */
+        if (fpu->initialized) {
+                /* Invalidate any cached state: */
                 __fpu_invalidate_fpregs_state(fpu);
         } else {
                 fpstate_init(&fpu->state);
@@ -310,74 +300,11 @@ void fpu__activate_fpstate_write(struct fpu *fpu)
 
                 trace_x86_fpu_activate_state(fpu);
                 /* Safe to do for stopped child tasks: */
-                fpu->fpstate_active = 1;
+                fpu->initialized = 1;
         }
 }
 
 /*
- * This function must be called before we write the current
- * task's fpstate.
- *
- * This call gets the current FPU register state and moves
- * it in to the 'fpstate'.  Preemption is disabled so that
- * no writes to the 'fpstate' can occur from context
- * swiches.
- *
- * Must be followed by a fpu__current_fpstate_write_end().
- */
-void fpu__current_fpstate_write_begin(void)
-{
-        struct fpu *fpu = &current->thread.fpu;
-
-        /*
-         * Ensure that the context-switching code does not write
-         * over the fpstate while we are doing our update.
-         */
-        preempt_disable();
-
-        /*
-         * Move the fpregs in to the fpu's 'fpstate'.
-         */
-        fpu__activate_fpstate_read(fpu);
-
-        /*
-         * The caller is about to write to 'fpu'.  Ensure that no
-         * CPU thinks that its fpregs match the fpstate.  This
-         * ensures we will not be lazy and skip a XRSTOR in the
-         * future.
-         */
-        __fpu_invalidate_fpregs_state(fpu);
-}
-
-/*
- * This function must be paired with fpu__current_fpstate_write_begin()
- *
- * This will ensure that the modified fpstate gets placed back in
- * the fpregs if necessary.
- *
- * Note: This function may be called whether or not an _actual_
- * write to the fpstate occurred.
- */
-void fpu__current_fpstate_write_end(void)
-{
-        struct fpu *fpu = &current->thread.fpu;
-
-        /*
-         * 'fpu' now has an updated copy of the state, but the
-         * registers may still be out of date.  Update them with
-         * an XRSTOR if they are active.
-         */
-        if (fpregs_active())
-                copy_kernel_to_fpregs(&fpu->state);
-
-        /*
-         * Our update is done and the fpregs/fpstate are in sync
-         * if necessary.  Context switches can happen again.
-         */
-        preempt_enable();
-}
-
-/*
  * 'fpu__restore()' is called to copy FPU registers from
  * the FPU fpstate to the live hw registers and to activate
  * access to the hardware registers, so that FPU instructions
@@ -389,7 +316,7 @@ void fpu__current_fpstate_write_end(void)
  */
 void fpu__restore(struct fpu *fpu)
 {
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
         /* Avoid __kernel_fpu_begin() right after fpregs_activate() */
         kernel_fpu_disable();
@@ -414,15 +341,17 @@ void fpu__drop(struct fpu *fpu)
 {
         preempt_disable();
 
-        if (fpu->fpregs_active) {
-                /* Ignore delayed exceptions from user space */
-                asm volatile("1: fwait\n"
-                             "2:\n"
-                             _ASM_EXTABLE(1b, 2b));
-                fpregs_deactivate(fpu);
+        if (fpu == &current->thread.fpu) {
+                if (fpu->initialized) {
+                        /* Ignore delayed exceptions from user space */
+                        asm volatile("1: fwait\n"
+                                     "2:\n"
+                                     _ASM_EXTABLE(1b, 2b));
+                        fpregs_deactivate(fpu);
+                }
         }
 
-        fpu->fpstate_active = 0;
+        fpu->initialized = 0;
 
         trace_x86_fpu_dropped(fpu);
 
@@ -462,9 +391,11 @@ void fpu__clear(struct fpu *fpu)
          * Make sure fpstate is cleared and initialized.
          */
         if (static_cpu_has(X86_FEATURE_FPU)) {
-                fpu__activate_curr(fpu);
+                preempt_disable();
+                fpu__initialize(fpu);
                 user_fpu_begin();
                 copy_init_fpstate_to_fpregs();
+                preempt_enable();
         }
 }
 
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index d5d44c452624..7affb7e3d9a5 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -240,7 +240,7 @@ static void __init fpu__init_system_ctx_switch(void)
         WARN_ON_FPU(!on_boot_cpu);
         on_boot_cpu = 0;
 
-        WARN_ON_FPU(current->thread.fpu.fpstate_active);
+        WARN_ON_FPU(current->thread.fpu.initialized);
 }
 
 /*
diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c
index b188b16841e3..3ea151372389 100644
--- a/arch/x86/kernel/fpu/regset.c
+++ b/arch/x86/kernel/fpu/regset.c
@@ -16,14 +16,14 @@ int regset_fpregs_active(struct task_struct *target, const struct user_regset *r
 {
         struct fpu *target_fpu = &target->thread.fpu;
 
-        return target_fpu->fpstate_active ? regset->n : 0;
+        return target_fpu->initialized ? regset->n : 0;
 }
 
 int regset_xregset_fpregs_active(struct task_struct *target, const struct user_regset *regset)
 {
         struct fpu *target_fpu = &target->thread.fpu;
 
-        if (boot_cpu_has(X86_FEATURE_FXSR) && target_fpu->fpstate_active)
+        if (boot_cpu_has(X86_FEATURE_FXSR) && target_fpu->initialized)
                 return regset->n;
         else
                 return 0;
@@ -38,7 +38,7 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
         if (!boot_cpu_has(X86_FEATURE_FXSR))
                 return -ENODEV;
 
-        fpu__activate_fpstate_read(fpu);
+        fpu__prepare_read(fpu);
         fpstate_sanitize_xstate(fpu);
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
@@ -55,7 +55,7 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
         if (!boot_cpu_has(X86_FEATURE_FXSR))
                 return -ENODEV;
 
-        fpu__activate_fpstate_write(fpu);
+        fpu__prepare_write(fpu);
         fpstate_sanitize_xstate(fpu);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
@@ -89,10 +89,13 @@ int xstateregs_get(struct task_struct *target, const struct user_regset *regset,
 
         xsave = &fpu->state.xsave;
 
-        fpu__activate_fpstate_read(fpu);
+        fpu__prepare_read(fpu);
 
         if (using_compacted_format()) {
-                ret = copyout_from_xsaves(pos, count, kbuf, ubuf, xsave);
+                if (kbuf)
+                        ret = copy_xstate_to_kernel(kbuf, xsave, pos, count);
+                else
+                        ret = copy_xstate_to_user(ubuf, xsave, pos, count);
         } else {
                 fpstate_sanitize_xstate(fpu);
                 /*
@@ -129,28 +132,29 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
 
         xsave = &fpu->state.xsave;
 
-        fpu__activate_fpstate_write(fpu);
+        fpu__prepare_write(fpu);
 
-        if (boot_cpu_has(X86_FEATURE_XSAVES))
-                ret = copyin_to_xsaves(kbuf, ubuf, xsave);
-        else
+        if (using_compacted_format()) {
+                if (kbuf)
+                        ret = copy_kernel_to_xstate(xsave, kbuf);
+                else
+                        ret = copy_user_to_xstate(xsave, ubuf);
+        } else {
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1);
-
-        /*
-         * In case of failure, mark all states as init:
-         */
-        if (ret)
-                fpstate_init(&fpu->state);
+                if (!ret)
+                        ret = validate_xstate_header(&xsave->header);
+        }
 
         /*
          * mxcsr reserved bits must be masked to zero for security reasons.
          */
         xsave->i387.mxcsr &= mxcsr_feature_mask;
-        xsave->header.xfeatures &= xfeatures_mask;
+
         /*
-         * These bits must be zero.
+         * In case of failure, mark all states as init:
          */
-        memset(&xsave->header.reserved, 0, 48);
+        if (ret)
+                fpstate_init(&fpu->state);
 
         return ret;
 }
@@ -299,7 +303,7 @@ int fpregs_get(struct task_struct *target, const struct user_regset *regset,
         struct fpu *fpu = &target->thread.fpu;
         struct user_i387_ia32_struct env;
 
-        fpu__activate_fpstate_read(fpu);
+        fpu__prepare_read(fpu);
 
         if (!boot_cpu_has(X86_FEATURE_FPU))
                 return fpregs_soft_get(target, regset, pos, count, kbuf, ubuf);
@@ -329,7 +333,7 @@ int fpregs_set(struct task_struct *target, const struct user_regset *regset,
         struct user_i387_ia32_struct env;
         int ret;
 
-        fpu__activate_fpstate_write(fpu);
+        fpu__prepare_write(fpu);
         fpstate_sanitize_xstate(fpu);
 
         if (!boot_cpu_has(X86_FEATURE_FPU))
@@ -369,7 +373,7 @@ int dump_fpu(struct pt_regs *regs, struct user_i387_struct *ufpu)
         struct fpu *fpu = &tsk->thread.fpu;
         int fpvalid;
 
-        fpvalid = fpu->fpstate_active;
+        fpvalid = fpu->initialized;
         if (fpvalid)
                 fpvalid = !fpregs_get(tsk, NULL,
                                       0, sizeof(struct user_i387_ia32_struct),
diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
index 83c23c230b4c..fb639e70048f 100644
--- a/arch/x86/kernel/fpu/signal.c
+++ b/arch/x86/kernel/fpu/signal.c
@@ -155,7 +155,8 @@ static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
  */
 int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
 {
-        struct xregs_state *xsave = &current->thread.fpu.state.xsave;
+        struct fpu *fpu = &current->thread.fpu;
+        struct xregs_state *xsave = &fpu->state.xsave;
         struct task_struct *tsk = current;
         int ia32_fxstate = (buf != buf_fx);
 
@@ -170,13 +171,13 @@ int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
                         sizeof(struct user_i387_ia32_struct), NULL,
                         (struct _fpstate_32 __user *) buf) ? -1 : 1;
 
-        if (fpregs_active() || using_compacted_format()) {
+        if (fpu->initialized || using_compacted_format()) {
                 /* Save the live register state to the user directly. */
                 if (copy_fpregs_to_sigframe(buf_fx))
                         return -1;
                 /* Update the thread's fxstate to save the fsave header. */
                 if (ia32_fxstate)
-                        copy_fxregs_to_kernel(&tsk->thread.fpu);
+                        copy_fxregs_to_kernel(fpu);
         } else {
                 /*
                  * It is a *bug* if kernel uses compacted-format for xsave
@@ -189,7 +190,7 @@ int copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)
                         return -1;
                 }
 
-                fpstate_sanitize_xstate(&tsk->thread.fpu);
+                fpstate_sanitize_xstate(fpu);
                 if (__copy_to_user(buf_fx, xsave, fpu_user_xstate_size))
                         return -1;
         }
@@ -213,8 +214,11 @@ sanitize_restored_xstate(struct task_struct *tsk,
         struct xstate_header *header = &xsave->header;
 
         if (use_xsave()) {
-                /* These bits must be zero. */
-                memset(header->reserved, 0, 48);
+                /*
+                 * Note: we don't need to zero the reserved bits in the
+                 * xstate_header here because we either didn't copy them at all,
+                 * or we checked earlier that they aren't set.
+                 */
 
                 /*
                  * Init the state that is not present in the memory
@@ -223,7 +227,7 @@ sanitize_restored_xstate(struct task_struct *tsk,
                 if (fx_only)
                         header->xfeatures = XFEATURE_MASK_FPSSE;
                 else
-                        header->xfeatures &= (xfeatures_mask & xfeatures);
+                        header->xfeatures &= xfeatures;
         }
 
         if (use_fxsr()) {
@@ -279,7 +283,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
         if (!access_ok(VERIFY_READ, buf, size))
                 return -EACCES;
 
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
         if (!static_cpu_has(X86_FEATURE_FPU))
                 return fpregs_soft_set(current, NULL,
@@ -307,28 +311,29 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
                 /*
                  * For 32-bit frames with fxstate, copy the user state to the
                  * thread's fpu state, reconstruct fxstate from the fsave
-                 * header. Sanitize the copied state etc.
+                 * header. Validate and sanitize the copied state.
                  */
                 struct fpu *fpu = &tsk->thread.fpu;
                 struct user_i387_ia32_struct env;
                 int err = 0;
 
                 /*
-                 * Drop the current fpu which clears fpu->fpstate_active. This ensures
+                 * Drop the current fpu which clears fpu->initialized. This ensures
                  * that any context-switch during the copy of the new state,
                  * avoids the intermediate state from getting restored/saved.
                  * Thus avoiding the new restored state from getting corrupted.
                  * We will be ready to restore/save the state only after
-                 * fpu->fpstate_active is again set.
+                 * fpu->initialized is again set.
                  */
                 fpu__drop(fpu);
 
                 if (using_compacted_format()) {
-                        err = copyin_to_xsaves(NULL, buf_fx,
-                                               &fpu->state.xsave);
+                        err = copy_user_to_xstate(&fpu->state.xsave, buf_fx);
                 } else {
-                        err = __copy_from_user(&fpu->state.xsave,
-                                               buf_fx, state_size);
+                        err = __copy_from_user(&fpu->state.xsave, buf_fx, state_size);
+
+                        if (!err && state_size > offsetof(struct xregs_state, header))
+                                err = validate_xstate_header(&fpu->state.xsave.header);
                 }
 
                 if (err || __copy_from_user(&env, buf, sizeof(env))) {
@@ -339,7 +344,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
                         sanitize_restored_xstate(tsk, &env, xfeatures, fx_only);
                 }
 
-                fpu->fpstate_active = 1;
+                fpu->initialized = 1;
                 preempt_disable();
                 fpu__restore(fpu);
                 preempt_enable();
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index c24ac1efb12d..f1d5476c9022 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -483,6 +483,30 @@ int using_compacted_format(void)
         return boot_cpu_has(X86_FEATURE_XSAVES);
 }
 
+/* Validate an xstate header supplied by userspace (ptrace or sigreturn) */
+int validate_xstate_header(const struct xstate_header *hdr)
+{
+        /* No unknown or supervisor features may be set */
+        if (hdr->xfeatures & (~xfeatures_mask | XFEATURE_MASK_SUPERVISOR))
+                return -EINVAL;
+
+        /* Userspace must use the uncompacted format */
+        if (hdr->xcomp_bv)
+                return -EINVAL;
+
+        /*
+         * If 'reserved' is shrunken to add a new field, make sure to validate
+         * that new field here!
+         */
+        BUILD_BUG_ON(sizeof(hdr->reserved) != 48);
+
+        /* No reserved bits may be set */
+        if (memchr_inv(hdr->reserved, 0, sizeof(hdr->reserved)))
+                return -EINVAL;
+
+        return 0;
+}
+
 static void __xstate_dump_leaves(void)
 {
         int i;
@@ -867,7 +891,7 @@ const void *get_xsave_field_ptr(int xsave_state)
 {
         struct fpu *fpu = &current->thread.fpu;
 
-        if (!fpu->fpstate_active)
+        if (!fpu->initialized)
                 return NULL;
         /*
          * fpu__save() takes the CPU's xstate registers
@@ -921,38 +945,129 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
 #endif /* ! CONFIG_ARCH_HAS_PKEYS */
 
 /*
+ * Weird legacy quirk: SSE and YMM states store information in the
+ * MXCSR and MXCSR_FLAGS fields of the FP area. That means if the FP
+ * area is marked as unused in the xfeatures header, we need to copy
+ * MXCSR and MXCSR_FLAGS if either SSE or YMM are in use.
+ */
+static inline bool xfeatures_mxcsr_quirk(u64 xfeatures)
+{
+        if (!(xfeatures & (XFEATURE_MASK_SSE|XFEATURE_MASK_YMM)))
+                return false;
+
+        if (xfeatures & XFEATURE_MASK_FP)
+                return false;
+
+        return true;
+}
+
+/*
  * This is similar to user_regset_copyout(), but will not add offset to
  * the source data pointer or increment pos, count, kbuf, and ubuf.
  */
-static inline int xstate_copyout(unsigned int pos, unsigned int count,
-                                 void *kbuf, void __user *ubuf,
-                                 const void *data, const int start_pos,
-                                 const int end_pos)
+static inline void
+__copy_xstate_to_kernel(void *kbuf, const void *data,
+                        unsigned int offset, unsigned int size, unsigned int size_total)
 {
-        if ((count == 0) || (pos < start_pos))
-                return 0;
+        if (offset < size_total) {
+                unsigned int copy = min(size, size_total - offset);
 
-        if (end_pos < 0 || pos < end_pos) {
-                unsigned int copy = (end_pos < 0 ? count : min(count, end_pos - pos));
+                memcpy(kbuf + offset, data, copy);
+        }
+}
 
-                if (kbuf) {
-                        memcpy(kbuf + pos, data, copy);
-                } else {
-                        if (__copy_to_user(ubuf + pos, data, copy))
-                                return -EFAULT;
+/*
+ * Convert from kernel XSAVES compacted format to standard format and copy
+ * to a kernel-space ptrace buffer.
+ *
+ * It supports partial copy but pos always starts from zero. This is called
+ * from xstateregs_get() and there we check the CPU has XSAVES.
+ */
+int copy_xstate_to_kernel(void *kbuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
+{
+        unsigned int offset, size;
+        struct xstate_header header;
+        int i;
+
+        /*
+         * Currently copy_regset_to_user() starts from pos 0:
+         */
+        if (unlikely(offset_start != 0))
+                return -EFAULT;
+
+        /*
+         * The destination is a ptrace buffer; we put in only user xstates:
+         */
+        memset(&header, 0, sizeof(header));
+        header.xfeatures = xsave->header.xfeatures;
+        header.xfeatures &= ~XFEATURE_MASK_SUPERVISOR;
+
+        /*
+         * Copy xregs_state->header:
+         */
+        offset = offsetof(struct xregs_state, header);
+        size = sizeof(header);
+
+        __copy_xstate_to_kernel(kbuf, &header, offset, size, size_total);
+
+        for (i = 0; i < XFEATURE_MAX; i++) {
+                /*
+                 * Copy only in-use xstates:
+                 */
+                if ((header.xfeatures >> i) & 1) {
+                        void *src = __raw_xsave_addr(xsave, 1 << i);
+
+                        offset = xstate_offsets[i];
+                        size = xstate_sizes[i];
+
+                        /* The next component has to fit fully into the output buffer: */
+                        if (offset + size > size_total)
+                                break;
+
+                        __copy_xstate_to_kernel(kbuf, src, offset, size, size_total);
                 }
+
+        }
+
+        if (xfeatures_mxcsr_quirk(header.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                __copy_xstate_to_kernel(kbuf, &xsave->i387.mxcsr, offset, size, size_total);
+        }
+
+        /*
+         * Fill xsave->i387.sw_reserved value for ptrace frame:
+         */
+        offset = offsetof(struct fxregs_state, sw_reserved);
+        size = sizeof(xstate_fx_sw_bytes);
+
+        __copy_xstate_to_kernel(kbuf, xstate_fx_sw_bytes, offset, size, size_total);
+
+        return 0;
+}
+
+static inline int
+__copy_xstate_to_user(void __user *ubuf, const void *data, unsigned int offset, unsigned int size, unsigned int size_total)
+{
+        if (!size)
+                return 0;
+
+        if (offset < size_total) {
+                unsigned int copy = min(size, size_total - offset);
+
+                if (__copy_to_user(ubuf + offset, data, copy))
+                        return -EFAULT;
         }
         return 0;
 }
 
 /*
  * Convert from kernel XSAVES compacted format to standard format and copy
- * to a ptrace buffer. It supports partial copy but pos always starts from
+ * to a user-space buffer. It supports partial copy but pos always starts from
  * zero. This is called from xstateregs_get() and there we check the CPU
  * has XSAVES.
  */
-int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
-                        void __user *ubuf, struct xregs_state *xsave)
+int copy_xstate_to_user(void __user *ubuf, struct xregs_state *xsave, unsigned int offset_start, unsigned int size_total)
 {
         unsigned int offset, size;
         int ret, i;
@@ -961,7 +1076,7 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
         /*
          * Currently copy_regset_to_user() starts from pos 0:
          */
-        if (unlikely(pos != 0))
+        if (unlikely(offset_start != 0))
                 return -EFAULT;
 
         /*
@@ -977,8 +1092,7 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
         offset = offsetof(struct xregs_state, header);
         size = sizeof(header);
 
-        ret = xstate_copyout(offset, size, kbuf, ubuf, &header, 0, count);
-
+        ret = __copy_xstate_to_user(ubuf, &header, offset, size, size_total);
         if (ret)
                 return ret;
 
@@ -992,25 +1106,30 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
                         offset = xstate_offsets[i];
                         size = xstate_sizes[i];
 
-                        ret = xstate_copyout(offset, size, kbuf, ubuf, src, 0, count);
+                        /* The next component has to fit fully into the output buffer: */
+                        if (offset + size > size_total)
+                                break;
 
+                        ret = __copy_xstate_to_user(ubuf, src, offset, size, size_total);
                         if (ret)
                                 return ret;
-
-                        if (offset + size >= count)
-                                break;
                 }
 
         }
 
+        if (xfeatures_mxcsr_quirk(header.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                __copy_xstate_to_user(ubuf, &xsave->i387.mxcsr, offset, size, size_total);
+        }
+
         /*
          * Fill xsave->i387.sw_reserved value for ptrace frame:
          */
         offset = offsetof(struct fxregs_state, sw_reserved);
         size = sizeof(xstate_fx_sw_bytes);
 
-        ret = xstate_copyout(offset, size, kbuf, ubuf, xstate_fx_sw_bytes, 0, count);
-
+        ret = __copy_xstate_to_user(ubuf, xstate_fx_sw_bytes, offset, size, size_total);
         if (ret)
                 return ret;
 
@@ -1018,55 +1137,98 @@ int copyout_from_xsaves(unsigned int pos, unsigned int count, void *kbuf,
 }
 
 /*
- * Convert from a ptrace standard-format buffer to kernel XSAVES format
- * and copy to the target thread. This is called from xstateregs_set() and
- * there we check the CPU has XSAVES and a whole standard-sized buffer
- * exists.
+ * Convert from a ptrace standard-format kernel buffer to kernel XSAVES format
+ * and copy to the target thread. This is called from xstateregs_set().
  */
-int copyin_to_xsaves(const void *kbuf, const void __user *ubuf,
-                     struct xregs_state *xsave)
+int copy_kernel_to_xstate(struct xregs_state *xsave, const void *kbuf)
 {
         unsigned int offset, size;
         int i;
-        u64 xfeatures;
-        u64 allowed_features;
+        struct xstate_header hdr;
 
         offset = offsetof(struct xregs_state, header);
-        size = sizeof(xfeatures);
+        size = sizeof(hdr);
 
-        if (kbuf) {
-                memcpy(&xfeatures, kbuf + offset, size);
-        } else {
-                if (__copy_from_user(&xfeatures, ubuf + offset, size))
-                        return -EFAULT;
+        memcpy(&hdr, kbuf + offset, size);
+
+        if (validate_xstate_header(&hdr))
+                return -EINVAL;
+
+        for (i = 0; i < XFEATURE_MAX; i++) {
+                u64 mask = ((u64)1 << i);
+
+                if (hdr.xfeatures & mask) {
+                        void *dst = __raw_xsave_addr(xsave, 1 << i);
+
+                        offset = xstate_offsets[i];
+                        size = xstate_sizes[i];
+
+                        memcpy(dst, kbuf + offset, size);
+                }
+        }
+
+        if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                memcpy(&xsave->i387.mxcsr, kbuf + offset, size);
         }
 
         /*
-         * Reject if the user sets any disabled or supervisor features:
+         * The state that came in from userspace was user-state only.
+         * Mask all the user states out of 'xfeatures':
+         */
+        xsave->header.xfeatures &= XFEATURE_MASK_SUPERVISOR;
+
+        /*
+         * Add back in the features that came in from userspace:
          */
-        allowed_features = xfeatures_mask & ~XFEATURE_MASK_SUPERVISOR;
+        xsave->header.xfeatures |= hdr.xfeatures;
 
-        if (xfeatures & ~allowed_features)
+        return 0;
+}
+
+/*
+ * Convert from a ptrace or sigreturn standard-format user-space buffer to
+ * kernel XSAVES format and copy to the target thread. This is called from
+ * xstateregs_set(), as well as potentially from the sigreturn() and
+ * rt_sigreturn() system calls.
+ */
+int copy_user_to_xstate(struct xregs_state *xsave, const void __user *ubuf)
+{
+        unsigned int offset, size;
+        int i;
+        struct xstate_header hdr;
+
+        offset = offsetof(struct xregs_state, header);
+        size = sizeof(hdr);
+
+        if (__copy_from_user(&hdr, ubuf + offset, size))
+                return -EFAULT;
+
+        if (validate_xstate_header(&hdr))
                 return -EINVAL;
 
         for (i = 0; i < XFEATURE_MAX; i++) {
                 u64 mask = ((u64)1 << i);
 
-                if (xfeatures & mask) {
+                if (hdr.xfeatures & mask) {
                         void *dst = __raw_xsave_addr(xsave, 1 << i);
 
                         offset = xstate_offsets[i];
                         size = xstate_sizes[i];
 
-                        if (kbuf) {
-                                memcpy(dst, kbuf + offset, size);
-                        } else {
-                                if (__copy_from_user(dst, ubuf + offset, size))
-                                        return -EFAULT;
-                        }
+                        if (__copy_from_user(dst, ubuf + offset, size))
+                                return -EFAULT;
                 }
         }
 
+        if (xfeatures_mxcsr_quirk(hdr.xfeatures)) {
+                offset = offsetof(struct fxregs_state, mxcsr);
+                size = MXCSR_AND_FLAGS_SIZE;
+                if (__copy_from_user(&xsave->i387.mxcsr, ubuf + offset, size))
+                        return -EFAULT;
+        }
+
         /*
          * The state that came in from userspace was user-state only.
          * Mask all the user states out of 'xfeatures':
@@ -1076,7 +1238,7 @@ int copyin_to_xsaves(const void *kbuf, const void __user *ubuf,
         /*
          * Add back in the features that came in from userspace:
          */
-        xsave->header.xfeatures |= xfeatures;
+        xsave->header.xfeatures |= hdr.xfeatures;
 
         return 0;
 }
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 1f38d9a4d9de..d4eb450144fd 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -64,7 +64,7 @@ static void call_on_stack(void *func, void *stack)
 
 static inline void *current_stack(void)
 {
-        return (void *)(current_stack_pointer() & ~(THREAD_SIZE - 1));
+        return (void *)(current_stack_pointer & ~(THREAD_SIZE - 1));
 }
 
 static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc)
@@ -88,7 +88,7 @@ static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc)
 
         /* Save the next esp at the bottom of the stack */
         prev_esp = (u32 *)irqstk;
-        *prev_esp = current_stack_pointer();
+        *prev_esp = current_stack_pointer;
 
         if (unlikely(overflow))
                 call_on_stack(print_stack_overflow, isp);
@@ -139,7 +139,7 @@ void do_softirq_own_stack(void)
 
         /* Push the previous esp onto the stack */
         prev_esp = (u32 *)irqstk;
-        *prev_esp = current_stack_pointer();
+        *prev_esp = current_stack_pointer;
 
         call_on_stack(__do_softirq, isp);
 }
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 4b0592ca9e47..8c1cc08f514f 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -299,7 +299,7 @@ static int __init create_setup_data_nodes(struct kobject *parent)
         return 0;
 
 out_clean_nodes:
-        for (j = i - 1; j > 0; j--)
+        for (j = i - 1; j >= 0; j--)
                 cleanup_setup_data_node(*(kobjp + j));
         kfree(kobjp);
 out_setup_data_kobj:
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index aa60a08b65b1..8bb9594d0761 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -117,7 +117,11 @@ static struct kvm_task_sleep_node *_find_apf_task(struct kvm_task_sleep_head *b,
         return NULL;
 }
 
-void kvm_async_pf_task_wait(u32 token)
+/*
+ * @interrupt_kernel: Is this called from a routine which interrupts the kernel
+ *                    (other than user space)?
+ */
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel)
 {
         u32 key = hash_32(token, KVM_TASK_SLEEP_HASHBITS);
         struct kvm_task_sleep_head *b = &async_pf_sleepers[key];
@@ -140,7 +144,10 @@ void kvm_async_pf_task_wait(u32 token)
 
         n.token = token;
         n.cpu = smp_processor_id();
-        n.halted = is_idle_task(current) || preempt_count() > 1;
+        n.halted = is_idle_task(current) ||
+                   (IS_ENABLED(CONFIG_PREEMPT_COUNT)
+                    ? preempt_count() > 1 || rcu_preempt_depth()
+                    : interrupt_kernel);
         init_swait_queue_head(&n.wq);
         hlist_add_head(&n.link, &b->list);
         raw_spin_unlock(&b->lock);
@@ -268,7 +275,7 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
         case KVM_PV_REASON_PAGE_NOT_PRESENT:
                 /* page is swapped out by the host. */
                 prev_state = exception_enter();
-                kvm_async_pf_task_wait((u32)read_cr2());
+                kvm_async_pf_task_wait((u32)read_cr2(), !user_mode(regs));
                 exception_exit(prev_state);
                 break;
         case KVM_PV_REASON_PAGE_READY:
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index e04442345fc0..4e188fda5961 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -263,7 +263,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
                 sp = (unsigned long) ka->sa.sa_restorer;
         }
 
-        if (fpu->fpstate_active) {
+        if (fpu->initialized) {
                 sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32),
                                           &buf_fx, &math_size);
                 *fpstate = (void __user *)sp;
@@ -279,7 +279,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
                 return (void __user *)-1L;
 
         /* save i387 and extended state */
-        if (fpu->fpstate_active &&
+        if (fpu->initialized &&
             copy_fpstate_to_sigframe(*fpstate, (void __user *)buf_fx, math_size) < 0)
                 return (void __user *)-1L;
 
@@ -755,7 +755,7 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs)
                 /*
                  * Ensure the signal handler starts with the new fpu state.
                  */
-                if (fpu->fpstate_active)
+                if (fpu->initialized)
                         fpu__clear(fpu);
         }
         signal_setup_done(failed, ksig, stepping);
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 0854ff169274..ad59edd84de7 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -232,12 +232,6 @@ static void notrace start_secondary(void *unused)
          */
         if (boot_cpu_has(X86_FEATURE_PCID))
                 __write_cr4(__read_cr4() | X86_CR4_PCIDE);
-        cpu_init();
-        x86_cpuinit.early_percpu_clock_init();
-        preempt_disable();
-        smp_callin();
-
-        enable_start_cpu0 = 0;
 
 #ifdef CONFIG_X86_32
         /* switch away from the initial page table */
@@ -245,6 +239,13 @@ static void notrace start_secondary(void *unused)
         __flush_tlb_all();
 #endif
 
+        cpu_init();
+        x86_cpuinit.early_percpu_clock_init();
+        preempt_disable();
+        smp_callin();
+
+        enable_start_cpu0 = 0;
+
         /* otherwise gcc will move up smp_processor_id before the cpu_init */
         barrier();
         /*
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 34ea3651362e..67db4f43309e 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -142,7 +142,7 @@ void ist_begin_non_atomic(struct pt_regs *regs)
          * from double_fault.
          */
         BUG_ON((unsigned long)(current_top_of_stack() -
-                               current_stack_pointer()) >= THREAD_SIZE);
+                               current_stack_pointer) >= THREAD_SIZE);
 
         preempt_enable_no_resched();
 }
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 3ea624452f93..3c48bc8bf08c 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -23,6 +23,7 @@ config KVM
         depends on HIGH_RES_TIMERS
         # for TASKSTATS/TASK_DELAY_ACCT:
         depends on NET && MULTIUSER
+        depends on X86_LOCAL_APIC
         select PREEMPT_NOTIFIERS
         select MMU_NOTIFIER
         select ANON_INODES
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 16bf6655aa85..d90cdc77e077 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -425,8 +425,10 @@ static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *));
         #op " %al \n\t" \
         FOP_RET
 
-asm(".global kvm_fastop_exception \n"
-    "kvm_fastop_exception: xor %esi, %esi; ret");
+asm(".pushsection .fixup, \"ax\"\n"
+    ".global kvm_fastop_exception \n"
+    "kvm_fastop_exception: xor %esi, %esi; ret\n"
+    ".popsection");
 
 FOP_START(setcc)
 FOP_SETCC(seto)
@@ -4102,10 +4104,12 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
                 ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
                 if (efer & EFER_LMA) {
                         u64 maxphyaddr;
-                        u32 eax = 0x80000008;
+                        u32 eax, ebx, ecx, edx;
 
-                        if (ctxt->ops->get_cpuid(ctxt, &eax, NULL, NULL,
-                                                 NULL, false))
+                        eax = 0x80000008;
+                        ecx = 0;
+                        if (ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx,
+                                                 &edx, false))
                                 maxphyaddr = eax & 0xff;
                         else
                                 maxphyaddr = 36;
@@ -5296,7 +5300,6 @@ static void fetch_possible_mmx_operand(struct x86_emulate_ctxt *ctxt,
 
 static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *))
 {
-        register void *__sp asm(_ASM_SP);
         ulong flags = (ctxt->eflags & EFLAGS_MASK) | X86_EFLAGS_IF;
 
         if (!(ctxt->d & ByteOp))
@@ -5304,7 +5307,7 @@ static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *))
 
         asm("push %[flags]; popf; call *%[fastop]; pushf; pop %[flags]\n"
             : "+a"(ctxt->dst.val), "+d"(ctxt->src.val), [flags]"+D"(flags),
-              [fastop]"+S"(fop), "+r"(__sp)
+              [fastop]"+S"(fop), ASM_CALL_CONSTRAINT
             : "c"(ctxt->src2.val));
 
         ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index eca30c1eb1d9..106d4a029a8a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3837,7 +3837,7 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
         case KVM_PV_REASON_PAGE_NOT_PRESENT:
                 vcpu->arch.apf.host_apf_reason = 0;
                 local_irq_disable();
-                kvm_async_pf_task_wait(fault_address);
+                kvm_async_pf_task_wait(fault_address, 0);
                 local_irq_enable();
                 break;
         case KVM_PV_REASON_PAGE_READY:
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 06c0c6d0541e..a2b804e10c95 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -200,6 +200,8 @@ struct loaded_vmcs {
         int cpu;
         bool launched;
         bool nmi_known_unmasked;
+        unsigned long vmcs_host_cr3;    /* May not match real cr3 */
+        unsigned long vmcs_host_cr4;    /* May not match real cr4 */
         struct list_head loaded_vmcss_on_cpu_link;
 };
 
@@ -600,8 +602,6 @@ struct vcpu_vmx {
                 int           gs_ldt_reload_needed;
                 int           fs_reload_needed;
                 u64           msr_host_bndcfgs;
-                unsigned long vmcs_host_cr3;    /* May not match real cr3 */
-                unsigned long vmcs_host_cr4;    /* May not match real cr4 */
         } host_state;
         struct {
                 int vm86_active;
@@ -2202,46 +2202,44 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
         struct pi_desc old, new;
         unsigned int dest;
 
-        if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
-                !kvm_vcpu_apicv_active(vcpu))
+        /*
+         * In case of hot-plug or hot-unplug, we may have to undo
+         * vmx_vcpu_pi_put even if there is no assigned device.  And we
+         * always keep PI.NDST up to date for simplicity: it makes the
+         * code easier, and CPU migration is not a fast path.
+         */
+        if (!pi_test_sn(pi_desc) && vcpu->cpu == cpu)
+                return;
+
+        /*
+         * First handle the simple case where no cmpxchg is necessary; just
+         * allow posting non-urgent interrupts.
+         *
+         * If the 'nv' field is POSTED_INTR_WAKEUP_VECTOR, do not change
+         * PI.NDST: pi_post_block will do it for us and the wakeup_handler
+         * expects the VCPU to be on the blocked_vcpu_list that matches
+         * PI.NDST.
+         */
+        if (pi_desc->nv == POSTED_INTR_WAKEUP_VECTOR ||
+            vcpu->cpu == cpu) {
+                pi_clear_sn(pi_desc);
                 return;
+        }
 
+        /* The full case.  */
         do {
                 old.control = new.control = pi_desc->control;
 
-                /*
-                 * If 'nv' field is POSTED_INTR_WAKEUP_VECTOR, there
-                 * are two possible cases:
-                 * 1. After running 'pre_block', context switch
-                 *    happened. For this case, 'sn' was set in
-                 *    vmx_vcpu_put(), so we need to clear it here.
-                 * 2. After running 'pre_block', we were blocked,
-                 *    and woken up by some other guy. For this case,
-                 *    we don't need to do anything, 'pi_post_block'
-                 *    will do everything for us. However, we cannot
-                 *    check whether it is case #1 or case #2 here
-                 *    (maybe, not needed), so we also clear sn here,
-                 *    I think it is not a big deal.
-                 */
-                if (pi_desc->nv != POSTED_INTR_WAKEUP_VECTOR) {
-                        if (vcpu->cpu != cpu) {
-                                dest = cpu_physical_id(cpu);
-
-                                if (x2apic_enabled())
-                                        new.ndst = dest;
-                                else
-                                        new.ndst = (dest << 8) & 0xFF00;
-                        }
+                dest = cpu_physical_id(cpu);
 
-                        /* set 'NV' to 'notification vector' */
-                        new.nv = POSTED_INTR_VECTOR;
-                }
+                if (x2apic_enabled())
+                        new.ndst = dest;
+                else
+                        new.ndst = (dest << 8) & 0xFF00;
 
-                /* Allow posting non-urgent interrupts */
                 new.sn = 0;
-        } while (cmpxchg(&pi_desc->control, old.control,
-                        new.control) != old.control);
+        } while (cmpxchg64(&pi_desc->control, old.control,
+                           new.control) != old.control);
 }
 
 static void decache_tsc_multiplier(struct vcpu_vmx *vmx)
@@ -5077,21 +5075,30 @@ static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu,
         int pi_vec = nested ? POSTED_INTR_NESTED_VECTOR : POSTED_INTR_VECTOR;
 
         if (vcpu->mode == IN_GUEST_MODE) {
-                struct vcpu_vmx *vmx = to_vmx(vcpu);
-
                 /*
-                 * Currently, we don't support urgent interrupt,
-                 * all interrupts are recognized as non-urgent
-                 * interrupt, so we cannot post interrupts when
-                 * 'SN' is set.
+                 * The vector of interrupt to be delivered to vcpu had
+                 * been set in PIR before this function.
+                 *
+                 * Following cases will be reached in this block, and
+                 * we always send a notification event in all cases as
+                 * explained below.
+                 *
+                 * Case 1: vcpu keeps in non-root mode. Sending a
+                 * notification event posts the interrupt to vcpu.
                  *
-                 * If the vcpu is in guest mode, it means it is
-                 * running instead of being scheduled out and
-                 * waiting in the run queue, and that's the only
-                 * case when 'SN' is set currently, warning if
-                 * 'SN' is set.
+                 * Case 2: vcpu exits to root mode and is still
+                 * runnable. PIR will be synced to vIRR before the
+                 * next vcpu entry. Sending a notification event in
+                 * this case has no effect, as vcpu is not in root
+                 * mode.
+                 *
+                 * Case 3: vcpu exits to root mode and is blocked.
+                 * vcpu_block() has already synced PIR to vIRR and
+                 * never blocks vcpu if vIRR is not cleared. Therefore,
+                 * a blocked vcpu here does not wait for any requested
+                 * interrupts in PIR, and sending a notification event
+                 * which has no effect is safe here.
                  */
-                WARN_ON_ONCE(pi_test_sn(&vmx->pi_desc));
 
                 apic->send_IPI_mask(get_cpu_mask(vcpu->cpu), pi_vec);
                 return true;
@@ -5169,12 +5176,12 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
          */
         cr3 = __read_cr3();
         vmcs_writel(HOST_CR3, cr3);             /* 22.2.3  FIXME: shadow tables */
-        vmx->host_state.vmcs_host_cr3 = cr3;
+        vmx->loaded_vmcs->vmcs_host_cr3 = cr3;
 
         /* Save the most likely value for this task's CR4 in the VMCS. */
         cr4 = cr4_read_shadow();
         vmcs_writel(HOST_CR4, cr4);                     /* 22.2.3, 22.2.5 */
-        vmx->host_state.vmcs_host_cr4 = cr4;
+        vmx->loaded_vmcs->vmcs_host_cr4 = cr4;
 
         vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS);  /* 22.2.4 */
 #ifdef CONFIG_X86_64
@@ -9036,7 +9043,6 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
 static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
 {
         u32 exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
-        register void *__sp asm(_ASM_SP);
 
         if ((exit_intr_info & (INTR_INFO_VALID_MASK | INTR_INFO_INTR_TYPE_MASK))
                         == (INTR_INFO_VALID_MASK | INTR_TYPE_EXT_INTR)) {
@@ -9065,7 +9071,7 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu)
 #ifdef CONFIG_X86_64
                         [sp]"=&r"(tmp),
 #endif
-                        "+r"(__sp)
+                        ASM_CALL_CONSTRAINT
                         :
                         [entry]"r"(entry),
                         [ss]"i"(__KERNEL_DS),
@@ -9265,15 +9271,15 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
                 vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
 
         cr3 = __get_current_cr3_fast();
-        if (unlikely(cr3 != vmx->host_state.vmcs_host_cr3)) {
+        if (unlikely(cr3 != vmx->loaded_vmcs->vmcs_host_cr3)) {
                 vmcs_writel(HOST_CR3, cr3);
-                vmx->host_state.vmcs_host_cr3 = cr3;
+                vmx->loaded_vmcs->vmcs_host_cr3 = cr3;
         }
 
         cr4 = cr4_read_shadow();
-        if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) {
+        if (unlikely(cr4 != vmx->loaded_vmcs->vmcs_host_cr4)) {
                 vmcs_writel(HOST_CR4, cr4);
-                vmx->host_state.vmcs_host_cr4 = cr4;
+                vmx->loaded_vmcs->vmcs_host_cr4 = cr4;
         }
 
         /* When single-stepping over STI and MOV SS, we must clear the
@@ -9583,6 +9589,13 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
 
         vmx->msr_ia32_feature_control_valid_bits = FEATURE_CONTROL_LOCKED;
 
+        /*
+         * Enforce invariant: pi_desc.nv is always either POSTED_INTR_VECTOR
+         * or POSTED_INTR_WAKEUP_VECTOR.
+         */
+        vmx->pi_desc.nv = POSTED_INTR_VECTOR;
+        vmx->pi_desc.sn = 1;
+
         return &vmx->vcpu;
 
 free_vmcs:
@@ -9831,7 +9844,8 @@ static void vmx_inject_page_fault_nested(struct kvm_vcpu *vcpu,
 
         WARN_ON(!is_guest_mode(vcpu));
 
-        if (nested_vmx_is_page_fault_vmexit(vmcs12, fault->error_code)) {
+        if (nested_vmx_is_page_fault_vmexit(vmcs12, fault->error_code) &&
+                !to_vmx(vcpu)->nested.nested_run_pending) {
                 vmcs12->vm_exit_intr_error_code = fault->error_code;
                 nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
                                   PF_VECTOR | INTR_TYPE_HARD_EXCEPTION |
@@ -11696,6 +11710,37 @@ static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
         kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
 }
 
+static void __pi_post_block(struct kvm_vcpu *vcpu)
+{
+        struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
+        struct pi_desc old, new;
+        unsigned int dest;
+
+        do {
+                old.control = new.control = pi_desc->control;
+                WARN(old.nv != POSTED_INTR_WAKEUP_VECTOR,
+                     "Wakeup handler not enabled while the VCPU is blocked\n");
+
+                dest = cpu_physical_id(vcpu->cpu);
+
+                if (x2apic_enabled())
+                        new.ndst = dest;
+                else
+                        new.ndst = (dest << 8) & 0xFF00;
+
+                /* set 'NV' to 'notification vector' */
+                new.nv = POSTED_INTR_VECTOR;
+        } while (cmpxchg64(&pi_desc->control, old.control,
+                           new.control) != old.control);
+
+        if (!WARN_ON_ONCE(vcpu->pre_pcpu == -1)) {
+                spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+                list_del(&vcpu->blocked_vcpu_list);
+                spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+                vcpu->pre_pcpu = -1;
+        }
+}
+
 /*
  * This routine does the following things for vCPU which is going
  * to be blocked if VT-d PI is enabled.
@@ -11711,7 +11756,6 @@ static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
  */
 static int pi_pre_block(struct kvm_vcpu *vcpu)
 {
-        unsigned long flags;
         unsigned int dest;
         struct pi_desc old, new;
         struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
@@ -11721,34 +11765,20 @@ static int pi_pre_block(struct kvm_vcpu *vcpu)
                 !kvm_vcpu_apicv_active(vcpu))
                 return 0;
 
-        vcpu->pre_pcpu = vcpu->cpu;
-        spin_lock_irqsave(&per_cpu(blocked_vcpu_on_cpu_lock,
-                          vcpu->pre_pcpu), flags);
-        list_add_tail(&vcpu->blocked_vcpu_list,
-                      &per_cpu(blocked_vcpu_on_cpu,
-                      vcpu->pre_pcpu));
-        spin_unlock_irqrestore(&per_cpu(blocked_vcpu_on_cpu_lock,
-                               vcpu->pre_pcpu), flags);
+        WARN_ON(irqs_disabled());
+        local_irq_disable();
+        if (!WARN_ON_ONCE(vcpu->pre_pcpu != -1)) {
+                vcpu->pre_pcpu = vcpu->cpu;
+                spin_lock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+                list_add_tail(&vcpu->blocked_vcpu_list,
+                              &per_cpu(blocked_vcpu_on_cpu,
+                                       vcpu->pre_pcpu));
+                spin_unlock(&per_cpu(blocked_vcpu_on_cpu_lock, vcpu->pre_pcpu));
+        }
 
         do {
                 old.control = new.control = pi_desc->control;
 
-                /*
-                 * We should not block the vCPU if
-                 * an interrupt is posted for it.
-                 */
-                if (pi_test_on(pi_desc) == 1) {
-                        spin_lock_irqsave(&per_cpu(blocked_vcpu_on_cpu_lock,
-                                          vcpu->pre_pcpu), flags);
-                        list_del(&vcpu->blocked_vcpu_list);
-                        spin_unlock_irqrestore(
-                                        &per_cpu(blocked_vcpu_on_cpu_lock,
-                                        vcpu->pre_pcpu), flags);
-                        vcpu->pre_pcpu = -1;
-
-                        return 1;
-                }
-
                 WARN((pi_desc->sn == 1),
                      "Warning: SN field of posted-interrupts "
                      "is set before blocking\n");
@@ -11770,10 +11800,15 @@ static int pi_pre_block(struct kvm_vcpu *vcpu)
 
                 /* set 'NV' to 'wakeup vector' */
                 new.nv = POSTED_INTR_WAKEUP_VECTOR;
-        } while (cmpxchg(&pi_desc->control, old.control,
-                        new.control) != old.control);
+        } while (cmpxchg64(&pi_desc->control, old.control,
+                           new.control) != old.control);
 
-        return 0;
+        /* We should not block the vCPU if an interrupt is posted for it.  */
+        if (pi_test_on(pi_desc) == 1)
+                __pi_post_block(vcpu);
+
+        local_irq_enable();
+        return (vcpu->pre_pcpu == -1);
 }
 
 static int vmx_pre_block(struct kvm_vcpu *vcpu)
@@ -11789,44 +11824,13 @@ static int vmx_pre_block(struct kvm_vcpu *vcpu)
 
 static void pi_post_block(struct kvm_vcpu *vcpu)
 {
-        struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
-        struct pi_desc old, new;
-        unsigned int dest;
-        unsigned long flags;
-
-        if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
-                !kvm_vcpu_apicv_active(vcpu))
+        if (vcpu->pre_pcpu == -1)
                 return;
 
-        do {
-                old.control = new.control = pi_desc->control;
-
-                dest = cpu_physical_id(vcpu->cpu);
-
-                if (x2apic_enabled())
-                        new.ndst = dest;
-                else
-                        new.ndst = (dest << 8) & 0xFF00;
-
-                /* Allow posting non-urgent interrupts */
-                new.sn = 0;
-
-                /* set 'NV' to 'notification vector' */
-                new.nv = POSTED_INTR_VECTOR;
-        } while (cmpxchg(&pi_desc->control, old.control,
-                        new.control) != old.control);
-
-        if(vcpu->pre_pcpu != -1) {
-                spin_lock_irqsave(
-                        &per_cpu(blocked_vcpu_on_cpu_lock,
-                        vcpu->pre_pcpu), flags);
-                list_del(&vcpu->blocked_vcpu_list);
-                spin_unlock_irqrestore(
-                        &per_cpu(blocked_vcpu_on_cpu_lock,
-                        vcpu->pre_pcpu), flags);
-                vcpu->pre_pcpu = -1;
-        }
+        WARN_ON(irqs_disabled());
+        local_irq_disable();
+        __pi_post_block(vcpu);
+        local_irq_enable();
 }
 
 static void vmx_post_block(struct kvm_vcpu *vcpu)
@@ -11911,12 +11915,8 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
 
                 if (set)
                         ret = irq_set_vcpu_affinity(host_irq, &vcpu_info);
-                else {
-                        /* suppress notification event before unposting */
-                        pi_set_sn(vcpu_to_pi_desc(vcpu));
+                else
                         ret = irq_set_vcpu_affinity(host_irq, NULL);
-                        pi_clear_sn(vcpu_to_pi_desc(vcpu));
-                }
 
                 if (ret < 0) {
                         printk(KERN_INFO "%s: failed to update PI IRTE\n",
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index cd17b7d9a107..03869eb7fcd6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7225,7 +7225,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         int r;
         sigset_t sigsaved;
 
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
         if (vcpu->sigset_active)
                 sigprocmask(SIG_SETMASK, &vcpu->sigset, &sigsaved);
diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
index d4a7df2205b8..220638a4cb94 100644
--- a/arch/x86/math-emu/fpu_entry.c
+++ b/arch/x86/math-emu/fpu_entry.c
@@ -114,7 +114,7 @@ void math_emulate(struct math_emu_info *info)
         struct desc_struct code_descriptor;
         struct fpu *fpu = &current->thread.fpu;
 
-        fpu__activate_curr(fpu);
+        fpu__initialize(fpu);
 
 #ifdef RE_ENTRANT_CHECKING
         if (emulating) {
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index c076f710de4c..c3521e2be396 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -2,6 +2,7 @@
 #include <linux/uaccess.h>
 #include <linux/sched/debug.h>
 
+#include <asm/fpu/internal.h>
 #include <asm/traps.h>
 #include <asm/kdebug.h>
 
@@ -78,6 +79,29 @@ bool ex_handler_refcount(const struct exception_table_entry *fixup,
 }
 EXPORT_SYMBOL_GPL(ex_handler_refcount);
 
+/*
+ * Handler for when we fail to restore a task's FPU state.  We should never get
+ * here because the FPU state of a task using the FPU (task->thread.fpu.state)
+ * should always be valid.  However, past bugs have allowed userspace to set
+ * reserved bits in the XSAVE area using PTRACE_SETREGSET or sys_rt_sigreturn().
+ * These caused XRSTOR to fail when switching to the task, leaking the FPU
+ * registers of the task previously executing on the CPU.  Mitigate this class
+ * of vulnerability by restoring from the initial state (essentially, zeroing
+ * out all the FPU registers) if we can't restore from the task's FPU state.
+ */
+bool ex_handler_fprestore(const struct exception_table_entry *fixup,
+                          struct pt_regs *regs, int trapnr)
+{
+        regs->ip = ex_fixup_addr(fixup);
+
+        WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
+                  (void *)instruction_pointer(regs));
+
+        __copy_kernel_to_fpregs(&init_fpstate, -1);
+        return true;
+}
+EXPORT_SYMBOL_GPL(ex_handler_fprestore);
+
 bool ex_handler_ext(const struct exception_table_entry *fixup,
                    struct pt_regs *regs, int trapnr)
 {
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index b836a7274e12..e2baeaa053a5 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -192,8 +192,7 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
  * 6. T1   : reaches here, sees vma_pkey(vma)=5, when we really
  *           faulted on a pte with its pkey=4.
  */
-static void fill_sig_info_pkey(int si_code, siginfo_t *info,
-                struct vm_area_struct *vma)
+static void fill_sig_info_pkey(int si_code, siginfo_t *info, u32 *pkey)
 {
         /* This is effectively an #ifdef */
         if (!boot_cpu_has(X86_FEATURE_OSPKE))
@@ -209,7 +208,7 @@ static void fill_sig_info_pkey(int si_code, siginfo_t *info,
          * valid VMA, so we should never reach this without a
          * valid VMA.
          */
-        if (!vma) {
+        if (!pkey) {
                 WARN_ONCE(1, "PKU fault with no VMA passed in");
                 info->si_pkey = 0;
                 return;
@@ -219,13 +218,12 @@ static void fill_sig_info_pkey(int si_code, siginfo_t *info,
          * absolutely guranteed to be 100% accurate because of
          * the race explained above.
          */
-        info->si_pkey = vma_pkey(vma);
+        info->si_pkey = *pkey;
 }
 
 static void
 force_sig_info_fault(int si_signo, int si_code, unsigned long address,
-                     struct task_struct *tsk, struct vm_area_struct *vma,
-                     int fault)
+                     struct task_struct *tsk, u32 *pkey, int fault)
 {
         unsigned lsb = 0;
         siginfo_t info;
@@ -240,7 +238,7 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
                 lsb = PAGE_SHIFT;
         info.si_addr_lsb = lsb;
 
-        fill_sig_info_pkey(si_code, &info, vma);
+        fill_sig_info_pkey(si_code, &info, pkey);
 
         force_sig_info(si_signo, &info, tsk);
 }
@@ -762,8 +760,6 @@ no_context(struct pt_regs *regs, unsigned long error_code,
         struct task_struct *tsk = current;
         unsigned long flags;
         int sig;
-        /* No context means no VMA to pass down */
-        struct vm_area_struct *vma = NULL;
 
         /* Are we prepared to handle this kernel fault? */
         if (fixup_exception(regs, X86_TRAP_PF)) {
@@ -788,7 +784,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
 
                         /* XXX: hwpoison faults will set the wrong code. */
                         force_sig_info_fault(signal, si_code, address,
-                                             tsk, vma, 0);
+                                             tsk, NULL, 0);
                 }
 
                 /*
@@ -806,7 +802,6 @@ no_context(struct pt_regs *regs, unsigned long error_code,
         if (is_vmalloc_addr((void *)address) &&
             (((unsigned long)tsk->stack - 1 - address < PAGE_SIZE) ||
              address - ((unsigned long)tsk->stack + THREAD_SIZE) < PAGE_SIZE)) {
-                register void *__sp asm("rsp");
                 unsigned long stack = this_cpu_read(orig_ist.ist[DOUBLEFAULT_STACK]) - sizeof(void *);
                 /*
                  * We're likely to be running with very little stack space
@@ -821,7 +816,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
                 asm volatile ("movq %[stack], %%rsp\n\t"
                               "call handle_stack_overflow\n\t"
                               "1: jmp 1b"
-                              : "+r" (__sp)
+                              : ASM_CALL_CONSTRAINT
                               : "D" ("kernel stack overflow (page fault)"),
                                 "S" (regs), "d" (address),
                                 [stack] "rm" (stack));
@@ -897,8 +892,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code,
 
 static void
 __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
-                       unsigned long address, struct vm_area_struct *vma,
-                       int si_code)
+                       unsigned long address, u32 *pkey, int si_code)
 {
         struct task_struct *tsk = current;
 
@@ -946,7 +940,7 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
                 tsk->thread.error_code  = error_code;
                 tsk->thread.trap_nr     = X86_TRAP_PF;
 
-                force_sig_info_fault(SIGSEGV, si_code, address, tsk, vma, 0);
+                force_sig_info_fault(SIGSEGV, si_code, address, tsk, pkey, 0);
 
                 return;
         }
@@ -959,9 +953,9 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
 
 static noinline void
 bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
-                     unsigned long address, struct vm_area_struct *vma)
+                     unsigned long address, u32 *pkey)
 {
-        __bad_area_nosemaphore(regs, error_code, address, vma, SEGV_MAPERR);
+        __bad_area_nosemaphore(regs, error_code, address, pkey, SEGV_MAPERR);
 }
 
 static void
@@ -969,6 +963,10 @@ __bad_area(struct pt_regs *regs, unsigned long error_code,
            unsigned long address,  struct vm_area_struct *vma, int si_code)
 {
         struct mm_struct *mm = current->mm;
+        u32 pkey;
+
+        if (vma)
+                pkey = vma_pkey(vma);
 
         /*
          * Something tried to access memory that isn't in our memory map..
@@ -976,7 +974,8 @@ __bad_area(struct pt_regs *regs, unsigned long error_code,
          */
         up_read(&mm->mmap_sem);
 
-        __bad_area_nosemaphore(regs, error_code, address, vma, si_code);
+        __bad_area_nosemaphore(regs, error_code, address,
+                               (vma) ? &pkey : NULL, si_code);
 }
 
 static noinline void
@@ -1019,7 +1018,7 @@ bad_area_access_error(struct pt_regs *regs, unsigned long error_code,
 
 static void
 do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
-          struct vm_area_struct *vma, unsigned int fault)
+          u32 *pkey, unsigned int fault)
 {
         struct task_struct *tsk = current;
         int code = BUS_ADRERR;
@@ -1046,13 +1045,12 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
                 code = BUS_MCEERR_AR;
         }
 #endif
-        force_sig_info_fault(SIGBUS, code, address, tsk, vma, fault);
+        force_sig_info_fault(SIGBUS, code, address, tsk, pkey, fault);
 }
 
 static noinline void
 mm_fault_error(struct pt_regs *regs, unsigned long error_code,
-               unsigned long address, struct vm_area_struct *vma,
-               unsigned int fault)
+               unsigned long address, u32 *pkey, unsigned int fault)
 {
         if (fatal_signal_pending(current) && !(error_code & PF_USER)) {
                 no_context(regs, error_code, address, 0, 0);
@@ -1076,9 +1074,9 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
         } else {
                 if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
                              VM_FAULT_HWPOISON_LARGE))
-                        do_sigbus(regs, error_code, address, vma, fault);
+                        do_sigbus(regs, error_code, address, pkey, fault);
                 else if (fault & VM_FAULT_SIGSEGV)
-                        bad_area_nosemaphore(regs, error_code, address, vma);
+                        bad_area_nosemaphore(regs, error_code, address, pkey);
                 else
                         BUG();
         }
@@ -1268,6 +1266,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
         struct mm_struct *mm;
         int fault, major = 0;
         unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+        u32 pkey;
 
         tsk = current;
         mm = tsk->mm;
@@ -1468,9 +1467,10 @@ good_area:
                 return;
         }
 
+        pkey = vma_pkey(vma);
         up_read(&mm->mmap_sem);
         if (unlikely(fault & VM_FAULT_ERROR)) {
-                mm_fault_error(regs, error_code, address, vma, fault);
+                mm_fault_error(regs, error_code, address, &pkey, fault);
                 return;
         }
 
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
index 3fcc8e01683b..16c5f37933a2 100644
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -10,6 +10,8 @@
  * published by the Free Software Foundation.
  */
 
+#define DISABLE_BRANCH_PROFILING
+
 #include <linux/linkage.h>
 #include <linux/init.h>
 #include <linux/mm.h>
diff --git a/arch/x86/mm/pkeys.c b/arch/x86/mm/pkeys.c
index 2dab69a706ec..d7bc0eea20a5 100644
--- a/arch/x86/mm/pkeys.c
+++ b/arch/x86/mm/pkeys.c
@@ -18,7 +18,6 @@
 
 #include <asm/cpufeature.h>             /* boot_cpu_has, ...            */
 #include <asm/mmu_context.h>            /* vma_pkey()                   */
-#include <asm/fpu/internal.h>           /* fpregs_active()              */
 
 int __execute_only_pkey(struct mm_struct *mm)
 {
@@ -45,7 +44,7 @@ int __execute_only_pkey(struct mm_struct *mm)
          */
         preempt_disable();
         if (!need_to_set_mm_pkey &&
-            fpregs_active() &&
+            current->thread.fpu.initialized &&
             !__pkru_allows_read(read_pkru(), execute_only_pkey)) {
                 preempt_enable();
                 return execute_only_pkey;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 1ab3821f9e26..49d9778376d7 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -126,8 +126,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
          * isn't free.
          */
 #ifdef CONFIG_DEBUG_VM
-        if (WARN_ON_ONCE(__read_cr3() !=
-                         (__sme_pa(real_prev->pgd) | prev_asid))) {
+        if (WARN_ON_ONCE(__read_cr3() != build_cr3(real_prev, prev_asid))) {
                 /*
                  * If we were to BUG here, we'd be very likely to kill
                  * the system so hard that we don't see the call trace.
@@ -172,7 +171,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                          */
                         this_cpu_write(cpu_tlbstate.ctxs[prev_asid].tlb_gen,
                                        next_tlb_gen);
-                        write_cr3(__sme_pa(next->pgd) | prev_asid);
+                        write_cr3(build_cr3(next, prev_asid));
                         trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH,
                                         TLB_FLUSH_ALL);
                 }
@@ -192,7 +191,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                          * mapped in the new pgd, we'll double-fault.  Forcibly
                          * map it.
                          */
-                        unsigned int index = pgd_index(current_stack_pointer());
+                        unsigned int index = pgd_index(current_stack_pointer);
                         pgd_t *pgd = next->pgd + index;
 
                         if (unlikely(pgd_none(*pgd)))
@@ -216,12 +215,12 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                 if (need_flush) {
                         this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
                         this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
-                        write_cr3(__sme_pa(next->pgd) | new_asid);
+                        write_cr3(build_cr3(next, new_asid));
                         trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH,
                                         TLB_FLUSH_ALL);
                 } else {
                         /* The new ASID is already up to date. */
-                        write_cr3(__sme_pa(next->pgd) | new_asid | CR3_NOFLUSH);
+                        write_cr3(build_cr3_noflush(next, new_asid));
                         trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, 0);
                 }
 
@@ -265,7 +264,7 @@ void initialize_tlbstate_and_flush(void)
                 !(cr4_read_shadow() & X86_CR4_PCIDE));
 
         /* Force ASID 0 and force a TLB flush. */
-        write_cr3(cr3 & ~CR3_PCID_MASK);
+        write_cr3(build_cr3(mm, 0));
 
         /* Reinitialize tlbstate. */
         this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 8c9573660d51..0554e8aef4d5 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -284,9 +284,9 @@ static void emit_bpf_tail_call(u8 **pprog)
         /* if (index >= array->map.max_entries)
          *   goto out;
          */
-        EMIT4(0x48, 0x8B, 0x46,                   /* mov rax, qword ptr [rsi + 16] */
+        EMIT2(0x89, 0xD2);                        /* mov edx, edx */
+        EMIT3(0x39, 0x56,                         /* cmp dword ptr [rsi + 16], edx */
               offsetof(struct bpf_array, map.max_entries));
-        EMIT3(0x48, 0x39, 0xD0);                  /* cmp rax, rdx */
 #define OFFSET1 43 /* number of bytes to jump */
         EMIT2(X86_JBE, OFFSET1);                  /* jbe out */
         label1 = cnt;
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 509f560bd0c6..71495f1a86d7 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1238,21 +1238,16 @@ static void __init xen_pagetable_cleanhighmap(void)
          * from _brk_limit way up to the max_pfn_mapped (which is the end of
          * the ramdisk). We continue on, erasing PMD entries that point to page
          * tables - do note that they are accessible at this stage via __va.
-         * For good measure we also round up to the PMD - which means that if
+         * As Xen is aligning the memory end to a 4MB boundary, for good
+         * measure we also round up to PMD_SIZE * 2 - which means that if
          * anybody is using __ka address to the initial boot-stack - and try
          * to use it - they are going to crash. The xen_start_info has been
          * taken care of already in xen_setup_kernel_pagetable. */
         addr = xen_start_info->pt_base;
-        size = roundup(xen_start_info->nr_pt_frames * PAGE_SIZE, PMD_SIZE);
+        size = xen_start_info->nr_pt_frames * PAGE_SIZE;
 
-        xen_cleanhighmap(addr, addr + size);
+        xen_cleanhighmap(addr, roundup(addr + size, PMD_SIZE * 2));
         xen_start_info->pt_base = (unsigned long)__va(__pa(xen_start_info->pt_base));
-#ifdef DEBUG
-        /* This is superfluous and is not necessary, but you know what
-         * lets do it. The MODULES_VADDR -> MODULES_END should be clear of
-         * anything at this stage. */
-        xen_cleanhighmap(MODULES_VADDR, roundup(MODULES_VADDR, PUD_SIZE) - 1);
-#endif
 }
 #endif
 
@@ -2220,7 +2215,7 @@ static void __init xen_write_cr3_init(unsigned long cr3)
  * not the first page table in the page table pool.
  * Iterate through the initial page tables to find the real page table base.
  */
-static phys_addr_t xen_find_pt_base(pmd_t *pmd)
+static phys_addr_t __init xen_find_pt_base(pmd_t *pmd)
 {
         phys_addr_t pt_base, paddr;
         unsigned pmdidx;
diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
index 30ee8c608853..5b0027d4ecc0 100644
--- a/arch/xtensa/include/asm/processor.h
+++ b/arch/xtensa/include/asm/processor.h
@@ -208,11 +208,6 @@ struct mm_struct;
 /* Free all resources held by a thread. */
 #define release_thread(thread) do { } while(0)
 
-/* Copy and release all segment info associated with a VM */
-#define copy_segments(p, mm)    do { } while(0)
-#define release_segments(mm)    do { } while(0)
-#define forget_segments()       do { } while (0)
-
 extern unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)           (task_pt_regs(tsk)->pc)
diff --git a/block/blk-core.c b/block/blk-core.c
index aebe676225e6..048be4aa6024 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -854,6 +854,9 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id)
 
         kobject_init(&q->kobj, &blk_queue_ktype);
 
+#ifdef CONFIG_BLK_DEV_IO_TRACE
+        mutex_init(&q->blk_trace_mutex);
+#endif
         mutex_init(&q->sysfs_lock);
         spin_lock_init(&q->__queue_lock);
 
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 980e73095643..de294d775acf 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -815,10 +815,14 @@ int blk_mq_debugfs_register(struct request_queue *q)
                 goto err;
 
         /*
-         * blk_mq_init_hctx() attempted to do this already, but q->debugfs_dir
+         * blk_mq_init_sched() attempted to do this already, but q->debugfs_dir
          * didn't exist yet (because we don't know what to name the directory
          * until the queue is registered to a gendisk).
          */
+        if (q->elevator && !q->sched_debugfs_dir)
+                blk_mq_debugfs_register_sched(q);
+
+        /* Similarly, blk_mq_init_hctx() couldn't do this previously. */
         queue_for_each_hw_ctx(q, hctx, i) {
                 if (!hctx->debugfs_dir && blk_mq_debugfs_register_hctx(q, hctx))
                         goto err;
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 0fea76aa0f3f..17816a028dcb 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1911,11 +1911,11 @@ static void throtl_upgrade_state(struct throtl_data *td)
 
                 tg->disptime = jiffies - 1;
                 throtl_select_dispatch(sq);
-                throtl_schedule_next_dispatch(sq, false);
+                throtl_schedule_next_dispatch(sq, true);
         }
         rcu_read_unlock();
         throtl_select_dispatch(&td->service_queue);
-        throtl_schedule_next_dispatch(&td->service_queue, false);
+        throtl_schedule_next_dispatch(&td->service_queue, true);
         queue_work(kthrotld_workqueue, &td->dispatch_work);
 }
 
diff --git a/block/bsg-lib.c b/block/bsg-lib.c
index c82408c7cc3c..15d25ccd51a5 100644
--- a/block/bsg-lib.c
+++ b/block/bsg-lib.c
@@ -154,7 +154,6 @@ static int bsg_prepare_job(struct device *dev, struct request *req)
 failjob_rls_rqst_payload:
         kfree(job->request_payload.sg_list);
 failjob_rls_job:
-        kfree(job);
         return -ENOMEM;
 }
 
@@ -208,20 +207,34 @@ static int bsg_init_rq(struct request_queue *q, struct request *req, gfp_t gfp)
         struct bsg_job *job = blk_mq_rq_to_pdu(req);
         struct scsi_request *sreq = &job->sreq;
 
+        /* called right after the request is allocated for the request_queue */
+
+        sreq->sense = kzalloc(SCSI_SENSE_BUFFERSIZE, gfp);
+        if (!sreq->sense)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void bsg_initialize_rq(struct request *req)
+{
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
+        struct scsi_request *sreq = &job->sreq;
+        void *sense = sreq->sense;
+
+        /* called right before the request is given to the request_queue user */
+
         memset(job, 0, sizeof(*job));
 
         scsi_req_init(sreq);
+
+        sreq->sense = sense;
         sreq->sense_len = SCSI_SENSE_BUFFERSIZE;
-        sreq->sense = kzalloc(sreq->sense_len, gfp);
-        if (!sreq->sense)
-                return -ENOMEM;
 
         job->req = req;
-        job->reply = sreq->sense;
+        job->reply = sense;
         job->reply_len = sreq->sense_len;
         job->dd_data = job + 1;
-
-        return 0;
 }
 
 static void bsg_exit_rq(struct request_queue *q, struct request *req)
@@ -252,6 +265,7 @@ struct request_queue *bsg_setup_queue(struct device *dev, const char *name,
         q->cmd_size = sizeof(struct bsg_job) + dd_job_size;
         q->init_rq_fn = bsg_init_rq;
         q->exit_rq_fn = bsg_exit_rq;
+        q->initialize_rq_fn = bsg_initialize_rq;
         q->request_fn = bsg_request_fn;
 
         ret = blk_init_allocated_queue(q);
diff --git a/block/partition-generic.c b/block/partition-generic.c
index 86e8fe1adcdb..88c555db4e5d 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -112,7 +112,7 @@ ssize_t part_stat_show(struct device *dev,
                        struct device_attribute *attr, char *buf)
 {
         struct hd_struct *p = dev_to_part(dev);
-        struct request_queue *q = dev_to_disk(dev)->queue;
+        struct request_queue *q = part_to_disk(p)->queue;
         unsigned int inflight[2];
         int cpu;
 
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index ffa9f4ccd9b4..337cf382718e 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -619,14 +619,14 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
         struct af_alg_ctx *ctx = ask->private;
         struct af_alg_tsgl *sgl;
         struct scatterlist *sg;
-        unsigned int i, j;
+        unsigned int i, j = 0;
 
         while (!list_empty(&ctx->tsgl_list)) {
                 sgl = list_first_entry(&ctx->tsgl_list, struct af_alg_tsgl,
                                        list);
                 sg = sgl->sg;
 
-                for (i = 0, j = 0; i < sgl->cur; i++) {
+                for (i = 0; i < sgl->cur; i++) {
                         size_t plen = min_t(size_t, used, sg[i].length);
                         struct page *page = sg_page(sg + i);
 
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 633a88e93ab0..70018397e59a 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1133,10 +1133,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
 {
         if (!drbg)
                 return;
-        kzfree(drbg->V);
-        drbg->Vbuf = NULL;
-        kzfree(drbg->C);
-        drbg->Cbuf = NULL;
+        kzfree(drbg->Vbuf);
+        drbg->V = NULL;
+        kzfree(drbg->Cbuf);
+        drbg->C = NULL;
         kzfree(drbg->scratchpadbuf);
         drbg->scratchpadbuf = NULL;
         drbg->reseed_ctr = 0;
diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index bf22c29d2517..11b113f8e367 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -66,7 +66,7 @@ void __init acpi_watchdog_init(void)
         for (i = 0; i < wdat->entries; i++) {
                 const struct acpi_generic_address *gas;
                 struct resource_entry *rentry;
-                struct resource res;
+                struct resource res = {};
                 bool found;
 
                 gas = &entries[i].register_region;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 077f9bad6f44..3c3a37b8503b 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -743,17 +743,19 @@ static int ghes_proc(struct ghes *ghes)
         }
         ghes_do_proc(ghes, ghes->estatus);
 
+out:
+        ghes_clear_estatus(ghes);
+
+        if (rc == -ENOENT)
+                return rc;
+
         /*
          * GHESv2 type HEST entries introduce support for error acknowledgment,
          * so only acknowledge the error if this support is present.
          */
-        if (is_hest_type_generic_v2(ghes)) {
-                rc = ghes_ack_error(ghes->generic_v2);
-                if (rc)
-                        return rc;
-        }
-out:
-        ghes_clear_estatus(ghes);
+        if (is_hest_type_generic_v2(ghes))
+                return ghes_ack_error(ghes->generic_v2);
+
         return rc;
 }
 
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 9565d572f8dd..de56394dd161 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -1178,12 +1178,44 @@ dev_put:
         return ret;
 }
 
+static bool __init iort_enable_acs(struct acpi_iort_node *iort_node)
+{
+        if (iort_node->type == ACPI_IORT_NODE_PCI_ROOT_COMPLEX) {
+                struct acpi_iort_node *parent;
+                struct acpi_iort_id_mapping *map;
+                int i;
+
+                map = ACPI_ADD_PTR(struct acpi_iort_id_mapping, iort_node,
+                                   iort_node->mapping_offset);
+
+                for (i = 0; i < iort_node->mapping_count; i++, map++) {
+                        if (!map->output_reference)
+                                continue;
+
+                        parent = ACPI_ADD_PTR(struct acpi_iort_node,
+                                        iort_table,  map->output_reference);
+                        /*
+                         * If we detect a RC->SMMU mapping, make sure
+                         * we enable ACS on the system.
+                         */
+                        if ((parent->type == ACPI_IORT_NODE_SMMU) ||
+                                (parent->type == ACPI_IORT_NODE_SMMU_V3)) {
+                                pci_request_acs();
+                                return true;
+                        }
+                }
+        }
+
+        return false;
+}
+
 static void __init iort_init_platform_devices(void)
 {
         struct acpi_iort_node *iort_node, *iort_end;
         struct acpi_table_iort *iort;
         struct fwnode_handle *fwnode;
         int i, ret;
+        bool acs_enabled = false;
 
         /*
          * iort_table and iort both point to the start of IORT table, but
@@ -1203,6 +1235,9 @@ static void __init iort_init_platform_devices(void)
                         return;
                 }
 
+                if (!acs_enabled)
+                        acs_enabled = iort_enable_acs(iort_node);
+
                 if ((iort_node->type == ACPI_IORT_NODE_SMMU) ||
                         (iort_node->type == ACPI_IORT_NODE_SMMU_V3)) {
 
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index c1c216163de3..3fb8ff513461 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -908,11 +908,12 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
                                             struct fwnode_handle *child)
 {
         const struct acpi_device *adev = to_acpi_device_node(fwnode);
-        struct acpi_device *child_adev = NULL;
         const struct list_head *head;
         struct list_head *next;
 
         if (!child || is_acpi_device_node(child)) {
+                struct acpi_device *child_adev;
+
                 if (adev)
                         head = &adev->children;
                 else
@@ -922,8 +923,8 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
                         goto nondev;
 
                 if (child) {
-                        child_adev = to_acpi_device_node(child);
-                        next = child_adev->node.next;
+                        adev = to_acpi_device_node(child);
+                        next = adev->node.next;
                         if (next == head) {
                                 child = NULL;
                                 goto nondev;
@@ -941,8 +942,8 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
                 const struct acpi_data_node *data = to_acpi_data_node(fwnode);
                 struct acpi_data_node *dn;
 
-                if (child_adev)
-                        head = &child_adev->data.subnodes;
+                if (adev)
+                        head = &adev->data.subnodes;
                 else if (data)
                         head = &data->data.subnodes;
                 else
@@ -1293,3 +1294,16 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
 DECLARE_ACPI_FWNODE_OPS(acpi_device_fwnode_ops);
 DECLARE_ACPI_FWNODE_OPS(acpi_data_fwnode_ops);
 const struct fwnode_operations acpi_static_fwnode_ops;
+
+bool is_acpi_device_node(const struct fwnode_handle *fwnode)
+{
+        return !IS_ERR_OR_NULL(fwnode) &&
+                fwnode->ops == &acpi_device_fwnode_ops;
+}
+EXPORT_SYMBOL(is_acpi_device_node);
+
+bool is_acpi_data_node(const struct fwnode_handle *fwnode)
+{
+        return !IS_ERR_OR_NULL(fwnode) && fwnode->ops == &acpi_data_fwnode_ops;
+}
+EXPORT_SYMBOL(is_acpi_data_node);
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d055b3f2a207..ab34239a76ee 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2217,7 +2217,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                                        debug_id, (u64)fda->num_fds);
                                 continue;
                         }
-                        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+                        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
                                 task_close_fd(proc, fd_array[fd_index]);
                 } break;
@@ -2326,7 +2326,6 @@ static int binder_translate_handle(struct flat_binder_object *fp,
                              (u64)node->ptr);
                 binder_node_unlock(node);
         } else {
-                int ret;
                 struct binder_ref_data dest_rdata;
 
                 binder_node_unlock(node);
@@ -2442,7 +2441,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
          */
         parent_buffer = parent->buffer -
                 binder_alloc_get_user_buffer_offset(&target_proc->alloc);
-        fd_array = (u32 *)(parent_buffer + fda->parent_offset);
+        fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
         if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
                 binder_user_error("%d:%d parent offset not aligned correctly.\n",
                                   proc->pid, thread->pid);
@@ -2508,7 +2507,7 @@ static int binder_fixup_parent(struct binder_transaction *t,
                                   proc->pid, thread->pid);
                 return -EINVAL;
         }
-        parent_buffer = (u8 *)(parent->buffer -
+        parent_buffer = (u8 *)((uintptr_t)parent->buffer -
                         binder_alloc_get_user_buffer_offset(
                                 &target_proc->alloc));
         *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
@@ -3083,6 +3082,7 @@ static void binder_transaction(struct binder_proc *proc,
 err_dead_proc_or_thread:
         return_error = BR_DEAD_REPLY;
         return_error_line = __LINE__;
+        binder_dequeue_work(proc, tcomplete);
 err_translate_failed:
 err_bad_object_type:
 err_bad_offset:
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 8fe165844e47..064f5e31ec55 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -913,6 +913,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
         struct binder_alloc *alloc;
         uintptr_t page_addr;
         size_t index;
+        struct vm_area_struct *vma;
 
         alloc = page->alloc;
         if (!mutex_trylock(&alloc->mutex))
@@ -923,16 +924,22 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         index = page - alloc->pages;
         page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
-        if (alloc->vma) {
+        vma = alloc->vma;
+        if (vma) {
                 mm = get_task_mm(alloc->tsk);
                 if (!mm)
                         goto err_get_task_mm_failed;
                 if (!down_write_trylock(&mm->mmap_sem))
                         goto err_down_write_mmap_sem_failed;
+        }
+
+        list_lru_isolate(lru, item);
+        spin_unlock(lock);
 
+        if (vma) {
                 trace_binder_unmap_user_start(alloc, index);
 
-                zap_page_range(alloc->vma,
+                zap_page_range(vma,
                                page_addr + alloc->user_buffer_offset,
                                PAGE_SIZE);
 
@@ -950,13 +957,12 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 
         trace_binder_unmap_kernel_end(alloc, index);
 
-        list_lru_isolate(lru, item);
-
+        spin_lock(lock);
         mutex_unlock(&alloc->mutex);
-        return LRU_REMOVED;
+        return LRU_REMOVED_RETRY;
 
 err_down_write_mmap_sem_failed:
-        mmput(mm);
+        mmput_async(mm);
 err_get_task_mm_failed:
 err_page_already_freed:
         mutex_unlock(&alloc->mutex);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index cb9b0e9090e3..9f78bb03bb76 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -621,8 +621,11 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
 static int ahci_pci_reset_controller(struct ata_host *host)
 {
         struct pci_dev *pdev = to_pci_dev(host->dev);
+        int rc;
 
-        ahci_reset_controller(host);
+        rc = ahci_reset_controller(host);
+        if (rc)
+                return rc;
 
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 struct ahci_host_priv *hpriv = host->private_data;
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 8401c3b5be92..b702c20fbc2b 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -492,6 +492,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x27DF, 0x152D, 0x0778 },     /* ICH7 on unknown Intel */
         { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
+        { 0x24CA, 0x10CF, 0x11AB },     /* ICH4M on Fujitsu-Siemens Lifebook S6120 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
         { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 1945a8ea2099..ee4c1ec9dca0 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3234,19 +3234,19 @@ static const struct ata_timing ata_timing[] = {
 };
 
 #define ENOUGH(v, unit)         (((v)-1)/(unit)+1)
-#define EZ(v, unit)             ((v)?ENOUGH(v, unit):0)
+#define EZ(v, unit)             ((v)?ENOUGH(((v) * 1000), unit):0)
 
 static void ata_timing_quantize(const struct ata_timing *t, struct ata_timing *q, int T, int UT)
 {
-        q->setup        = EZ(t->setup      * 1000,  T);
-        q->act8b        = EZ(t->act8b      * 1000,  T);
-        q->rec8b        = EZ(t->rec8b      * 1000,  T);
-        q->cyc8b        = EZ(t->cyc8b      * 1000,  T);
-        q->active       = EZ(t->active     * 1000,  T);
-        q->recover      = EZ(t->recover    * 1000,  T);
-        q->dmack_hold   = EZ(t->dmack_hold * 1000,  T);
-        q->cycle        = EZ(t->cycle      * 1000,  T);
-        q->udma         = EZ(t->udma       * 1000, UT);
+        q->setup        = EZ(t->setup,       T);
+        q->act8b        = EZ(t->act8b,       T);
+        q->rec8b        = EZ(t->rec8b,       T);
+        q->cyc8b        = EZ(t->cyc8b,       T);
+        q->active       = EZ(t->active,      T);
+        q->recover      = EZ(t->recover,     T);
+        q->dmack_hold   = EZ(t->dmack_hold,  T);
+        q->cycle        = EZ(t->cycle,       T);
+        q->udma         = EZ(t->udma,       UT);
 }
 
 void ata_timing_merge(const struct ata_timing *a, const struct ata_timing *b,
diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index cfeb049a01ef..642afd88870b 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -647,18 +647,25 @@ static ssize_t charlcd_write(struct file *file, const char __user *buf,
 static int charlcd_open(struct inode *inode, struct file *file)
 {
         struct charlcd_priv *priv = to_priv(the_charlcd);
+        int ret;
 
+        ret = -EBUSY;
         if (!atomic_dec_and_test(&charlcd_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
 
+        ret = -EPERM;
         if (file->f_mode & FMODE_READ)  /* device is write-only */
-                return -EPERM;
+                goto fail;
 
         if (priv->must_clear) {
                 charlcd_clear_display(&priv->lcd);
                 priv->must_clear = false;
         }
         return nonseekable_open(inode, file);
+
+ fail:
+        atomic_inc(&charlcd_available);
+        return ret;
 }
 
 static int charlcd_release(struct inode *inode, struct file *file)
diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
index df126dcdaf18..6911acd896d9 100644
--- a/drivers/auxdisplay/panel.c
+++ b/drivers/auxdisplay/panel.c
@@ -1105,14 +1105,21 @@ static ssize_t keypad_read(struct file *file,
 
 static int keypad_open(struct inode *inode, struct file *file)
 {
+        int ret;
+
+        ret = -EBUSY;
         if (!atomic_dec_and_test(&keypad_available))
-                return -EBUSY;  /* open only once at a time */
+                goto fail;      /* open only once at a time */
 
+        ret = -EPERM;
         if (file->f_mode & FMODE_WRITE) /* device is read-only */
-                return -EPERM;
+                goto fail;
 
         keypad_buflen = 0;      /* flush the buffer on opening */
         return 0;
+ fail:
+        atomic_inc(&keypad_available);
+        return ret;
 }
 
 static int keypad_release(struct inode *inode, struct file *file)
diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c
index 41be9ff7d70a..6df7d6676a48 100644
--- a/drivers/base/arch_topology.c
+++ b/drivers/base/arch_topology.c
@@ -166,11 +166,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu)
 }
 
 #ifdef CONFIG_CPU_FREQ
-static cpumask_var_t cpus_to_visit;
-static void parsing_done_workfn(struct work_struct *work);
-static DECLARE_WORK(parsing_done_work, parsing_done_workfn);
+static cpumask_var_t cpus_to_visit __initdata;
+static void __init parsing_done_workfn(struct work_struct *work);
+static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn);
 
-static int
+static int __init
 init_cpu_capacity_callback(struct notifier_block *nb,
                            unsigned long val,
                            void *data)
@@ -206,7 +206,7 @@ init_cpu_capacity_callback(struct notifier_block *nb,
         return 0;
 }
 
-static struct notifier_block init_cpu_capacity_notifier = {
+static struct notifier_block init_cpu_capacity_notifier __initdata = {
         .notifier_call = init_cpu_capacity_callback,
 };
 
@@ -232,7 +232,7 @@ static int __init register_cpufreq_notifier(void)
 }
 core_initcall(register_cpufreq_notifier);
 
-static void parsing_done_workfn(struct work_struct *work)
+static void __init parsing_done_workfn(struct work_struct *work)
 {
         cpufreq_unregister_notifier(&init_cpu_capacity_notifier,
                                          CPUFREQ_POLICY_NOTIFIER);
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index a39b2166b145..744f64f43454 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -348,16 +348,15 @@ static int rmem_dma_device_init(struct reserved_mem *rmem, struct device *dev)
         struct dma_coherent_mem *mem = rmem->priv;
         int ret;
 
-        if (!mem)
-                return -ENODEV;
-
-        ret = dma_init_coherent_memory(rmem->base, rmem->base, rmem->size,
-                                       DMA_MEMORY_EXCLUSIVE, &mem);
-
-        if (ret) {
-                pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %ld MiB\n",
-                        &rmem->base, (unsigned long)rmem->size / SZ_1M);
-                return ret;
+        if (!mem) {
+                ret = dma_init_coherent_memory(rmem->base, rmem->base,
+                                               rmem->size,
+                                               DMA_MEMORY_EXCLUSIVE, &mem);
+                if (ret) {
+                        pr_err("Reserved memory: failed to init DMA memory pool at %pa, size %ld MiB\n",
+                                &rmem->base, (unsigned long)rmem->size / SZ_1M);
+                        return ret;
+                }
         }
         mem->use_dev_dma_pfn_offset = true;
         rmem->priv = mem;
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index d1bd99271066..9045c5f3734e 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -868,7 +868,8 @@ static ssize_t driver_override_store(struct device *dev,
         struct platform_device *pdev = to_platform_device(dev);
         char *driver_override, *old, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index ea1732ed7a9d..770b1539a083 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1860,10 +1860,13 @@ void device_pm_check_callbacks(struct device *dev)
 {
         spin_lock_irq(&dev->power.lock);
         dev->power.no_pm_callbacks =
-                (!dev->bus || pm_ops_is_empty(dev->bus->pm)) &&
-                (!dev->class || pm_ops_is_empty(dev->class->pm)) &&
+                (!dev->bus || (pm_ops_is_empty(dev->bus->pm) &&
+                 !dev->bus->suspend && !dev->bus->resume)) &&
+                (!dev->class || (pm_ops_is_empty(dev->class->pm) &&
+                 !dev->class->suspend && !dev->class->resume)) &&
                 (!dev->type || pm_ops_is_empty(dev->type->pm)) &&
                 (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) &&
-                (!dev->driver || pm_ops_is_empty(dev->driver->pm));
+                (!dev->driver || (pm_ops_is_empty(dev->driver->pm) &&
+                 !dev->driver->suspend && !dev->driver->resume));
         spin_unlock_irq(&dev->power.lock);
 }
diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
index a8cc14fd8ae4..a6de32530693 100644
--- a/drivers/base/power/opp/core.c
+++ b/drivers/base/power/opp/core.c
@@ -1581,6 +1581,9 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
 
         opp->available = availability_req;
 
+        dev_pm_opp_get(opp);
+        mutex_unlock(&opp_table->lock);
+
         /* Notify the change of the OPP availability */
         if (availability_req)
                 blocking_notifier_call_chain(&opp_table->head, OPP_EVENT_ENABLE,
@@ -1589,8 +1592,12 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
                 blocking_notifier_call_chain(&opp_table->head,
                                              OPP_EVENT_DISABLE, opp);
 
+        dev_pm_opp_put(opp);
+        goto put_table;
+
 unlock:
         mutex_unlock(&opp_table->lock);
+put_table:
         dev_pm_opp_put_opp_table(opp_table);
         return r;
 }
diff --git a/drivers/base/power/qos.c b/drivers/base/power/qos.c
index f850daeffba4..277d43a83f53 100644
--- a/drivers/base/power/qos.c
+++ b/drivers/base/power/qos.c
@@ -277,11 +277,11 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
         mutex_unlock(&dev_pm_qos_sysfs_mtx);
 }
 
-static bool dev_pm_qos_invalid_request(struct device *dev,
-                                       struct dev_pm_qos_request *req)
+static bool dev_pm_qos_invalid_req_type(struct device *dev,
+                                        enum dev_pm_qos_req_type type)
 {
-        return !req || (req->type == DEV_PM_QOS_LATENCY_TOLERANCE
-                        && !dev->power.set_latency_tolerance);
+        return type == DEV_PM_QOS_LATENCY_TOLERANCE &&
+               !dev->power.set_latency_tolerance;
 }
 
 static int __dev_pm_qos_add_request(struct device *dev,
@@ -290,7 +290,7 @@ static int __dev_pm_qos_add_request(struct device *dev,
 {
         int ret = 0;
 
-        if (!dev || dev_pm_qos_invalid_request(dev, req))
+        if (!dev || !req || dev_pm_qos_invalid_req_type(dev, type))
                 return -EINVAL;
 
         if (WARN(dev_pm_qos_request_active(req),
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 4a438b8abe27..2dfe99b328f8 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -17,7 +17,7 @@ if BLK_DEV
 
 config BLK_DEV_NULL_BLK
         tristate "Null test block driver"
-        depends on CONFIGFS_FS
+        select CONFIGFS_FS
 
 config BLK_DEV_FD
         tristate "Normal floppy disk support"
diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index bbd0d186cfc0..2d7178f7754e 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -342,7 +342,7 @@ static long __brd_direct_access(struct brd_device *brd, pgoff_t pgoff,
 
         if (!brd)
                 return -ENODEV;
-        page = brd_insert_page(brd, PFN_PHYS(pgoff) / 512);
+        page = brd_insert_page(brd, (sector_t)pgoff << PAGE_SECTORS_SHIFT);
         if (!page)
                 return -ENOSPC;
         *kaddr = page_address(page);
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index f68c1d50802f..1f3956702993 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -67,10 +67,8 @@ struct loop_device {
 struct loop_cmd {
         struct kthread_work work;
         struct request *rq;
-        union {
-                bool use_aio; /* use AIO interface to handle I/O */
-                atomic_t ref; /* only for aio */
-        };
+        bool use_aio; /* use AIO interface to handle I/O */
+        atomic_t ref; /* only for aio */
         long ret;
         struct kiocb iocb;
         struct bio_vec *bvec;
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 2aa87cbdede0..883dfebd3014 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -820,9 +820,13 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          * appropriate.
          */
         ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_STS_IOERR;
+        else if (!ret)
+                ret = BLK_STS_OK;
         complete(&cmd->send_complete);
 
-        return ret < 0 ? BLK_STS_IOERR : BLK_STS_OK;
+        return ret;
 }
 
 static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
@@ -1194,6 +1198,12 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
+        /* The block layer will pass back some non-nbd ioctls in case we have
+         * special handling for them, but we don't so just return an error.
+         */
+        if (_IOC_TYPE(cmd) != 0xab)
+                return -EINVAL;
+
         mutex_lock(&nbd->config_lock);
 
         /* Don't allow ioctl operations on a nbd device that was created with
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 2981c27d3aae..f149d3e61234 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -766,27 +766,6 @@ static void zram_slot_unlock(struct zram *zram, u32 index)
         bit_spin_unlock(ZRAM_ACCESS, &zram->table[index].value);
 }
 
-static bool zram_same_page_read(struct zram *zram, u32 index,
-                                struct page *page,
-                                unsigned int offset, unsigned int len)
-{
-        zram_slot_lock(zram, index);
-        if (unlikely(!zram_get_handle(zram, index) ||
-                        zram_test_flag(zram, index, ZRAM_SAME))) {
-                void *mem;
-
-                zram_slot_unlock(zram, index);
-                mem = kmap_atomic(page);
-                zram_fill_page(mem + offset, len,
-                                        zram_get_element(zram, index));
-                kunmap_atomic(mem);
-                return true;
-        }
-        zram_slot_unlock(zram, index);
-
-        return false;
-}
-
 static void zram_meta_free(struct zram *zram, u64 disksize)
 {
         size_t num_pages = disksize >> PAGE_SHIFT;
@@ -884,11 +863,20 @@ static int __zram_bvec_read(struct zram *zram, struct page *page, u32 index,
                 zram_slot_unlock(zram, index);
         }
 
-        if (zram_same_page_read(zram, index, page, 0, PAGE_SIZE))
-                return 0;
-
         zram_slot_lock(zram, index);
         handle = zram_get_handle(zram, index);
+        if (!handle || zram_test_flag(zram, index, ZRAM_SAME)) {
+                unsigned long value;
+                void *mem;
+
+                value = handle ? zram_get_element(zram, index) : 0;
+                mem = kmap_atomic(page);
+                zram_fill_page(mem, PAGE_SIZE, value);
+                kunmap_atomic(mem);
+                zram_slot_unlock(zram, index);
+                return 0;
+        }
+
         size = zram_get_obj_size(zram, index);
 
         src = zs_map_object(zram->mem_pool, handle, ZS_MM_RO);
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index fe597e6c55c4..1d6729be4cd6 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -455,7 +455,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
                         goto out;
                 }
 
-                msleep(TPM_TIMEOUT);    /* CHECK */
+                tpm_msleep(TPM_TIMEOUT);
                 rmb();
         } while (time_before(jiffies, stop));
 
@@ -970,7 +970,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
                         dev_info(
                             &chip->dev, HW_ERR
                             "TPM command timed out during continue self test");
-                        msleep(delay_msec);
+                        tpm_msleep(delay_msec);
                         continue;
                 }
 
@@ -985,7 +985,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
                 }
                 if (rc != TPM_WARN_DOING_SELFTEST)
                         return rc;
-                msleep(delay_msec);
+                tpm_msleep(delay_msec);
         } while (--loops > 0);
 
         return rc;
@@ -1085,7 +1085,7 @@ again:
                 }
         } else {
                 do {
-                        msleep(TPM_TIMEOUT);
+                        tpm_msleep(TPM_TIMEOUT);
                         status = chip->ops->status(chip);
                         if ((status & mask) == mask)
                                 return 0;
@@ -1150,7 +1150,7 @@ int tpm_pm_suspend(struct device *dev)
                  */
                 if (rc != TPM_WARN_RETRY)
                         break;
-                msleep(TPM_TIMEOUT_RETRY);
+                tpm_msleep(TPM_TIMEOUT_RETRY);
         }
 
         if (rc)
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 04fbff2edbf3..2d5466a72e40 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -50,7 +50,8 @@ enum tpm_const {
 
 enum tpm_timeout {
         TPM_TIMEOUT = 5,        /* msecs */
-        TPM_TIMEOUT_RETRY = 100 /* msecs */
+        TPM_TIMEOUT_RETRY = 100, /* msecs */
+        TPM_TIMEOUT_RANGE_US = 300      /* usecs */
 };
 
 /* TPM addresses */
@@ -527,6 +528,12 @@ int tpm_pm_resume(struct device *dev);
 int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
                       wait_queue_head_t *queue, bool check_cancel);
 
+static inline void tpm_msleep(unsigned int delay_msec)
+{
+        usleep_range(delay_msec * 1000,
+                     (delay_msec * 1000) + TPM_TIMEOUT_RANGE_US);
+};
+
 struct tpm_chip *tpm_chip_find_get(int chip_num);
 __must_check int tpm_try_get_ops(struct tpm_chip *chip);
 void tpm_put_ops(struct tpm_chip *chip);
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index f7f34b2aa981..e1a41b788f08 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -899,7 +899,7 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
                 if (rc != TPM2_RC_TESTING)
                         break;
 
-                msleep(delay_msec);
+                tpm_msleep(delay_msec);
         }
 
         return rc;
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index a4ac63a21d8a..8f0a98dea327 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -665,7 +665,7 @@ static const struct dev_pm_ops crb_pm = {
         SET_RUNTIME_PM_OPS(crb_pm_runtime_suspend, crb_pm_runtime_resume, NULL)
 };
 
-static struct acpi_device_id crb_device_ids[] = {
+static const struct acpi_device_id crb_device_ids[] = {
         {"MSFT0101", 0},
         {"", 0},
 };
diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index f01d083eced2..25f6e2665385 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -32,26 +32,70 @@
 
 static const char tpm_ibmvtpm_driver_name[] = "tpm_ibmvtpm";
 
-static struct vio_device_id tpm_ibmvtpm_device_table[] = {
+static const struct vio_device_id tpm_ibmvtpm_device_table[] = {
         { "IBM,vtpm", "IBM,vtpm"},
         { "", "" }
 };
 MODULE_DEVICE_TABLE(vio, tpm_ibmvtpm_device_table);
 
 /**
+ *
+ * ibmvtpm_send_crq_word - Send a CRQ request
+ * @vdev:       vio device struct
+ * @w1:         pre-constructed first word of tpm crq (second word is reserved)
+ *
+ * Return:
+ *      0 - Success
+ *      Non-zero - Failure
+ */
+static int ibmvtpm_send_crq_word(struct vio_dev *vdev, u64 w1)
+{
+        return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, w1, 0);
+}
+
+/**
+ *
  * ibmvtpm_send_crq - Send a CRQ request
  *
  * @vdev:       vio device struct
- * @w1:         first word
- * @w2:         second word
+ * @valid:      Valid field
+ * @msg:        Type field
+ * @len:        Length field
+ * @data:       Data field
+ *
+ * The ibmvtpm crq is defined as follows:
+ *
+ * Byte  |   0   |   1   |   2   |   3   |   4   |   5   |   6   |   7
+ * -----------------------------------------------------------------------
+ * Word0 | Valid | Type  |     Length    |              Data
+ * -----------------------------------------------------------------------
+ * Word1 |                Reserved
+ * -----------------------------------------------------------------------
+ *
+ * Which matches the following structure (on bigendian host):
+ *
+ * struct ibmvtpm_crq {
+ *         u8 valid;
+ *         u8 msg;
+ *         __be16 len;
+ *         __be32 data;
+ *         __be64 reserved;
+ * } __attribute__((packed, aligned(8)));
+ *
+ * However, the value is passed in a register so just compute the numeric value
+ * to load into the register avoiding byteswap altogether. Endian only affects
+ * memory loads and stores - registers are internally represented the same.
  *
  * Return:
- *      0 -Sucess
+ *      0 (H_SUCCESS) - Success
  *      Non-zero - Failure
  */
-static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1, u64 w2)
+static int ibmvtpm_send_crq(struct vio_dev *vdev,
+                u8 valid, u8 msg, u16 len, u32 data)
 {
-        return plpar_hcall_norets(H_SEND_CRQ, vdev->unit_address, w1, w2);
+        u64 w1 = ((u64)valid << 56) | ((u64)msg << 48) | ((u64)len << 32) |
+                (u64)data;
+        return ibmvtpm_send_crq_word(vdev, w1);
 }
 
 /**
@@ -109,8 +153,6 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
 {
         struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
-        struct ibmvtpm_crq crq;
-        __be64 *word = (__be64 *)&crq;
         int rc, sig;
 
         if (!ibmvtpm->rtce_buf) {
@@ -137,10 +179,6 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
         spin_lock(&ibmvtpm->rtce_lock);
         ibmvtpm->res_len = 0;
         memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_TPM_COMMAND;
-        crq.len = cpu_to_be16(count);
-        crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
 
         /*
          * set the processing flag before the Hcall, since we may get the
@@ -148,8 +186,9 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
          */
         ibmvtpm->tpm_processing_cmd = true;
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-                              be64_to_cpu(word[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_TPM_COMMAND,
+                        count, ibmvtpm->rtce_dma_handle);
         if (rc != H_SUCCESS) {
                 dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
                 rc = 0;
@@ -182,15 +221,10 @@ static u8 tpm_ibmvtpm_status(struct tpm_chip *chip)
  */
 static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm)
 {
-        struct ibmvtpm_crq crq;
-        u64 *buf = (u64 *) &crq;
         int rc;
 
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_GET_RTCE_BUFFER_SIZE;
-
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
-                              cpu_to_be64(buf[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_GET_RTCE_BUFFER_SIZE, 0, 0);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_get_rtce_size failed rc=%d\n", rc);
@@ -210,15 +244,10 @@ static int ibmvtpm_crq_get_rtce_size(struct ibmvtpm_dev *ibmvtpm)
  */
 static int ibmvtpm_crq_get_version(struct ibmvtpm_dev *ibmvtpm)
 {
-        struct ibmvtpm_crq crq;
-        u64 *buf = (u64 *) &crq;
         int rc;
 
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_GET_VERSION;
-
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
-                              cpu_to_be64(buf[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_GET_VERSION, 0, 0);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_get_version failed rc=%d\n", rc);
@@ -238,7 +267,7 @@ static int ibmvtpm_crq_send_init_complete(struct ibmvtpm_dev *ibmvtpm)
 {
         int rc;
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, INIT_CRQ_COMP_CMD, 0);
+        rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_COMP_CMD);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_send_init_complete failed rc=%d\n", rc);
@@ -258,7 +287,7 @@ static int ibmvtpm_crq_send_init(struct ibmvtpm_dev *ibmvtpm)
 {
         int rc;
 
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, INIT_CRQ_CMD, 0);
+        rc = ibmvtpm_send_crq_word(ibmvtpm->vdev, INIT_CRQ_CMD);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "ibmvtpm_crq_send_init failed rc=%d\n", rc);
@@ -340,15 +369,10 @@ static int tpm_ibmvtpm_suspend(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
-        struct ibmvtpm_crq crq;
-        u64 *buf = (u64 *) &crq;
         int rc = 0;
 
-        crq.valid = (u8)IBMVTPM_VALID_CMD;
-        crq.msg = (u8)VTPM_PREPARE_TO_SUSPEND;
-
-        rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(buf[0]),
-                              cpu_to_be64(buf[1]));
+        rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+                        IBMVTPM_VALID_CMD, VTPM_PREPARE_TO_SUSPEND, 0, 0);
         if (rc != H_SUCCESS)
                 dev_err(ibmvtpm->dev,
                         "tpm_ibmvtpm_suspend failed rc=%d\n", rc);
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 3b1b9f9322d5..d8f10047fbba 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -191,7 +191,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
-                msleep(TPM_MSLEEP_TIME);
+                tpm_msleep(TPM_MSLEEP_TIME);
         }
         if (i == TPM_MAX_TRIES) {       /* timeout occurs */
                 if (wait_for_bit == STAT_XFE)
@@ -226,7 +226,7 @@ static void tpm_wtx(struct tpm_chip *chip)
         wait_and_send(chip, TPM_CTRL_WTX);
         wait_and_send(chip, 0x00);
         wait_and_send(chip, 0x00);
-        msleep(TPM_WTX_MSLEEP_TIME);
+        tpm_msleep(TPM_WTX_MSLEEP_TIME);
 }
 
 static void tpm_wtx_abort(struct tpm_chip *chip)
@@ -237,7 +237,7 @@ static void tpm_wtx_abort(struct tpm_chip *chip)
         wait_and_send(chip, 0x00);
         wait_and_send(chip, 0x00);
         number_of_wtx = 0;
-        msleep(TPM_WTX_MSLEEP_TIME);
+        tpm_msleep(TPM_WTX_MSLEEP_TIME);
 }
 
 static int tpm_inf_recv(struct tpm_chip *chip, u8 * buf, size_t count)
diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index b617b2eeb080..63bc6c3b949e 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -51,7 +51,7 @@ static int wait_startup(struct tpm_chip *chip, int l)
 
                 if (access & TPM_ACCESS_VALID)
                         return 0;
-                msleep(TPM_TIMEOUT);
+                tpm_msleep(TPM_TIMEOUT);
         } while (time_before(jiffies, stop));
         return -1;
 }
@@ -117,7 +117,7 @@ again:
                 do {
                         if (check_locality(chip, l))
                                 return l;
-                        msleep(TPM_TIMEOUT);
+                        tpm_msleep(TPM_TIMEOUT);
                 } while (time_before(jiffies, stop));
         }
         return -1;
@@ -164,7 +164,7 @@ static int get_burstcount(struct tpm_chip *chip)
                 burstcnt = (value >> 8) & 0xFFFF;
                 if (burstcnt)
                         return burstcnt;
-                msleep(TPM_TIMEOUT);
+                tpm_msleep(TPM_TIMEOUT);
         } while (time_before(jiffies, stop));
         return -EBUSY;
 }
@@ -396,7 +396,7 @@ static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
         priv->irq = irq;
         chip->flags |= TPM_CHIP_FLAG_IRQ;
         if (!priv->irq_tested)
-                msleep(1);
+                tpm_msleep(1);
         if (!priv->irq_tested)
                 disable_interrupts(chip);
         priv->irq_tested = true;
diff --git a/drivers/clk/clk-bulk.c b/drivers/clk/clk-bulk.c
index c834f5abfc49..4c10456f8a32 100644
--- a/drivers/clk/clk-bulk.c
+++ b/drivers/clk/clk-bulk.c
@@ -105,6 +105,7 @@ err:
 
         return  ret;
 }
+EXPORT_SYMBOL_GPL(clk_bulk_prepare);
 
 #endif /* CONFIG_HAVE_CLK_PREPARE */
 
diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c
index 62d7854e4b87..5970a50671b9 100644
--- a/drivers/clk/rockchip/clk-rk3128.c
+++ b/drivers/clk/rockchip/clk-rk3128.c
@@ -315,13 +315,13 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
                         RK2928_CLKGATE_CON(10), 8, GFLAGS),
 
         GATE(SCLK_PVTM_CORE, "clk_pvtm_core", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 0, GFLAGS),
         GATE(SCLK_PVTM_GPU, "clk_pvtm_gpu", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 1, GFLAGS),
         GATE(SCLK_PVTM_FUNC, "clk_pvtm_func", "xin24m", 0,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(10), 2, GFLAGS),
         GATE(SCLK_MIPI_24M, "clk_mipi_24m", "xin24m", CLK_IGNORE_UNUSED,
-                        RK2928_CLKGATE_CON(10), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(2), 15, GFLAGS),
 
         COMPOSITE(SCLK_SDMMC, "sclk_sdmmc0", mux_mmc_src_p, 0,
                         RK2928_CLKSEL_CON(11), 6, 2, MFLAGS, 0, 6, DFLAGS,
@@ -541,7 +541,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
         GATE(0, "pclk_grf", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 4, GFLAGS),
         GATE(0, "pclk_mipiphy", "pclk_cpu", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(5), 0, GFLAGS),
 
-        GATE(0, "pclk_pmu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 2, GFLAGS),
+        GATE(0, "pclk_pmu", "pclk_pmu_pre", 0, RK2928_CLKGATE_CON(9), 2, GFLAGS),
         GATE(0, "pclk_pmu_niu", "pclk_pmu_pre", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 3, GFLAGS),
 
         /* PD_MMC */
@@ -577,6 +577,8 @@ static const char *const rk3128_critical_clocks[] __initconst = {
         "aclk_peri",
         "hclk_peri",
         "pclk_peri",
+        "pclk_pmu",
+        "sclk_timer5",
 };
 
 static struct rockchip_clk_provider *__init rk3128_common_clk_init(struct device_node *np)
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index e40b77583c47..d8d3cb67b402 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -294,6 +294,18 @@ static const struct samsung_clk_reg_dump src_mask_suspend_e4210[] = {
 #define PLL_ENABLED     (1 << 31)
 #define PLL_LOCKED      (1 << 29)
 
+static void exynos4_clk_enable_pll(u32 reg)
+{
+        u32 pll_con = readl(reg_base + reg);
+        pll_con |= PLL_ENABLED;
+        writel(pll_con, reg_base + reg);
+
+        while (!(pll_con & PLL_LOCKED)) {
+                cpu_relax();
+                pll_con = readl(reg_base + reg);
+        }
+}
+
 static void exynos4_clk_wait_for_pll(u32 reg)
 {
         u32 pll_con;
@@ -315,6 +327,9 @@ static int exynos4_clk_suspend(void)
         samsung_clk_save(reg_base, exynos4_save_pll,
                                 ARRAY_SIZE(exynos4_clk_pll_regs));
 
+        exynos4_clk_enable_pll(EPLL_CON0);
+        exynos4_clk_enable_pll(VPLL_CON0);
+
         if (exynos4_soc == EXYNOS4210) {
                 samsung_clk_save(reg_base, exynos4_save_soc,
                                         ARRAY_SIZE(exynos4210_clk_save));
diff --git a/drivers/clocksource/numachip.c b/drivers/clocksource/numachip.c
index 6a20dc8b253f..9a7d7f0f23fe 100644
--- a/drivers/clocksource/numachip.c
+++ b/drivers/clocksource/numachip.c
@@ -43,7 +43,7 @@ static int numachip2_set_next_event(unsigned long delta, struct clock_event_devi
         return 0;
 }
 
-static struct clock_event_device numachip2_clockevent = {
+static const struct clock_event_device numachip2_clockevent __initconst = {
         .name            = "numachip2",
         .rating          = 400,
         .set_next_event  = numachip2_set_next_event,
diff --git a/drivers/clocksource/timer-integrator-ap.c b/drivers/clocksource/timer-integrator-ap.c
index 2ff64d9d4fb3..62d24690ba02 100644
--- a/drivers/clocksource/timer-integrator-ap.c
+++ b/drivers/clocksource/timer-integrator-ap.c
@@ -36,8 +36,8 @@ static u64 notrace integrator_read_sched_clock(void)
         return -readl(sched_clk_base + TIMER_VALUE);
 }
 
-static int integrator_clocksource_init(unsigned long inrate,
-                                       void __iomem *base)
+static int __init integrator_clocksource_init(unsigned long inrate,
+                                              void __iomem *base)
 {
         u32 ctrl = TIMER_CTRL_ENABLE | TIMER_CTRL_PERIODIC;
         unsigned long rate = inrate;
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index a020da7940d6..a753c50e9e41 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -106,6 +106,22 @@ static const struct of_device_id whitelist[] __initconst = {
  * platforms using "operating-points-v2" property.
  */
 static const struct of_device_id blacklist[] __initconst = {
+        { .compatible = "calxeda,highbank", },
+        { .compatible = "calxeda,ecx-2000", },
+
+        { .compatible = "marvell,armadaxp", },
+
+        { .compatible = "nvidia,tegra124", },
+
+        { .compatible = "st,stih407", },
+        { .compatible = "st,stih410", },
+
+        { .compatible = "sigma,tango4", },
+
+        { .compatible = "ti,am33xx", },
+        { .compatible = "ti,am43", },
+        { .compatible = "ti,dra7", },
+
         { }
 };
 
diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
index b29cd3398463..4bf47de6101f 100644
--- a/drivers/cpufreq/ti-cpufreq.c
+++ b/drivers/cpufreq/ti-cpufreq.c
@@ -190,7 +190,7 @@ static int ti_cpufreq_setup_syscon_register(struct ti_cpufreq_data *opp_data)
 
 static const struct of_device_id ti_cpufreq_of_match[] = {
         { .compatible = "ti,am33xx", .data = &am3x_soc_data, },
-        { .compatible = "ti,am4372", .data = &am4x_soc_data, },
+        { .compatible = "ti,am43", .data = &am4x_soc_data, },
         { .compatible = "ti,dra7", .data = &dra7_soc_data },
         {},
 };
diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
index 7080c384ad5d..52a75053ee03 100644
--- a/drivers/cpuidle/cpuidle-arm.c
+++ b/drivers/cpuidle/cpuidle-arm.c
@@ -104,13 +104,13 @@ static int __init arm_idle_init(void)
                 ret = dt_init_idle_driver(drv, arm_idle_state_match, 1);
                 if (ret <= 0) {
                         ret = ret ? : -ENODEV;
-                        goto out_fail;
+                        goto init_fail;
                 }
 
                 ret = cpuidle_register_driver(drv);
                 if (ret) {
                         pr_err("Failed to register cpuidle driver\n");
-                        goto out_fail;
+                        goto init_fail;
                 }
 
                 /*
@@ -149,6 +149,8 @@ static int __init arm_idle_init(void)
         }
 
         return 0;
+init_fail:
+        kfree(drv);
 out_fail:
         while (--cpu >= 0) {
                 dev = per_cpu(cpuidle_devices, cpu);
diff --git a/drivers/crypto/caam/Kconfig b/drivers/crypto/caam/Kconfig
index e36aeacd7635..1eb852765469 100644
--- a/drivers/crypto/caam/Kconfig
+++ b/drivers/crypto/caam/Kconfig
@@ -1,6 +1,7 @@
 config CRYPTO_DEV_FSL_CAAM
         tristate "Freescale CAAM-Multicore driver backend"
         depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE
+        select SOC_BUS
         help
           Enables the driver module for Freescale's Cryptographic Accelerator
           and Assurance Module (CAAM), also known as the SEC version 4 (SEC4).
@@ -141,10 +142,6 @@ config CRYPTO_DEV_FSL_CAAM_RNG_API
           To compile this as a module, choose M here: the module
           will be called caamrng.
 
-config CRYPTO_DEV_FSL_CAAM_IMX
-        def_bool SOC_IMX6 || SOC_IMX7D
-        depends on CRYPTO_DEV_FSL_CAAM
-
 config CRYPTO_DEV_FSL_CAAM_DEBUG
         bool "Enable debug output in CAAM driver"
         depends on CRYPTO_DEV_FSL_CAAM
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index dacb53fb690e..027e121c6f70 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -7,6 +7,7 @@
 #include <linux/device.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
+#include <linux/sys_soc.h>
 
 #include "compat.h"
 #include "regs.h"
@@ -19,6 +20,8 @@ bool caam_little_end;
 EXPORT_SYMBOL(caam_little_end);
 bool caam_dpaa2;
 EXPORT_SYMBOL(caam_dpaa2);
+bool caam_imx;
+EXPORT_SYMBOL(caam_imx);
 
 #ifdef CONFIG_CAAM_QI
 #include "qi.h"
@@ -28,19 +31,11 @@ EXPORT_SYMBOL(caam_dpaa2);
  * i.MX targets tend to have clock control subsystems that can
  * enable/disable clocking to our device.
  */
-#ifdef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
 static inline struct clk *caam_drv_identify_clk(struct device *dev,
                                                 char *clk_name)
 {
-        return devm_clk_get(dev, clk_name);
+        return caam_imx ? devm_clk_get(dev, clk_name) : NULL;
 }
-#else
-static inline struct clk *caam_drv_identify_clk(struct device *dev,
-                                                char *clk_name)
-{
-        return NULL;
-}
-#endif
 
 /*
  * Descriptor to instantiate RNG State Handle 0 in normal mode and
@@ -430,6 +425,10 @@ static int caam_probe(struct platform_device *pdev)
 {
         int ret, ring, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
+        static const struct soc_device_attribute imx_soc[] = {
+                {.family = "Freescale i.MX"},
+                {},
+        };
         struct device *dev;
         struct device_node *nprop, *np;
         struct caam_ctrl __iomem *ctrl;
@@ -451,6 +450,8 @@ static int caam_probe(struct platform_device *pdev)
         dev_set_drvdata(dev, ctrlpriv);
         nprop = pdev->dev.of_node;
 
+        caam_imx = (bool)soc_device_match(imx_soc);
+
         /* Enable clocking */
         clk = caam_drv_identify_clk(&pdev->dev, "ipg");
         if (IS_ERR(clk)) {
diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
index 2b5efff9ec3c..17cfd23a38fa 100644
--- a/drivers/crypto/caam/regs.h
+++ b/drivers/crypto/caam/regs.h
@@ -67,6 +67,7 @@
  */
 
 extern bool caam_little_end;
+extern bool caam_imx;
 
 #define caam_to_cpu(len)                                \
 static inline u##len caam##len ## _to_cpu(u##len val)   \
@@ -154,13 +155,10 @@ static inline u64 rd_reg64(void __iomem *reg)
 #else /* CONFIG_64BIT */
 static inline void wr_reg64(void __iomem *reg, u64 data)
 {
-#ifndef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
-        if (caam_little_end) {
+        if (!caam_imx && caam_little_end) {
                 wr_reg32((u32 __iomem *)(reg) + 1, data >> 32);
                 wr_reg32((u32 __iomem *)(reg), data);
-        } else
-#endif
-        {
+        } else {
                 wr_reg32((u32 __iomem *)(reg), data >> 32);
                 wr_reg32((u32 __iomem *)(reg) + 1, data);
         }
@@ -168,41 +166,40 @@ static inline void wr_reg64(void __iomem *reg, u64 data)
 
 static inline u64 rd_reg64(void __iomem *reg)
 {
-#ifndef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
-        if (caam_little_end)
+        if (!caam_imx && caam_little_end)
                 return ((u64)rd_reg32((u32 __iomem *)(reg) + 1) << 32 |
                         (u64)rd_reg32((u32 __iomem *)(reg)));
-        else
-#endif
-                return ((u64)rd_reg32((u32 __iomem *)(reg)) << 32 |
-                        (u64)rd_reg32((u32 __iomem *)(reg) + 1));
+
+        return ((u64)rd_reg32((u32 __iomem *)(reg)) << 32 |
+                (u64)rd_reg32((u32 __iomem *)(reg) + 1));
 }
 #endif /* CONFIG_64BIT  */
 
+static inline u64 cpu_to_caam_dma64(dma_addr_t value)
+{
+        if (caam_imx)
+                return (((u64)cpu_to_caam32(lower_32_bits(value)) << 32) |
+                         (u64)cpu_to_caam32(upper_32_bits(value)));
+
+        return cpu_to_caam64(value);
+}
+
+static inline u64 caam_dma64_to_cpu(u64 value)
+{
+        if (caam_imx)
+                return (((u64)caam32_to_cpu(lower_32_bits(value)) << 32) |
+                         (u64)caam32_to_cpu(upper_32_bits(value)));
+
+        return caam64_to_cpu(value);
+}
+
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-#ifdef CONFIG_SOC_IMX7D
-#define cpu_to_caam_dma(value) \
-                (((u64)cpu_to_caam32(lower_32_bits(value)) << 32) | \
-                  (u64)cpu_to_caam32(upper_32_bits(value)))
-#define caam_dma_to_cpu(value) \
-                (((u64)caam32_to_cpu(lower_32_bits(value)) << 32) | \
-                  (u64)caam32_to_cpu(upper_32_bits(value)))
-#else
-#define cpu_to_caam_dma(value) cpu_to_caam64(value)
-#define caam_dma_to_cpu(value) caam64_to_cpu(value)
-#endif /* CONFIG_SOC_IMX7D */
+#define cpu_to_caam_dma(value) cpu_to_caam_dma64(value)
+#define caam_dma_to_cpu(value) caam_dma64_to_cpu(value)
 #else
 #define cpu_to_caam_dma(value) cpu_to_caam32(value)
 #define caam_dma_to_cpu(value) caam32_to_cpu(value)
-#endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT  */
-
-#ifdef CONFIG_CRYPTO_DEV_FSL_CAAM_IMX
-#define cpu_to_caam_dma64(value) \
-                (((u64)cpu_to_caam32(lower_32_bits(value)) << 32) | \
-                 (u64)cpu_to_caam32(upper_32_bits(value)))
-#else
-#define cpu_to_caam_dma64(value) cpu_to_caam64(value)
-#endif
+#endif /* CONFIG_ARCH_DMA_ADDR_T_64BIT */
 
 /*
  * jr_outentry
diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
index d2207ac5ba19..5438552bc6d7 100644
--- a/drivers/crypto/inside-secure/safexcel_cipher.c
+++ b/drivers/crypto/inside-secure/safexcel_cipher.c
@@ -386,7 +386,7 @@ static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm)
         struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
         struct safexcel_crypto_priv *priv = ctx->priv;
         struct skcipher_request req;
-        struct safexcel_inv_result result = { 0 };
+        struct safexcel_inv_result result = {};
         int ring = ctx->base.ring;
 
         memset(&req, 0, sizeof(struct skcipher_request));
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 3f819399cd95..3980f946874f 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -419,7 +419,7 @@ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
         struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm);
         struct safexcel_crypto_priv *priv = ctx->priv;
         struct ahash_request req;
-        struct safexcel_inv_result result = { 0 };
+        struct safexcel_inv_result result = {};
         int ring = ctx->base.ring;
 
         memset(&req, 0, sizeof(struct ahash_request));
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 79791c690858..dff88838dce7 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1756,9 +1756,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
                 req_ctx->swinit = 0;
         } else {
                 desc->ptr[1] = zero_entry;
-                /* Indicate next op is not the first. */
-                req_ctx->first = 0;
         }
+        /* Indicate next op is not the first. */
+        req_ctx->first = 0;
 
         /* HMAC key */
         if (ctx->keylen)
@@ -1769,7 +1769,7 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
 
         sg_count = edesc->src_nents ?: 1;
         if (is_sec1 && sg_count > 1)
-                sg_copy_to_buffer(areq->src, sg_count, edesc->buf, length);
+                sg_copy_to_buffer(req_ctx->psrc, sg_count, edesc->buf, length);
         else
                 sg_count = dma_map_sg(dev, req_ctx->psrc, sg_count,
                                       DMA_TO_DEVICE);
@@ -3057,7 +3057,8 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
                 t_alg->algt.alg.hash.final = ahash_final;
                 t_alg->algt.alg.hash.finup = ahash_finup;
                 t_alg->algt.alg.hash.digest = ahash_digest;
-                t_alg->algt.alg.hash.setkey = ahash_setkey;
+                if (!strncmp(alg->cra_name, "hmac", 4))
+                        t_alg->algt.alg.hash.setkey = ahash_setkey;
                 t_alg->algt.alg.hash.import = ahash_import;
                 t_alg->algt.alg.hash.export = ahash_export;
 
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 08629ee69d11..00e73d28077c 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -361,12 +361,12 @@ static const struct fpga_manager_ops altera_cvp_ops = {
         .write_complete = altera_cvp_write_complete,
 };
 
-static ssize_t show_chkcfg(struct device_driver *dev, char *buf)
+static ssize_t chkcfg_show(struct device_driver *dev, char *buf)
 {
         return snprintf(buf, 3, "%d\n", altera_cvp_chkcfg);
 }
 
-static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
+static ssize_t chkcfg_store(struct device_driver *drv, const char *buf,
                             size_t count)
 {
         int ret;
@@ -378,7 +378,7 @@ static ssize_t store_chkcfg(struct device_driver *drv, const char *buf,
         return count;
 }
 
-static DRIVER_ATTR(chkcfg, 0600, show_chkcfg, store_chkcfg);
+static DRIVER_ATTR_RW(chkcfg);
 
 static int altera_cvp_probe(struct pci_dev *pdev,
                             const struct pci_device_id *dev_id);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
index d228f5a99044..dbbe986f90f2 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
@@ -636,7 +636,194 @@ static void gfx_v6_0_tiling_mode_table_init(struct amdgpu_device *adev)
                                 NUM_BANKS(ADDR_SURF_2_BANK);
                 for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
                         WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
-        } else if (adev->asic_type == CHIP_OLAND || adev->asic_type == CHIP_HAINAN) {
+        } else if (adev->asic_type == CHIP_OLAND) {
+                tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[1] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[2] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[3] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_128B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[4] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[5] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[6] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[7] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[8] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_LINEAR_ALIGNED) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[9] =   MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[10] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[11] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[12] =  MICRO_TILE_MODE(ADDR_SURF_DISPLAY_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[13] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_1D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_64B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[14] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[15] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[16] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[17] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P4_8x16) |
+                                TILE_SPLIT(split_equal_to_row_size) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[21] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_2) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[22] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_4) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_4);
+                tilemode[23] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_256B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_2) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[24] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_512B) |
+                                NUM_BANKS(ADDR_SURF_16_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_2);
+                tilemode[25] =  MICRO_TILE_MODE(ADDR_SURF_THIN_MICRO_TILING) |
+                                ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
+                                PIPE_CONFIG(ADDR_SURF_P8_32x32_8x16) |
+                                TILE_SPLIT(ADDR_SURF_TILE_SPLIT_1KB) |
+                                NUM_BANKS(ADDR_SURF_8_BANK) |
+                                BANK_WIDTH(ADDR_SURF_BANK_WIDTH_1) |
+                                BANK_HEIGHT(ADDR_SURF_BANK_HEIGHT_1) |
+                                MACRO_TILE_ASPECT(ADDR_SURF_MACRO_ASPECT_1);
+                for (reg_offset = 0; reg_offset < num_tile_mode_states; reg_offset++)
+                        WREG32(mmGB_TILE_MODE0 + reg_offset, tilemode[reg_offset]);
+        } else if (adev->asic_type == CHIP_HAINAN) {
                 tilemode[0] =   MICRO_TILE_MODE(ADDR_SURF_DEPTH_MICRO_TILING) |
                                 ARRAY_MODE(ARRAY_2D_TILED_THIN1) |
                                 PIPE_CONFIG(ADDR_SURF_P2) |
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index e4a8c2e52cb2..660b3fbade41 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -892,6 +892,8 @@ static int kfd_ioctl_get_tile_config(struct file *filep,
         int err = 0;
 
         dev = kfd_device_by_id(args->gpu_id);
+        if (!dev)
+                return -EINVAL;
 
         dev->kfd2kgd->get_tile_config(dev->kgd, &config);
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
index 5979158c3f7b..944abfad39c1 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
@@ -292,7 +292,10 @@ static int create_signal_event(struct file *devkfd,
                                 struct kfd_event *ev)
 {
         if (p->signal_event_count == KFD_SIGNAL_EVENT_LIMIT) {
-                pr_warn("Signal event wasn't created because limit was reached\n");
+                if (!p->signal_event_limit_reached) {
+                        pr_warn("Signal event wasn't created because limit was reached\n");
+                        p->signal_event_limit_reached = true;
+                }
                 return -ENOMEM;
         }
 
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index 681b639f5133..ed71ad40e8f7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -183,8 +183,8 @@ static void uninitialize(struct kernel_queue *kq)
 {
         if (kq->queue->properties.type == KFD_QUEUE_TYPE_HIQ)
                 kq->mqd->destroy_mqd(kq->mqd,
-                                        NULL,
-                                        false,
+                                        kq->queue->mqd,
+                                        KFD_PREEMPT_TYPE_WAVEFRONT_RESET,
                                         QUEUE_PREEMPT_DEFAULT_TIMEOUT_MS,
                                         kq->queue->pipe,
                                         kq->queue->queue);
@@ -210,6 +210,11 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         uint32_t wptr, rptr;
         unsigned int *queue_address;
 
+        /* When rptr == wptr, the buffer is empty.
+         * When rptr == wptr + 1, the buffer is full.
+         * It is always rptr that advances to the position of wptr, rather than
+         * the opposite. So we can only use up to queue_size_dwords - 1 dwords.
+         */
         rptr = *kq->rptr_kernel;
         wptr = *kq->wptr_kernel;
         queue_address = (unsigned int *)kq->pq_kernel_addr;
@@ -219,11 +224,10 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         pr_debug("wptr: %d\n", wptr);
         pr_debug("queue_address 0x%p\n", queue_address);
 
-        available_size = (rptr - 1 - wptr + queue_size_dwords) %
+        available_size = (rptr + queue_size_dwords - 1 - wptr) %
                                                         queue_size_dwords;
 
-        if (packet_size_in_dwords >= queue_size_dwords ||
-                        packet_size_in_dwords >= available_size) {
+        if (packet_size_in_dwords > available_size) {
                 /*
                  * make sure calling functions know
                  * acquire_packet_buffer() failed
@@ -233,6 +237,14 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
         }
 
         if (wptr + packet_size_in_dwords >= queue_size_dwords) {
+                /* make sure after rolling back to position 0, there is
+                 * still enough space.
+                 */
+                if (packet_size_in_dwords >= rptr) {
+                        *buffer_ptr = NULL;
+                        return -ENOMEM;
+                }
+                /* fill nops, roll back and start at position 0 */
                 while (wptr > 0) {
                         queue_address[wptr] = kq->nop_packet;
                         wptr = (wptr + 1) % queue_size_dwords;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index b397ec726400..b87e96cee5fa 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -521,6 +521,7 @@ struct kfd_process {
         struct list_head signal_event_pages;
         u32 next_nonsignal_event_id;
         size_t signal_event_count;
+        bool signal_event_limit_reached;
 };
 
 /**
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
index 1cae95e2b13a..03bec765b03d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -143,7 +143,6 @@ int pqm_create_queue(struct process_queue_manager *pqm,
         int num_queues = 0;
         struct queue *cur;
 
-        memset(&q_properties, 0, sizeof(struct queue_properties));
         memcpy(&q_properties, properties, sizeof(struct queue_properties));
         q = NULL;
         kq = NULL;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 5a634594a6ce..57881167ccd2 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -551,12 +551,15 @@ static const struct etnaviv_gem_ops etnaviv_gem_shmem_ops = {
 void etnaviv_gem_free_object(struct drm_gem_object *obj)
 {
         struct etnaviv_gem_object *etnaviv_obj = to_etnaviv_bo(obj);
+        struct etnaviv_drm_private *priv = obj->dev->dev_private;
         struct etnaviv_vram_mapping *mapping, *tmp;
 
         /* object should not be active */
         WARN_ON(is_active(etnaviv_obj));
 
+        mutex_lock(&priv->gem_lock);
         list_del(&etnaviv_obj->gem_node);
+        mutex_unlock(&priv->gem_lock);
 
         list_for_each_entry_safe(mapping, tmp, &etnaviv_obj->vram_list,
                                  obj_node) {
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 026ef4e02f85..46dfe0737f43 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -445,8 +445,10 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
         cmdbuf->user_size = ALIGN(args->stream_size, 8);
 
         ret = etnaviv_gpu_submit(gpu, submit, cmdbuf);
-        if (ret == 0)
-                cmdbuf = NULL;
+        if (ret)
+                goto out;
+
+        cmdbuf = NULL;
 
         if (args->flags & ETNA_SUBMIT_FENCE_FD_OUT) {
                 /*
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 730b8d9db187..6be5b53c3b27 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -14,6 +14,7 @@
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/iopoll.h>
+#include <linux/irq.h>
 #include <linux/mfd/syscon.h>
 #include <linux/of_device.h>
 #include <linux/of_gpio.h>
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index b1f7299600f0..e651a58c18cf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -168,23 +168,19 @@ static struct drm_driver exynos_drm_driver = {
 static int exynos_drm_suspend(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
+        struct exynos_drm_private *private = drm_dev->dev_private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
-        drm_connector_list_iter_begin(drm_dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                int old_dpms = connector->dpms;
-
-                if (connector->funcs->dpms)
-                        connector->funcs->dpms(connector, DRM_MODE_DPMS_OFF);
-
-                /* Set the old mode back to the connector for resume */
-                connector->dpms = old_dpms;
+        drm_kms_helper_poll_disable(drm_dev);
+        exynos_drm_fbdev_suspend(drm_dev);
+        private->suspend_state = drm_atomic_helper_suspend(drm_dev);
+        if (IS_ERR(private->suspend_state)) {
+                exynos_drm_fbdev_resume(drm_dev);
+                drm_kms_helper_poll_enable(drm_dev);
+                return PTR_ERR(private->suspend_state);
         }
-        drm_connector_list_iter_end(&conn_iter);
 
         return 0;
 }
@@ -192,22 +188,14 @@ static int exynos_drm_suspend(struct device *dev)
 static int exynos_drm_resume(struct device *dev)
 {
         struct drm_device *drm_dev = dev_get_drvdata(dev);
-        struct drm_connector *connector;
-        struct drm_connector_list_iter conn_iter;
+        struct exynos_drm_private *private = drm_dev->dev_private;
 
         if (pm_runtime_suspended(dev) || !drm_dev)
                 return 0;
 
-        drm_connector_list_iter_begin(drm_dev, &conn_iter);
-        drm_for_each_connector_iter(connector, &conn_iter) {
-                if (connector->funcs->dpms) {
-                        int dpms = connector->dpms;
-
-                        connector->dpms = DRM_MODE_DPMS_OFF;
-                        connector->funcs->dpms(connector, dpms);
-                }
-        }
-        drm_connector_list_iter_end(&conn_iter);
+        drm_atomic_helper_resume(drm_dev, private->suspend_state);
+        exynos_drm_fbdev_resume(drm_dev);
+        drm_kms_helper_poll_enable(drm_dev);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index cf131c2aa23e..f8bae4cb4823 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -202,6 +202,7 @@ struct drm_exynos_file_private {
  */
 struct exynos_drm_private {
         struct drm_fb_helper *fb_helper;
+        struct drm_atomic_state *suspend_state;
 
         struct device *dma_dev;
         void *mapping;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index c3a068409b48..dfb66ecf417b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -18,6 +18,8 @@
 #include <drm/drm_crtc_helper.h>
 #include <drm/exynos_drm.h>
 
+#include <linux/console.h>
+
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_fbdev.h"
@@ -285,3 +287,21 @@ void exynos_drm_output_poll_changed(struct drm_device *dev)
 
         drm_fb_helper_hotplug_event(fb_helper);
 }
+
+void exynos_drm_fbdev_suspend(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+
+        console_lock();
+        drm_fb_helper_set_suspend(private->fb_helper, 1);
+        console_unlock();
+}
+
+void exynos_drm_fbdev_resume(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+
+        console_lock();
+        drm_fb_helper_set_suspend(private->fb_helper, 0);
+        console_unlock();
+}
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.h b/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
index 330eef87f718..645d1bb7f665 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.h
@@ -21,6 +21,8 @@ int exynos_drm_fbdev_init(struct drm_device *dev);
 void exynos_drm_fbdev_fini(struct drm_device *dev);
 void exynos_drm_fbdev_restore_mode(struct drm_device *dev);
 void exynos_drm_output_poll_changed(struct drm_device *dev);
+void exynos_drm_fbdev_suspend(struct drm_device *drm);
+void exynos_drm_fbdev_resume(struct drm_device *drm);
 
 #else
 
@@ -39,6 +41,14 @@ static inline void exynos_drm_fbdev_restore_mode(struct drm_device *dev)
 
 #define exynos_drm_output_poll_changed (NULL)
 
+static inline void exynos_drm_fbdev_suspend(struct drm_device *drm)
+{
+}
+
+static inline void exynos_drm_fbdev_resume(struct drm_device *drm)
+{
+}
+
 #endif
 
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 214fa5e51963..0109ff40b1db 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -944,22 +944,27 @@ static bool hdmi_mode_fixup(struct drm_encoder *encoder,
         struct drm_device *dev = encoder->dev;
         struct drm_connector *connector;
         struct drm_display_mode *m;
+        struct drm_connector_list_iter conn_iter;
         int mode_ok;
 
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        drm_for_each_connector_iter(connector, &conn_iter) {
                 if (connector->encoder == encoder)
                         break;
         }
+        if (connector)
+                drm_connector_get(connector);
+        drm_connector_list_iter_end(&conn_iter);
 
-        if (connector->encoder != encoder)
+        if (!connector)
                 return true;
 
         mode_ok = hdmi_mode_valid(connector, adjusted_mode);
 
         if (mode_ok == MODE_OK)
-                return true;
+                goto cleanup;
 
         /*
          * Find the most suitable mode and copy it to adjusted_mode.
@@ -979,6 +984,9 @@ static bool hdmi_mode_fixup(struct drm_encoder *encoder,
                 }
         }
 
+cleanup:
+        drm_connector_put(connector);
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 40af17ec6312..ff3154fe6588 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -197,78 +197,65 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
 static int emulate_pci_bar_write(struct intel_vgpu *vgpu, unsigned int offset,
         void *p_data, unsigned int bytes)
 {
-        unsigned int bar_index =
-                (rounddown(offset, 8) % PCI_BASE_ADDRESS_0) / 8;
         u32 new = *(u32 *)(p_data);
         bool lo = IS_ALIGNED(offset, 8);
         u64 size;
         int ret = 0;
         bool mmio_enabled =
                 vgpu_cfg_space(vgpu)[PCI_COMMAND] & PCI_COMMAND_MEMORY;
+        struct intel_vgpu_pci_bar *bars = vgpu->cfg_space.bar;
 
-        if (WARN_ON(bar_index >= INTEL_GVT_PCI_BAR_MAX))
-                return -EINVAL;
-
+        /*
+         * Power-up software can determine how much address
+         * space the device requires by writing a value of
+         * all 1's to the register and then reading the value
+         * back. The device will return 0's in all don't-care
+         * address bits.
+         */
         if (new == 0xffffffff) {
-                /*
-                 * Power-up software can determine how much address
-                 * space the device requires by writing a value of
-                 * all 1's to the register and then reading the value
-                 * back. The device will return 0's in all don't-care
-                 * address bits.
-                 */
-                size = vgpu->cfg_space.bar[bar_index].size;
-                if (lo) {
-                        new = rounddown(new, size);
-                } else {
-                        u32 val = vgpu_cfg_space(vgpu)[rounddown(offset, 8)];
-                        /* for 32bit mode bar it returns all-0 in upper 32
-                         * bit, for 64bit mode bar it will calculate the
-                         * size with lower 32bit and return the corresponding
-                         * value
+                switch (offset) {
+                case PCI_BASE_ADDRESS_0:
+                case PCI_BASE_ADDRESS_1:
+                        size = ~(bars[INTEL_GVT_PCI_BAR_GTTMMIO].size -1);
+                        intel_vgpu_write_pci_bar(vgpu, offset,
+                                                size >> (lo ? 0 : 32), lo);
+                        /*
+                         * Untrap the BAR, since guest hasn't configured a
+                         * valid GPA
                          */
-                        if (val & PCI_BASE_ADDRESS_MEM_TYPE_64)
-                                new &= (~(size-1)) >> 32;
-                        else
-                                new = 0;
-                }
-                /*
-                 * Unmapp & untrap the BAR, since guest hasn't configured a
-                 * valid GPA
-                 */
-                switch (bar_index) {
-                case INTEL_GVT_PCI_BAR_GTTMMIO:
                         ret = trap_gttmmio(vgpu, false);
                         break;
-                case INTEL_GVT_PCI_BAR_APERTURE:
+                case PCI_BASE_ADDRESS_2:
+                case PCI_BASE_ADDRESS_3:
+                        size = ~(bars[INTEL_GVT_PCI_BAR_APERTURE].size -1);
+                        intel_vgpu_write_pci_bar(vgpu, offset,
+                                                size >> (lo ? 0 : 32), lo);
                         ret = map_aperture(vgpu, false);
                         break;
+                default:
+                        /* Unimplemented BARs */
+                        intel_vgpu_write_pci_bar(vgpu, offset, 0x0, false);
                 }
-                intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
         } else {
-                /*
-                 * Unmapp & untrap the old BAR first, since guest has
-                 * re-configured the BAR
-                 */
-                switch (bar_index) {
-                case INTEL_GVT_PCI_BAR_GTTMMIO:
-                        ret = trap_gttmmio(vgpu, false);
+                switch (offset) {
+                case PCI_BASE_ADDRESS_0:
+                case PCI_BASE_ADDRESS_1:
+                        /*
+                         * Untrap the old BAR first, since guest has
+                         * re-configured the BAR
+                         */
+                        trap_gttmmio(vgpu, false);
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
+                        ret = trap_gttmmio(vgpu, mmio_enabled);
                         break;
-                case INTEL_GVT_PCI_BAR_APERTURE:
-                        ret = map_aperture(vgpu, false);
+                case PCI_BASE_ADDRESS_2:
+                case PCI_BASE_ADDRESS_3:
+                        map_aperture(vgpu, false);
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
+                        ret = map_aperture(vgpu, mmio_enabled);
                         break;
-                }
-                intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
-                /* Track the new BAR */
-                if (mmio_enabled) {
-                        switch (bar_index) {
-                        case INTEL_GVT_PCI_BAR_GTTMMIO:
-                                ret = trap_gttmmio(vgpu, true);
-                                break;
-                        case INTEL_GVT_PCI_BAR_APERTURE:
-                                ret = map_aperture(vgpu, true);
-                                break;
-                        }
+                default:
+                        intel_vgpu_write_pci_bar(vgpu, offset, new, lo);
                 }
         }
         return ret;
@@ -299,10 +286,7 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
         }
 
         switch (rounddown(offset, 4)) {
-        case PCI_BASE_ADDRESS_0:
-        case PCI_BASE_ADDRESS_1:
-        case PCI_BASE_ADDRESS_2:
-        case PCI_BASE_ADDRESS_3:
+        case PCI_BASE_ADDRESS_0 ... PCI_BASE_ADDRESS_5:
                 if (WARN_ON(!IS_ALIGNED(offset, 4)))
                         return -EINVAL;
                 return emulate_pci_bar_write(vgpu, offset, p_data, bytes);
@@ -344,7 +328,6 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
         struct intel_gvt *gvt = vgpu->gvt;
         const struct intel_gvt_device_info *info = &gvt->device_info;
         u16 *gmch_ctl;
-        int i;
 
         memcpy(vgpu_cfg_space(vgpu), gvt->firmware.cfg_space,
                info->cfg_space_size);
@@ -371,13 +354,13 @@ void intel_vgpu_init_cfg_space(struct intel_vgpu *vgpu,
          */
         memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_1, 0, 4);
         memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_3, 0, 4);
+        memset(vgpu_cfg_space(vgpu) + PCI_BASE_ADDRESS_4, 0, 8);
         memset(vgpu_cfg_space(vgpu) + INTEL_GVT_PCI_OPREGION, 0, 4);
 
-        for (i = 0; i < INTEL_GVT_MAX_BAR_NUM; i++) {
-                vgpu->cfg_space.bar[i].size = pci_resource_len(
-                                              gvt->dev_priv->drm.pdev, i * 2);
-                vgpu->cfg_space.bar[i].tracked = false;
-        }
+        vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_GTTMMIO].size =
+                                pci_resource_len(gvt->dev_priv->drm.pdev, 0);
+        vgpu->cfg_space.bar[INTEL_GVT_PCI_BAR_APERTURE].size =
+                                pci_resource_len(gvt->dev_priv->drm.pdev, 2);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e21ce9c18b6e..b63893eeca73 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -839,7 +839,6 @@ static bool i915_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
                                                                 pipe);
         int position;
         int vbl_start, vbl_end, hsync_start, htotal, vtotal;
-        bool in_vbl = true;
         unsigned long irqflags;
 
         if (WARN_ON(!mode->crtc_clock)) {
@@ -922,8 +921,6 @@ static bool i915_get_crtc_scanoutpos(struct drm_device *dev, unsigned int pipe,
 
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 
-        in_vbl = position >= vbl_start && position < vbl_end;
-
         /*
          * While in vblank, position will be negative
          * counting up towards 0 at vbl_end. And outside
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index d805b6e6fe71..27743be5b768 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -606,11 +606,6 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder,
                          connector->encoder->base.id,
                          connector->encoder->name);
 
-        /* ELD Conn_Type */
-        connector->eld[5] &= ~(3 << 2);
-        if (intel_crtc_has_dp_encoder(crtc_state))
-                connector->eld[5] |= (1 << 2);
-
         connector->eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2;
 
         if (dev_priv->display.audio_codec_enable)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 183e87e8ea31..00c6aee0a9a1 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1163,6 +1163,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
         is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0;
         is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR);
 
+        if (port == PORT_A && is_dvi) {
+                DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n",
+                              is_hdmi ? "/HDMI" : "");
+                is_dvi = false;
+                is_hdmi = false;
+        }
+
         info->supports_dvi = is_dvi;
         info->supports_hdmi = is_hdmi;
         info->supports_dp = is_dp;
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 965988f79a55..92c1f8e166dc 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -216,7 +216,7 @@ static void gen9_set_dc_state_debugmask(struct drm_i915_private *dev_priv)
 
         mask = DC_STATE_DEBUG_MASK_MEMORY_UP;
 
-        if (IS_BROXTON(dev_priv))
+        if (IS_GEN9_LP(dev_priv))
                 mask |= DC_STATE_DEBUG_MASK_CORES;
 
         /* The below bit doesn't need to be cleared ever afterwards */
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 4b4fd1f8110b..476681d5940c 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1655,7 +1655,8 @@ bool intel_ddi_get_hw_state(struct intel_encoder *encoder,
 out:
         if (ret && IS_GEN9_LP(dev_priv)) {
                 tmp = I915_READ(BXT_PHY_CTL(port));
-                if ((tmp & (BXT_PHY_LANE_POWERDOWN_ACK |
+                if ((tmp & (BXT_PHY_CMNLANE_POWERDOWN_ACK |
+                            BXT_PHY_LANE_POWERDOWN_ACK |
                             BXT_PHY_LANE_ENABLED)) != BXT_PHY_LANE_ENABLED)
                         DRM_ERROR("Port %c enabled but PHY powered down? "
                                   "(PHY_CTL %08x)\n", port_name(port), tmp);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f17275519484..64f7b51ed97c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -12359,7 +12359,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
         struct drm_crtc_state *old_crtc_state, *new_crtc_state;
         struct drm_crtc *crtc;
         struct intel_crtc_state *intel_cstate;
-        bool hw_check = intel_state->modeset;
         u64 put_domains[I915_MAX_PIPES] = {};
         unsigned crtc_vblank_mask = 0;
         int i;
@@ -12376,7 +12375,6 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
 
                 if (needs_modeset(new_crtc_state) ||
                     to_intel_crtc_state(new_crtc_state)->update_pipe) {
-                        hw_check = true;
 
                         put_domains[to_intel_crtc(crtc)->pipe] =
                                 modeset_get_crtc_power_domains(crtc,
@@ -14030,7 +14028,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
 
                 if (mode_cmd->handles[i] != mode_cmd->handles[0]) {
                         DRM_DEBUG_KMS("bad plane %d handle\n", i);
-                        return -EINVAL;
+                        goto err;
                 }
 
                 stride_alignment = intel_fb_stride_alignment(fb, i);
diff --git a/drivers/gpu/drm/i915/intel_dpio_phy.c b/drivers/gpu/drm/i915/intel_dpio_phy.c
index 09b670929786..de38d014ed39 100644
--- a/drivers/gpu/drm/i915/intel_dpio_phy.c
+++ b/drivers/gpu/drm/i915/intel_dpio_phy.c
@@ -208,12 +208,6 @@ static const struct bxt_ddi_phy_info glk_ddi_phy_info[] = {
         },
 };
 
-static u32 bxt_phy_port_mask(const struct bxt_ddi_phy_info *phy_info)
-{
-        return (phy_info->dual_channel * BIT(phy_info->channel[DPIO_CH1].port)) |
-                BIT(phy_info->channel[DPIO_CH0].port);
-}
-
 static const struct bxt_ddi_phy_info *
 bxt_get_phy_list(struct drm_i915_private *dev_priv, int *count)
 {
@@ -313,7 +307,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                             enum dpio_phy phy)
 {
         const struct bxt_ddi_phy_info *phy_info;
-        enum port port;
 
         phy_info = bxt_get_phy_info(dev_priv, phy);
 
@@ -335,19 +328,6 @@ bool bxt_ddi_phy_is_enabled(struct drm_i915_private *dev_priv,
                 return false;
         }
 
-        for_each_port_masked(port, bxt_phy_port_mask(phy_info)) {
-                u32 tmp = I915_READ(BXT_PHY_CTL(port));
-
-                if (tmp & BXT_PHY_CMNLANE_POWERDOWN_ACK) {
-                        DRM_DEBUG_DRIVER("DDI PHY %d powered, but common lane "
-                                         "for port %c powered down "
-                                         "(PHY_CTL %08x)\n",
-                                         phy, port_name(port), tmp);
-
-                        return false;
-                }
-        }
-
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index f0c11aec5ea5..7442891762be 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -892,8 +892,6 @@ static void intel_dsi_disable(struct intel_encoder *encoder,
                               struct intel_crtc_state *old_crtc_state,
                               struct drm_connector_state *old_conn_state)
 {
-        struct drm_device *dev = encoder->base.dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
         enum port port;
 
@@ -903,15 +901,6 @@ static void intel_dsi_disable(struct intel_encoder *encoder,
         intel_panel_disable_backlight(old_conn_state);
 
         /*
-         * Disable Device ready before the port shutdown in order
-         * to avoid split screen
-         */
-        if (IS_BROXTON(dev_priv)) {
-                for_each_dsi_port(port, intel_dsi->ports)
-                        I915_WRITE(MIPI_DEVICE_READY(port), 0);
-        }
-
-        /*
          * According to the spec we should send SHUTDOWN before
          * MIPI_SEQ_DISPLAY_OFF only for v3+ VBTs, but field testing
          * has shown that the v3 sequence works for v2 VBTs too
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 951e834dd274..28a778b785ac 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -30,6 +30,21 @@
 #include "intel_drv.h"
 #include "i915_drv.h"
 
+static void intel_connector_update_eld_conn_type(struct drm_connector *connector)
+{
+        u8 conn_type;
+
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort ||
+            connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                conn_type = DRM_ELD_CONN_TYPE_DP;
+        } else {
+                conn_type = DRM_ELD_CONN_TYPE_HDMI;
+        }
+
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] &= ~DRM_ELD_CONN_TYPE_MASK;
+        connector->eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= conn_type;
+}
+
 /**
  * intel_connector_update_modes - update connector from edid
  * @connector: DRM connector device to use
@@ -44,6 +59,8 @@ int intel_connector_update_modes(struct drm_connector *connector,
         ret = drm_add_edid_modes(connector, edid);
         drm_edid_to_eld(connector, edid);
 
+        intel_connector_update_eld_conn_type(connector);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index a17b1de7d7e0..3b1c5d783ee7 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -1699,6 +1699,8 @@ bxt_setup_backlight(struct intel_connector *connector, enum pipe unused)
         if (!panel->backlight.max)
                 return -ENODEV;
 
+        panel->backlight.min = get_backlight_min_vbt(connector);
+
         val = bxt_get_backlight(connector);
         val = intel_panel_compute_brightness(connector, val);
         panel->backlight.level = clamp(val, panel->backlight.min,
@@ -1735,6 +1737,8 @@ cnp_setup_backlight(struct intel_connector *connector, enum pipe unused)
         if (!panel->backlight.max)
                 return -ENODEV;
 
+        panel->backlight.min = get_backlight_min_vbt(connector);
+
         val = bxt_get_backlight(connector);
         val = intel_panel_compute_brightness(connector, val);
         panel->backlight.level = clamp(val, panel->backlight.min,
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index b66d8e136aa3..b3a087cb0860 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -2782,6 +2782,9 @@ static void cnl_display_core_init(struct drm_i915_private *dev_priv, bool resume
 
         /* 6. Enable DBUF */
         gen9_dbuf_enable(dev_priv);
+
+        if (resume && dev_priv->csr.dmc_payload)
+                intel_csr_load_program(dev_priv);
 }
 
 #undef CNL_PROCMON_IDX
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 14c5613b4388..afbf50d0c08f 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -509,23 +509,25 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
             .y2 = qfb->base.height
         };
 
-        if (!old_state->fb) {
-                qxl_io_log(qdev,
-                           "create primary fb: %dx%d,%d,%d\n",
-                           bo->surf.width, bo->surf.height,
-                           bo->surf.stride, bo->surf.format);
+        if (old_state->fb) {
+                qfb_old = to_qxl_framebuffer(old_state->fb);
+                bo_old = gem_to_qxl_bo(qfb_old->obj);
+        } else {
+                bo_old = NULL;
+        }
 
-                qxl_io_create_primary(qdev, 0, bo);
-                bo->is_primary = true;
+        if (bo == bo_old)
                 return;
 
-        } else {
-                qfb_old = to_qxl_framebuffer(old_state->fb);
-                bo_old = gem_to_qxl_bo(qfb_old->obj);
+        if (bo_old && bo_old->is_primary) {
+                qxl_io_destroy_primary(qdev);
                 bo_old->is_primary = false;
         }
 
-        bo->is_primary = true;
+        if (!bo->is_primary) {
+                qxl_io_create_primary(qdev, 0, bo);
+                bo->is_primary = true;
+        }
         qxl_draw_dirty_fb(qdev, qfb, bo, 0, 0, &norect, 1, 1);
 }
 
@@ -534,13 +536,15 @@ static void qxl_primary_atomic_disable(struct drm_plane *plane,
 {
         struct qxl_device *qdev = plane->dev->dev_private;
 
-        if (old_state->fb)
-        {       struct qxl_framebuffer *qfb =
+        if (old_state->fb) {
+                struct qxl_framebuffer *qfb =
                         to_qxl_framebuffer(old_state->fb);
                 struct qxl_bo *bo = gem_to_qxl_bo(qfb->obj);
 
-                qxl_io_destroy_primary(qdev);
-                bo->is_primary = false;
+                if (bo->is_primary) {
+                        qxl_io_destroy_primary(qdev);
+                        bo->is_primary = false;
+                }
         }
 }
 
@@ -698,14 +702,15 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane,
         struct drm_gem_object *obj;
         struct qxl_bo *user_bo;
 
-        if (!plane->state->fb) {
-                /* we never executed prepare_fb, so there's nothing to
+        if (!old_state->fb) {
+                /*
+                 * we never executed prepare_fb, so there's nothing to
                  * unpin.
                  */
                 return;
         }
 
-        obj = to_qxl_framebuffer(plane->state->fb)->obj;
+        obj = to_qxl_framebuffer(old_state->fb)->obj;
         user_bo = gem_to_qxl_bo(obj);
         qxl_bo_unpin(user_bo);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 997131d58c7f..ffc10cadcf34 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1663,7 +1663,7 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
         radeon_agp_suspend(rdev);
 
         pci_save_state(dev->pdev);
-        if (freeze && rdev->family >= CHIP_CEDAR) {
+        if (freeze && rdev->family >= CHIP_CEDAR && !(rdev->flags & RADEON_IS_IGP)) {
                 rdev->asic->asic_reset(rdev, true);
                 pci_restore_state(dev->pdev);
         } else if (suspend) {
diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig
index 06f05302ee75..882d85db9053 100644
--- a/drivers/gpu/drm/sun4i/Kconfig
+++ b/drivers/gpu/drm/sun4i/Kconfig
@@ -26,7 +26,7 @@ config DRM_SUN4I_HDMI_CEC
        bool "Allwinner A10 HDMI CEC Support"
        depends on DRM_SUN4I_HDMI
        select CEC_CORE
-       depends on CEC_PIN
+       select CEC_PIN
        help
           Choose this option if you have an Allwinner SoC with an HDMI
           controller and want to use CEC.
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi.h b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
index 1457750988da..a1f8cba251a2 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi.h
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi.h
@@ -15,7 +15,7 @@
 #include <drm/drm_connector.h>
 #include <drm/drm_encoder.h>
 
-#include <media/cec.h>
+#include <media/cec-pin.h>
 
 #define SUN4I_HDMI_CTRL_REG             0x004
 #define SUN4I_HDMI_CTRL_ENABLE                  BIT(31)
diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
index 9ea6cd5a1370..3cf1a6932fac 100644
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -302,26 +302,29 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
         hdmi->mod_clk = devm_clk_get(dev, "mod");
         if (IS_ERR(hdmi->mod_clk)) {
                 dev_err(dev, "Couldn't get the HDMI mod clock\n");
-                return PTR_ERR(hdmi->mod_clk);
+                ret = PTR_ERR(hdmi->mod_clk);
+                goto err_disable_bus_clk;
         }
         clk_prepare_enable(hdmi->mod_clk);
 
         hdmi->pll0_clk = devm_clk_get(dev, "pll-0");
         if (IS_ERR(hdmi->pll0_clk)) {
                 dev_err(dev, "Couldn't get the HDMI PLL 0 clock\n");
-                return PTR_ERR(hdmi->pll0_clk);
+                ret = PTR_ERR(hdmi->pll0_clk);
+                goto err_disable_mod_clk;
         }
 
         hdmi->pll1_clk = devm_clk_get(dev, "pll-1");
         if (IS_ERR(hdmi->pll1_clk)) {
                 dev_err(dev, "Couldn't get the HDMI PLL 1 clock\n");
-                return PTR_ERR(hdmi->pll1_clk);
+                ret = PTR_ERR(hdmi->pll1_clk);
+                goto err_disable_mod_clk;
         }
 
         ret = sun4i_tmds_create(hdmi);
         if (ret) {
                 dev_err(dev, "Couldn't create the TMDS clock\n");
-                return ret;
+                goto err_disable_mod_clk;
         }
 
         writel(SUN4I_HDMI_CTRL_ENABLE, hdmi->base + SUN4I_HDMI_CTRL_REG);
@@ -362,7 +365,7 @@ static int sun4i_hdmi_bind(struct device *dev, struct device *master,
         ret = sun4i_hdmi_i2c_create(dev, hdmi);
         if (ret) {
                 dev_err(dev, "Couldn't create the HDMI I2C adapter\n");
-                return ret;
+                goto err_disable_mod_clk;
         }
 
         drm_encoder_helper_add(&hdmi->encoder,
@@ -422,6 +425,10 @@ err_cleanup_connector:
         drm_encoder_cleanup(&hdmi->encoder);
 err_del_i2c_adapter:
         i2c_del_adapter(hdmi->i2c);
+err_disable_mod_clk:
+        clk_disable_unprepare(hdmi->mod_clk);
+err_disable_bus_clk:
+        clk_disable_unprepare(hdmi->bus_clk);
         return ret;
 }
 
@@ -434,6 +441,8 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master,
         drm_connector_cleanup(&hdmi->connector);
         drm_encoder_cleanup(&hdmi->encoder);
         i2c_del_adapter(hdmi->i2c);
+        clk_disable_unprepare(hdmi->mod_clk);
+        clk_disable_unprepare(hdmi->bus_clk);
 }
 
 static const struct component_ops sun4i_hdmi_ops = {
diff --git a/drivers/gpu/drm/tegra/trace.h b/drivers/gpu/drm/tegra/trace.h
index e9b7cdad5c4c..5a1ab4046e92 100644
--- a/drivers/gpu/drm/tegra/trace.h
+++ b/drivers/gpu/drm/tegra/trace.h
@@ -63,6 +63,6 @@ DEFINE_EVENT(register_access, sor_readl,
 
 /* This part must be outside protection */
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_PATH ../../drivers/gpu/drm/tegra
 #define TRACE_INCLUDE_FILE trace
 #include <trace/define_trace.h>
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b397a14ab970..a98919199858 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -533,6 +533,7 @@
 #define USB_VENDOR_ID_IDEACOM           0x1cb6
 #define USB_DEVICE_ID_IDEACOM_IDC6650   0x6650
 #define USB_DEVICE_ID_IDEACOM_IDC6651   0x6651
+#define USB_DEVICE_ID_IDEACOM_IDC6680   0x6680
 
 #define USB_VENDOR_ID_ILITEK            0x222a
 #define USB_DEVICE_ID_ILITEK_MULTITOUCH 0x0001
@@ -660,6 +661,7 @@
 #define USB_DEVICE_ID_LENOVO_CBTKBD     0x6048
 #define USB_DEVICE_ID_LENOVO_TPPRODOCK  0x6067
 #define USB_DEVICE_ID_LENOVO_X1_COVER   0x6085
+#define USB_DEVICE_ID_LENOVO_X1_TAB     0x60a3
 
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 440b999304a5..9e8c4d2ba11d 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -930,6 +930,7 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
             field->application != HID_DG_PEN &&
             field->application != HID_DG_TOUCHPAD &&
             field->application != HID_GD_KEYBOARD &&
+            field->application != HID_GD_SYSTEM_CONTROL &&
             field->application != HID_CP_CONSUMER_CONTROL &&
             field->application != HID_GD_WIRELESS_RADIO_CTLS &&
             !(field->application == HID_VD_ASUS_CUSTOM_MEDIA_KEYS &&
@@ -1419,6 +1420,12 @@ static const struct hid_device_id mt_devices[] = {
                         USB_VENDOR_ID_ALPS_JP,
                         HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
 
+        /* Lenovo X1 TAB Gen 2 */
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+                           USB_VENDOR_ID_LENOVO,
+                           USB_DEVICE_ID_LENOVO_X1_TAB) },
+
         /* Anton devices */
         { .driver_data = MT_CLS_EXPORT_ALL_INPUTS,
                 MT_USB_DEVICE(USB_VENDOR_ID_ANTON,
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index 5b40c2614599..ef241d66562e 100644
--- a/drivers/hid/hid-rmi.c
+++ b/drivers/hid/hid-rmi.c
@@ -436,17 +436,24 @@ static int rmi_post_resume(struct hid_device *hdev)
         if (!(data->device_flags & RMI_DEVICE))
                 return 0;
 
-        ret = rmi_reset_attn_mode(hdev);
+        /* Make sure the HID device is ready to receive events */
+        ret = hid_hw_open(hdev);
         if (ret)
                 return ret;
 
+        ret = rmi_reset_attn_mode(hdev);
+        if (ret)
+                goto out;
+
         ret = rmi_driver_resume(rmi_dev, false);
         if (ret) {
                 hid_warn(hdev, "Failed to resume device: %d\n", ret);
-                return ret;
+                goto out;
         }
 
-        return 0;
+out:
+        hid_hw_close(hdev);
+        return ret;
 }
 #endif /* CONFIG_PM */
 
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index ec530454e6f6..5fbe0f81ab2e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -337,8 +337,8 @@ static void drop_ref(struct hidraw *hidraw, int exists_bit)
                         kfree(hidraw);
                 } else {
                         /* close device for last reader */
-                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                         hid_hw_close(hidraw->hid);
+                        hid_hw_power(hidraw->hid, PM_HINT_NORMAL);
                 }
         }
 }
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 77396145d2d0..9145c2129a96 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -543,7 +543,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
 {
         /* the worst case is computed from the set_report command with a
          * reportID > 15 and the maximum report length */
-        int args_len = sizeof(__u8) + /* optional ReportID byte */
+        int args_len = sizeof(__u8) + /* ReportID */
+                       sizeof(__u8) + /* optional ReportID byte */
                        sizeof(__u16) + /* data register */
                        sizeof(__u16) + /* size of the report */
                        report_size; /* report */
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index a83fa76655b9..f489a5cfcb48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -99,6 +99,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index e82a696a1d07..906e654fb0ba 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -668,8 +668,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
 
         /* Try to find an already-probed interface from the same device */
         list_for_each_entry(data, &wacom_udev_list, list) {
-                if (compare_device_paths(hdev, data->dev, '/'))
+                if (compare_device_paths(hdev, data->dev, '/')) {
+                        kref_get(&data->kref);
                         return data;
+                }
         }
 
         /* Fallback to finding devices that appear to be "siblings" */
@@ -766,6 +768,9 @@ static int wacom_led_control(struct wacom *wacom)
         if (!wacom->led.groups)
                 return -ENOTSUPP;
 
+        if (wacom->wacom_wac.features.type == REMOTE)
+                return -ENOTSUPP;
+
         if (wacom->wacom_wac.pid) { /* wireless connected */
                 report_id = WAC_CMD_WL_LED_CONTROL;
                 buf_size = 13;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index bb17d7bbefd3..aa692e28b2cd 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -567,8 +567,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
                                 keys = data[9] & 0x07;
                         }
                 } else {
-                        buttons = ((data[6] & 0x10) << 10) |
-                                  ((data[5] & 0x10) << 9)  |
+                        buttons = ((data[6] & 0x10) << 5)  |
+                                  ((data[5] & 0x10) << 4)  |
                                   ((data[6] & 0x0F) << 4)  |
                                   (data[5] & 0x0F);
                 }
@@ -1227,11 +1227,17 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
                         continue;
 
                 if (range) {
+                        /* Fix rotation alignment: userspace expects zero at left */
+                        int16_t rotation = (int16_t)get_unaligned_le16(&frame[9]);
+                        rotation += 1800/4;
+                        if (rotation > 899)
+                                rotation -= 1800;
+
                         input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1]));
                         input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3]));
-                        input_report_abs(pen_input, ABS_TILT_X, frame[7]);
-                        input_report_abs(pen_input, ABS_TILT_Y, frame[8]);
-                        input_report_abs(pen_input, ABS_Z, get_unaligned_le16(&frame[9]));
+                        input_report_abs(pen_input, ABS_TILT_X, (char)frame[7]);
+                        input_report_abs(pen_input, ABS_TILT_Y, (char)frame[8]);
+                        input_report_abs(pen_input, ABS_Z, rotation);
                         input_report_abs(pen_input, ABS_WHEEL, get_unaligned_le16(&frame[11]));
                 }
                 input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5]));
@@ -1319,12 +1325,19 @@ static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom)
         unsigned char *data = wacom->data;
 
         int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01);
-        int ring = data[285];
-        int prox = buttons | (ring & 0x80);
+        int ring = data[285] & 0x7F;
+        bool ringstatus = data[285] & 0x80;
+        bool prox = buttons || ringstatus;
+
+        /* Fix touchring data: userspace expects 0 at left and increasing clockwise */
+        ring = 71 - ring;
+        ring += 3*72/16;
+        if (ring > 71)
+                ring -= 72;
 
         wacom_report_numbered_buttons(pad_input, 9, buttons);
 
-        input_report_abs(pad_input, ABS_WHEEL, (ring & 0x80) ? (ring & 0x7f) : 0);
+        input_report_abs(pad_input, ABS_WHEEL, ringstatus ? ring : 0);
 
         input_report_key(pad_input, wacom->tool[1], prox ? 1 : 0);
         input_report_abs(pad_input, ABS_MISC, prox ? PAD_DEVICE_ID : 0);
@@ -1616,6 +1629,20 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
         return 0;
 }
 
+static int wacom_offset_rotation(struct input_dev *input, struct hid_usage *usage,
+                                 int value, int num, int denom)
+{
+        struct input_absinfo *abs = &input->absinfo[usage->code];
+        int range = (abs->maximum - abs->minimum + 1);
+
+        value += num*range/denom;
+        if (value > abs->maximum)
+                value -= range;
+        else if (value < abs->minimum)
+                value += range;
+        return value;
+}
+
 int wacom_equivalent_usage(int usage)
 {
         if ((usage & HID_USAGE_PAGE) == WACOM_HID_UP_WACOMDIGITIZER) {
@@ -1898,6 +1925,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
         unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
         int i;
         bool is_touch_on = value;
+        bool do_report = false;
 
         /*
          * Avoid reporting this event and setting inrange_state if this usage
@@ -1912,6 +1940,29 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
         }
 
         switch (equivalent_usage) {
+        case WACOM_HID_WD_TOUCHRING:
+                /*
+                 * Userspace expects touchrings to increase in value with
+                 * clockwise gestures and have their zero point at the
+                 * tablet's left. HID events "should" be clockwise-
+                 * increasing and zero at top, though the MobileStudio
+                 * Pro and 2nd-gen Intuos Pro don't do this...
+                 */
+                if (hdev->vendor == 0x56a &&
+                    (hdev->product == 0x34d || hdev->product == 0x34e ||  /* MobileStudio Pro */
+                     hdev->product == 0x357 || hdev->product == 0x358)) { /* Intuos Pro 2 */
+                        value = (field->logical_maximum - value);
+
+                        if (hdev->product == 0x357 || hdev->product == 0x358)
+                                value = wacom_offset_rotation(input, usage, value, 3, 16);
+                        else if (hdev->product == 0x34d || hdev->product == 0x34e)
+                                value = wacom_offset_rotation(input, usage, value, 1, 2);
+                }
+                else {
+                        value = wacom_offset_rotation(input, usage, value, 1, 4);
+                }
+                do_report = true;
+                break;
         case WACOM_HID_WD_TOUCHRINGSTATUS:
                 if (!value)
                         input_event(input, usage->type, usage->code, 0);
@@ -1945,10 +1996,14 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field
                                          value, i);
                  /* fall through*/
         default:
+                do_report = true;
+                break;
+        }
+
+        if (do_report) {
                 input_event(input, usage->type, usage->code, value);
                 if (value)
                         wacom_wac->hid_data.pad_input_event_flag = true;
-                break;
         }
 }
 
@@ -2086,22 +2141,34 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                 wacom_wac->hid_data.tipswitch |= value;
                 return;
         case HID_DG_TOOLSERIALNUMBER:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                wacom_wac->serial[0] |= (__u32)value;
+                if (value) {
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
+                        wacom_wac->serial[0] |= (__u32)value;
+                }
                 return;
+        case HID_DG_TWIST:
+                /*
+                 * Userspace expects pen twist to have its zero point when
+                 * the buttons/finger is on the tablet's left. HID values
+                 * are zero when buttons are toward the top.
+                 */
+                value = wacom_offset_rotation(input, usage, value, 1, 4);
+                break;
         case WACOM_HID_WD_SENSE:
                 wacom_wac->hid_data.sense_state = value;
                 return;
         case WACOM_HID_WD_SERIALHI:
-                wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
-                wacom_wac->serial[0] |= ((__u64)value) << 32;
-                /*
-                 * Non-USI EMR devices may contain additional tool type
-                 * information here. See WACOM_HID_WD_TOOLTYPE case for
-                 * more details.
-                 */
-                if (value >> 20 == 1) {
-                        wacom_wac->id[0] |= value & 0xFFFFF;
+                if (value) {
+                        wacom_wac->serial[0] = (wacom_wac->serial[0] & 0xFFFFFFFF);
+                        wacom_wac->serial[0] |= ((__u64)value) << 32;
+                        /*
+                         * Non-USI EMR devices may contain additional tool type
+                         * information here. See WACOM_HID_WD_TOOLTYPE case for
+                         * more details.
+                         */
+                        if (value >> 20 == 1) {
+                                wacom_wac->id[0] |= value & 0xFFFFF;
+                        }
                 }
                 return;
         case WACOM_HID_WD_TOOLTYPE:
@@ -2205,7 +2272,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
                 input_report_key(input, wacom_wac->tool[0], prox);
                 if (wacom_wac->serial[0]) {
                         input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]);
-                        input_report_abs(input, ABS_MISC, id);
+                        input_report_abs(input, ABS_MISC, prox ? id : 0);
                 }
 
                 wacom_wac->hid_data.tipswitch = false;
@@ -2216,6 +2283,7 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
         if (!prox) {
                 wacom_wac->tool[0] = 0;
                 wacom_wac->id[0] = 0;
+                wacom_wac->serial[0] = 0;
         }
 }
 
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 060df71c2e8b..bcbb031f7263 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -936,14 +936,10 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 
 void vmbus_hvsock_device_unregister(struct vmbus_channel *channel)
 {
-        mutex_lock(&vmbus_connection.channel_mutex);
-
         BUG_ON(!is_hvsock_channel(channel));
 
         channel->rescind = true;
         vmbus_device_unregister(channel->device_obj);
-
-        mutex_unlock(&vmbus_connection.channel_mutex);
 }
 EXPORT_SYMBOL_GPL(vmbus_hvsock_device_unregister);
 
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index daa75bd41f86..2364281d8593 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_struct *dummy)
                 out_src = smsg_out;
                 break;
 
+        case WRITE_TO_FILE:
+                out_src = fcopy_transaction.fcopy_msg;
+                out_len = sizeof(struct hv_do_fcopy);
+                break;
         default:
                 out_src = fcopy_transaction.fcopy_msg;
                 out_len = fcopy_transaction.recv_len;
diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c
index 9c0dbb8191ad..e1be61095532 100644
--- a/drivers/hwmon/xgene-hwmon.c
+++ b/drivers/hwmon/xgene-hwmon.c
@@ -630,7 +630,7 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                          sizeof(struct slimpro_resp_msg) * ASYNC_MSG_FIFO_SIZE,
                          GFP_KERNEL);
         if (rc)
-                goto out_mbox_free;
+                return -ENOMEM;
 
         INIT_WORK(&ctx->workq, xgene_hwmon_evt_work);
 
@@ -646,7 +646,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (IS_ERR(ctx->mbox_chan)) {
                         dev_err(&pdev->dev,
                                 "SLIMpro mailbox channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
         } else {
                 struct acpi_pcct_hw_reduced *cppc_ss;
@@ -654,7 +655,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (device_property_read_u32(&pdev->dev, "pcc-channel",
                                              &ctx->mbox_idx)) {
                         dev_err(&pdev->dev, "no pcc-channel property\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
 
                 cl->rx_callback = xgene_hwmon_pcc_rx_cb;
@@ -662,7 +664,8 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (IS_ERR(ctx->mbox_chan)) {
                         dev_err(&pdev->dev,
                                 "PPC channel request failed\n");
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto out_mbox_free;
                 }
 
                 /*
@@ -675,13 +678,13 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 if (!cppc_ss) {
                         dev_err(&pdev->dev, "PPC subspace not found\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 if (!ctx->mbox_chan->mbox->txdone_irq) {
                         dev_err(&pdev->dev, "PCC IRQ not supported\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 /*
@@ -696,14 +699,14 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
                 } else {
                         dev_err(&pdev->dev, "Failed to get PCC comm region\n");
                         rc = -ENODEV;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 if (!ctx->pcc_comm_addr) {
                         dev_err(&pdev->dev,
                                 "Failed to ioremap PCC comm region\n");
                         rc = -ENOMEM;
-                        goto out_mbox_free;
+                        goto out;
                 }
 
                 /*
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index bc9cebc30526..c2a2ce8ee541 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -144,6 +144,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 .driver_data = (kernel_ulong_t)0,
         },
         {
+                /* Lewisburg PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
                 /* Gemini Lake */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
@@ -158,6 +163,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
                 .driver_data = (kernel_ulong_t)&intel_th_2x,
         },
+        {
+                /* Cedar Fork PCH */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
+                .driver_data = (kernel_ulong_t)&intel_th_2x,
+        },
         { 0 },
 };
 
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9414900575d8..f129869e05a9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data)
 
         stm_source_link_drop(src);
 
-        device_destroy(&stm_source_class, src->dev.devt);
+        device_unregister(&src->dev);
 }
 EXPORT_SYMBOL_GPL(stm_source_unregister_device);
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index c06dce2c1da7..45a3f3ca29b3 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -131,6 +131,7 @@ config I2C_I801
             Gemini Lake (SOC)
             Cannon Lake-H (PCH)
             Cannon Lake-LP (PCH)
+            Cedar Fork (PCH)
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index e114e4e00d29..9e12a53ef7b8 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -68,6 +68,7 @@
  * Gemini Lake (SOC)            0x31d4  32      hard    yes     yes     yes
  * Cannon Lake-H (PCH)          0xa323  32      hard    yes     yes     yes
  * Cannon Lake-LP (PCH)         0x9da3  32      hard    yes     yes     yes
+ * Cedar Fork (PCH)             0x18df  32      hard    yes     yes     yes
  *
  * Features supported by this driver:
  * Software PEC                         no
@@ -204,6 +205,7 @@
 
 /* Older devices have their ID defined in <linux/pci_ids.h> */
 #define PCI_DEVICE_ID_INTEL_BAYTRAIL_SMBUS              0x0f12
+#define PCI_DEVICE_ID_INTEL_CDF_SMBUS                   0x18df
 #define PCI_DEVICE_ID_INTEL_DNV_SMBUS                   0x19df
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS           0x1c22
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS              0x1d22
@@ -1025,6 +1027,7 @@ static const struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BRASWELL_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_SMBUS) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CDF_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_DNV_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BROXTON_SMBUS) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS) },
@@ -1513,6 +1516,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         case PCI_DEVICE_ID_INTEL_CANNONLAKE_LP_SMBUS:
         case PCI_DEVICE_ID_INTEL_LEWISBURG_SMBUS:
         case PCI_DEVICE_ID_INTEL_LEWISBURG_SSKU_SMBUS:
+        case PCI_DEVICE_ID_INTEL_CDF_SMBUS:
         case PCI_DEVICE_ID_INTEL_DNV_SMBUS:
         case PCI_DEVICE_ID_INTEL_KABYLAKE_PCH_H_SMBUS:
                 priv->features |= FEATURE_I2C_BLOCK_READ;
diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
index 84fb35f6837f..eb1d91b986fd 100644
--- a/drivers/i2c/busses/i2c-img-scb.c
+++ b/drivers/i2c/busses/i2c-img-scb.c
@@ -1459,6 +1459,6 @@ static struct platform_driver img_scb_i2c_driver = {
 };
 module_platform_driver(img_scb_i2c_driver);
 
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("IMG host I2C driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
index 22e08ae1704f..25fcc3c1e32b 100644
--- a/drivers/i2c/busses/i2c-sprd.c
+++ b/drivers/i2c/busses/i2c-sprd.c
@@ -627,6 +627,7 @@ static const struct dev_pm_ops sprd_i2c_pm_ops = {
 
 static const struct of_device_id sprd_i2c_of_match[] = {
         { .compatible = "sprd,sc9860-i2c", },
+        {},
 };
 
 static struct platform_driver sprd_i2c_driver = {
diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
index 47c67b0ca896..d4a6e9c2e9aa 100644
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -215,7 +215,7 @@ struct stm32f7_i2c_dev {
         unsigned int msg_num;
         unsigned int msg_id;
         struct stm32f7_i2c_msg f7_msg;
-        struct stm32f7_i2c_setup *setup;
+        struct stm32f7_i2c_setup setup;
         struct stm32f7_i2c_timings timing;
 };
 
@@ -265,7 +265,7 @@ static struct stm32f7_i2c_spec i2c_specs[] = {
         },
 };
 
-struct stm32f7_i2c_setup stm32f7_setup = {
+static const struct stm32f7_i2c_setup stm32f7_setup = {
         .rise_time = STM32F7_I2C_RISE_TIME_DEFAULT,
         .fall_time = STM32F7_I2C_FALL_TIME_DEFAULT,
         .dnf = STM32F7_I2C_DNF_DEFAULT,
@@ -537,7 +537,7 @@ static void stm32f7_i2c_hw_config(struct stm32f7_i2c_dev *i2c_dev)
         writel_relaxed(timing, i2c_dev->base + STM32F7_I2C_TIMINGR);
 
         /* Enable I2C */
-        if (i2c_dev->setup->analog_filter)
+        if (i2c_dev->setup.analog_filter)
                 stm32f7_i2c_clr_bits(i2c_dev->base + STM32F7_I2C_CR1,
                                      STM32F7_I2C_CR1_ANFOFF);
         else
@@ -887,22 +887,19 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
         }
 
         setup = of_device_get_match_data(&pdev->dev);
-        i2c_dev->setup->rise_time = setup->rise_time;
-        i2c_dev->setup->fall_time = setup->fall_time;
-        i2c_dev->setup->dnf = setup->dnf;
-        i2c_dev->setup->analog_filter = setup->analog_filter;
+        i2c_dev->setup = *setup;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
                                        &rise_time);
         if (!ret)
-                i2c_dev->setup->rise_time = rise_time;
+                i2c_dev->setup.rise_time = rise_time;
 
         ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-falling-time-ns",
                                        &fall_time);
         if (!ret)
-                i2c_dev->setup->fall_time = fall_time;
+                i2c_dev->setup.fall_time = fall_time;
 
-        ret = stm32f7_i2c_setup_timing(i2c_dev, i2c_dev->setup);
+        ret = stm32f7_i2c_setup_timing(i2c_dev, &i2c_dev->setup);
         if (ret)
                 goto clk_free;
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 01b2adfd8226..eaf39e5db08b 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1451,6 +1451,7 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                 if (hwif_init(hwif) == 0) {
                         printk(KERN_INFO "%s: failed to initialize IDE "
                                          "interface\n", hwif->name);
+                        device_unregister(hwif->portdev);
                         device_unregister(&hwif->gendev);
                         ide_disable_port(hwif);
                         continue;
diff --git a/drivers/ide/ide-scan-pci.c b/drivers/ide/ide-scan-pci.c
index 86aa88aeb3a6..acf874800ca4 100644
--- a/drivers/ide/ide-scan-pci.c
+++ b/drivers/ide/ide-scan-pci.c
@@ -56,6 +56,7 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
 {
         struct list_head *l;
         struct pci_driver *d;
+        int ret;
 
         list_for_each(l, &ide_pci_drivers) {
                 d = list_entry(l, struct pci_driver, node);
@@ -63,10 +64,14 @@ static int __init ide_scan_pcidev(struct pci_dev *dev)
                         const struct pci_device_id *id =
                                 pci_match_id(d->id_table, dev);
 
-                        if (id != NULL && d->probe(dev, id) >= 0) {
-                                dev->driver = d;
-                                pci_dev_get(dev);
-                                return 1;
+                        if (id != NULL) {
+                                pci_assign_irq(dev);
+                                ret = d->probe(dev, id);
+                                if (ret >= 0) {
+                                        dev->driver = d;
+                                        pci_dev_get(dev);
+                                        return 1;
+                                }
                         }
                 }
         }
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index 112d2fe1bcdb..fdc8e813170c 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -179,6 +179,7 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
 /**
  *      ide_pci_enable  -       do PCI enables
  *      @dev: PCI device
+ *      @bars: PCI BARs mask
  *      @d: IDE port info
  *
  *      Enable the IDE PCI device. We attempt to enable the device in full
@@ -189,9 +190,10 @@ EXPORT_SYMBOL_GPL(ide_setup_pci_noise);
  *      Returns zero on success or an error code
  */
 
-static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
+static int ide_pci_enable(struct pci_dev *dev, int bars,
+                          const struct ide_port_info *d)
 {
-        int ret, bars;
+        int ret;
 
         if (pci_enable_device(dev)) {
                 ret = pci_enable_device_io(dev);
@@ -216,18 +218,6 @@ static int ide_pci_enable(struct pci_dev *dev, const struct ide_port_info *d)
                 goto out;
         }
 
-        if (d->host_flags & IDE_HFLAG_SINGLE)
-                bars = (1 << 2) - 1;
-        else
-                bars = (1 << 4) - 1;
-
-        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
-                if (d->host_flags & IDE_HFLAG_CS5520)
-                        bars |= (1 << 2);
-                else
-                        bars |= (1 << 4);
-        }
-
         ret = pci_request_selected_regions(dev, bars, d->name);
         if (ret < 0)
                 printk(KERN_ERR "%s %s: can't reserve resources\n",
@@ -403,6 +393,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
 /**
  *      ide_setup_pci_controller        -       set up IDE PCI
  *      @dev: PCI device
+ *      @bars: PCI BARs mask
  *      @d: IDE port info
  *      @noisy: verbose flag
  *
@@ -411,7 +402,7 @@ int ide_hwif_setup_dma(ide_hwif_t *hwif, const struct ide_port_info *d)
  *      and enables it if need be
  */
 
-static int ide_setup_pci_controller(struct pci_dev *dev,
+static int ide_setup_pci_controller(struct pci_dev *dev, int bars,
                                     const struct ide_port_info *d, int noisy)
 {
         int ret;
@@ -420,7 +411,7 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
         if (noisy)
                 ide_setup_pci_noise(dev, d);
 
-        ret = ide_pci_enable(dev, d);
+        ret = ide_pci_enable(dev, bars, d);
         if (ret < 0)
                 goto out;
 
@@ -428,16 +419,20 @@ static int ide_setup_pci_controller(struct pci_dev *dev,
         if (ret < 0) {
                 printk(KERN_ERR "%s %s: error accessing PCI regs\n",
                         d->name, pci_name(dev));
-                goto out;
+                goto out_free_bars;
         }
         if (!(pcicmd & PCI_COMMAND_IO)) {       /* is device disabled? */
                 ret = ide_pci_configure(dev, d);
                 if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
                 printk(KERN_INFO "%s %s: device enabled (Linux)\n",
                         d->name, pci_name(dev));
         }
 
+        goto out;
+
+out_free_bars:
+        pci_release_selected_regions(dev, bars);
 out:
         return ret;
 }
@@ -540,13 +535,28 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
 {
         struct pci_dev *pdev[] = { dev1, dev2 };
         struct ide_host *host;
-        int ret, i, n_ports = dev2 ? 4 : 2;
+        int ret, i, n_ports = dev2 ? 4 : 2, bars;
         struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
 
+        if (d->host_flags & IDE_HFLAG_SINGLE)
+                bars = (1 << 2) - 1;
+        else
+                bars = (1 << 4) - 1;
+
+        if ((d->host_flags & IDE_HFLAG_NO_DMA) == 0) {
+                if (d->host_flags & IDE_HFLAG_CS5520)
+                        bars |= (1 << 2);
+                else
+                        bars |= (1 << 4);
+        }
+
         for (i = 0; i < n_ports / 2; i++) {
-                ret = ide_setup_pci_controller(pdev[i], d, !i);
-                if (ret < 0)
+                ret = ide_setup_pci_controller(pdev[i], bars, d, !i);
+                if (ret < 0) {
+                        if (i == 1)
+                                pci_release_selected_regions(pdev[0], bars);
                         goto out;
+                }
 
                 ide_pci_setup_ports(pdev[i], d, &hw[i*2], &hws[i*2]);
         }
@@ -554,7 +564,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
         host = ide_host_alloc(d, hws, n_ports);
         if (host == NULL) {
                 ret = -ENOMEM;
-                goto out;
+                goto out_free_bars;
         }
 
         host->dev[0] = &dev1->dev;
@@ -576,7 +586,7 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
                  * do_ide_setup_pci_device() on the first device!
                  */
                 if (ret < 0)
-                        goto out;
+                        goto out_free_bars;
 
                 /* fixup IRQ */
                 if (ide_pci_is_in_compatibility_mode(pdev[i])) {
@@ -589,6 +599,13 @@ int ide_pci_init_two(struct pci_dev *dev1, struct pci_dev *dev2,
         ret = ide_host_register(host, d, hws);
         if (ret)
                 ide_host_free(host);
+        else
+                goto out;
+
+out_free_bars:
+        i = n_ports / 2;
+        while (i--)
+                pci_release_selected_regions(pdev[i], bars);
 out:
         return ret;
 }
diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index c40263ad881f..801afb61310b 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
         unsigned int vref_mv)
 {
         struct ad7793_state *st = iio_priv(indio_dev);
-        int i, ret = -1;
+        int i, ret;
         unsigned long long scale_uv;
         u32 id;
 
@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev,
                 return ret;
 
         /* reset the serial interface */
-        ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret));
+        ret = ad_sd_reset(&st->sd, 32);
         if (ret < 0)
                 goto out;
         usleep_range(500, 2000); /* Wait for at least 500us */
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index e3ed74ee41d1..cf1b048b0665 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -177,6 +177,34 @@ out:
 }
 EXPORT_SYMBOL_GPL(ad_sd_read_reg);
 
+/**
+ * ad_sd_reset() - Reset the serial interface
+ *
+ * @sigma_delta: The sigma delta device
+ * @reset_length: Number of SCLKs with DIN = 1
+ *
+ * Returns 0 on success, an error code otherwise.
+ **/
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length)
+{
+        uint8_t *buf;
+        unsigned int size;
+        int ret;
+
+        size = DIV_ROUND_UP(reset_length, 8);
+        buf = kcalloc(size, sizeof(*buf), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        memset(buf, 0xff, size);
+        ret = spi_write(sigma_delta->spi, buf, size);
+        kfree(buf);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(ad_sd_reset);
+
 static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta,
         unsigned int mode, unsigned int channel)
 {
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index a41956eb3379..32859188d653 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -17,6 +17,8 @@
  * MCP3204
  * MCP3208
  * ------------
+ * 13 bit converter
+ * MCP3301
  *
  * Datasheet can be found here:
  * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf  mcp3001
@@ -103,7 +105,7 @@ static int mcp320x_channel_to_tx_data(int device_index,
 }
 
 static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
-                                  bool differential, int device_index)
+                                  bool differential, int device_index, int *val)
 {
         int ret;
 
@@ -118,19 +120,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel,
 
         switch (device_index) {
         case mcp3001:
-                return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3);
+                return 0;
         case mcp3002:
         case mcp3004:
         case mcp3008:
-                return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6);
+                return 0;
         case mcp3201:
-                return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1);
+                return 0;
         case mcp3202:
         case mcp3204:
         case mcp3208:
-                return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4);
+                return 0;
         case mcp3301:
-                return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12);
+                *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8
+                                    | adc->rx_buf[1], 12);
+                return 0;
         default:
                 return -EINVAL;
         }
@@ -151,12 +159,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev,
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
                 ret = mcp320x_adc_conversion(adc, channel->address,
-                        channel->differential, device_index);
-
+                        channel->differential, device_index, val);
                 if (ret < 0)
                         goto out;
 
-                *val = ret;
                 ret = IIO_VAL_INT;
                 break;
 
@@ -312,6 +318,7 @@ static int mcp320x_probe(struct spi_device *spi)
         indio_dev->name = spi_get_device_id(spi)->name;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->info = &mcp320x_info;
+        spi_set_drvdata(spi, indio_dev);
 
         chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data];
         indio_dev->channels = chip_info->channels;
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index d965b6121e5d..8b7c24780a8a 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1665,7 +1665,7 @@ static int stm32_adc_chan_of_init(struct iio_dev *indio_dev)
 
         num_channels = of_property_count_u32_elems(node, "st,adc-channels");
         if (num_channels < 0 ||
-            num_channels >= adc_info->max_channels) {
+            num_channels > adc_info->max_channels) {
                 dev_err(&indio_dev->dev, "Bad st,adc-channels?\n");
                 return num_channels < 0 ? num_channels : -EINVAL;
         }
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index 3e9719e8cf3b..6a114dcb4a3a 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -52,7 +52,7 @@
 
 #define ADS1015_CFG_COMP_QUE_MASK       GENMASK(1, 0)
 #define ADS1015_CFG_COMP_LAT_MASK       BIT(2)
-#define ADS1015_CFG_COMP_POL_MASK       BIT(2)
+#define ADS1015_CFG_COMP_POL_MASK       BIT(3)
 #define ADS1015_CFG_COMP_MODE_MASK      BIT(4)
 #define ADS1015_CFG_DR_MASK     GENMASK(7, 5)
 #define ADS1015_CFG_MOD_MASK    BIT(8)
@@ -1015,10 +1015,12 @@ static int ads1015_probe(struct i2c_client *client,
 
                 switch (irq_trig) {
                 case IRQF_TRIGGER_LOW:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_LOW <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                         break;
                 case IRQF_TRIGGER_HIGH:
-                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH;
+                        cfg_comp |= ADS1015_CFG_COMP_POL_HIGH <<
+                                        ADS1015_CFG_COMP_POL_SHIFT;
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 438aa25f548d..8c019bb6625f 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -886,21 +886,27 @@ static int twl4030_madc_probe(struct platform_device *pdev)
 
         /* Enable 3v1 bias regulator for MADC[3:6] */
         madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1");
-        if (IS_ERR(madc->usb3v1))
-                return -ENODEV;
+        if (IS_ERR(madc->usb3v1)) {
+                ret = -ENODEV;
+                goto err_i2c;
+        }
 
         ret = regulator_enable(madc->usb3v1);
-        if (ret)
+        if (ret) {
                 dev_err(madc->dev, "could not enable 3v1 bias regulator\n");
+                goto err_i2c;
+        }
 
         ret = iio_device_register(iio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "could not register iio device\n");
-                goto err_i2c;
+                goto err_usb3v1;
         }
 
         return 0;
 
+err_usb3v1:
+        regulator_disable(madc->usb3v1);
 err_i2c:
         twl4030_madc_set_current_generator(madc, 0, 0);
 err_current_generator:
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index d99bb1460fe2..02e833b14db0 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -463,8 +463,17 @@ int st_sensors_set_dataready_irq(struct iio_dev *indio_dev, bool enable)
         u8 drdy_mask;
         struct st_sensor_data *sdata = iio_priv(indio_dev);
 
-        if (!sdata->sensor_settings->drdy_irq.addr)
+        if (!sdata->sensor_settings->drdy_irq.addr) {
+                /*
+                 * there are some devices (e.g. LIS3MDL) where drdy line is
+                 * routed to a given pin and it is not possible to select a
+                 * different one. Take into account irq status register
+                 * to understand if irq trigger can be properly supported
+                 */
+                if (sdata->sensor_settings->drdy_irq.addr_stat_drdy)
+                        sdata->hw_irq_trigger = enable;
                 return 0;
+        }
 
         /* Enable/Disable the interrupt generator 1. */
         if (sdata->sensor_settings->drdy_irq.ig1.en_addr > 0) {
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 7a5aa127c52e..9c4cfd19b739 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -310,8 +310,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf,
         ret = indio_dev->info->debugfs_reg_access(indio_dev,
                                                   indio_dev->cached_reg_addr,
                                                   0, &val);
-        if (ret)
+        if (ret) {
                 dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__);
+                return ret;
+        }
 
         len = snprintf(buf, sizeof(buf), "0x%X\n", val);
 
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index 926031d64978..703de313c418 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -315,6 +315,10 @@ static const struct st_sensor_settings st_magn_sensors_settings[] = {
                                 },
                         },
                 },
+                .drdy_irq = {
+                        /* drdy line is routed drdy pin */
+                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 8d5c7b250b11..fd1da26a62e4 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -572,7 +572,7 @@ static int bmp280_chip_config(struct bmp280_data *data)
         u8 osrs = BMP280_OSRS_TEMP_X(data->oversampling_temp + 1) |
                   BMP280_OSRS_PRESS_X(data->oversampling_press + 1);
 
-        ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS,
+        ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS,
                                  BMP280_OSRS_TEMP_MASK |
                                  BMP280_OSRS_PRESS_MASK |
                                  BMP280_MODE_MASK,
diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
index d523b056f468..b542dc484969 100644
--- a/drivers/iio/trigger/stm32-timer-trigger.c
+++ b/drivers/iio/trigger/stm32-timer-trigger.c
@@ -174,6 +174,7 @@ static void stm32_timer_stop(struct stm32_timer_trigger *priv)
                 clk_disable(priv->clk);
 
         /* Stop timer */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
         regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
         regmap_write(priv->regmap, TIM_PSC, 0);
         regmap_write(priv->regmap, TIM_ARR, 0);
@@ -713,8 +714,9 @@ static ssize_t stm32_count_set_preset(struct iio_dev *indio_dev,
         if (ret)
                 return ret;
 
+        /* TIMx_ARR register shouldn't be buffered (ARPE=0) */
+        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
         regmap_write(priv->regmap, TIM_ARR, preset);
-        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE);
 
         return len;
 }
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 30825bb9b8e9..8861c052155a 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -100,6 +100,8 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
         if (ret)
                 goto pid_query_error;
 
+        nlmsg_end(skb, nlh);
+
         pr_debug("%s: Multicasting a nlmsg (dev = %s ifname = %s iwpm = %s)\n",
                 __func__, pm_msg->dev_name, pm_msg->if_name, iwpm_ulib_name);
 
@@ -170,6 +172,8 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                 &pm_msg->loc_addr, IWPM_NLA_MANAGE_ADDR);
         if (ret)
                 goto add_mapping_error;
+
+        nlmsg_end(skb, nlh);
         nlmsg_request->req_buffer = pm_msg;
 
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -246,6 +250,8 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                                 &pm_msg->rem_addr, IWPM_NLA_QUERY_REMOTE_ADDR);
         if (ret)
                 goto query_mapping_error;
+
+        nlmsg_end(skb, nlh);
         nlmsg_request->req_buffer = pm_msg;
 
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
@@ -308,6 +314,8 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client)
         if (ret)
                 goto remove_mapping_error;
 
+        nlmsg_end(skb, nlh);
+
         ret = rdma_nl_unicast_wait(skb, iwpm_user_pid);
         if (ret) {
                 skb = NULL; /* skb is freed in the netlink send-op handling */
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index c81c55942626..3c4faadb8cdd 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -597,6 +597,9 @@ static int send_mapinfo_num(u32 mapping_num, u8 nl_client, int iwpm_pid)
                                 &mapping_num, IWPM_NLA_MAPINFO_SEND_NUM);
         if (ret)
                 goto mapinfo_num_error;
+
+        nlmsg_end(skb, nlh);
+
         ret = rdma_nl_unicast(skb, iwpm_pid);
         if (ret) {
                 skb = NULL;
@@ -678,6 +681,8 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid)
                         if (ret)
                                 goto send_mapping_info_unlock;
 
+                        nlmsg_end(skb, nlh);
+
                         iwpm_print_sockaddr(&map_info->local_sockaddr,
                                 "send_mapping_info: Local sockaddr:");
                         iwpm_print_sockaddr(&map_info->mapped_sockaddr,
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index 70ad19c4c73e..88bdafb297f5 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -432,8 +432,10 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev)
         atomic_set(&qp->qp_sec->error_list_count, 0);
         init_completion(&qp->qp_sec->error_complete);
         ret = security_ib_alloc_security(&qp->qp_sec->security);
-        if (ret)
+        if (ret) {
                 kfree(qp->qp_sec);
+                qp->qp_sec = NULL;
+        }
 
         return ret;
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 4ab30d832ac5..52a2cf2d83aa 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3869,15 +3869,15 @@ int ib_uverbs_ex_query_device(struct ib_uverbs_file *file,
         resp.raw_packet_caps = attr.raw_packet_caps;
         resp.response_length += sizeof(resp.raw_packet_caps);
 
-        if (ucore->outlen < resp.response_length + sizeof(resp.xrq_caps))
+        if (ucore->outlen < resp.response_length + sizeof(resp.tm_caps))
                 goto end;
 
-        resp.xrq_caps.max_rndv_hdr_size = attr.xrq_caps.max_rndv_hdr_size;
-        resp.xrq_caps.max_num_tags      = attr.xrq_caps.max_num_tags;
-        resp.xrq_caps.max_ops           = attr.xrq_caps.max_ops;
-        resp.xrq_caps.max_sge           = attr.xrq_caps.max_sge;
-        resp.xrq_caps.flags             = attr.xrq_caps.flags;
-        resp.response_length += sizeof(resp.xrq_caps);
+        resp.tm_caps.max_rndv_hdr_size  = attr.tm_caps.max_rndv_hdr_size;
+        resp.tm_caps.max_num_tags       = attr.tm_caps.max_num_tags;
+        resp.tm_caps.max_ops            = attr.tm_caps.max_ops;
+        resp.tm_caps.max_sge            = attr.tm_caps.max_sge;
+        resp.tm_caps.flags              = attr.tm_caps.flags;
+        resp.response_length += sizeof(resp.tm_caps);
 end:
         err = ib_copy_to_udata(ucore, &resp, resp.response_length);
         return err;
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index ee9e27dc799b..de57d6c11a25 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1646,7 +1646,7 @@ static bool is_valid_mcast_lid(struct ib_qp *qp, u16 lid)
          */
         if (!ib_query_qp(qp, &attr, IB_QP_STATE | IB_QP_PORT, &init_attr)) {
                 if (attr.qp_state >= IB_QPS_INIT) {
-                        if (qp->device->get_link_layer(qp->device, attr.port_num) !=
+                        if (rdma_port_get_link_layer(qp->device, attr.port_num) !=
                             IB_LINK_LAYER_INFINIBAND)
                                 return true;
                         goto lid_check;
@@ -1655,7 +1655,7 @@ static bool is_valid_mcast_lid(struct ib_qp *qp, u16 lid)
 
         /* Can't get a quick answer, iterate over all ports */
         for (port = 0; port < qp->device->phys_port_cnt; port++)
-                if (qp->device->get_link_layer(qp->device, port) !=
+                if (rdma_port_get_link_layer(qp->device, port) !=
                     IB_LINK_LAYER_INFINIBAND)
                         num_eth_ports++;
 
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index b3ad37fec578..ecbac91b2e14 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -93,11 +93,13 @@ struct bnxt_re_dev {
         struct ib_device                ibdev;
         struct list_head                list;
         unsigned long                   flags;
-#define BNXT_RE_FLAG_NETDEV_REGISTERED  0
-#define BNXT_RE_FLAG_IBDEV_REGISTERED   1
-#define BNXT_RE_FLAG_GOT_MSIX           2
-#define BNXT_RE_FLAG_RCFW_CHANNEL_EN    8
-#define BNXT_RE_FLAG_QOS_WORK_REG       16
+#define BNXT_RE_FLAG_NETDEV_REGISTERED          0
+#define BNXT_RE_FLAG_IBDEV_REGISTERED           1
+#define BNXT_RE_FLAG_GOT_MSIX                   2
+#define BNXT_RE_FLAG_HAVE_L2_REF                3
+#define BNXT_RE_FLAG_RCFW_CHANNEL_EN            4
+#define BNXT_RE_FLAG_QOS_WORK_REG               5
+#define BNXT_RE_FLAG_TASK_IN_PROG               6
         struct net_device               *netdev;
         unsigned int                    version, major, minor;
         struct bnxt_en_dev              *en_dev;
@@ -108,6 +110,8 @@ struct bnxt_re_dev {
 
         struct delayed_work             worker;
         u8                              cur_prio_map;
+        u8                              active_speed;
+        u8                              active_width;
 
         /* FP Notification Queue (CQ & SRQ) */
         struct tasklet_struct           nq_task;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 01eee15bbd65..0d89621d9fe8 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -259,14 +259,9 @@ int bnxt_re_query_port(struct ib_device *ibdev, u8 port_num,
         port_attr->sm_sl = 0;
         port_attr->subnet_timeout = 0;
         port_attr->init_type_reply = 0;
-        /* call the underlying netdev's ethtool hooks to query speed settings
-         * for which we acquire rtnl_lock _only_ if it's registered with
-         * IB stack to avoid race in the NETDEV_UNREG path
-         */
-        if (test_bit(BNXT_RE_FLAG_IBDEV_REGISTERED, &rdev->flags))
-                if (ib_get_eth_speed(ibdev, port_num, &port_attr->active_speed,
-                                     &port_attr->active_width))
-                        return -EINVAL;
+        port_attr->active_speed = rdev->active_speed;
+        port_attr->active_width = rdev->active_width;
+
         return 0;
 }
 
@@ -319,6 +314,7 @@ int bnxt_re_del_gid(struct ib_device *ibdev, u8 port_num,
         struct bnxt_re_gid_ctx *ctx, **ctx_tbl;
         struct bnxt_re_dev *rdev = to_bnxt_re_dev(ibdev, ibdev);
         struct bnxt_qplib_sgid_tbl *sgid_tbl = &rdev->qplib_res.sgid_tbl;
+        struct bnxt_qplib_gid *gid_to_del;
 
         /* Delete the entry from the hardware */
         ctx = *context;
@@ -328,11 +324,25 @@ int bnxt_re_del_gid(struct ib_device *ibdev, u8 port_num,
         if (sgid_tbl && sgid_tbl->active) {
                 if (ctx->idx >= sgid_tbl->max)
                         return -EINVAL;
+                gid_to_del = &sgid_tbl->tbl[ctx->idx];
+                /* DEL_GID is called in WQ context(netdevice_event_work_handler)
+                 * or via the ib_unregister_device path. In the former case QP1
+                 * may not be destroyed yet, in which case just return as FW
+                 * needs that entry to be present and will fail it's deletion.
+                 * We could get invoked again after QP1 is destroyed OR get an
+                 * ADD_GID call with a different GID value for the same index
+                 * where we issue MODIFY_GID cmd to update the GID entry -- TBD
+                 */
+                if (ctx->idx == 0 &&
+                    rdma_link_local_addr((struct in6_addr *)gid_to_del) &&
+                    ctx->refcnt == 1 && rdev->qp1_sqp) {
+                        dev_dbg(rdev_to_dev(rdev),
+                                "Trying to delete GID0 while QP1 is alive\n");
+                        return -EFAULT;
+                }
                 ctx->refcnt--;
                 if (!ctx->refcnt) {
-                        rc = bnxt_qplib_del_sgid(sgid_tbl,
-                                                 &sgid_tbl->tbl[ctx->idx],
-                                                 true);
+                        rc = bnxt_qplib_del_sgid(sgid_tbl, gid_to_del, true);
                         if (rc) {
                                 dev_err(rdev_to_dev(rdev),
                                         "Failed to remove GID: %#x", rc);
@@ -816,6 +826,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp)
 
                 kfree(rdev->sqp_ah);
                 kfree(rdev->qp1_sqp);
+                rdev->qp1_sqp = NULL;
+                rdev->sqp_ah = NULL;
         }
 
         if (!IS_ERR_OR_NULL(qp->rumem))
@@ -1436,11 +1448,14 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                 qp->qplib_qp.modify_flags |=
                                 CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
                 qp->qplib_qp.path_mtu = __from_ib_mtu(qp_attr->path_mtu);
+                qp->qplib_qp.mtu = ib_mtu_enum_to_int(qp_attr->path_mtu);
         } else if (qp_attr->qp_state == IB_QPS_RTR) {
                 qp->qplib_qp.modify_flags |=
                         CMDQ_MODIFY_QP_MODIFY_MASK_PATH_MTU;
                 qp->qplib_qp.path_mtu =
                         __from_ib_mtu(iboe_get_mtu(rdev->netdev->mtu));
+                qp->qplib_qp.mtu =
+                        ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
         }
 
         if (qp_attr_mask & IB_QP_TIMEOUT) {
@@ -1551,43 +1566,46 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 {
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_re_dev *rdev = qp->rdev;
-        struct bnxt_qplib_qp qplib_qp;
+        struct bnxt_qplib_qp *qplib_qp;
         int rc;
 
-        memset(&qplib_qp, 0, sizeof(struct bnxt_qplib_qp));
-        qplib_qp.id = qp->qplib_qp.id;
-        qplib_qp.ah.host_sgid_index = qp->qplib_qp.ah.host_sgid_index;
+        qplib_qp = kzalloc(sizeof(*qplib_qp), GFP_KERNEL);
+        if (!qplib_qp)
+                return -ENOMEM;
+
+        qplib_qp->id = qp->qplib_qp.id;
+        qplib_qp->ah.host_sgid_index = qp->qplib_qp.ah.host_sgid_index;
 
-        rc = bnxt_qplib_query_qp(&rdev->qplib_res, &qplib_qp);
+        rc = bnxt_qplib_query_qp(&rdev->qplib_res, qplib_qp);
         if (rc) {
                 dev_err(rdev_to_dev(rdev), "Failed to query HW QP");
-                return rc;
+                goto out;
         }
-        qp_attr->qp_state = __to_ib_qp_state(qplib_qp.state);
-        qp_attr->en_sqd_async_notify = qplib_qp.en_sqd_async_notify ? 1 : 0;
-        qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp.access);
-        qp_attr->pkey_index = qplib_qp.pkey_index;
-        qp_attr->qkey = qplib_qp.qkey;
+        qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
+        qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
+        qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
+        qp_attr->pkey_index = qplib_qp->pkey_index;
+        qp_attr->qkey = qplib_qp->qkey;
         qp_attr->ah_attr.type = RDMA_AH_ATTR_TYPE_ROCE;
-        rdma_ah_set_grh(&qp_attr->ah_attr, NULL, qplib_qp.ah.flow_label,
-                        qplib_qp.ah.host_sgid_index,
-                        qplib_qp.ah.hop_limit,
-                        qplib_qp.ah.traffic_class);
-        rdma_ah_set_dgid_raw(&qp_attr->ah_attr, qplib_qp.ah.dgid.data);
-        rdma_ah_set_sl(&qp_attr->ah_attr, qplib_qp.ah.sl);
-        ether_addr_copy(qp_attr->ah_attr.roce.dmac, qplib_qp.ah.dmac);
-        qp_attr->path_mtu = __to_ib_mtu(qplib_qp.path_mtu);
-        qp_attr->timeout = qplib_qp.timeout;
-        qp_attr->retry_cnt = qplib_qp.retry_cnt;
-        qp_attr->rnr_retry = qplib_qp.rnr_retry;
-        qp_attr->min_rnr_timer = qplib_qp.min_rnr_timer;
-        qp_attr->rq_psn = qplib_qp.rq.psn;
-        qp_attr->max_rd_atomic = qplib_qp.max_rd_atomic;
-        qp_attr->sq_psn = qplib_qp.sq.psn;
-        qp_attr->max_dest_rd_atomic = qplib_qp.max_dest_rd_atomic;
-        qp_init_attr->sq_sig_type = qplib_qp.sig_type ? IB_SIGNAL_ALL_WR :
-                                                        IB_SIGNAL_REQ_WR;
-        qp_attr->dest_qp_num = qplib_qp.dest_qpn;
+        rdma_ah_set_grh(&qp_attr->ah_attr, NULL, qplib_qp->ah.flow_label,
+                        qplib_qp->ah.host_sgid_index,
+                        qplib_qp->ah.hop_limit,
+                        qplib_qp->ah.traffic_class);
+        rdma_ah_set_dgid_raw(&qp_attr->ah_attr, qplib_qp->ah.dgid.data);
+        rdma_ah_set_sl(&qp_attr->ah_attr, qplib_qp->ah.sl);
+        ether_addr_copy(qp_attr->ah_attr.roce.dmac, qplib_qp->ah.dmac);
+        qp_attr->path_mtu = __to_ib_mtu(qplib_qp->path_mtu);
+        qp_attr->timeout = qplib_qp->timeout;
+        qp_attr->retry_cnt = qplib_qp->retry_cnt;
+        qp_attr->rnr_retry = qplib_qp->rnr_retry;
+        qp_attr->min_rnr_timer = qplib_qp->min_rnr_timer;
+        qp_attr->rq_psn = qplib_qp->rq.psn;
+        qp_attr->max_rd_atomic = qplib_qp->max_rd_atomic;
+        qp_attr->sq_psn = qplib_qp->sq.psn;
+        qp_attr->max_dest_rd_atomic = qplib_qp->max_dest_rd_atomic;
+        qp_init_attr->sq_sig_type = qplib_qp->sig_type ? IB_SIGNAL_ALL_WR :
+                                                         IB_SIGNAL_REQ_WR;
+        qp_attr->dest_qp_num = qplib_qp->dest_qpn;
 
         qp_attr->cap.max_send_wr = qp->qplib_qp.sq.max_wqe;
         qp_attr->cap.max_send_sge = qp->qplib_qp.sq.max_sge;
@@ -1596,7 +1614,9 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
         qp_attr->cap.max_inline_data = qp->qplib_qp.max_inline_data;
         qp_init_attr->cap = qp_attr->cap;
 
-        return 0;
+out:
+        kfree(qplib_qp);
+        return rc;
 }
 
 /* Routine for sending QP1 packets for RoCE V1 an V2
@@ -1908,6 +1928,7 @@ static int bnxt_re_build_atomic_wqe(struct ib_send_wr *wr,
         switch (wr->opcode) {
         case IB_WR_ATOMIC_CMP_AND_SWP:
                 wqe->type = BNXT_QPLIB_SWQE_TYPE_ATOMIC_CMP_AND_SWP;
+                wqe->atomic.cmp_data = atomic_wr(wr)->compare_add;
                 wqe->atomic.swap_data = atomic_wr(wr)->swap;
                 break;
         case IB_WR_ATOMIC_FETCH_AND_ADD:
@@ -3062,7 +3083,7 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
                 return rc;
         }
 
-        if (mr->npages && mr->pages) {
+        if (mr->pages) {
                 rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
                                                         &mr->qplib_frpl);
                 kfree(mr->pages);
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 82d1cbc27aee..e7450ea92aa9 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1161,6 +1161,8 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev)
                 }
         }
         set_bit(BNXT_RE_FLAG_IBDEV_REGISTERED, &rdev->flags);
+        ib_get_eth_speed(&rdev->ibdev, 1, &rdev->active_speed,
+                         &rdev->active_width);
         bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1, IB_EVENT_PORT_ACTIVE);
         bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1, IB_EVENT_GID_CHANGE);
 
@@ -1255,10 +1257,14 @@ static void bnxt_re_task(struct work_struct *work)
                 else if (netif_carrier_ok(rdev->netdev))
                         bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1,
                                                IB_EVENT_PORT_ACTIVE);
+                ib_get_eth_speed(&rdev->ibdev, 1, &rdev->active_speed,
+                                 &rdev->active_width);
                 break;
         default:
                 break;
         }
+        smp_mb__before_atomic();
+        clear_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
         kfree(re_work);
 }
 
@@ -1317,6 +1323,11 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                 break;
 
         case NETDEV_UNREGISTER:
+                /* netdev notifier will call NETDEV_UNREGISTER again later since
+                 * we are still holding the reference to the netdev
+                 */
+                if (test_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags))
+                        goto exit;
                 bnxt_re_ib_unreg(rdev, false);
                 bnxt_re_remove_one(rdev);
                 bnxt_re_dev_unreg(rdev);
@@ -1335,6 +1346,7 @@ static int bnxt_re_netdev_event(struct notifier_block *notifier,
                         re_work->vlan_dev = (real_dev == netdev ?
                                              NULL : netdev);
                         INIT_WORK(&re_work->work, bnxt_re_task);
+                        set_bit(BNXT_RE_FLAG_TASK_IN_PROG, &rdev->flags);
                         queue_work(bnxt_re_wq, &re_work->work);
                 }
         }
@@ -1375,6 +1387,22 @@ err_netdev:
 
 static void __exit bnxt_re_mod_exit(void)
 {
+        struct bnxt_re_dev *rdev;
+        LIST_HEAD(to_be_deleted);
+
+        mutex_lock(&bnxt_re_dev_lock);
+        /* Free all adapter allocated resources */
+        if (!list_empty(&bnxt_re_dev_list))
+                list_splice_init(&bnxt_re_dev_list, &to_be_deleted);
+        mutex_unlock(&bnxt_re_dev_lock);
+
+        list_for_each_entry(rdev, &to_be_deleted, list) {
+                dev_info(rdev_to_dev(rdev), "Unregistering Device");
+                bnxt_re_dev_stop(rdev);
+                bnxt_re_ib_unreg(rdev, true);
+                bnxt_re_remove_one(rdev);
+                bnxt_re_dev_unreg(rdev);
+        }
         unregister_netdevice_notifier(&bnxt_re_netdev_notifier);
         if (bnxt_re_wq)
                 destroy_workqueue(bnxt_re_wq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 391bb7006e8f..2bdb1562bd21 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -107,6 +107,9 @@ static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
                 return -EINVAL;
         }
 
+        if (test_bit(FIRMWARE_TIMED_OUT, &rcfw->flags))
+                return -ETIMEDOUT;
+
         /* Cmdq are in 16-byte units, each request can consume 1 or more
          * cmdqe
          */
@@ -226,6 +229,7 @@ int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
                 /* timed out */
                 dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x timedout (%d)msec",
                         cookie, opcode, RCFW_CMD_WAIT_TIME_MS);
+                set_bit(FIRMWARE_TIMED_OUT, &rcfw->flags);
                 return rc;
         }
 
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index 0ed312f17c8d..85b16da287f9 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -162,8 +162,9 @@ struct bnxt_qplib_rcfw {
         unsigned long           *cmdq_bitmap;
         u32                     bmap_size;
         unsigned long           flags;
-#define FIRMWARE_INITIALIZED_FLAG       1
+#define FIRMWARE_INITIALIZED_FLAG       BIT(0)
 #define FIRMWARE_FIRST_FLAG             BIT(31)
+#define FIRMWARE_TIMED_OUT              BIT(3)
         wait_queue_head_t       waitq;
         int                     (*aeq_handler)(struct bnxt_qplib_rcfw *,
                                                struct creq_func_event *);
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index ceaa2fa54d32..daf7a56e5d7e 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2333,9 +2333,14 @@ static int close_listsrv_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
         unsigned int stid = GET_TID(rpl);
         struct c4iw_listen_ep *ep = get_ep_from_stid(dev, stid);
 
+        if (!ep) {
+                pr_debug("%s stid %d lookup failure!\n", __func__, stid);
+                goto out;
+        }
         pr_debug("%s ep %p\n", __func__, ep);
         c4iw_wake_up(&ep->com.wr_wait, status2errno(rpl->status));
         c4iw_put_ep(&ep->com);
+out:
         return 0;
 }
 
@@ -2594,9 +2599,9 @@ fail:
         c4iw_put_ep(&child_ep->com);
 reject:
         reject_cr(dev, hwtid, skb);
+out:
         if (parent_ep)
                 c4iw_put_ep(&parent_ep->com);
-out:
         return 0;
 }
 
@@ -3457,7 +3462,7 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
                 cm_id->provider_data = ep;
                 goto out;
         }
-
+        remove_handle(ep->com.dev, &ep->com.dev->stid_idr, ep->stid);
         cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid,
                         ep->com.local_addr.ss_family);
 fail2:
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b2ed4b9cda6e..0be42787759f 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1066,6 +1066,8 @@ static int read_idle_sma(struct hfi1_devdata *dd, u64 *data);
 static int thermal_init(struct hfi1_devdata *dd);
 
 static void update_statusp(struct hfi1_pportdata *ppd, u32 state);
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs);
 static int wait_logical_linkstate(struct hfi1_pportdata *ppd, u32 state,
                                   int msecs);
 static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
@@ -8238,6 +8240,7 @@ static irqreturn_t general_interrupt(int irq, void *data)
         u64 regs[CCE_NUM_INT_CSRS];
         u32 bit;
         int i;
+        irqreturn_t handled = IRQ_NONE;
 
         this_cpu_inc(*dd->int_counter);
 
@@ -8258,9 +8261,10 @@ static irqreturn_t general_interrupt(int irq, void *data)
         for_each_set_bit(bit, (unsigned long *)&regs[0],
                          CCE_NUM_INT_CSRS * 64) {
                 is_interrupt(dd, bit);
+                handled = IRQ_HANDLED;
         }
 
-        return IRQ_HANDLED;
+        return handled;
 }
 
 static irqreturn_t sdma_interrupt(int irq, void *data)
@@ -9413,7 +9417,7 @@ static void set_qsfp_int_n(struct hfi1_pportdata *ppd, u8 enable)
         write_csr(dd, dd->hfi1_id ? ASIC_QSFP2_MASK : ASIC_QSFP1_MASK, mask);
 }
 
-void reset_qsfp(struct hfi1_pportdata *ppd)
+int reset_qsfp(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
         u64 mask, qsfp_mask;
@@ -9443,6 +9447,13 @@ void reset_qsfp(struct hfi1_pportdata *ppd)
          * for alarms and warnings
          */
         set_qsfp_int_n(ppd, 1);
+
+        /*
+         * After the reset, AOC transmitters are enabled by default. They need
+         * to be turned off to complete the QSFP setup before they can be
+         * enabled again.
+         */
+        return set_qsfp_tx(ppd, 0);
 }
 
 static int handle_qsfp_error_conditions(struct hfi1_pportdata *ppd,
@@ -10305,6 +10316,7 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
 {
         struct hfi1_devdata *dd = ppd->dd;
         u32 previous_state;
+        int offline_state_ret;
         int ret;
 
         update_lcb_cache(dd);
@@ -10326,28 +10338,11 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                 ppd->offline_disabled_reason =
                 HFI1_ODR_MASK(OPA_LINKDOWN_REASON_TRANSIENT);
 
-        /*
-         * Wait for offline transition. It can take a while for
-         * the link to go down.
-         */
-        ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 10000);
-        if (ret < 0)
-                return ret;
-
-        /*
-         * Now in charge of LCB - must be after the physical state is
-         * offline.quiet and before host_link_state is changed.
-         */
-        set_host_lcb_access(dd);
-        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
-
-        /* make sure the logical state is also down */
-        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
-        if (ret)
-                force_logical_link_state_down(ppd);
-
-        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+        offline_state_ret = wait_phys_link_offline_substates(ppd, 10000);
+        if (offline_state_ret < 0)
+                return offline_state_ret;
 
+        /* Disabling AOC transmitters */
         if (ppd->port_type == PORT_TYPE_QSFP &&
             ppd->qsfp_info.limiting_active &&
             qsfp_mod_present(ppd)) {
@@ -10365,6 +10360,30 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
         }
 
         /*
+         * Wait for the offline.Quiet transition if it hasn't happened yet. It
+         * can take a while for the link to go down.
+         */
+        if (offline_state_ret != PLS_OFFLINE_QUIET) {
+                ret = wait_physical_linkstate(ppd, PLS_OFFLINE, 30000);
+                if (ret < 0)
+                        return ret;
+        }
+
+        /*
+         * Now in charge of LCB - must be after the physical state is
+         * offline.quiet and before host_link_state is changed.
+         */
+        set_host_lcb_access(dd);
+        write_csr(dd, DC_LCB_ERR_EN, ~0ull); /* watch LCB errors */
+
+        /* make sure the logical state is also down */
+        ret = wait_logical_linkstate(ppd, IB_PORT_DOWN, 1000);
+        if (ret)
+                force_logical_link_state_down(ppd);
+
+        ppd->host_link_state = HLS_LINK_COOLDOWN; /* LCB access allowed */
+
+        /*
          * The LNI has a mandatory wait time after the physical state
          * moves to Offline.Quiet.  The wait time may be different
          * depending on how the link went down.  The 8051 firmware
@@ -10396,6 +10415,9 @@ static int goto_offline(struct hfi1_pportdata *ppd, u8 rem_reason)
                         & (HLS_DN_POLL | HLS_VERIFY_CAP | HLS_GOING_UP)) {
                 /* went down while attempting link up */
                 check_lni_states(ppd);
+
+                /* The QSFP doesn't need to be reset on LNI failure */
+                ppd->qsfp_info.reset_needed = 0;
         }
 
         /* the active link width (downgrade) is 0 on link down */
@@ -12804,6 +12826,39 @@ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
         return 0;
 }
 
+/*
+ * wait_phys_link_offline_quiet_substates - wait for any offline substate
+ * @ppd: port device
+ * @msecs: the number of milliseconds to wait
+ *
+ * Wait up to msecs milliseconds for any offline physical link
+ * state change to occur.
+ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
+ */
+static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+                                            int msecs)
+{
+        u32 read_state;
+        unsigned long timeout;
+
+        timeout = jiffies + msecs_to_jiffies(msecs);
+        while (1) {
+                read_state = read_physical_state(ppd->dd);
+                if ((read_state & 0xF0) == PLS_OFFLINE)
+                        break;
+                if (time_after(jiffies, timeout)) {
+                        dd_dev_err(ppd->dd,
+                                   "timeout waiting for phy link offline.quiet substates. Read state 0x%x, %dms\n",
+                                   read_state, msecs);
+                        return -ETIMEDOUT;
+                }
+                usleep_range(1950, 2050); /* sleep 2ms-ish */
+        }
+
+        log_state_transition(ppd, read_state);
+        return read_state;
+}
+
 #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
 (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
 
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index b8345a60a0fb..50b8645d0b87 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -204,6 +204,7 @@
 #define PLS_OFFLINE_READY_TO_QUIET_LT      0x92
 #define PLS_OFFLINE_REPORT_FAILURE                 0x93
 #define PLS_OFFLINE_READY_TO_QUIET_BCC     0x94
+#define PLS_OFFLINE_QUIET_DURATION         0x95
 #define PLS_POLLING                                0x20
 #define PLS_POLLING_QUIET                          0x20
 #define PLS_POLLING_ACTIVE                         0x21
@@ -722,7 +723,7 @@ void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
 void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
-void reset_qsfp(struct hfi1_pportdata *ppd);
+int reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
 void start_freeze_handling(struct hfi1_pportdata *ppd, int flags);
 int send_idle_sma(struct hfi1_devdata *dd, u64 message);
diff --git a/drivers/infiniband/hw/hfi1/eprom.c b/drivers/infiniband/hw/hfi1/eprom.c
index d46b17107901..1613af1c58d9 100644
--- a/drivers/infiniband/hw/hfi1/eprom.c
+++ b/drivers/infiniband/hw/hfi1/eprom.c
@@ -204,7 +204,10 @@ done_asic:
         return ret;
 }
 
-/* magic character sequence that trails an image */
+/* magic character sequence that begins an image */
+#define IMAGE_START_MAGIC "APO="
+
+/* magic character sequence that might trail an image */
 #define IMAGE_TRAIL_MAGIC "egamiAPO"
 
 /* EPROM file types */
@@ -250,6 +253,7 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
 {
         void *buffer;
         void *p;
+        u32 length;
         int ret;
 
         buffer = kmalloc(P1_SIZE, GFP_KERNEL);
@@ -262,15 +266,21 @@ static int read_partition_platform_config(struct hfi1_devdata *dd, void **data,
                 return ret;
         }
 
-        /* scan for image magic that may trail the actual data */
-        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
-        if (!p) {
+        /* config partition is valid only if it starts with IMAGE_START_MAGIC */
+        if (memcmp(buffer, IMAGE_START_MAGIC, strlen(IMAGE_START_MAGIC))) {
                 kfree(buffer);
                 return -ENOENT;
         }
 
+        /* scan for image magic that may trail the actual data */
+        p = strnstr(buffer, IMAGE_TRAIL_MAGIC, P1_SIZE);
+        if (p)
+                length = p - buffer;
+        else
+                length = P1_SIZE;
+
         *data = buffer;
-        *size = p - buffer;
+        *size = length;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 2bc89260235a..d9a1e9893136 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -930,15 +930,8 @@ static int assign_ctxt(struct hfi1_filedata *fd, struct hfi1_user_info *uinfo)
         switch (ret) {
         case 0:
                 ret = setup_base_ctxt(fd, uctxt);
-                if (uctxt->subctxt_cnt) {
-                        /*
-                         * Base context is done (successfully or not), notify
-                         * anybody using a sub-context that is waiting for
-                         * this completion.
-                         */
-                        clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
-                        wake_up(&uctxt->wait);
-                }
+                if (ret)
+                        deallocate_ctxt(uctxt);
                 break;
         case 1:
                 ret = complete_subctxt(fd);
@@ -1305,25 +1298,25 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
         /* Now allocate the RcvHdr queue and eager buffers. */
         ret = hfi1_create_rcvhdrq(dd, uctxt);
         if (ret)
-                return ret;
+                goto done;
 
         ret = hfi1_setup_eagerbufs(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         /* If sub-contexts are enabled, do the appropriate setup */
         if (uctxt->subctxt_cnt)
                 ret = setup_subctxt(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         ret = hfi1_alloc_ctxt_rcv_groups(uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         ret = init_user_ctxt(fd, uctxt);
         if (ret)
-                goto setup_failed;
+                goto done;
 
         user_init(uctxt);
 
@@ -1331,12 +1324,22 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
         fd->uctxt = uctxt;
         hfi1_rcd_get(uctxt);
 
-        return 0;
+done:
+        if (uctxt->subctxt_cnt) {
+                /*
+                 * On error, set the failed bit so sub-contexts will clean up
+                 * correctly.
+                 */
+                if (ret)
+                        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
 
-setup_failed:
-        /* Set the failed bit so sub-context init can do the right thing */
-        set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
-        deallocate_ctxt(uctxt);
+                /*
+                 * Base context is done (successfully or not), notify anybody
+                 * using a sub-context that is waiting for this completion.
+                 */
+                clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
+                wake_up(&uctxt->wait);
+        }
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 82447b7cdda1..09e50fd2a08f 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -68,7 +68,7 @@
 /*
  * Code to adjust PCIe capabilities.
  */
-static int tune_pcie_caps(struct hfi1_devdata *);
+static void tune_pcie_caps(struct hfi1_devdata *);
 
 /*
  * Do all the common PCIe setup and initialization.
@@ -351,7 +351,7 @@ int pcie_speeds(struct hfi1_devdata *dd)
  */
 int request_msix(struct hfi1_devdata *dd, u32 msireq)
 {
-        int nvec, ret;
+        int nvec;
 
         nvec = pci_alloc_irq_vectors(dd->pcidev, 1, msireq,
                                      PCI_IRQ_MSIX | PCI_IRQ_LEGACY);
@@ -360,12 +360,7 @@ int request_msix(struct hfi1_devdata *dd, u32 msireq)
                 return nvec;
         }
 
-        ret = tune_pcie_caps(dd);
-        if (ret) {
-                dd_dev_err(dd, "tune_pcie_caps() failed: %d\n", ret);
-                pci_free_irq_vectors(dd->pcidev);
-                return ret;
-        }
+        tune_pcie_caps(dd);
 
         /* check for legacy IRQ */
         if (nvec == 1 && !dd->pcidev->msix_enabled)
@@ -502,7 +497,7 @@ uint aspm_mode = ASPM_MODE_DISABLED;
 module_param_named(aspm, aspm_mode, uint, S_IRUGO);
 MODULE_PARM_DESC(aspm, "PCIe ASPM: 0: disable, 1: enable, 2: dynamic");
 
-static int tune_pcie_caps(struct hfi1_devdata *dd)
+static void tune_pcie_caps(struct hfi1_devdata *dd)
 {
         struct pci_dev *parent;
         u16 rc_mpss, rc_mps, ep_mpss, ep_mps;
@@ -513,22 +508,14 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
          * Turn on extended tags in DevCtl in case the BIOS has turned it off
          * to improve WFR SDMA bandwidth
          */
-        ret = pcie_capability_read_word(dd->pcidev,
-                                        PCI_EXP_DEVCTL, &ectl);
-        if (ret) {
-                dd_dev_err(dd, "Unable to read from PCI config\n");
-                return ret;
-        }
-
-        if (!(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
+        ret = pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &ectl);
+        if ((!ret) && !(ectl & PCI_EXP_DEVCTL_EXT_TAG)) {
                 dd_dev_info(dd, "Enabling PCIe extended tags\n");
                 ectl |= PCI_EXP_DEVCTL_EXT_TAG;
                 ret = pcie_capability_write_word(dd->pcidev,
                                                  PCI_EXP_DEVCTL, ectl);
-                if (ret) {
-                        dd_dev_err(dd, "Unable to write to PCI config\n");
-                        return ret;
-                }
+                if (ret)
+                        dd_dev_info(dd, "Unable to write to PCI config\n");
         }
         /* Find out supported and configured values for parent (root) */
         parent = dd->pcidev->bus->self;
@@ -536,15 +523,22 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
          * The driver cannot perform the tuning if it does not have
          * access to the upstream component.
          */
-        if (!parent)
-                return -EINVAL;
+        if (!parent) {
+                dd_dev_info(dd, "Parent not found\n");
+                return;
+        }
         if (!pci_is_root_bus(parent->bus)) {
                 dd_dev_info(dd, "Parent not root\n");
-                return -EINVAL;
+                return;
+        }
+        if (!pci_is_pcie(parent)) {
+                dd_dev_info(dd, "Parent is not PCI Express capable\n");
+                return;
+        }
+        if (!pci_is_pcie(dd->pcidev)) {
+                dd_dev_info(dd, "PCI device is not PCI Express capable\n");
+                return;
         }
-
-        if (!pci_is_pcie(parent) || !pci_is_pcie(dd->pcidev))
-                return -EINVAL;
         rc_mpss = parent->pcie_mpss;
         rc_mps = ffs(pcie_get_mps(parent)) - 8;
         /* Find out supported and configured values for endpoint (us) */
@@ -590,8 +584,6 @@ static int tune_pcie_caps(struct hfi1_devdata *dd)
                 ep_mrrs = max_mrrs;
                 pcie_set_readrq(dd->pcidev, ep_mrrs);
         }
-
-        return 0;
 }
 
 /* End of PCIe capability tuning */
diff --git a/drivers/infiniband/hw/hfi1/platform.c b/drivers/infiniband/hw/hfi1/platform.c
index a8af96d2b1b0..d486355880cb 100644
--- a/drivers/infiniband/hw/hfi1/platform.c
+++ b/drivers/infiniband/hw/hfi1/platform.c
@@ -790,7 +790,9 @@ static int tune_active_qsfp(struct hfi1_pportdata *ppd, u32 *ptr_tx_preset,
          * reuse of stale settings established in our previous pass through.
          */
         if (ppd->qsfp_info.reset_needed) {
-                reset_qsfp(ppd);
+                ret = reset_qsfp(ppd);
+                if (ret)
+                        return ret;
                 refresh_qsfp_cache(ppd, &ppd->qsfp_info);
         } else {
                 ppd->qsfp_info.reset_needed = 1;
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index 9b1566468744..a65e4cbdce2f 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -201,7 +201,6 @@ enum init_completion_state {
         CEQ_CREATED,
         ILQ_CREATED,
         IEQ_CREATED,
-        INET_NOTIFIER,
         IP_ADDR_REGISTERED,
         RDMA_DEV_REGISTERED
 };
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 14f36ba4e5be..5230dd3c938c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -1504,23 +1504,40 @@ static void i40iw_add_hte_node(struct i40iw_cm_core *cm_core,
 }
 
 /**
- * listen_port_in_use - determine if port is in use
- * @port: Listen port number
+ * i40iw_port_in_use - determine if port is in use
+ * @port: port number
+ * @active_side: flag for listener side vs active side
  */
-static bool i40iw_listen_port_in_use(struct i40iw_cm_core *cm_core, u16 port)
+static bool i40iw_port_in_use(struct i40iw_cm_core *cm_core, u16 port, bool active_side)
 {
         struct i40iw_cm_listener *listen_node;
+        struct i40iw_cm_node *cm_node;
         unsigned long flags;
         bool ret = false;
 
-        spin_lock_irqsave(&cm_core->listen_list_lock, flags);
-        list_for_each_entry(listen_node, &cm_core->listen_nodes, list) {
-                if (listen_node->loc_port == port) {
-                        ret = true;
-                        break;
+        if (active_side) {
+                /* search connected node list */
+                spin_lock_irqsave(&cm_core->ht_lock, flags);
+                list_for_each_entry(cm_node, &cm_core->connected_nodes, list) {
+                        if (cm_node->loc_port == port) {
+                                ret = true;
+                                break;
+                        }
+                }
+                        if (!ret)
+                                clear_bit(port, cm_core->active_side_ports);
+                spin_unlock_irqrestore(&cm_core->ht_lock, flags);
+        } else {
+                spin_lock_irqsave(&cm_core->listen_list_lock, flags);
+                list_for_each_entry(listen_node, &cm_core->listen_nodes, list) {
+                        if (listen_node->loc_port == port) {
+                                ret = true;
+                                break;
+                        }
                 }
+                spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
         }
-        spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
+
         return ret;
 }
 
@@ -1868,7 +1885,7 @@ static int i40iw_dec_refcnt_listen(struct i40iw_cm_core *cm_core,
                 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
 
                 if (listener->iwdev) {
-                        if (apbvt_del && !i40iw_listen_port_in_use(cm_core, listener->loc_port))
+                        if (apbvt_del && !i40iw_port_in_use(cm_core, listener->loc_port, false))
                                 i40iw_manage_apbvt(listener->iwdev,
                                                    listener->loc_port,
                                                    I40IW_MANAGE_APBVT_DEL);
@@ -2247,21 +2264,21 @@ static void i40iw_rem_ref_cm_node(struct i40iw_cm_node *cm_node)
         if (cm_node->listener) {
                 i40iw_dec_refcnt_listen(cm_core, cm_node->listener, 0, true);
         } else {
-                if (!i40iw_listen_port_in_use(cm_core, cm_node->loc_port) &&
-                    cm_node->apbvt_set) {
+                if (!i40iw_port_in_use(cm_core, cm_node->loc_port, true) && cm_node->apbvt_set) {
                         i40iw_manage_apbvt(cm_node->iwdev,
                                            cm_node->loc_port,
                                            I40IW_MANAGE_APBVT_DEL);
-                        i40iw_get_addr_info(cm_node, &nfo);
-                        if (cm_node->qhash_set) {
-                                i40iw_manage_qhash(cm_node->iwdev,
-                                                   &nfo,
-                                                   I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                                   I40IW_QHASH_MANAGE_TYPE_DELETE,
-                                                   NULL,
-                                                   false);
-                                cm_node->qhash_set = 0;
-                        }
+                        cm_node->apbvt_set = 0;
+                }
+                i40iw_get_addr_info(cm_node, &nfo);
+                if (cm_node->qhash_set) {
+                        i40iw_manage_qhash(cm_node->iwdev,
+                                           &nfo,
+                                           I40IW_QHASH_TYPE_TCP_ESTABLISHED,
+                                           I40IW_QHASH_MANAGE_TYPE_DELETE,
+                                           NULL,
+                                           false);
+                        cm_node->qhash_set = 0;
                 }
         }
 
@@ -3255,7 +3272,8 @@ static void i40iw_init_tcp_ctx(struct i40iw_cm_node *cm_node,
         tcp_info->snd_mss = cpu_to_le32(((u32)cm_node->tcp_cntxt.mss));
         if (cm_node->vlan_id < VLAN_TAG_PRESENT) {
                 tcp_info->insert_vlan_tag = true;
-                tcp_info->vlan_tag = cpu_to_le16(cm_node->vlan_id);
+                tcp_info->vlan_tag = cpu_to_le16(((u16)cm_node->user_pri << I40IW_VLAN_PRIO_SHIFT) |
+                                                  cm_node->vlan_id);
         }
         if (cm_node->ipv4) {
                 tcp_info->src_port = cpu_to_le16(cm_node->loc_port);
@@ -3737,10 +3755,8 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         struct sockaddr_in *raddr;
         struct sockaddr_in6 *laddr6;
         struct sockaddr_in6 *raddr6;
-        bool qhash_set = false;
-        int apbvt_set = 0;
-        int err = 0;
-        enum i40iw_status_code status;
+        int ret = 0;
+        unsigned long flags;
 
         ibqp = i40iw_get_qp(cm_id->device, conn_param->qpn);
         if (!ibqp)
@@ -3789,32 +3805,6 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         cm_info.user_pri = rt_tos2priority(cm_id->tos);
         i40iw_debug(&iwdev->sc_dev, I40IW_DEBUG_DCB, "%s TOS:[%d] UP:[%d]\n",
                     __func__, cm_id->tos, cm_info.user_pri);
-        if ((cm_info.ipv4 && (laddr->sin_addr.s_addr != raddr->sin_addr.s_addr)) ||
-            (!cm_info.ipv4 && memcmp(laddr6->sin6_addr.in6_u.u6_addr32,
-                                     raddr6->sin6_addr.in6_u.u6_addr32,
-                                     sizeof(laddr6->sin6_addr.in6_u.u6_addr32)))) {
-                status = i40iw_manage_qhash(iwdev,
-                                            &cm_info,
-                                            I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                            I40IW_QHASH_MANAGE_TYPE_ADD,
-                                            NULL,
-                                            true);
-                if (status)
-                        return -EINVAL;
-                qhash_set = true;
-        }
-        status = i40iw_manage_apbvt(iwdev, cm_info.loc_port, I40IW_MANAGE_APBVT_ADD);
-        if (status) {
-                i40iw_manage_qhash(iwdev,
-                                   &cm_info,
-                                   I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                   I40IW_QHASH_MANAGE_TYPE_DELETE,
-                                   NULL,
-                                   false);
-                return -EINVAL;
-        }
-
-        apbvt_set = 1;
         cm_id->add_ref(cm_id);
         cm_node = i40iw_create_cm_node(&iwdev->cm_core, iwdev,
                                        conn_param->private_data_len,
@@ -3822,17 +3812,40 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                                        &cm_info);
 
         if (IS_ERR(cm_node)) {
-                err = PTR_ERR(cm_node);
-                goto err_out;
+                ret = PTR_ERR(cm_node);
+                cm_id->rem_ref(cm_id);
+                return ret;
+        }
+
+        if ((cm_info.ipv4 && (laddr->sin_addr.s_addr != raddr->sin_addr.s_addr)) ||
+            (!cm_info.ipv4 && memcmp(laddr6->sin6_addr.in6_u.u6_addr32,
+                                     raddr6->sin6_addr.in6_u.u6_addr32,
+                                     sizeof(laddr6->sin6_addr.in6_u.u6_addr32)))) {
+                if (i40iw_manage_qhash(iwdev, &cm_info, I40IW_QHASH_TYPE_TCP_ESTABLISHED,
+                                       I40IW_QHASH_MANAGE_TYPE_ADD, NULL, true)) {
+                        ret = -EINVAL;
+                        goto err;
+                }
+                cm_node->qhash_set = true;
         }
 
+        spin_lock_irqsave(&iwdev->cm_core.ht_lock, flags);
+        if (!test_and_set_bit(cm_info.loc_port, iwdev->cm_core.active_side_ports)) {
+                spin_unlock_irqrestore(&iwdev->cm_core.ht_lock, flags);
+                if (i40iw_manage_apbvt(iwdev, cm_info.loc_port, I40IW_MANAGE_APBVT_ADD)) {
+                        ret =  -EINVAL;
+                        goto err;
+                }
+        } else {
+                spin_unlock_irqrestore(&iwdev->cm_core.ht_lock, flags);
+        }
+
+        cm_node->apbvt_set = true;
         i40iw_record_ird_ord(cm_node, (u16)conn_param->ird, (u16)conn_param->ord);
         if (cm_node->send_rdma0_op == SEND_RDMA_READ_ZERO &&
             !cm_node->ord_size)
                 cm_node->ord_size = 1;
 
-        cm_node->apbvt_set = apbvt_set;
-        cm_node->qhash_set = qhash_set;
         iwqp->cm_node = cm_node;
         cm_node->iwqp = iwqp;
         iwqp->cm_id = cm_id;
@@ -3840,11 +3853,9 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 
         if (cm_node->state != I40IW_CM_STATE_OFFLOADED) {
                 cm_node->state = I40IW_CM_STATE_SYN_SENT;
-                err = i40iw_send_syn(cm_node, 0);
-                if (err) {
-                        i40iw_rem_ref_cm_node(cm_node);
-                        goto err_out;
-                }
+                ret = i40iw_send_syn(cm_node, 0);
+                if (ret)
+                        goto err;
         }
 
         i40iw_debug(cm_node->dev,
@@ -3853,9 +3864,10 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                     cm_node->rem_port,
                     cm_node,
                     cm_node->cm_id);
+
         return 0;
 
-err_out:
+err:
         if (cm_info.ipv4)
                 i40iw_debug(&iwdev->sc_dev,
                             I40IW_DEBUG_CM,
@@ -3867,22 +3879,10 @@ err_out:
                             "Api - connect() FAILED: dest addr=%pI6",
                             cm_info.rem_addr);
 
-        if (qhash_set)
-                i40iw_manage_qhash(iwdev,
-                                   &cm_info,
-                                   I40IW_QHASH_TYPE_TCP_ESTABLISHED,
-                                   I40IW_QHASH_MANAGE_TYPE_DELETE,
-                                   NULL,
-                                   false);
-
-        if (apbvt_set && !i40iw_listen_port_in_use(&iwdev->cm_core,
-                                                   cm_info.loc_port))
-                i40iw_manage_apbvt(iwdev,
-                                   cm_info.loc_port,
-                                   I40IW_MANAGE_APBVT_DEL);
+        i40iw_rem_ref_cm_node(cm_node);
         cm_id->rem_ref(cm_id);
         iwdev->cm_core.stats_connect_errs++;
-        return err;
+        return ret;
 }
 
 /**
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.h b/drivers/infiniband/hw/i40iw/i40iw_cm.h
index 2e52e38ffcf3..45abef76295b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.h
@@ -71,6 +71,9 @@
 #define I40IW_HW_IRD_SETTING_32 32
 #define I40IW_HW_IRD_SETTING_64 64
 
+#define MAX_PORTS               65536
+#define I40IW_VLAN_PRIO_SHIFT   13
+
 enum ietf_mpa_flags {
         IETF_MPA_FLAGS_MARKERS = 0x80,  /* receive Markers */
         IETF_MPA_FLAGS_CRC = 0x40,      /* receive Markers */
@@ -411,6 +414,8 @@ struct i40iw_cm_core {
         spinlock_t ht_lock; /* manage hash table */
         spinlock_t listen_list_lock; /* listen list */
 
+        unsigned long active_side_ports[BITS_TO_LONGS(MAX_PORTS)];
+
         u64     stats_nodes_created;
         u64     stats_nodes_destroyed;
         u64     stats_listen_created;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index d1f5345f04f0..42ca5346777d 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -48,7 +48,7 @@
  * @wqe: cqp wqe for header
  * @header: header for the cqp wqe
  */
-static inline void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header)
 {
         wmb();            /* make sure WQE is populated before polarity is set */
         set_64bit_val(wqe, 24, header);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index cc742c3132c6..27590ae21881 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -99,8 +99,6 @@ static struct notifier_block i40iw_net_notifier = {
         .notifier_call = i40iw_net_event
 };
 
-static atomic_t i40iw_notifiers_registered;
-
 /**
  * i40iw_find_i40e_handler - find a handler given a client info
  * @ldev: pointer to a client info
@@ -1376,11 +1374,20 @@ error:
  */
 static void i40iw_register_notifiers(void)
 {
-        if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
-                register_inetaddr_notifier(&i40iw_inetaddr_notifier);
-                register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
-                register_netevent_notifier(&i40iw_net_notifier);
-        }
+        register_inetaddr_notifier(&i40iw_inetaddr_notifier);
+        register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
+        register_netevent_notifier(&i40iw_net_notifier);
+}
+
+/**
+ * i40iw_unregister_notifiers - unregister tcp ip notifiers
+ */
+
+static void i40iw_unregister_notifiers(void)
+{
+        unregister_netevent_notifier(&i40iw_net_notifier);
+        unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
+        unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
 }
 
 /**
@@ -1400,6 +1407,11 @@ static enum i40iw_status_code i40iw_save_msix_info(struct i40iw_device *iwdev,
         u32 i;
         u32 size;
 
+        if (!ldev->msix_count) {
+                i40iw_pr_err("No MSI-X vectors\n");
+                return I40IW_ERR_CONFIG;
+        }
+
         iwdev->msix_count = ldev->msix_count;
 
         size = sizeof(struct i40iw_msix_vector) * iwdev->msix_count;
@@ -1462,12 +1474,6 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev)
                 if (!iwdev->reset)
                         i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                 /* fallthrough */
-        case INET_NOTIFIER:
-                if (!atomic_dec_return(&i40iw_notifiers_registered)) {
-                        unregister_netevent_notifier(&i40iw_net_notifier);
-                        unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
-                        unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
-                }
                 /* fallthrough */
         case PBLE_CHUNK_MEM:
                 i40iw_destroy_pble_pool(dev, iwdev->pble_rsrc);
@@ -1550,7 +1556,7 @@ static enum i40iw_status_code i40iw_setup_init_state(struct i40iw_handler *hdl,
 
         status = i40iw_save_msix_info(iwdev, ldev);
         if (status)
-                goto exit;
+                return status;
         iwdev->hw.dev_context = (void *)ldev->pcidev;
         iwdev->hw.hw_addr = ldev->hw_addr;
         status = i40iw_allocate_dma_mem(&iwdev->hw,
@@ -1667,8 +1673,6 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
                         break;
                 iwdev->init_state = PBLE_CHUNK_MEM;
                 iwdev->virtchnl_wq = alloc_ordered_workqueue("iwvch", WQ_MEM_RECLAIM);
-                i40iw_register_notifiers();
-                iwdev->init_state = INET_NOTIFIER;
                 status = i40iw_add_mac_ip(iwdev);
                 if (status)
                         break;
@@ -2018,6 +2022,8 @@ static int __init i40iw_init_module(void)
         i40iw_client.type = I40E_CLIENT_IWARP;
         spin_lock_init(&i40iw_handler_lock);
         ret = i40e_register_client(&i40iw_client);
+        i40iw_register_notifiers();
+
         return ret;
 }
 
@@ -2029,6 +2035,7 @@ static int __init i40iw_init_module(void)
  */
 static void __exit i40iw_exit_module(void)
 {
+        i40iw_unregister_notifiers();
         i40e_unregister_client(&i40iw_client);
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_p.h b/drivers/infiniband/hw/i40iw/i40iw_p.h
index e217a1259f57..5498ad01c280 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_p.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_p.h
@@ -59,6 +59,8 @@ enum i40iw_status_code i40iw_sc_mr_fast_register(struct i40iw_sc_qp *qp,
                                                  struct i40iw_fast_reg_stag_info *info,
                                                  bool post_sq);
 
+void i40iw_insert_wqe_hdr(u64 *wqe, u64 header);
+
 /* HMC/FPM functions */
 enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev,
                                             u8 hmc_fn_id);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index c2cab20c4bc5..59f70676f0e0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -123,12 +123,11 @@ static void i40iw_puda_post_recvbuf(struct i40iw_puda_rsrc *rsrc, u32 wqe_idx,
                 get_64bit_val(wqe, 24, &offset24);
 
         offset24 = (offset24) ? 0 : LS_64(1, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, offset24);
 
         set_64bit_val(wqe, 0, buf->mem.pa);
         set_64bit_val(wqe, 8,
                       LS_64(buf->mem.size, I40IWQPSQ_FRAG_LEN));
-        set_64bit_val(wqe, 24, offset24);
+        i40iw_insert_wqe_hdr(wqe, offset24);
 }
 
 /**
@@ -409,9 +408,7 @@ enum i40iw_status_code i40iw_puda_send(struct i40iw_sc_qp *qp,
         set_64bit_val(wqe, 8, LS_64(info->len, I40IWQPSQ_FRAG_LEN));
         set_64bit_val(wqe, 16, header[0]);
 
-        /* Ensure all data is written before writing valid bit */
-        wmb();
-        set_64bit_val(wqe, 24, header[1]);
+        i40iw_insert_wqe_hdr(wqe, header[1]);
 
         i40iw_debug_buf(qp->dev, I40IW_DEBUG_PUDA, "PUDA SEND WQE", wqe, 32);
         i40iw_qp_post_wr(&qp->qp_uk);
@@ -539,7 +536,7 @@ static enum i40iw_status_code i40iw_puda_qp_wqe(struct i40iw_sc_dev *dev, struct
                  LS_64(2, I40IW_CQPSQ_QP_NEXTIWSTATE) |
                  LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
 
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
 
         i40iw_debug_buf(cqp->dev, I40IW_DEBUG_PUDA, "PUDA CQE", wqe, 32);
         i40iw_sc_cqp_post_sq(cqp);
@@ -655,7 +652,7 @@ static enum i40iw_status_code i40iw_puda_cq_wqe(struct i40iw_sc_dev *dev, struct
             LS_64(1, I40IW_CQPSQ_CQ_ENCEQEMASK) |
             LS_64(1, I40IW_CQPSQ_CQ_CEQIDVALID) |
             LS_64(cqp->polarity, I40IW_CQPSQ_WQEVALID);
-        set_64bit_val(wqe, 24, header);
+        i40iw_insert_wqe_hdr(wqe, header);
 
         i40iw_debug_buf(dev, I40IW_DEBUG_PUDA, "PUDA CQE",
                         wqe, I40IW_CQP_WQE_SIZE * 8);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 62f1f45b8737..e52dbbb4165e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -160,7 +160,7 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
-        if (iwdev->init_state < INET_NOTIFIER)
+        if (iwdev->init_state < IP_ADDR_REGISTERED || iwdev->closing)
                 return NOTIFY_DONE;
 
         netdev = iwdev->ldev->netdev;
@@ -217,7 +217,7 @@ int i40iw_inet6addr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
-        if (iwdev->init_state < INET_NOTIFIER)
+        if (iwdev->init_state < IP_ADDR_REGISTERED || iwdev->closing)
                 return NOTIFY_DONE;
 
         netdev = iwdev->ldev->netdev;
@@ -266,7 +266,7 @@ int i40iw_net_event(struct notifier_block *notifier, unsigned long event, void *
                 if (!iwhdl)
                         return NOTIFY_DONE;
                 iwdev = &iwhdl->device;
-                if (iwdev->init_state < INET_NOTIFIER)
+                if (iwdev->init_state < IP_ADDR_REGISTERED || iwdev->closing)
                         return NOTIFY_DONE;
                 p = (__be32 *)neigh->primary_key;
                 i40iw_copy_ip_ntohl(local_ipaddr, p);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 1aa411034a27..62be0a41ad0b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -826,12 +826,14 @@ static int i40iw_query_qp(struct ib_qp *ibqp,
         attr->cap.max_inline_data = I40IW_MAX_INLINE_DATA_SIZE;
         attr->cap.max_send_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
         attr->cap.max_recv_sge = I40IW_MAX_WQ_FRAGMENT_COUNT;
+        attr->port_num = 1;
         init_attr->event_handler = iwqp->ibqp.event_handler;
         init_attr->qp_context = iwqp->ibqp.qp_context;
         init_attr->send_cq = iwqp->ibqp.send_cq;
         init_attr->recv_cq = iwqp->ibqp.recv_cq;
         init_attr->srq = iwqp->ibqp.srq;
         init_attr->cap = attr->cap;
+        init_attr->port_num = 1;
         return 0;
 }
 
@@ -1027,7 +1029,19 @@ int i40iw_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
                                 iwqp->hw_tcp_state = I40IW_TCP_STATE_CLOSED;
                                 iwqp->last_aeq = I40IW_AE_RESET_SENT;
                                 spin_unlock_irqrestore(&iwqp->lock, flags);
+                                i40iw_cm_disconn(iwqp);
                         }
+                } else {
+                        spin_lock_irqsave(&iwqp->lock, flags);
+                        if (iwqp->cm_id) {
+                                if (atomic_inc_return(&iwqp->close_timer_started) == 1) {
+                                        iwqp->cm_id->add_ref(iwqp->cm_id);
+                                        i40iw_schedule_cm_timer(iwqp->cm_node,
+                                                                (struct i40iw_puda_buf *)iwqp,
+                                                                 I40IW_TIMER_TYPE_CLOSE, 1, 0);
+                                }
+                        }
+                        spin_unlock_irqrestore(&iwqp->lock, flags);
                 }
         }
         return 0;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index ab3c562d5ba7..552f7bd4ecc3 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -778,13 +778,13 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
         }
 
         if (MLX5_CAP_GEN(mdev, tag_matching)) {
-                props->xrq_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
-                props->xrq_caps.max_num_tags =
+                props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+                props->tm_caps.max_num_tags =
                         (1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
-                props->xrq_caps.flags = IB_TM_CAP_RC;
-                props->xrq_caps.max_ops =
+                props->tm_caps.flags = IB_TM_CAP_RC;
+                props->tm_caps.max_ops =
                         1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
-                props->xrq_caps.max_sge = MLX5_TM_MAX_SGE;
+                props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
         }
 
         if (field_avail(typeof(resp), cqe_comp_caps, uhw->outlen)) {
@@ -3837,11 +3837,13 @@ static int delay_drop_debugfs_init(struct mlx5_ib_dev *dev)
         if (!dbg)
                 return -ENOMEM;
 
+        dev->delay_drop.dbg = dbg;
+
         dbg->dir_debugfs =
                 debugfs_create_dir("delay_drop",
                                    dev->mdev->priv.dbg_root);
         if (!dbg->dir_debugfs)
-                return -ENOMEM;
+                goto out_debugfs;
 
         dbg->events_cnt_debugfs =
                 debugfs_create_atomic_t("num_timeout_events", 0400,
@@ -3865,8 +3867,6 @@ static int delay_drop_debugfs_init(struct mlx5_ib_dev *dev)
         if (!dbg->timeout_debugfs)
                 goto out_debugfs;
 
-        dev->delay_drop.dbg = dbg;
-
         return 0;
 
 out_debugfs:
@@ -4174,9 +4174,9 @@ err_bfreg:
 err_uar_page:
         mlx5_put_uars_page(dev->mdev, dev->mdev->priv.uar);
 
-err_cnt:
-        mlx5_ib_cleanup_cong_debugfs(dev);
 err_cong:
+        mlx5_ib_cleanup_cong_debugfs(dev);
+err_cnt:
         if (MLX5_CAP_GEN(dev->mdev, max_qp_cnt))
                 mlx5_ib_dealloc_counters(dev);
 
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 914f212e7ef6..f3dbd75a0a96 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -50,13 +50,9 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
 {
         unsigned long tmp;
         unsigned long m;
-        int i, k;
-        u64 base = 0;
-        int p = 0;
-        int skip;
-        int mask;
-        u64 len;
-        u64 pfn;
+        u64 base = ~0, p = 0;
+        u64 len, pfn;
+        int i = 0;
         struct scatterlist *sg;
         int entry;
         unsigned long page_shift = umem->page_shift;
@@ -76,33 +72,24 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr,
         m = find_first_bit(&tmp, BITS_PER_LONG);
         if (max_page_shift)
                 m = min_t(unsigned long, max_page_shift - page_shift, m);
-        skip = 1 << m;
-        mask = skip - 1;
-        i = 0;
+
         for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                 len = sg_dma_len(sg) >> page_shift;
                 pfn = sg_dma_address(sg) >> page_shift;
-                for (k = 0; k < len; k++) {
-                        if (!(i & mask)) {
-                                tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
-                                skip = 1 << m;
-                                mask = skip - 1;
-                                base = pfn;
-                                p = 0;
-                        } else {
-                                if (base + p != pfn) {
-                                        tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, BITS_PER_LONG);
-                                        skip = 1 << m;
-                                        mask = skip - 1;
-                                        base = pfn;
-                                        p = 0;
-                                }
-                        }
-                        p++;
-                        i++;
+                if (base + p != pfn) {
+                        /* If either the offset or the new
+                         * base are unaligned update m
+                         */
+                        tmp = (unsigned long)(pfn | p);
+                        if (!IS_ALIGNED(tmp, 1 << m))
+                                m = find_first_bit(&tmp, BITS_PER_LONG);
+
+                        base = pfn;
+                        p = 0;
                 }
+
+                p += len;
+                i += len;
         }
 
         if (i) {
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 0e2789d9bb4d..37bbc543847a 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -47,7 +47,8 @@ enum {
 
 #define MLX5_UMR_ALIGN 2048
 
-static int clean_mr(struct mlx5_ib_mr *mr);
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 static int mr_cache_max_order(struct mlx5_ib_dev *dev);
 static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
 
@@ -1270,8 +1271,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 
                 err = mlx5_ib_update_xlt(mr, 0, ncont, page_shift,
                                          update_xlt_flags);
+
                 if (err) {
-                        mlx5_ib_dereg_mr(&mr->ibmr);
+                        dereg_mr(dev, mr);
                         return ERR_PTR(err);
                 }
         }
@@ -1356,7 +1358,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 err = mr_umem_get(pd, addr, len, access_flags, &mr->umem,
                                   &npages, &page_shift, &ncont, &order);
                 if (err < 0) {
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                         return err;
                 }
         }
@@ -1410,7 +1412,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
                 if (err) {
                         mlx5_ib_warn(dev, "Failed to rereg UMR\n");
                         ib_umem_release(mr->umem);
-                        clean_mr(mr);
+                        clean_mr(dev, mr);
                         return err;
                 }
         }
@@ -1469,9 +1471,8 @@ mlx5_free_priv_descs(struct mlx5_ib_mr *mr)
         }
 }
 
-static int clean_mr(struct mlx5_ib_mr *mr)
+static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
         int allocated_from_cache = mr->allocated_from_cache;
         int err;
 
@@ -1507,10 +1508,8 @@ static int clean_mr(struct mlx5_ib_mr *mr)
         return 0;
 }
 
-int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
 {
-        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
-        struct mlx5_ib_mr *mr = to_mmr(ibmr);
         int npages = mr->npages;
         struct ib_umem *umem = mr->umem;
 
@@ -1539,7 +1538,7 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
         }
 #endif
 
-        clean_mr(mr);
+        clean_mr(dev, mr);
 
         if (umem) {
                 ib_umem_release(umem);
@@ -1549,6 +1548,14 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
         return 0;
 }
 
+int mlx5_ib_dereg_mr(struct ib_mr *ibmr)
+{
+        struct mlx5_ib_dev *dev = to_mdev(ibmr->device);
+        struct mlx5_ib_mr *mr = to_mmr(ibmr);
+
+        return dereg_mr(dev, mr);
+}
+
 struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd,
                                enum ib_mr_type mr_type,
                                u32 max_num_sg)
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index f0dc5f4aa177..442b9bdc0f03 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -3232,7 +3232,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                             mr->ibmr.iova);
                         set_wqe_32bit_value(wqe->wqe_words,
                                             NES_IWARP_SQ_FMR_WQE_LENGTH_LOW_IDX,
-                                            mr->ibmr.length);
+                                            lower_32_bits(mr->ibmr.length));
                         set_wqe_32bit_value(wqe->wqe_words,
                                             NES_IWARP_SQ_FMR_WQE_LENGTH_HIGH_IDX, 0);
                         set_wqe_32bit_value(wqe->wqe_words,
@@ -3274,7 +3274,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
                                             mr->npages * 8);
 
                         nes_debug(NES_DBG_IW_TX, "SQ_REG_MR: iova_start: %llx, "
-                                  "length: %d, rkey: %0x, pgl_paddr: %llx, "
+                                  "length: %lld, rkey: %0x, pgl_paddr: %llx, "
                                   "page_list_len: %u, wqe_misc: %x\n",
                                   (unsigned long long) mr->ibmr.iova,
                                   mr->ibmr.length,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index dcb5942f9fb5..65b166cc7437 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -252,7 +252,10 @@ static int ocrdma_get_mbx_errno(u32 status)
                 case OCRDMA_MBX_ADDI_STATUS_INSUFFICIENT_RESOURCES:
                         err_num = -EAGAIN;
                         break;
+                default:
+                        err_num = -EFAULT;
                 }
+                break;
         default:
                 err_num = -EFAULT;
         }
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index b2bb42e2805d..254083b524bd 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -387,7 +387,7 @@ struct qedr_qp {
                 u8 wqe_size;
 
                 u8 smac[ETH_ALEN];
-                u16 vlan_id;
+                u16 vlan;
                 int rc;
         } *rqe_wr_id;
 
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 4689e802b332..ad8965397cf7 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -105,7 +105,7 @@ void qedr_ll2_complete_rx_packet(void *cxt,
 
         qp->rqe_wr_id[qp->rq.gsi_cons].rc = data->u.data_length_error ?
                 -EINVAL : 0;
-        qp->rqe_wr_id[qp->rq.gsi_cons].vlan_id = data->vlan;
+        qp->rqe_wr_id[qp->rq.gsi_cons].vlan = data->vlan;
         /* note: length stands for data length i.e. GRH is excluded */
         qp->rqe_wr_id[qp->rq.gsi_cons].sg_list[0].length =
                 data->length.data_length;
@@ -694,6 +694,7 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct qedr_cq *cq = get_qedr_cq(ibcq);
         struct qedr_qp *qp = dev->gsi_qp;
         unsigned long flags;
+        u16 vlan_id;
         int i = 0;
 
         spin_lock_irqsave(&cq->cq_lock, flags);
@@ -712,9 +713,14 @@ int qedr_gsi_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 wc[i].wc_flags |= IB_WC_GRH | IB_WC_IP_CSUM_OK;
                 ether_addr_copy(wc[i].smac, qp->rqe_wr_id[qp->rq.cons].smac);
                 wc[i].wc_flags |= IB_WC_WITH_SMAC;
-                if (qp->rqe_wr_id[qp->rq.cons].vlan_id) {
+
+                vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan &
+                          VLAN_VID_MASK;
+                if (vlan_id) {
                         wc[i].wc_flags |= IB_WC_WITH_VLAN;
-                        wc[i].vlan_id = qp->rqe_wr_id[qp->rq.cons].vlan_id;
+                        wc[i].vlan_id = vlan_id;
+                        wc[i].sl = (qp->rqe_wr_id[qp->rq.cons].vlan &
+                                    VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
                 }
 
                 qedr_inc_sw_cons(&qp->rq);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 663a0c301c43..984aa3484928 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -416,9 +416,34 @@ static inline enum ib_wc_status pvrdma_wc_status_to_ib(
         return (enum ib_wc_status)status;
 }
 
-static inline int pvrdma_wc_opcode_to_ib(int opcode)
-{
-        return opcode;
+static inline int pvrdma_wc_opcode_to_ib(unsigned int opcode)
+{
+        switch (opcode) {
+        case PVRDMA_WC_SEND:
+                return IB_WC_SEND;
+        case PVRDMA_WC_RDMA_WRITE:
+                return IB_WC_RDMA_WRITE;
+        case PVRDMA_WC_RDMA_READ:
+                return IB_WC_RDMA_READ;
+        case PVRDMA_WC_COMP_SWAP:
+                return IB_WC_COMP_SWAP;
+        case PVRDMA_WC_FETCH_ADD:
+                return IB_WC_FETCH_ADD;
+        case PVRDMA_WC_LOCAL_INV:
+                return IB_WC_LOCAL_INV;
+        case PVRDMA_WC_FAST_REG_MR:
+                return IB_WC_REG_MR;
+        case PVRDMA_WC_MASKED_COMP_SWAP:
+                return IB_WC_MASKED_COMP_SWAP;
+        case PVRDMA_WC_MASKED_FETCH_ADD:
+                return IB_WC_MASKED_FETCH_ADD;
+        case PVRDMA_WC_RECV:
+                return IB_WC_RECV;
+        case PVRDMA_WC_RECV_RDMA_WITH_IMM:
+                return IB_WC_RECV_RDMA_WITH_IMM;
+        default:
+                return IB_WC_SEND;
+        }
 }
 
 static inline int pvrdma_wc_flags_to_ib(int flags)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 14b62f7472b4..7774654c2ccb 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -823,12 +823,18 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
             wc->status != IB_WC_WR_FLUSH_ERR) {
                 struct ipoib_neigh *neigh;
 
-                if (wc->status != IB_WC_RNR_RETRY_EXC_ERR)
-                        ipoib_warn(priv, "failed cm send event (status=%d, wrid=%d vend_err %x)\n",
-                                   wc->status, wr_id, wc->vendor_err);
+                /* IB_WC[_RNR]_RETRY_EXC_ERR error is part of the life cycle,
+                 * so don't make waves.
+                 */
+                if (wc->status == IB_WC_RNR_RETRY_EXC_ERR ||
+                    wc->status == IB_WC_RETRY_EXC_ERR)
+                        ipoib_dbg(priv,
+                                  "%s: failed cm send event (status=%d, wrid=%d vend_err 0x%x)\n",
+                                   __func__, wc->status, wr_id, wc->vendor_err);
                 else
-                        ipoib_dbg(priv, "failed cm send event (status=%d, wrid=%d vend_err %x)\n",
-                                  wc->status, wr_id, wc->vendor_err);
+                        ipoib_warn(priv,
+                                    "%s: failed cm send event (status=%d, wrid=%d vend_err 0x%x)\n",
+                                   __func__, wc->status, wr_id, wc->vendor_err);
 
                 spin_lock_irqsave(&priv->lock, flags);
                 neigh = tx->neigh;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 2e075377242e..6cd61638b441 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1000,19 +1000,6 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv)
                  */
                 priv->dev->broadcast[8] = priv->pkey >> 8;
                 priv->dev->broadcast[9] = priv->pkey & 0xff;
-
-                /*
-                 * Update the broadcast address in the priv->broadcast object,
-                 * in case it already exists, otherwise no one will do that.
-                 */
-                if (priv->broadcast) {
-                        spin_lock_irq(&priv->lock);
-                        memcpy(priv->broadcast->mcmember.mgid.raw,
-                               priv->dev->broadcast + 4,
-                        sizeof(union ib_gid));
-                        spin_unlock_irq(&priv->lock);
-                }
-
                 return 0;
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index bac95b509a9b..dcc77014018d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -2180,6 +2180,7 @@ static struct net_device *ipoib_add_port(const char *format,
 {
         struct ipoib_dev_priv *priv;
         struct ib_port_attr attr;
+        struct rdma_netdev *rn;
         int result = -ENOMEM;
 
         priv = ipoib_intf_alloc(hca, port, format);
@@ -2279,7 +2280,8 @@ register_failed:
         ipoib_dev_cleanup(priv->dev);
 
 device_init_failed:
-        free_netdev(priv->dev);
+        rn = netdev_priv(priv->dev);
+        rn->free_rdma_netdev(priv->dev);
         kfree(priv);
 
 alloc_mem_failed:
@@ -2328,7 +2330,7 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 return;
 
         list_for_each_entry_safe(priv, tmp, dev_list, list) {
-                struct rdma_netdev *rn = netdev_priv(priv->dev);
+                struct rdma_netdev *parent_rn = netdev_priv(priv->dev);
 
                 ib_unregister_event_handler(&priv->event_handler);
                 flush_workqueue(ipoib_workqueue);
@@ -2350,10 +2352,15 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 unregister_netdev(priv->dev);
                 mutex_unlock(&priv->sysfs_mutex);
 
-                rn->free_rdma_netdev(priv->dev);
+                parent_rn->free_rdma_netdev(priv->dev);
+
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) {
+                        struct rdma_netdev *child_rn;
 
-                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        child_rn = netdev_priv(cpriv->dev);
+                        child_rn->free_rdma_netdev(cpriv->dev);
                         kfree(cpriv);
+                }
 
                 kfree(priv);
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 9927cd6b7082..55a9b71ed05a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -141,14 +141,17 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
                 return restart_syscall();
         }
 
-        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
-        if (!priv) {
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
                 rtnl_unlock();
                 mutex_unlock(&ppriv->sysfs_mutex);
-                return -ENOMEM;
+                return restart_syscall();
         }
 
-        down_write(&ppriv->vlan_rwsem);
+        priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
+        if (!priv) {
+                result = -ENOMEM;
+                goto out;
+        }
 
         /*
          * First ensure this isn't a duplicate. We check the parent device and
@@ -175,8 +178,11 @@ out:
         rtnl_unlock();
         mutex_unlock(&ppriv->sysfs_mutex);
 
-        if (result) {
-                free_netdev(priv->dev);
+        if (result && priv) {
+                struct rdma_netdev *rn;
+
+                rn = netdev_priv(priv->dev);
+                rn->free_rdma_netdev(priv->dev);
                 kfree(priv);
         }
 
@@ -204,7 +210,12 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                 return restart_syscall();
         }
 
-        down_write(&ppriv->vlan_rwsem);
+        if (!down_write_trylock(&ppriv->vlan_rwsem)) {
+                rtnl_unlock();
+                mutex_unlock(&ppriv->sysfs_mutex);
+                return restart_syscall();
+        }
+
         list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
                 if (priv->pkey == pkey &&
                     priv->child_type == IPOIB_LEGACY_CHILD) {
@@ -224,7 +235,10 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
         mutex_unlock(&ppriv->sysfs_mutex);
 
         if (dev) {
-                free_netdev(dev);
+                struct rdma_netdev *rn;
+
+                rn = netdev_priv(dev);
+                rn->free_rdma_netdev(priv->dev);
                 kfree(priv);
                 return 0;
         }
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 9c3e9ab53a41..322209d5ff58 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -154,7 +154,7 @@ static void iser_dump_page_vec(struct iser_page_vec *page_vec)
 {
         int i;
 
-        iser_err("page vec npages %d data length %d\n",
+        iser_err("page vec npages %d data length %lld\n",
                  page_vec->npages, page_vec->fake_mr.length);
         for (i = 0; i < page_vec->npages; i++)
                 iser_err("vec[%d]: %llx\n", i, page_vec->pages[i]);
diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index 8f2042432c85..66a46c84e28f 100644
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -237,9 +237,15 @@ int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file)
 EXPORT_SYMBOL_GPL(input_ff_erase);
 
 /*
- * flush_effects - erase all effects owned by a file handle
+ * input_ff_flush - erase all effects owned by a file handle
+ * @dev: input device to erase effect from
+ * @file: purported owner of the effects
+ *
+ * This function erases all force-feedback effects associated with
+ * the given owner from specified device. Note that @file may be %NULL,
+ * in which case all effects will be erased.
  */
-static int flush_effects(struct input_dev *dev, struct file *file)
+int input_ff_flush(struct input_dev *dev, struct file *file)
 {
         struct ff_device *ff = dev->ff;
         int i;
@@ -255,6 +261,7 @@ static int flush_effects(struct input_dev *dev, struct file *file)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(input_ff_flush);
 
 /**
  * input_ff_event() - generic handler for force-feedback events
@@ -343,7 +350,7 @@ int input_ff_create(struct input_dev *dev, unsigned int max_effects)
         mutex_init(&ff->mutex);
 
         dev->ff = ff;
-        dev->flush = flush_effects;
+        dev->flush = input_ff_flush;
         dev->event = input_ff_event;
         __set_bit(EV_FF, dev->evbit);
 
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 022be0e22eba..443151de90c6 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -98,14 +98,15 @@ static int uinput_request_reserve_slot(struct uinput_device *udev,
                                         uinput_request_alloc_id(udev, request));
 }
 
-static void uinput_request_done(struct uinput_device *udev,
-                                struct uinput_request *request)
+static void uinput_request_release_slot(struct uinput_device *udev,
+                                        unsigned int id)
 {
         /* Mark slot as available */
-        udev->requests[request->id] = NULL;
-        wake_up(&udev->requests_waitq);
+        spin_lock(&udev->requests_lock);
+        udev->requests[id] = NULL;
+        spin_unlock(&udev->requests_lock);
 
-        complete(&request->done);
+        wake_up(&udev->requests_waitq);
 }
 
 static int uinput_request_send(struct uinput_device *udev,
@@ -138,20 +139,22 @@ static int uinput_request_send(struct uinput_device *udev,
 static int uinput_request_submit(struct uinput_device *udev,
                                  struct uinput_request *request)
 {
-        int error;
+        int retval;
 
-        error = uinput_request_reserve_slot(udev, request);
-        if (error)
-                return error;
+        retval = uinput_request_reserve_slot(udev, request);
+        if (retval)
+                return retval;
 
-        error = uinput_request_send(udev, request);
-        if (error) {
-                uinput_request_done(udev, request);
-                return error;
-        }
+        retval = uinput_request_send(udev, request);
+        if (retval)
+                goto out;
 
         wait_for_completion(&request->done);
-        return request->retval;
+        retval = request->retval;
+
+ out:
+        uinput_request_release_slot(udev, request->id);
+        return retval;
 }
 
 /*
@@ -169,7 +172,7 @@ static void uinput_flush_requests(struct uinput_device *udev)
                 request = udev->requests[i];
                 if (request) {
                         request->retval = -ENODEV;
-                        uinput_request_done(udev, request);
+                        complete(&request->done);
                 }
         }
 
@@ -230,6 +233,18 @@ static int uinput_dev_erase_effect(struct input_dev *dev, int effect_id)
         return uinput_request_submit(udev, &request);
 }
 
+static int uinput_dev_flush(struct input_dev *dev, struct file *file)
+{
+        /*
+         * If we are called with file == NULL that means we are tearing
+         * down the device, and therefore we can not handle FF erase
+         * requests: either we are handling UI_DEV_DESTROY (and holding
+         * the udev->mutex), or the file descriptor is closed and there is
+         * nobody on the other side anymore.
+         */
+        return file ? input_ff_flush(dev, file) : 0;
+}
+
 static void uinput_destroy_device(struct uinput_device *udev)
 {
         const char *name, *phys;
@@ -297,6 +312,12 @@ static int uinput_create_device(struct uinput_device *udev)
                 dev->ff->playback = uinput_dev_playback;
                 dev->ff->set_gain = uinput_dev_set_gain;
                 dev->ff->set_autocenter = uinput_dev_set_autocenter;
+                /*
+                 * The standard input_ff_flush() implementation does
+                 * not quite work for uinput as we can't reasonably
+                 * handle FF requests during device teardown.
+                 */
+                dev->flush = uinput_dev_flush;
         }
 
         error = input_register_device(udev->dev);
@@ -939,7 +960,7 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
                         }
 
                         req->retval = ff_up.retval;
-                        uinput_request_done(udev, req);
+                        complete(&req->done);
                         goto out;
 
                 case UI_END_FF_ERASE:
@@ -955,7 +976,7 @@ static long uinput_ioctl_handler(struct file *file, unsigned int cmd,
                         }
 
                         req->retval = ff_erase.retval;
-                        uinput_request_done(udev, req);
+                        complete(&req->done);
                         goto out;
         }
 
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index 15b1330606c1..e19eb60b3d2f 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -598,7 +598,7 @@ static int elan_i2c_write_fw_block(struct i2c_client *client,
         }
 
         /* Wait for F/W to update one page ROM data. */
-        msleep(20);
+        msleep(35);
 
         error = elan_i2c_read_cmd(client, ETP_I2C_IAP_CTRL_CMD, val);
         if (error) {
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 49bd2ab8c507..f3a21343e636 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -278,7 +278,7 @@ config EXYNOS_IOMMU_DEBUG
 config IPMMU_VMSA
         bool "Renesas VMSA-compatible IPMMU"
         depends on ARM || IOMMU_DMA
-        depends on ARCH_RENESAS || COMPILE_TEST
+        depends on ARCH_RENESAS || (COMPILE_TEST && !GENERIC_ATOMIC64)
         select IOMMU_API
         select IOMMU_IO_PGTABLE_LPAE
         select ARM_DMA_USE_IOMMU
@@ -373,7 +373,8 @@ config MTK_IOMMU_V1
 config QCOM_IOMMU
         # Note: iommu drivers cannot (yet?) be built as modules
         bool "Qualcomm IOMMU Support"
-        depends on ARCH_QCOM || COMPILE_TEST
+        depends on ARCH_QCOM || (COMPILE_TEST && !GENERIC_ATOMIC64)
+        depends on HAS_DMA
         select IOMMU_API
         select IOMMU_IO_PGTABLE_LPAE
         select ARM_DMA_USE_IOMMU
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 382de42b8359..6fe2d0346073 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -874,7 +874,7 @@ static bool copy_device_table(void)
                 hi = readl(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET + 4);
                 entry = (((u64) hi) << 32) + lo;
                 if (last_entry && last_entry != entry) {
-                        pr_err("IOMMU:%d should use the same dev table as others!/n",
+                        pr_err("IOMMU:%d should use the same dev table as others!\n",
                                 iommu->index);
                         return false;
                 }
@@ -882,7 +882,7 @@ static bool copy_device_table(void)
 
                 old_devtb_size = ((entry & ~PAGE_MASK) + 1) << 12;
                 if (old_devtb_size != dev_table_size) {
-                        pr_err("The device table size of IOMMU:%d is not expected!/n",
+                        pr_err("The device table size of IOMMU:%d is not expected!\n",
                                 iommu->index);
                         return false;
                 }
@@ -890,7 +890,7 @@ static bool copy_device_table(void)
 
         old_devtb_phys = entry & PAGE_MASK;
         if (old_devtb_phys >= 0x100000000ULL) {
-                pr_err("The address of old device table is above 4G, not trustworthy!/n");
+                pr_err("The address of old device table is above 4G, not trustworthy!\n");
                 return false;
         }
         old_devtb = memremap(old_devtb_phys, dev_table_size, MEMREMAP_WB);
@@ -901,7 +901,7 @@ static bool copy_device_table(void)
         old_dev_tbl_cpy = (void *)__get_free_pages(gfp_flag,
                                 get_order(dev_table_size));
         if (old_dev_tbl_cpy == NULL) {
-                pr_err("Failed to allocate memory for copying old device table!/n");
+                pr_err("Failed to allocate memory for copying old device table!\n");
                 return false;
         }
 
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index ca5ebaeafd6a..57c920c1372d 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -497,7 +497,7 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg)
 #define dmar_parse_one_rhsa             dmar_res_noop
 #endif
 
-static void __init
+static void
 dmar_table_print_dmar_entry(struct acpi_dmar_header *header)
 {
         struct acpi_dmar_hardware_unit *drhd;
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index d665d0dc16e8..6961fc393f0b 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -245,7 +245,7 @@ static void __arm_v7s_free_table(void *table, int lvl,
 static void __arm_v7s_pte_sync(arm_v7s_iopte *ptep, int num_entries,
                                struct io_pgtable_cfg *cfg)
 {
-        if (!(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA))
+        if (cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)
                 return;
 
         dma_sync_single_for_device(cfg->iommu_dev, __arm_v7s_dma_addr(ptep),
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index bd515be5b380..16d33ac19db0 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -371,7 +371,8 @@ static int mtk_iommu_map(struct iommu_domain *domain, unsigned long iova,
         int ret;
 
         spin_lock_irqsave(&dom->pgtlock, flags);
-        ret = dom->iop->map(dom->iop, iova, paddr, size, prot);
+        ret = dom->iop->map(dom->iop, iova, paddr & DMA_BIT_MASK(32),
+                            size, prot);
         spin_unlock_irqrestore(&dom->pgtlock, flags);
 
         return ret;
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index e60e3dba85a0..50947ebb6d17 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -157,10 +157,7 @@ static int of_pci_iommu_init(struct pci_dev *pdev, u16 alias, void *data)
 
         err = of_iommu_xlate(info->dev, &iommu_spec);
         of_node_put(iommu_spec.np);
-        if (err)
-                return err;
-
-        return info->np == pdev->bus->dev.of_node;
+        return err;
 }
 
 const struct iommu_ops *of_iommu_configure(struct device *dev,
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 519149ec9053..b5df99c6f680 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1042,7 +1042,7 @@ static int get_cpu_number(struct device_node *dn)
 {
         const __be32 *cell;
         u64 hwid;
-        int i;
+        int cpu;
 
         cell = of_get_property(dn, "reg", NULL);
         if (!cell)
@@ -1056,9 +1056,9 @@ static int get_cpu_number(struct device_node *dn)
         if (hwid & ~MPIDR_HWID_BITMASK)
                 return -1;
 
-        for (i = 0; i < num_possible_cpus(); i++)
-                if (cpu_logical_map(i) == hwid)
-                        return i;
+        for_each_possible_cpu(cpu)
+                if (cpu_logical_map(cpu) == hwid)
+                        return cpu;
 
         return -1;
 }
diff --git a/drivers/irqchip/irq-gic-v4.c b/drivers/irqchip/irq-gic-v4.c
index 2370e6d9e603..cd0bcc3b7e33 100644
--- a/drivers/irqchip/irq-gic-v4.c
+++ b/drivers/irqchip/irq-gic-v4.c
@@ -173,7 +173,9 @@ int its_map_vlpi(int irq, struct its_vlpi_map *map)
 {
         struct its_cmd_info info = {
                 .cmd_type = MAP_VLPI,
-                .map      = map,
+                {
+                        .map      = map,
+                },
         };
 
         /*
@@ -189,7 +191,9 @@ int its_get_vlpi(int irq, struct its_vlpi_map *map)
 {
         struct its_cmd_info info = {
                 .cmd_type = GET_VLPI,
-                .map      = map,
+                {
+                        .map      = map,
+                },
         };
 
         return irq_set_vcpu_affinity(irq, &info);
@@ -205,7 +209,9 @@ int its_prop_update_vlpi(int irq, u8 config, bool inv)
 {
         struct its_cmd_info info = {
                 .cmd_type = inv ? PROP_UPDATE_AND_INV_VLPI : PROP_UPDATE_VLPI,
-                .config   = config,
+                {
+                        .config   = config,
+                },
         };
 
         return irq_set_vcpu_affinity(irq, &info);
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 6e52a88bbd9e..c90976d7e53c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -169,20 +169,19 @@ static void gic_mask_irq(struct irq_data *d)
 {
         unsigned int intr = GIC_HWIRQ_TO_SHARED(d->hwirq);
 
-        write_gic_rmask(BIT(intr));
+        write_gic_rmask(intr);
         gic_clear_pcpu_masks(intr);
 }
 
 static void gic_unmask_irq(struct irq_data *d)
 {
-        struct cpumask *affinity = irq_data_get_affinity_mask(d);
         unsigned int intr = GIC_HWIRQ_TO_SHARED(d->hwirq);
         unsigned int cpu;
 
-        write_gic_smask(BIT(intr));
+        write_gic_smask(intr);
 
         gic_clear_pcpu_masks(intr);
-        cpu = cpumask_first_and(affinity, cpu_online_mask);
+        cpu = cpumask_first(irq_data_get_effective_affinity_mask(d));
         set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
 }
 
@@ -420,13 +419,17 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
                                      irq_hw_number_t hw, unsigned int cpu)
 {
         int intr = GIC_HWIRQ_TO_SHARED(hw);
+        struct irq_data *data;
         unsigned long flags;
 
+        data = irq_get_irq_data(virq);
+
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
         gic_clear_pcpu_masks(intr);
         set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
+        irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
         return 0;
@@ -645,7 +648,7 @@ static int __init gic_of_init(struct device_node *node,
 
         /* Find the first available CPU vector. */
         i = 0;
-        reserved = (C_SW0 | C_SW1) >> __fls(C_SW0);
+        reserved = (C_SW0 | C_SW1) >> __ffs(C_SW0);
         while (!of_property_read_u32_index(node, "mti,reserved-cpu-vectors",
                                            i++, &cpu_vec))
                 reserved |= BIT(cpu_vec);
@@ -684,11 +687,11 @@ static int __init gic_of_init(struct device_node *node,
 
         gicconfig = read_gic_config();
         gic_shared_intrs = gicconfig & GIC_CONFIG_NUMINTERRUPTS;
-        gic_shared_intrs >>= __fls(GIC_CONFIG_NUMINTERRUPTS);
+        gic_shared_intrs >>= __ffs(GIC_CONFIG_NUMINTERRUPTS);
         gic_shared_intrs = (gic_shared_intrs + 1) * 8;
 
         gic_vpes = gicconfig & GIC_CONFIG_PVPS;
-        gic_vpes >>= __fls(GIC_CONFIG_PVPS);
+        gic_vpes >>= __ffs(GIC_CONFIG_PVPS);
         gic_vpes = gic_vpes + 1;
 
         if (cpu_has_veic) {
@@ -767,7 +770,7 @@ static int __init gic_of_init(struct device_node *node,
         for (i = 0; i < gic_shared_intrs; i++) {
                 change_gic_pol(i, GIC_POL_ACTIVE_HIGH);
                 change_gic_trig(i, GIC_TRIG_LEVEL);
-                write_gic_rmask(BIT(i));
+                write_gic_rmask(i);
         }
 
         for (i = 0; i < gic_vpes; i++) {
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 6c44609fd83a..cd2b3c69771a 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -825,7 +825,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
         isdn_net_local *lp;
         struct ippp_struct *is;
         int proto;
-        unsigned char protobuf[4];
 
         is = file->private_data;
 
@@ -839,24 +838,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
         if (!lp)
                 printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n");
         else {
-                /*
-                 * Don't reset huptimer for
-                 * LCP packets. (Echo requests).
-                 */
-                if (copy_from_user(protobuf, buf, 4))
-                        return -EFAULT;
-                proto = PPP_PROTOCOL(protobuf);
-                if (proto != PPP_LCP)
-                        lp->huptimer = 0;
+                if (lp->isdn_device < 0 || lp->isdn_channel < 0) {
+                        unsigned char protobuf[4];
+                        /*
+                         * Don't reset huptimer for
+                         * LCP packets. (Echo requests).
+                         */
+                        if (copy_from_user(protobuf, buf, 4))
+                                return -EFAULT;
+
+                        proto = PPP_PROTOCOL(protobuf);
+                        if (proto != PPP_LCP)
+                                lp->huptimer = 0;
 
-                if (lp->isdn_device < 0 || lp->isdn_channel < 0)
                         return 0;
+                }
 
                 if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) &&
                     lp->dialstate == 0 &&
                     (lp->flags & ISDN_NET_CONNECTED)) {
                         unsigned short hl;
                         struct sk_buff *skb;
+                        unsigned char *cpy_buf;
                         /*
                          * we need to reserve enough space in front of
                          * sk_buff. old call to dev_alloc_skb only reserved
@@ -869,11 +872,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
                                 return count;
                         }
                         skb_reserve(skb, hl);
-                        if (copy_from_user(skb_put(skb, count), buf, count))
+                        cpy_buf = skb_put(skb, count);
+                        if (copy_from_user(cpy_buf, buf, count))
                         {
                                 kfree_skb(skb);
                                 return -EFAULT;
                         }
+
+                        /*
+                         * Don't reset huptimer for
+                         * LCP packets. (Echo requests).
+                         */
+                        proto = PPP_PROTOCOL(cpy_buf);
+                        if (proto != PPP_LCP)
+                                lp->huptimer = 0;
+
                         if (is->debug & 0x40) {
                                 printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len);
                                 isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot);
diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c
index bbbbe0898233..9a257f969300 100644
--- a/drivers/leds/leds-as3645a.c
+++ b/drivers/leds/leds-as3645a.c
@@ -112,6 +112,10 @@
 #define AS_PEAK_mA_TO_REG(a) \
         ((min_t(u32, AS_PEAK_mA_MAX, a) - 1250) / 250)
 
+/* LED numbers for Devicetree */
+#define AS_LED_FLASH                            0
+#define AS_LED_INDICATOR                        1
+
 enum as_mode {
         AS_MODE_EXT_TORCH = 0 << AS_CONTROL_MODE_SETTING_SHIFT,
         AS_MODE_INDICATOR = 1 << AS_CONTROL_MODE_SETTING_SHIFT,
@@ -491,10 +495,29 @@ static int as3645a_parse_node(struct as3645a *flash,
                               struct device_node *node)
 {
         struct as3645a_config *cfg = &flash->cfg;
+        struct device_node *child;
         const char *name;
         int rval;
 
-        flash->flash_node = of_get_child_by_name(node, "flash");
+        for_each_child_of_node(node, child) {
+                u32 id = 0;
+
+                of_property_read_u32(child, "reg", &id);
+
+                switch (id) {
+                case AS_LED_FLASH:
+                        flash->flash_node = of_node_get(child);
+                        break;
+                case AS_LED_INDICATOR:
+                        flash->indicator_node = of_node_get(child);
+                        break;
+                default:
+                        dev_warn(&flash->client->dev,
+                                 "unknown LED %u encountered, ignoring\n", id);
+                        break;
+                }
+        }
+
         if (!flash->flash_node) {
                 dev_err(&flash->client->dev, "can't find flash node\n");
                 return -ENODEV;
@@ -534,11 +557,10 @@ static int as3645a_parse_node(struct as3645a *flash,
         of_property_read_u32(flash->flash_node, "voltage-reference",
                              &cfg->voltage_reference);
 
-        of_property_read_u32(flash->flash_node, "peak-current-limit",
+        of_property_read_u32(flash->flash_node, "ams,input-max-microamp",
                              &cfg->peak);
         cfg->peak = AS_PEAK_mA_TO_REG(cfg->peak);
 
-        flash->indicator_node = of_get_child_by_name(node, "indicator");
         if (!flash->indicator_node) {
                 dev_warn(&flash->client->dev,
                          "can't find indicator node\n");
@@ -721,6 +743,7 @@ static int as3645a_remove(struct i2c_client *client)
         as3645a_set_control(flash, AS_MODE_EXT_TORCH, false);
 
         v4l2_flash_release(flash->vf);
+        v4l2_flash_release(flash->vfind);
 
         led_classdev_flash_unregister(&flash->fled);
         led_classdev_unregister(&flash->iled_cdev);
diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
index 7d5286b05036..1841d0359bac 100644
--- a/drivers/md/bcache/closure.c
+++ b/drivers/md/bcache/closure.c
@@ -64,7 +64,7 @@ EXPORT_SYMBOL(closure_put);
 void __closure_wake_up(struct closure_waitlist *wait_list)
 {
         struct llist_node *list;
-        struct closure *cl;
+        struct closure *cl, *t;
         struct llist_node *reverse = NULL;
 
         list = llist_del_all(&wait_list->list);
@@ -73,7 +73,7 @@ void __closure_wake_up(struct closure_waitlist *wait_list)
         reverse = llist_reverse_order(list);
 
         /* Then do the wakeups */
-        llist_for_each_entry(cl, reverse, list) {
+        llist_for_each_entry_safe(cl, t, reverse, list) {
                 closure_set_waiting(cl, 0);
                 closure_sub(cl, CLOSURE_WAITING + 1);
         }
diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 24eddbdf2ab4..203144762f36 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -149,5 +149,6 @@ static inline bool dm_message_test_buffer_overflow(char *result, unsigned maxlen
 
 extern atomic_t dm_global_event_nr;
 extern wait_queue_head_t dm_global_eventq;
+void dm_issue_global_event(void);
 
 #endif
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index a55ffd4f5933..96ab46512e1f 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2466,6 +2466,7 @@ static int crypt_ctr_cipher_old(struct dm_target *ti, char *cipher_in, char *key
                 kfree(cipher_api);
                 return ret;
         }
+        kfree(cipher_api);
 
         return 0;
 bad_mem:
@@ -2584,6 +2585,10 @@ static int crypt_ctr_optional(struct dm_target *ti, unsigned int argc, char **ar
                                 ti->error = "Invalid feature value for sector_size";
                                 return -EINVAL;
                         }
+                        if (ti->len & ((cc->sector_size >> SECTOR_SHIFT) - 1)) {
+                                ti->error = "Device size is not multiple of sector_size feature";
+                                return -EINVAL;
+                        }
                         cc->sector_shift = __ffs(cc->sector_size) - SECTOR_SHIFT;
                 } else if (!strcasecmp(opt_string, "iv_large_sectors"))
                         set_bit(CRYPT_IV_LARGE_SECTORS, &cc->cipher_flags);
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 8756a6850431..e52676fa9832 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -477,9 +477,13 @@ static int remove_all(struct file *filp, struct dm_ioctl *param, size_t param_si
  * Round up the ptr to an 8-byte boundary.
  */
 #define ALIGN_MASK 7
+static inline size_t align_val(size_t val)
+{
+        return (val + ALIGN_MASK) & ~ALIGN_MASK;
+}
 static inline void *align_ptr(void *ptr)
 {
-        return (void *) (((size_t) (ptr + ALIGN_MASK)) & ~ALIGN_MASK);
+        return (void *)align_val((size_t)ptr);
 }
 
 /*
@@ -505,7 +509,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
         struct hash_cell *hc;
         size_t len, needed = 0;
         struct gendisk *disk;
-        struct dm_name_list *nl, *old_nl = NULL;
+        struct dm_name_list *orig_nl, *nl, *old_nl = NULL;
         uint32_t *event_nr;
 
         down_write(&_hash_lock);
@@ -516,17 +520,15 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
          */
         for (i = 0; i < NUM_BUCKETS; i++) {
                 list_for_each_entry (hc, _name_buckets + i, name_list) {
-                        needed += sizeof(struct dm_name_list);
-                        needed += strlen(hc->name) + 1;
-                        needed += ALIGN_MASK;
-                        needed += (sizeof(uint32_t) + ALIGN_MASK) & ~ALIGN_MASK;
+                        needed += align_val(offsetof(struct dm_name_list, name) + strlen(hc->name) + 1);
+                        needed += align_val(sizeof(uint32_t));
                 }
         }
 
         /*
          * Grab our output buffer.
          */
-        nl = get_result_buffer(param, param_size, &len);
+        nl = orig_nl = get_result_buffer(param, param_size, &len);
         if (len < needed) {
                 param->flags |= DM_BUFFER_FULL_FLAG;
                 goto out;
@@ -549,11 +551,16 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
                         strcpy(nl->name, hc->name);
 
                         old_nl = nl;
-                        event_nr = align_ptr(((void *) (nl + 1)) + strlen(hc->name) + 1);
+                        event_nr = align_ptr(nl->name + strlen(hc->name) + 1);
                         *event_nr = dm_get_event_nr(hc->md);
                         nl = align_ptr(event_nr + 1);
                 }
         }
+        /*
+         * If mismatch happens, security may be compromised due to buffer
+         * overflow, so it's better to crash.
+         */
+        BUG_ON((char *)nl - (char *)orig_nl != needed);
 
  out:
         up_write(&_hash_lock);
@@ -1621,7 +1628,8 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
  * which has a variable size, is not used by the function processing
  * the ioctl.
  */
-#define IOCTL_FLAGS_NO_PARAMS   1
+#define IOCTL_FLAGS_NO_PARAMS           1
+#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT  2
 
 /*-----------------------------------------------------------------
  * Implementation of open/close/ioctl on the special char
@@ -1635,12 +1643,12 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
                 ioctl_fn fn;
         } _ioctls[] = {
                 {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */
-                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all},
+                {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all},
                 {DM_LIST_DEVICES_CMD, 0, list_devices},
 
-                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create},
-                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove},
-                {DM_DEV_RENAME_CMD, 0, dev_rename},
+                {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create},
+                {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove},
+                {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename},
                 {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend},
                 {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status},
                 {DM_DEV_WAIT_CMD, 0, dev_wait},
@@ -1869,6 +1877,9 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us
             unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))
                 DMERR("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set", cmd);
 
+        if (!r && ioctl_flags & IOCTL_FLAGS_ISSUE_GLOBAL_EVENT)
+                dm_issue_global_event();
+
         /*
          * Copy the results back to userland.
          */
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 5bfe285ea9d1..2245d06d2045 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3238,7 +3238,7 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
         if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
                 return DM_MAPIO_REQUEUE;
 
-        mddev->pers->make_request(mddev, bio);
+        md_handle_request(mddev, bio);
 
         return DM_MAPIO_SUBMITTED;
 }
@@ -3297,11 +3297,10 @@ static const char *__raid_dev_status(struct raid_set *rs, struct md_rdev *rdev,
 static sector_t rs_get_progress(struct raid_set *rs,
                                 sector_t resync_max_sectors, bool *array_in_sync)
 {
-        sector_t r, recovery_cp, curr_resync_completed;
+        sector_t r, curr_resync_completed;
         struct mddev *mddev = &rs->md;
 
         curr_resync_completed = mddev->curr_resync_completed ?: mddev->recovery_cp;
-        recovery_cp = mddev->recovery_cp;
         *array_in_sync = false;
 
         if (rs_is_raid0(rs)) {
@@ -3330,9 +3329,11 @@ static sector_t rs_get_progress(struct raid_set *rs,
                 } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                         r = curr_resync_completed;
                 else
-                        r = recovery_cp;
+                        r = mddev->recovery_cp;
 
-                if (r == MaxSector) {
+                if ((r == MaxSector) ||
+                    (test_bit(MD_RECOVERY_DONE, &mddev->recovery) &&
+                     (mddev->curr_resync_completed == resync_max_sectors))) {
                         /*
                          * Sync complete.
                          */
@@ -3892,7 +3893,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 12, 1},
+        .version = {1, 13, 0},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6e54145969c5..4be85324f44d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -52,6 +52,12 @@ static struct workqueue_struct *deferred_remove_workqueue;
 atomic_t dm_global_event_nr = ATOMIC_INIT(0);
 DECLARE_WAIT_QUEUE_HEAD(dm_global_eventq);
 
+void dm_issue_global_event(void)
+{
+        atomic_inc(&dm_global_event_nr);
+        wake_up(&dm_global_eventq);
+}
+
 /*
  * One of these is allocated per bio.
  */
@@ -1865,9 +1871,8 @@ static void event_callback(void *context)
         dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
 
         atomic_inc(&md->event_nr);
-        atomic_inc(&dm_global_event_nr);
         wake_up(&md->eventq);
-        wake_up(&dm_global_eventq);
+        dm_issue_global_event();
 }
 
 /*
@@ -2283,6 +2288,7 @@ struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
         }
 
         map = __bind(md, table, &limits);
+        dm_issue_global_event();
 
 out:
         mutex_unlock(&md->suspend_lock);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 08fcaebc61bd..0ff1bbf6c90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -266,6 +266,37 @@ static DEFINE_SPINLOCK(all_mddevs_lock);
  * call has finished, the bio has been linked into some internal structure
  * and so is visible to ->quiesce(), so we don't need the refcount any more.
  */
+void md_handle_request(struct mddev *mddev, struct bio *bio)
+{
+check_suspended:
+        rcu_read_lock();
+        if (mddev->suspended) {
+                DEFINE_WAIT(__wait);
+                for (;;) {
+                        prepare_to_wait(&mddev->sb_wait, &__wait,
+                                        TASK_UNINTERRUPTIBLE);
+                        if (!mddev->suspended)
+                                break;
+                        rcu_read_unlock();
+                        schedule();
+                        rcu_read_lock();
+                }
+                finish_wait(&mddev->sb_wait, &__wait);
+        }
+        atomic_inc(&mddev->active_io);
+        rcu_read_unlock();
+
+        if (!mddev->pers->make_request(mddev, bio)) {
+                atomic_dec(&mddev->active_io);
+                wake_up(&mddev->sb_wait);
+                goto check_suspended;
+        }
+
+        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
+                wake_up(&mddev->sb_wait);
+}
+EXPORT_SYMBOL(md_handle_request);
+
 static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
 {
         const int rw = bio_data_dir(bio);
@@ -285,23 +316,6 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio)
                 bio_endio(bio);
                 return BLK_QC_T_NONE;
         }
-check_suspended:
-        rcu_read_lock();
-        if (mddev->suspended) {
-                DEFINE_WAIT(__wait);
-                for (;;) {
-                        prepare_to_wait(&mddev->sb_wait, &__wait,
-                                        TASK_UNINTERRUPTIBLE);
-                        if (!mddev->suspended)
-                                break;
-                        rcu_read_unlock();
-                        schedule();
-                        rcu_read_lock();
-                }
-                finish_wait(&mddev->sb_wait, &__wait);
-        }
-        atomic_inc(&mddev->active_io);
-        rcu_read_unlock();
 
         /*
          * save the sectors now since our bio can
@@ -310,20 +324,14 @@ check_suspended:
         sectors = bio_sectors(bio);
         /* bio could be mergeable after passing to underlayer */
         bio->bi_opf &= ~REQ_NOMERGE;
-        if (!mddev->pers->make_request(mddev, bio)) {
-                atomic_dec(&mddev->active_io);
-                wake_up(&mddev->sb_wait);
-                goto check_suspended;
-        }
+
+        md_handle_request(mddev, bio);
 
         cpu = part_stat_lock();
         part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
         part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw], sectors);
         part_stat_unlock();
 
-        if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
-                wake_up(&mddev->sb_wait);
-
         return BLK_QC_T_NONE;
 }
 
@@ -439,16 +447,22 @@ static void md_submit_flush_data(struct work_struct *ws)
         struct mddev *mddev = container_of(ws, struct mddev, flush_work);
         struct bio *bio = mddev->flush_bio;
 
+        /*
+         * must reset flush_bio before calling into md_handle_request to avoid a
+         * deadlock, because other bios passed md_handle_request suspend check
+         * could wait for this and below md_handle_request could wait for those
+         * bios because of suspend check
+         */
+        mddev->flush_bio = NULL;
+        wake_up(&mddev->sb_wait);
+
         if (bio->bi_iter.bi_size == 0)
                 /* an empty barrier - all done */
                 bio_endio(bio);
         else {
                 bio->bi_opf &= ~REQ_PREFLUSH;
-                mddev->pers->make_request(mddev, bio);
+                md_handle_request(mddev, bio);
         }
-
-        mddev->flush_bio = NULL;
-        wake_up(&mddev->sb_wait);
 }
 
 void md_flush_request(struct mddev *mddev, struct bio *bio)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 561d22b9a9a8..d8287d3cd1bf 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -692,6 +692,7 @@ extern void md_stop_writes(struct mddev *mddev);
 extern int md_rdev_init(struct md_rdev *rdev);
 extern void md_rdev_clear(struct md_rdev *rdev);
 
+extern void md_handle_request(struct mddev *mddev, struct bio *bio);
 extern void mddev_suspend(struct mddev *mddev);
 extern void mddev_resume(struct mddev *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4188a4881148..928e24a07133 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -811,6 +811,14 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                         spin_unlock(&head->batch_head->batch_lock);
                         goto unlock_out;
                 }
+                /*
+                 * We must assign batch_head of this stripe within the
+                 * batch_lock, otherwise clear_batch_ready of batch head
+                 * stripe could clear BATCH_READY bit of this stripe and
+                 * this stripe->batch_head doesn't get assigned, which
+                 * could confuse clear_batch_ready for this stripe
+                 */
+                sh->batch_head = head->batch_head;
 
                 /*
                  * at this point, head's BATCH_READY could be cleared, but we
@@ -818,8 +826,6 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                  */
                 list_add(&sh->batch_list, &head->batch_list);
                 spin_unlock(&head->batch_head->batch_lock);
-
-                sh->batch_head = head->batch_head;
         } else {
                 head->batch_head = head;
                 sh->batch_head = head->batch_head;
@@ -4599,7 +4605,8 @@ static void break_stripe_batch_list(struct stripe_head *head_sh,
 
                 set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS |
                                             (1 << STRIPE_PREREAD_ACTIVE) |
-                                            (1 << STRIPE_DEGRADED)),
+                                            (1 << STRIPE_DEGRADED) |
+                                            (1 << STRIPE_ON_UNPLUG_LIST)),
                               head_sh->state & (1 << STRIPE_INSYNC));
 
                 sh->check_state = head_sh->check_state;
@@ -6568,14 +6575,17 @@ static ssize_t
 raid5_store_group_thread_cnt(struct mddev *mddev, const char *page, size_t len)
 {
         struct r5conf *conf;
-        unsigned long new;
+        unsigned int new;
         int err;
         struct r5worker_group *new_groups, *old_groups;
         int group_cnt, worker_cnt_per_group;
 
         if (len >= PAGE_SIZE)
                 return -EINVAL;
-        if (kstrtoul(page, 10, &new))
+        if (kstrtouint(page, 10, &new))
+                return -EINVAL;
+        /* 8192 should be big enough */
+        if (new > 8192)
                 return -EINVAL;
 
         err = mddev_lock(mddev);
diff --git a/drivers/media/rc/ir-sharp-decoder.c b/drivers/media/rc/ir-sharp-decoder.c
index ed43a4212479..129b558acc92 100644
--- a/drivers/media/rc/ir-sharp-decoder.c
+++ b/drivers/media/rc/ir-sharp-decoder.c
@@ -245,5 +245,5 @@ module_init(ir_sharp_decode_init);
 module_exit(ir_sharp_decode_exit);
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("James Hogan <james.hogan@imgtec.com>");
+MODULE_AUTHOR("James Hogan <jhogan@kernel.org>");
 MODULE_DESCRIPTION("Sharp IR protocol decoder");
diff --git a/drivers/misc/cxl/cxllib.c b/drivers/misc/cxl/cxllib.c
index 5dba23ca2e5f..dc9bc1807fdf 100644
--- a/drivers/misc/cxl/cxllib.c
+++ b/drivers/misc/cxl/cxllib.c
@@ -219,8 +219,17 @@ int cxllib_handle_fault(struct mm_struct *mm, u64 addr, u64 size, u64 flags)
 
         down_read(&mm->mmap_sem);
 
-        for (dar = addr; dar < addr + size; dar += page_size) {
-                if (!vma || dar < vma->vm_start || dar > vma->vm_end) {
+        vma = find_vma(mm, addr);
+        if (!vma) {
+                pr_err("Can't find vma for addr %016llx\n", addr);
+                rc = -EFAULT;
+                goto out;
+        }
+        /* get the size of the pages allocated */
+        page_size = vma_kernel_pagesize(vma);
+
+        for (dar = (addr & ~(page_size - 1)); dar < (addr + size); dar += page_size) {
+                if (dar < vma->vm_start || dar >= vma->vm_end) {
                         vma = find_vma(mm, addr);
                         if (!vma) {
                                 pr_err("Can't find vma for addr %016llx\n", addr);
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 29fc1e662891..2ad7b5c69156 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1634,8 +1634,6 @@ static void mmc_blk_data_prep(struct mmc_queue *mq, struct mmc_queue_req *mqrq,
         }
 
         mqrq->areq.mrq = &brq->mrq;
-
-        mmc_queue_bounce_pre(mqrq);
 }
 
 static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
@@ -1829,7 +1827,6 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                 brq = &mq_rq->brq;
                 old_req = mmc_queue_req_to_req(mq_rq);
                 type = rq_data_dir(old_req) == READ ? MMC_BLK_READ : MMC_BLK_WRITE;
-                mmc_queue_bounce_post(mq_rq);
 
                 switch (status) {
                 case MMC_BLK_SUCCESS:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a7eb623f8daa..36217ad5e9b1 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1286,6 +1286,23 @@ out_err:
         return err;
 }
 
+static void mmc_select_driver_type(struct mmc_card *card)
+{
+        int card_drv_type, drive_strength, drv_type;
+
+        card_drv_type = card->ext_csd.raw_driver_strength |
+                        mmc_driver_type_mask(0);
+
+        drive_strength = mmc_select_drive_strength(card,
+                                                   card->ext_csd.hs200_max_dtr,
+                                                   card_drv_type, &drv_type);
+
+        card->drive_strength = drive_strength;
+
+        if (drv_type)
+                mmc_set_driver_type(card->host, drv_type);
+}
+
 static int mmc_select_hs400es(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
@@ -1341,6 +1358,8 @@ static int mmc_select_hs400es(struct mmc_card *card)
                 goto out_err;
         }
 
+        mmc_select_driver_type(card);
+
         /* Switch card to HS400 */
         val = EXT_CSD_TIMING_HS400 |
               card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
@@ -1374,23 +1393,6 @@ out_err:
         return err;
 }
 
-static void mmc_select_driver_type(struct mmc_card *card)
-{
-        int card_drv_type, drive_strength, drv_type;
-
-        card_drv_type = card->ext_csd.raw_driver_strength |
-                        mmc_driver_type_mask(0);
-
-        drive_strength = mmc_select_drive_strength(card,
-                                                   card->ext_csd.hs200_max_dtr,
-                                                   card_drv_type, &drv_type);
-
-        card->drive_strength = drive_strength;
-
-        if (drv_type)
-                mmc_set_driver_type(card->host, drv_type);
-}
-
 /*
  * For device supporting HS200 mode, the following sequence
  * should be done before executing the tuning process.
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
index affa7370ba82..0a4e77a5ba33 100644
--- a/drivers/mmc/core/queue.c
+++ b/drivers/mmc/core/queue.c
@@ -23,8 +23,6 @@
 #include "core.h"
 #include "card.h"
 
-#define MMC_QUEUE_BOUNCESZ      65536
-
 /*
  * Prepare a MMC request. This just filters out odd stuff.
  */
@@ -150,26 +148,6 @@ static void mmc_queue_setup_discard(struct request_queue *q,
                 queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, q);
 }
 
-static unsigned int mmc_queue_calc_bouncesz(struct mmc_host *host)
-{
-        unsigned int bouncesz = MMC_QUEUE_BOUNCESZ;
-
-        if (host->max_segs != 1 || (host->caps & MMC_CAP_NO_BOUNCE_BUFF))
-                return 0;
-
-        if (bouncesz > host->max_req_size)
-                bouncesz = host->max_req_size;
-        if (bouncesz > host->max_seg_size)
-                bouncesz = host->max_seg_size;
-        if (bouncesz > host->max_blk_count * 512)
-                bouncesz = host->max_blk_count * 512;
-
-        if (bouncesz <= 512)
-                return 0;
-
-        return bouncesz;
-}
-
 /**
  * mmc_init_request() - initialize the MMC-specific per-request data
  * @q: the request queue
@@ -184,26 +162,9 @@ static int mmc_init_request(struct request_queue *q, struct request *req,
         struct mmc_card *card = mq->card;
         struct mmc_host *host = card->host;
 
-        if (card->bouncesz) {
-                mq_rq->bounce_buf = kmalloc(card->bouncesz, gfp);
-                if (!mq_rq->bounce_buf)
-                        return -ENOMEM;
-                if (card->bouncesz > 512) {
-                        mq_rq->sg = mmc_alloc_sg(1, gfp);
-                        if (!mq_rq->sg)
-                                return -ENOMEM;
-                        mq_rq->bounce_sg = mmc_alloc_sg(card->bouncesz / 512,
-                                                        gfp);
-                        if (!mq_rq->bounce_sg)
-                                return -ENOMEM;
-                }
-        } else {
-                mq_rq->bounce_buf = NULL;
-                mq_rq->bounce_sg = NULL;
-                mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
-                if (!mq_rq->sg)
-                        return -ENOMEM;
-        }
+        mq_rq->sg = mmc_alloc_sg(host->max_segs, gfp);
+        if (!mq_rq->sg)
+                return -ENOMEM;
 
         return 0;
 }
@@ -212,13 +173,6 @@ static void mmc_exit_request(struct request_queue *q, struct request *req)
 {
         struct mmc_queue_req *mq_rq = req_to_mmc_queue_req(req);
 
-        /* It is OK to kfree(NULL) so this will be smooth */
-        kfree(mq_rq->bounce_sg);
-        mq_rq->bounce_sg = NULL;
-
-        kfree(mq_rq->bounce_buf);
-        mq_rq->bounce_buf = NULL;
-
         kfree(mq_rq->sg);
         mq_rq->sg = NULL;
 }
@@ -265,18 +219,11 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
         if (mmc_can_erase(card))
                 mmc_queue_setup_discard(mq->queue, card);
 
-        card->bouncesz = mmc_queue_calc_bouncesz(host);
-        if (card->bouncesz) {
-                blk_queue_max_hw_sectors(mq->queue, card->bouncesz / 512);
-                blk_queue_max_segments(mq->queue, card->bouncesz / 512);
-                blk_queue_max_segment_size(mq->queue, card->bouncesz);
-        } else {
-                blk_queue_bounce_limit(mq->queue, limit);
-                blk_queue_max_hw_sectors(mq->queue,
-                        min(host->max_blk_count, host->max_req_size / 512));
-                blk_queue_max_segments(mq->queue, host->max_segs);
-                blk_queue_max_segment_size(mq->queue, host->max_seg_size);
-        }
+        blk_queue_bounce_limit(mq->queue, limit);
+        blk_queue_max_hw_sectors(mq->queue,
+                min(host->max_blk_count, host->max_req_size / 512));
+        blk_queue_max_segments(mq->queue, host->max_segs);
+        blk_queue_max_segment_size(mq->queue, host->max_seg_size);
 
         sema_init(&mq->thread_sem, 1);
 
@@ -365,56 +312,7 @@ void mmc_queue_resume(struct mmc_queue *mq)
  */
 unsigned int mmc_queue_map_sg(struct mmc_queue *mq, struct mmc_queue_req *mqrq)
 {
-        unsigned int sg_len;
-        size_t buflen;
-        struct scatterlist *sg;
         struct request *req = mmc_queue_req_to_req(mqrq);
-        int i;
-
-        if (!mqrq->bounce_buf)
-                return blk_rq_map_sg(mq->queue, req, mqrq->sg);
-
-        sg_len = blk_rq_map_sg(mq->queue, req, mqrq->bounce_sg);
-
-        mqrq->bounce_sg_len = sg_len;
-
-        buflen = 0;
-        for_each_sg(mqrq->bounce_sg, sg, sg_len, i)
-                buflen += sg->length;
-
-        sg_init_one(mqrq->sg, mqrq->bounce_buf, buflen);
-
-        return 1;
-}
-
-/*
- * If writing, bounce the data to the buffer before the request
- * is sent to the host driver
- */
-void mmc_queue_bounce_pre(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != WRITE)
-                return;
-
-        sg_copy_to_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
-}
-
-/*
- * If reading, bounce the data from the buffer after the request
- * has been handled by the host driver
- */
-void mmc_queue_bounce_post(struct mmc_queue_req *mqrq)
-{
-        if (!mqrq->bounce_buf)
-                return;
-
-        if (rq_data_dir(mmc_queue_req_to_req(mqrq)) != READ)
-                return;
 
-        sg_copy_from_buffer(mqrq->bounce_sg, mqrq->bounce_sg_len,
-                mqrq->bounce_buf, mqrq->sg[0].length);
+        return blk_rq_map_sg(mq->queue, req, mqrq->sg);
 }
diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h
index 04fc89360a7a..f18d3f656baa 100644
--- a/drivers/mmc/core/queue.h
+++ b/drivers/mmc/core/queue.h
@@ -49,9 +49,6 @@ enum mmc_drv_op {
 struct mmc_queue_req {
         struct mmc_blk_request  brq;
         struct scatterlist      *sg;
-        char                    *bounce_buf;
-        struct scatterlist      *bounce_sg;
-        unsigned int            bounce_sg_len;
         struct mmc_async_req    areq;
         enum mmc_drv_op         drv_op;
         int                     drv_op_result;
@@ -81,11 +78,8 @@ extern int mmc_init_queue(struct mmc_queue *, struct mmc_card *, spinlock_t *,
 extern void mmc_cleanup_queue(struct mmc_queue *);
 extern void mmc_queue_suspend(struct mmc_queue *);
 extern void mmc_queue_resume(struct mmc_queue *);
-
 extern unsigned int mmc_queue_map_sg(struct mmc_queue *,
                                      struct mmc_queue_req *);
-extern void mmc_queue_bounce_pre(struct mmc_queue_req *);
-extern void mmc_queue_bounce_post(struct mmc_queue_req *);
 
 extern int mmc_access_rpmb(struct mmc_queue *);
 
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 02179ed2a40d..8c15637178ff 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -5,7 +5,7 @@
 comment "MMC/SD/SDIO Host Controller Drivers"
 
 config MMC_DEBUG
-        bool "MMC host drivers debugginG"
+        bool "MMC host drivers debugging"
         depends on MMC != n
         help
           This is an option for use by developers; most people should
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index b9cc95998799..eee08d81b242 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -7,6 +7,7 @@
  *
  * Copyright (C) 2016 Cavium Inc.
  */
+#include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
 #include <linux/mmc/mmc.h>
@@ -149,8 +150,11 @@ error:
         for (i = 0; i < CAVIUM_MAX_MMC; i++) {
                 if (host->slot[i])
                         cvm_mmc_of_slot_remove(host->slot[i]);
-                if (host->slot_pdev[i])
+                if (host->slot_pdev[i]) {
+                        get_device(&host->slot_pdev[i]->dev);
                         of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+                        put_device(&host->slot_pdev[i]->dev);
+                }
         }
         clk_disable_unprepare(host->clk);
         return ret;
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 27fb625cbcf3..fbd29f00fca0 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -1038,7 +1038,7 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
          */
         mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
                      MMC_CAP_ERASE | MMC_CAP_CMD23 | MMC_CAP_POWER_OFF_CARD |
-                     MMC_CAP_3_3V_DDR | MMC_CAP_NO_BOUNCE_BUFF;
+                     MMC_CAP_3_3V_DDR;
 
         if (host->use_sg)
                 mmc->max_segs = 16;
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index c885c2d4b904..85745ef179e2 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -531,8 +531,7 @@ static int meson_mmc_clk_init(struct meson_host *host)
         div->shift = __ffs(CLK_DIV_MASK);
         div->width = __builtin_popcountl(CLK_DIV_MASK);
         div->hw.init = &init;
-        div->flags = (CLK_DIVIDER_ONE_BASED |
-                      CLK_DIVIDER_ROUND_CLOSEST);
+        div->flags = CLK_DIVIDER_ONE_BASED;
 
         clk = devm_clk_register(host->dev, &div->hw);
         if (WARN_ON(IS_ERR(clk)))
@@ -717,6 +716,22 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
+        int ret;
+
+        /*
+         * If this is the initial tuning, try to get a sane Rx starting
+         * phase before doing the actual tuning.
+         */
+        if (!mmc->doing_retune) {
+                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
+
+                if (ret)
+                        return ret;
+        }
+
+        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
+        if (ret)
+                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -746,6 +761,11 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         case MMC_POWER_UP:
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
+
+                /* Reset phases */
+                clk_set_phase(host->rx_clk, 0);
+                clk_set_phase(host->tx_clk, 270);
+
                 break;
 
         case MMC_POWER_ON:
@@ -759,8 +779,6 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                 host->vqmmc_enabled = true;
                 }
 
-                /* Reset rx phase */
-                clk_set_phase(host->rx_clk, 0);
                 break;
         }
 
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 59ab194cb009..c763b404510f 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -702,11 +702,7 @@ static int pxamci_probe(struct platform_device *pdev)
 
         pxamci_init_ocr(host);
 
-        /*
-         * This architecture used to disable bounce buffers through its
-         * defconfig, now it is done at runtime as a host property.
-         */
-        mmc->caps = MMC_CAP_NO_BOUNCE_BUFF;
+        mmc->caps = 0;
         host->cmdat = 0;
         if (!cpu_is_pxa25x()) {
                 mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_SDIO_IRQ;
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index bbaddf18a1b3..d0ccc6729fd2 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -392,6 +392,7 @@ static const struct sdhci_pci_fixes sdhci_intel_pch_sdio = {
 
 enum {
         INTEL_DSM_FNS           =  0,
+        INTEL_DSM_V18_SWITCH    =  3,
         INTEL_DSM_DRV_STRENGTH  =  9,
         INTEL_DSM_D3_RETUNE     = 10,
 };
@@ -557,6 +558,19 @@ static void intel_hs400_enhanced_strobe(struct mmc_host *mmc,
         sdhci_writel(host, val, INTEL_HS400_ES_REG);
 }
 
+static void sdhci_intel_voltage_switch(struct sdhci_host *host)
+{
+        struct sdhci_pci_slot *slot = sdhci_priv(host);
+        struct intel_host *intel_host = sdhci_pci_priv(slot);
+        struct device *dev = &slot->chip->pdev->dev;
+        u32 result = 0;
+        int err;
+
+        err = intel_dsm(intel_host, dev, INTEL_DSM_V18_SWITCH, &result);
+        pr_debug("%s: %s DSM error %d result %u\n",
+                 mmc_hostname(host->mmc), __func__, err, result);
+}
+
 static const struct sdhci_ops sdhci_intel_byt_ops = {
         .set_clock              = sdhci_set_clock,
         .set_power              = sdhci_intel_set_power,
@@ -565,6 +579,7 @@ static const struct sdhci_ops sdhci_intel_byt_ops = {
         .reset                  = sdhci_reset,
         .set_uhs_signaling      = sdhci_set_uhs_signaling,
         .hw_reset               = sdhci_pci_hw_reset,
+        .voltage_switch         = sdhci_intel_voltage_switch,
 };
 
 static void byt_read_dsm(struct sdhci_pci_slot *slot)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 2eec2e652c53..0842bbc2d7ad 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -466,6 +466,7 @@ static int xenon_probe(struct platform_device *pdev)
 {
         struct sdhci_pltfm_host *pltfm_host;
         struct sdhci_host *host;
+        struct xenon_priv *priv;
         int err;
 
         host = sdhci_pltfm_init(pdev, &sdhci_xenon_pdata,
@@ -474,6 +475,7 @@ static int xenon_probe(struct platform_device *pdev)
                 return PTR_ERR(host);
 
         pltfm_host = sdhci_priv(host);
+        priv = sdhci_pltfm_priv(pltfm_host);
 
         /*
          * Link Xenon specific mmc_host_ops function,
@@ -491,9 +493,20 @@ static int xenon_probe(struct platform_device *pdev)
         if (err)
                 goto free_pltfm;
 
+        priv->axi_clk = devm_clk_get(&pdev->dev, "axi");
+        if (IS_ERR(priv->axi_clk)) {
+                err = PTR_ERR(priv->axi_clk);
+                if (err == -EPROBE_DEFER)
+                        goto err_clk;
+        } else {
+                err = clk_prepare_enable(priv->axi_clk);
+                if (err)
+                        goto err_clk;
+        }
+
         err = mmc_of_parse(host->mmc);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         sdhci_get_of_property(pdev);
 
@@ -502,11 +515,11 @@ static int xenon_probe(struct platform_device *pdev)
         /* Xenon specific dt parse */
         err = xenon_probe_dt(pdev);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto err_clk;
+                goto err_clk_axi;
 
         pm_runtime_get_noresume(&pdev->dev);
         pm_runtime_set_active(&pdev->dev);
@@ -527,6 +540,8 @@ remove_sdhc:
         pm_runtime_disable(&pdev->dev);
         pm_runtime_put_noidle(&pdev->dev);
         xenon_sdhc_unprepare(host);
+err_clk_axi:
+        clk_disable_unprepare(priv->axi_clk);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -538,6 +553,7 @@ static int xenon_remove(struct platform_device *pdev)
 {
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
 
         pm_runtime_get_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
@@ -546,7 +562,7 @@ static int xenon_remove(struct platform_device *pdev)
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
-
+        clk_disable_unprepare(priv->axi_clk);
         clk_disable_unprepare(pltfm_host->clk);
 
         sdhci_pltfm_free(pdev);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 2bc0510c0769..9994995c7c56 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -83,6 +83,7 @@ struct xenon_priv {
         unsigned char   bus_width;
         unsigned char   timing;
         unsigned int    clock;
+        struct clk      *axi_clk;
 
         int             phy_type;
         /*
diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
index 12cf8288d663..a7293e186e03 100644
--- a/drivers/mmc/host/tmio_mmc_core.c
+++ b/drivers/mmc/host/tmio_mmc_core.c
@@ -129,50 +129,6 @@ static int tmio_mmc_next_sg(struct tmio_mmc_host *host)
 
 #define CMDREQ_TIMEOUT  5000
 
-#ifdef CONFIG_MMC_DEBUG
-
-#define STATUS_TO_TEXT(a, status, i) \
-        do { \
-                if ((status) & TMIO_STAT_##a) { \
-                        if ((i)++) \
-                                printk(KERN_DEBUG " | "); \
-                        printk(KERN_DEBUG #a); \
-                } \
-        } while (0)
-
-static void pr_debug_status(u32 status)
-{
-        int i = 0;
-
-        pr_debug("status: %08x = ", status);
-        STATUS_TO_TEXT(CARD_REMOVE, status, i);
-        STATUS_TO_TEXT(CARD_INSERT, status, i);
-        STATUS_TO_TEXT(SIGSTATE, status, i);
-        STATUS_TO_TEXT(WRPROTECT, status, i);
-        STATUS_TO_TEXT(CARD_REMOVE_A, status, i);
-        STATUS_TO_TEXT(CARD_INSERT_A, status, i);
-        STATUS_TO_TEXT(SIGSTATE_A, status, i);
-        STATUS_TO_TEXT(CMD_IDX_ERR, status, i);
-        STATUS_TO_TEXT(STOPBIT_ERR, status, i);
-        STATUS_TO_TEXT(ILL_FUNC, status, i);
-        STATUS_TO_TEXT(CMD_BUSY, status, i);
-        STATUS_TO_TEXT(CMDRESPEND, status, i);
-        STATUS_TO_TEXT(DATAEND, status, i);
-        STATUS_TO_TEXT(CRCFAIL, status, i);
-        STATUS_TO_TEXT(DATATIMEOUT, status, i);
-        STATUS_TO_TEXT(CMDTIMEOUT, status, i);
-        STATUS_TO_TEXT(RXOVERFLOW, status, i);
-        STATUS_TO_TEXT(TXUNDERRUN, status, i);
-        STATUS_TO_TEXT(RXRDY, status, i);
-        STATUS_TO_TEXT(TXRQ, status, i);
-        STATUS_TO_TEXT(ILL_ACCESS, status, i);
-        printk("\n");
-}
-
-#else
-#define pr_debug_status(s)  do { } while (0)
-#endif
-
 static void tmio_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
 {
         struct tmio_mmc_host *host = mmc_priv(mmc);
@@ -762,9 +718,6 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
         status = sd_ctrl_read16_and_16_as_32(host, CTL_STATUS);
         ireg = status & TMIO_MASK_IRQ & ~host->sdcard_irq_mask;
 
-        pr_debug_status(status);
-        pr_debug_status(ireg);
-
         /* Clear the status except the interrupt status */
         sd_ctrl_write32_as_16_and_16(host, CTL_STATUS, TMIO_MASK_IRQ);
 
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 5736b0c90b33..a308e707392d 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -581,6 +581,14 @@ static struct mtd_part *allocate_partition(struct mtd_info *parent,
                 slave->mtd.erasesize = parent->erasesize;
         }
 
+        /*
+         * Slave erasesize might differ from the master one if the master
+         * exposes several regions with different erasesize. Adjust
+         * wr_alignment accordingly.
+         */
+        if (!(slave->mtd.flags & MTD_NO_ERASE))
+                wr_alignment = slave->mtd.erasesize;
+
         tmp = slave->offset;
         remainder = do_div(tmp, wr_alignment);
         if ((slave->mtd.flags & MTD_WRITEABLE) && remainder) {
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index 146af8218314..8268636675ef 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -363,7 +363,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
         size += (req->ecc.strength + 1) * sizeof(u16);
         /* Reserve space for mu, dmu and delta. */
         size = ALIGN(size, sizeof(s32));
-        size += (req->ecc.strength + 1) * sizeof(s32);
+        size += (req->ecc.strength + 1) * sizeof(s32) * 3;
 
         user = kzalloc(size, GFP_KERNEL);
         if (!user)
diff --git a/drivers/mtd/nand/lpc32xx_mlc.c b/drivers/mtd/nand/lpc32xx_mlc.c
index c3bb358ef01e..5796468db653 100644
--- a/drivers/mtd/nand/lpc32xx_mlc.c
+++ b/drivers/mtd/nand/lpc32xx_mlc.c
@@ -707,7 +707,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
         }
         res = clk_prepare_enable(host->clk);
         if (res)
-                goto err_exit1;
+                goto err_put_clk;
 
         nand_chip->cmd_ctrl = lpc32xx_nand_cmd_ctrl;
         nand_chip->dev_ready = lpc32xx_nand_device_ready;
@@ -814,6 +814,7 @@ err_exit3:
                 dma_release_channel(host->dma_chan);
 err_exit2:
         clk_disable_unprepare(host->clk);
+err_put_clk:
         clk_put(host->clk);
 err_exit1:
         lpc32xx_wp_enable(host);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index bcc8cef1c615..12edaae17d81 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2668,7 +2668,7 @@ static uint8_t *nand_fill_oob(struct mtd_info *mtd, uint8_t *oob, size_t len,
 static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
                              struct mtd_oob_ops *ops)
 {
-        int chipnr, realpage, page, blockmask, column;
+        int chipnr, realpage, page, column;
         struct nand_chip *chip = mtd_to_nand(mtd);
         uint32_t writelen = ops->len;
 
@@ -2704,7 +2704,6 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
 
         realpage = (int)(to >> chip->page_shift);
         page = realpage & chip->pagemask;
-        blockmask = (1 << (chip->phys_erase_shift - chip->page_shift)) - 1;
 
         /* Invalidate the page cache, when we write to the cached page */
         if (to <= ((loff_t)chip->pagebuf << chip->page_shift) &&
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index cf1d4a15e10a..19c000722cbc 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -1784,7 +1784,7 @@ spi_nor_set_pp_settings(struct spi_nor_pp_command *pp,
  * @nor:        pointer to a 'struct spi_nor'
  * @addr:       offset in the SFDP area to start reading data from
  * @len:        number of bytes to read
- * @buf:        buffer where the SFDP data are copied into
+ * @buf:        buffer where the SFDP data are copied into (dma-safe memory)
  *
  * Whatever the actual numbers of bytes for address and dummy cycles are
  * for (Fast) Read commands, the Read SFDP (5Ah) instruction is always
@@ -1829,6 +1829,36 @@ read_err:
         return ret;
 }
 
+/**
+ * spi_nor_read_sfdp_dma_unsafe() - read Serial Flash Discoverable Parameters.
+ * @nor:        pointer to a 'struct spi_nor'
+ * @addr:       offset in the SFDP area to start reading data from
+ * @len:        number of bytes to read
+ * @buf:        buffer where the SFDP data are copied into
+ *
+ * Wrap spi_nor_read_sfdp() using a kmalloc'ed bounce buffer as @buf is now not
+ * guaranteed to be dma-safe.
+ *
+ * Return: -ENOMEM if kmalloc() fails, the return code of spi_nor_read_sfdp()
+ *          otherwise.
+ */
+static int spi_nor_read_sfdp_dma_unsafe(struct spi_nor *nor, u32 addr,
+                                        size_t len, void *buf)
+{
+        void *dma_safe_buf;
+        int ret;
+
+        dma_safe_buf = kmalloc(len, GFP_KERNEL);
+        if (!dma_safe_buf)
+                return -ENOMEM;
+
+        ret = spi_nor_read_sfdp(nor, addr, len, dma_safe_buf);
+        memcpy(buf, dma_safe_buf, len);
+        kfree(dma_safe_buf);
+
+        return ret;
+}
+
 struct sfdp_parameter_header {
         u8              id_lsb;
         u8              minor;
@@ -2101,7 +2131,7 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor,
                     bfpt_header->length * sizeof(u32));
         addr = SFDP_PARAM_HEADER_PTP(bfpt_header);
         memset(&bfpt, 0, sizeof(bfpt));
-        err = spi_nor_read_sfdp(nor,  addr, len, &bfpt);
+        err = spi_nor_read_sfdp_dma_unsafe(nor,  addr, len, &bfpt);
         if (err < 0)
                 return err;
 
@@ -2127,6 +2157,15 @@ static int spi_nor_parse_bfpt(struct spi_nor *nor,
         params->size = bfpt.dwords[BFPT_DWORD(2)];
         if (params->size & BIT(31)) {
                 params->size &= ~BIT(31);
+
+                /*
+                 * Prevent overflows on params->size. Anyway, a NOR of 2^64
+                 * bits is unlikely to exist so this error probably means
+                 * the BFPT we are reading is corrupted/wrong.
+                 */
+                if (params->size > 63)
+                        return -EINVAL;
+
                 params->size = 1ULL << params->size;
         } else {
                 params->size++;
@@ -2243,7 +2282,7 @@ static int spi_nor_parse_sfdp(struct spi_nor *nor,
         int i, err;
 
         /* Get the SFDP header. */
-        err = spi_nor_read_sfdp(nor, 0, sizeof(header), &header);
+        err = spi_nor_read_sfdp_dma_unsafe(nor, 0, sizeof(header), &header);
         if (err < 0)
                 return err;
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index c6678aa9b4ef..d74c7335c512 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -1100,6 +1100,10 @@ static int mv88e6xxx_port_check_hw_vlan(struct dsa_switch *ds, int port,
         };
         int i, err;
 
+        /* DSA and CPU ports have to be members of multiple vlans */
+        if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+                return 0;
+
         if (!vid_begin)
                 return -EOPNOTSUPP;
 
@@ -3947,7 +3951,9 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
         if (chip->irq > 0) {
                 if (chip->info->g2_irqs > 0)
                         mv88e6xxx_g2_irq_free(chip);
+                mutex_lock(&chip->reg_lock);
                 mv88e6xxx_g1_irq_free(chip);
+                mutex_unlock(&chip->reg_lock);
         }
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index 214986436ece..0fdaaa643073 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -51,6 +51,10 @@
 
 #define AQ_CFG_SKB_FRAGS_MAX   32U
 
+/* Number of descriptors available in one ring to resume this ring queue
+ */
+#define AQ_CFG_RESTART_DESC_THRES   (AQ_CFG_SKB_FRAGS_MAX * 2)
+
 #define AQ_CFG_NAPI_WEIGHT     64U
 
 #define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 6ac9e2602d6d..0a5bb4114eb4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -119,6 +119,35 @@ int aq_nic_cfg_start(struct aq_nic_s *self)
         return 0;
 }
 
+static int aq_nic_update_link_status(struct aq_nic_s *self)
+{
+        int err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
+
+        if (err)
+                return err;
+
+        if (self->link_status.mbps != self->aq_hw->aq_link_status.mbps)
+                pr_info("%s: link change old %d new %d\n",
+                        AQ_CFG_DRV_NAME, self->link_status.mbps,
+                        self->aq_hw->aq_link_status.mbps);
+
+        self->link_status = self->aq_hw->aq_link_status;
+        if (!netif_carrier_ok(self->ndev) && self->link_status.mbps) {
+                aq_utils_obj_set(&self->header.flags,
+                                 AQ_NIC_FLAG_STARTED);
+                aq_utils_obj_clear(&self->header.flags,
+                                   AQ_NIC_LINK_DOWN);
+                netif_carrier_on(self->ndev);
+                netif_tx_wake_all_queues(self->ndev);
+        }
+        if (netif_carrier_ok(self->ndev) && !self->link_status.mbps) {
+                netif_carrier_off(self->ndev);
+                netif_tx_disable(self->ndev);
+                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
+        }
+        return 0;
+}
+
 static void aq_nic_service_timer_cb(unsigned long param)
 {
         struct aq_nic_s *self = (struct aq_nic_s *)param;
@@ -131,26 +160,13 @@ static void aq_nic_service_timer_cb(unsigned long param)
         if (aq_utils_obj_test(&self->header.flags, AQ_NIC_FLAGS_IS_NOT_READY))
                 goto err_exit;
 
-        err = self->aq_hw_ops.hw_get_link_status(self->aq_hw);
-        if (err < 0)
+        err = aq_nic_update_link_status(self);
+        if (err)
                 goto err_exit;
 
-        self->link_status = self->aq_hw->aq_link_status;
-
         self->aq_hw_ops.hw_interrupt_moderation_set(self->aq_hw,
                     self->aq_nic_cfg.is_interrupt_moderation);
 
-        if (self->link_status.mbps) {
-                aq_utils_obj_set(&self->header.flags,
-                                 AQ_NIC_FLAG_STARTED);
-                aq_utils_obj_clear(&self->header.flags,
-                                   AQ_NIC_LINK_DOWN);
-                netif_carrier_on(self->ndev);
-        } else {
-                netif_carrier_off(self->ndev);
-                aq_utils_obj_set(&self->header.flags, AQ_NIC_LINK_DOWN);
-        }
-
         memset(&stats_rx, 0U, sizeof(struct aq_ring_stats_rx_s));
         memset(&stats_tx, 0U, sizeof(struct aq_ring_stats_tx_s));
         for (i = AQ_DIMOF(self->aq_vec); i--;) {
@@ -214,7 +230,6 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
         SET_NETDEV_DEV(ndev, dev);
 
         ndev->if_port = port;
-        ndev->min_mtu = ETH_MIN_MTU;
         self->ndev = ndev;
 
         self->aq_pci_func = aq_pci_func;
@@ -241,7 +256,6 @@ err_exit:
 int aq_nic_ndev_register(struct aq_nic_s *self)
 {
         int err = 0;
-        unsigned int i = 0U;
 
         if (!self->ndev) {
                 err = -EINVAL;
@@ -263,8 +277,7 @@ int aq_nic_ndev_register(struct aq_nic_s *self)
 
         netif_carrier_off(self->ndev);
 
-        for (i = AQ_CFG_VECS_MAX; i--;)
-                aq_nic_ndev_queue_stop(self, i);
+        netif_tx_disable(self->ndev);
 
         err = register_netdev(self->ndev);
         if (err < 0)
@@ -283,6 +296,7 @@ int aq_nic_ndev_init(struct aq_nic_s *self)
         self->ndev->features = aq_hw_caps->hw_features;
         self->ndev->priv_flags = aq_hw_caps->hw_priv_flags;
         self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN;
+        self->ndev->max_mtu = self->aq_hw_caps.mtu - ETH_FCS_LEN - ETH_HLEN;
 
         return 0;
 }
@@ -318,12 +332,8 @@ struct aq_nic_s *aq_nic_alloc_hot(struct net_device *ndev)
                 err = -EINVAL;
                 goto err_exit;
         }
-        if (netif_running(ndev)) {
-                unsigned int i;
-
-                for (i = AQ_CFG_VECS_MAX; i--;)
-                        netif_stop_subqueue(ndev, i);
-        }
+        if (netif_running(ndev))
+                netif_tx_disable(ndev);
 
         for (self->aq_vecs = 0; self->aq_vecs < self->aq_nic_cfg.vecs;
                 self->aq_vecs++) {
@@ -383,16 +393,6 @@ err_exit:
         return err;
 }
 
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_start_subqueue(self->ndev, idx);
-}
-
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx)
-{
-        netif_stop_subqueue(self->ndev, idx);
-}
-
 int aq_nic_start(struct aq_nic_s *self)
 {
         struct aq_vec_s *aq_vec = NULL;
@@ -451,10 +451,6 @@ int aq_nic_start(struct aq_nic_s *self)
                         goto err_exit;
         }
 
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_start(self, i);
-
         err = netif_set_real_num_tx_queues(self->ndev, self->aq_vecs);
         if (err < 0)
                 goto err_exit;
@@ -463,6 +459,8 @@ int aq_nic_start(struct aq_nic_s *self)
         if (err < 0)
                 goto err_exit;
 
+        netif_tx_start_all_queues(self->ndev);
+
 err_exit:
         return err;
 }
@@ -475,6 +473,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int frag_count = 0U;
         unsigned int dx = ring->sw_tail;
+        struct aq_ring_buff_s *first = NULL;
         struct aq_ring_buff_s *dx_buff = &ring->buff_ring[dx];
 
         if (unlikely(skb_is_gso(skb))) {
@@ -485,6 +484,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
                 dx_buff->len_l4 = tcp_hdrlen(skb);
                 dx_buff->mss = skb_shinfo(skb)->gso_size;
                 dx_buff->is_txc = 1U;
+                dx_buff->eop_index = 0xffffU;
 
                 dx_buff->is_ipv6 =
                         (ip_hdr(skb)->version == 6) ? 1U : 0U;
@@ -504,6 +504,7 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         if (unlikely(dma_mapping_error(aq_nic_get_dev(self), dx_buff->pa)))
                 goto exit;
 
+        first = dx_buff;
         dx_buff->len_pkt = skb->len;
         dx_buff->is_sop = 1U;
         dx_buff->is_mapped = 1U;
@@ -532,40 +533,46 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
 
         for (; nr_frags--; ++frag_count) {
                 unsigned int frag_len = 0U;
+                unsigned int buff_offset = 0U;
+                unsigned int buff_size = 0U;
                 dma_addr_t frag_pa;
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[frag_count];
 
                 frag_len = skb_frag_size(frag);
-                frag_pa = skb_frag_dma_map(aq_nic_get_dev(self), frag, 0,
-                                           frag_len, DMA_TO_DEVICE);
 
-                if (unlikely(dma_mapping_error(aq_nic_get_dev(self), frag_pa)))
-                        goto mapping_error;
+                while (frag_len) {
+                        if (frag_len > AQ_CFG_TX_FRAME_MAX)
+                                buff_size = AQ_CFG_TX_FRAME_MAX;
+                        else
+                                buff_size = frag_len;
+
+                        frag_pa = skb_frag_dma_map(aq_nic_get_dev(self),
+                                                   frag,
+                                                   buff_offset,
+                                                   buff_size,
+                                                   DMA_TO_DEVICE);
+
+                        if (unlikely(dma_mapping_error(aq_nic_get_dev(self),
+                                                       frag_pa)))
+                                goto mapping_error;
 
-                while (frag_len > AQ_CFG_TX_FRAME_MAX) {
                         dx = aq_ring_next_dx(ring, dx);
                         dx_buff = &ring->buff_ring[dx];
 
                         dx_buff->flags = 0U;
-                        dx_buff->len = AQ_CFG_TX_FRAME_MAX;
+                        dx_buff->len = buff_size;
                         dx_buff->pa = frag_pa;
                         dx_buff->is_mapped = 1U;
+                        dx_buff->eop_index = 0xffffU;
+
+                        frag_len -= buff_size;
+                        buff_offset += buff_size;
 
-                        frag_len -= AQ_CFG_TX_FRAME_MAX;
-                        frag_pa += AQ_CFG_TX_FRAME_MAX;
                         ++ret;
                 }
-
-                dx = aq_ring_next_dx(ring, dx);
-                dx_buff = &ring->buff_ring[dx];
-
-                dx_buff->flags = 0U;
-                dx_buff->len = frag_len;
-                dx_buff->pa = frag_pa;
-                dx_buff->is_mapped = 1U;
-                ++ret;
         }
 
+        first->eop_index = dx;
         dx_buff->is_eop = 1U;
         dx_buff->skb = skb;
         goto exit;
@@ -602,7 +609,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
         unsigned int vec = skb->queue_mapping % self->aq_nic_cfg.vecs;
         unsigned int tc = 0U;
         int err = NETDEV_TX_OK;
-        bool is_nic_in_bad_state;
 
         frags = skb_shinfo(skb)->nr_frags + 1;
 
@@ -613,13 +619,10 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                 goto err_exit;
         }
 
-        is_nic_in_bad_state = aq_utils_obj_test(&self->header.flags,
-                                                AQ_NIC_FLAGS_IS_NOT_TX_READY) ||
-                                                (aq_ring_avail_dx(ring) <
-                                                AQ_CFG_SKB_FRAGS_MAX);
+        aq_ring_update_queue_state(ring);
 
-        if (is_nic_in_bad_state) {
-                aq_nic_ndev_queue_stop(self, ring->idx);
+        /* Above status update may stop the queue. Check this. */
+        if (__netif_subqueue_stopped(self->ndev, ring->idx)) {
                 err = NETDEV_TX_BUSY;
                 goto err_exit;
         }
@@ -631,9 +634,6 @@ int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb)
                                                       ring,
                                                       frags);
                 if (err >= 0) {
-                        if (aq_ring_avail_dx(ring) < AQ_CFG_SKB_FRAGS_MAX + 1)
-                                aq_nic_ndev_queue_stop(self, ring->idx);
-
                         ++ring->stats.tx.packets;
                         ring->stats.tx.bytes += skb->len;
                 }
@@ -693,16 +693,9 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
 {
-        int err = 0;
-
-        if (new_mtu > self->aq_hw_caps.mtu) {
-                err = -EINVAL;
-                goto err_exit;
-        }
         self->aq_nic_cfg.mtu = new_mtu;
 
-err_exit:
-        return err;
+        return 0;
 }
 
 int aq_nic_set_mac(struct aq_nic_s *self, struct net_device *ndev)
@@ -905,9 +898,7 @@ int aq_nic_stop(struct aq_nic_s *self)
         struct aq_vec_s *aq_vec = NULL;
         unsigned int i = 0U;
 
-        for (i = 0U, aq_vec = self->aq_vec[0];
-                self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i])
-                aq_nic_ndev_queue_stop(self, i);
+        netif_tx_disable(self->ndev);
 
         del_timer_sync(&self->service_timer);
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index 7fc2a5ecb2b7..0ddd556ff901 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -83,8 +83,6 @@ struct net_device *aq_nic_get_ndev(struct aq_nic_s *self);
 int aq_nic_init(struct aq_nic_s *self);
 int aq_nic_cfg_start(struct aq_nic_s *self);
 int aq_nic_ndev_register(struct aq_nic_s *self);
-void aq_nic_ndev_queue_start(struct aq_nic_s *self, unsigned int idx);
-void aq_nic_ndev_queue_stop(struct aq_nic_s *self, unsigned int idx);
 void aq_nic_ndev_free(struct aq_nic_s *self);
 int aq_nic_start(struct aq_nic_s *self);
 int aq_nic_xmit(struct aq_nic_s *self, struct sk_buff *skb);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 4eee1996a825..0654e0c76bc2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -104,6 +104,38 @@ int aq_ring_init(struct aq_ring_s *self)
         return 0;
 }
 
+static inline bool aq_ring_dx_in_range(unsigned int h, unsigned int i,
+                                       unsigned int t)
+{
+        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+}
+
+void aq_ring_update_queue_state(struct aq_ring_s *ring)
+{
+        if (aq_ring_avail_dx(ring) <= AQ_CFG_SKB_FRAGS_MAX)
+                aq_ring_queue_stop(ring);
+        else if (aq_ring_avail_dx(ring) > AQ_CFG_RESTART_DESC_THRES)
+                aq_ring_queue_wake(ring);
+}
+
+void aq_ring_queue_wake(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+
+        if (__netif_subqueue_stopped(ndev, ring->idx)) {
+                netif_wake_subqueue(ndev, ring->idx);
+                ring->stats.tx.queue_restarts++;
+        }
+}
+
+void aq_ring_queue_stop(struct aq_ring_s *ring)
+{
+        struct net_device *ndev = aq_nic_get_ndev(ring->aq_nic);
+
+        if (!__netif_subqueue_stopped(ndev, ring->idx))
+                netif_stop_subqueue(ndev, ring->idx);
+}
+
 void aq_ring_tx_clean(struct aq_ring_s *self)
 {
         struct device *dev = aq_nic_get_dev(self->aq_nic);
@@ -113,23 +145,28 @@ void aq_ring_tx_clean(struct aq_ring_s *self)
                 struct aq_ring_buff_s *buff = &self->buff_ring[self->sw_head];
 
                 if (likely(buff->is_mapped)) {
-                        if (unlikely(buff->is_sop))
+                        if (unlikely(buff->is_sop)) {
+                                if (!buff->is_eop &&
+                                    buff->eop_index != 0xffffU &&
+                                    (!aq_ring_dx_in_range(self->sw_head,
+                                                buff->eop_index,
+                                                self->hw_head)))
+                                        break;
+
                                 dma_unmap_single(dev, buff->pa, buff->len,
                                                  DMA_TO_DEVICE);
-                        else
+                        } else {
                                 dma_unmap_page(dev, buff->pa, buff->len,
                                                DMA_TO_DEVICE);
+                        }
                 }
 
                 if (unlikely(buff->is_eop))
                         dev_kfree_skb_any(buff->skb);
-        }
-}
 
-static inline unsigned int aq_ring_dx_in_range(unsigned int h, unsigned int i,
-                                               unsigned int t)
-{
-        return (h < t) ? ((h < i) && (i < t)) : ((h < i) || (i < t));
+                buff->pa = 0U;
+                buff->eop_index = 0xffffU;
+        }
 }
 
 #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info))
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 782176c5f4f8..5844078764bd 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -65,7 +65,7 @@ struct __packed aq_ring_buff_s {
         };
         union {
                 struct {
-                        u32 len:16;
+                        u16 len;
                         u32 is_ip_cso:1;
                         u32 is_udp_cso:1;
                         u32 is_tcp_cso:1;
@@ -77,8 +77,10 @@ struct __packed aq_ring_buff_s {
                         u32 is_cleaned:1;
                         u32 is_error:1;
                         u32 rsvd3:6;
+                        u16 eop_index;
+                        u16 rsvd4;
                 };
-                u32 flags;
+                u64 flags;
         };
 };
 
@@ -94,6 +96,7 @@ struct aq_ring_stats_tx_s {
         u64 errors;
         u64 packets;
         u64 bytes;
+        u64 queue_restarts;
 };
 
 union aq_ring_stats_s {
@@ -147,6 +150,9 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
 int aq_ring_init(struct aq_ring_s *self);
 void aq_ring_rx_deinit(struct aq_ring_s *self);
 void aq_ring_free(struct aq_ring_s *self);
+void aq_ring_update_queue_state(struct aq_ring_s *ring);
+void aq_ring_queue_wake(struct aq_ring_s *ring);
+void aq_ring_queue_stop(struct aq_ring_s *ring);
 void aq_ring_tx_clean(struct aq_ring_s *self);
 int aq_ring_rx_clean(struct aq_ring_s *self,
                      struct napi_struct *napi,
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
index ebf588004c46..305ff8ffac2c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
@@ -59,12 +59,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
                         if (ring[AQ_VEC_TX_ID].sw_head !=
                             ring[AQ_VEC_TX_ID].hw_head) {
                                 aq_ring_tx_clean(&ring[AQ_VEC_TX_ID]);
-
-                                if (aq_ring_avail_dx(&ring[AQ_VEC_TX_ID]) >
-                                    AQ_CFG_SKB_FRAGS_MAX) {
-                                        aq_nic_ndev_queue_start(self->aq_nic,
-                                                ring[AQ_VEC_TX_ID].idx);
-                                }
+                                aq_ring_update_queue_state(&ring[AQ_VEC_TX_ID]);
                                 was_tx_cleaned = true;
                         }
 
@@ -364,6 +359,7 @@ void aq_vec_add_stats(struct aq_vec_s *self,
                 stats_tx->packets += tx->packets;
                 stats_tx->bytes += tx->bytes;
                 stats_tx->errors += tx->errors;
+                stats_tx->queue_restarts += tx->queue_restarts;
         }
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index f3957e930340..fcf89e25a773 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -16,7 +16,7 @@
 
 #include "../aq_common.h"
 
-#define HW_ATL_B0_MTU_JUMBO (16000U)
+#define HW_ATL_B0_MTU_JUMBO  16352U
 #define HW_ATL_B0_MTU        1514U
 
 #define HW_ATL_B0_TX_RINGS 4U
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
index 4f5ec9a0fbfb..bf734b32e44b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
@@ -351,8 +351,7 @@ int hw_atl_utils_mpi_get_link_status(struct aq_hw_s *self)
                         break;
 
                 default:
-                        link_status->mbps = 0U;
-                        break;
+                        return -EBUSY;
                 }
         }
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index c3c53f6cd9e6..83eec9a8c275 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -432,6 +432,27 @@ static void bcm_sysport_update_mib_counters(struct bcm_sysport_priv *priv)
         netif_dbg(priv, hw, priv->netdev, "updated MIB counters\n");
 }
 
+static void bcm_sysport_update_tx_stats(struct bcm_sysport_priv *priv,
+                                        u64 *tx_bytes, u64 *tx_packets)
+{
+        struct bcm_sysport_tx_ring *ring;
+        u64 bytes = 0, packets = 0;
+        unsigned int start;
+        unsigned int q;
+
+        for (q = 0; q < priv->netdev->num_tx_queues; q++) {
+                ring = &priv->tx_rings[q];
+                do {
+                        start = u64_stats_fetch_begin_irq(&priv->syncp);
+                        bytes = ring->bytes;
+                        packets = ring->packets;
+                } while (u64_stats_fetch_retry_irq(&priv->syncp, start));
+
+                *tx_bytes += bytes;
+                *tx_packets += packets;
+        }
+}
+
 static void bcm_sysport_get_stats(struct net_device *dev,
                                   struct ethtool_stats *stats, u64 *data)
 {
@@ -439,11 +460,16 @@ static void bcm_sysport_get_stats(struct net_device *dev,
         struct bcm_sysport_stats64 *stats64 = &priv->stats64;
         struct u64_stats_sync *syncp = &priv->syncp;
         struct bcm_sysport_tx_ring *ring;
+        u64 tx_bytes = 0, tx_packets = 0;
         unsigned int start;
         int i, j;
 
-        if (netif_running(dev))
+        if (netif_running(dev)) {
                 bcm_sysport_update_mib_counters(priv);
+                bcm_sysport_update_tx_stats(priv, &tx_bytes, &tx_packets);
+                stats64->tx_bytes = tx_bytes;
+                stats64->tx_packets = tx_packets;
+        }
 
         for (i =  0, j = 0; i < BCM_SYSPORT_STATS_LEN; i++) {
                 const struct bcm_sysport_stats *s;
@@ -461,12 +487,13 @@ static void bcm_sysport_get_stats(struct net_device *dev,
                         continue;
                 p += s->stat_offset;
 
-                if (s->stat_sizeof == sizeof(u64))
+                if (s->stat_sizeof == sizeof(u64) &&
+                    s->type == BCM_SYSPORT_STAT_NETDEV64) {
                         do {
                                 start = u64_stats_fetch_begin_irq(syncp);
                                 data[i] = *(u64 *)p;
                         } while (u64_stats_fetch_retry_irq(syncp, start));
-                else
+                } else
                         data[i] = *(u32 *)p;
                 j++;
         }
@@ -1716,27 +1743,12 @@ static void bcm_sysport_get_stats64(struct net_device *dev,
 {
         struct bcm_sysport_priv *priv = netdev_priv(dev);
         struct bcm_sysport_stats64 *stats64 = &priv->stats64;
-        struct bcm_sysport_tx_ring *ring;
-        u64 tx_packets = 0, tx_bytes = 0;
         unsigned int start;
-        unsigned int q;
 
         netdev_stats_to_stats64(stats, &dev->stats);
 
-        for (q = 0; q < dev->num_tx_queues; q++) {
-                ring = &priv->tx_rings[q];
-                do {
-                        start = u64_stats_fetch_begin_irq(&priv->syncp);
-                        tx_bytes = ring->bytes;
-                        tx_packets = ring->packets;
-                } while (u64_stats_fetch_retry_irq(&priv->syncp, start));
-
-                stats->tx_bytes += tx_bytes;
-                stats->tx_packets += tx_packets;
-        }
-
-        stats64->tx_bytes = stats->tx_bytes;
-        stats64->tx_packets = stats->tx_packets;
+        bcm_sysport_update_tx_stats(priv, &stats->tx_bytes,
+                                    &stats->tx_packets);
 
         do {
                 start = u64_stats_fetch_begin_irq(&priv->syncp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index ccd699fb2d70..7dd3d131043a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -750,6 +750,10 @@ int bnxt_tc_setup_flower(struct bnxt *bp, u16 src_fid,
 {
         int rc = 0;
 
+        if (!is_classid_clsact_ingress(cls_flower->common.classid) ||
+            cls_flower->common.chain_index)
+                return -EOPNOTSUPP;
+
         switch (cls_flower->command) {
         case TC_CLSFLOWER_REPLACE:
                 rc = bnxt_tc_add_flow(bp, src_fid, cls_flower);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index cec94bbb2ea5..8bc126a156e8 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1278,7 +1278,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
 
         ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
         if (ret)
-                return -ENOMEM;
+                goto error;
 
         n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
         for (i = 0, j = 0; i < cp->max_cid_space; i++) {
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 38c7b21e5d63..ede1876a9a19 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -374,8 +374,8 @@ struct bufdesc_ex {
 #define FEC_ENET_TS_AVAIL       ((uint)0x00010000)
 #define FEC_ENET_TS_TIMER       ((uint)0x00008000)
 
-#define FEC_DEFAULT_IMASK (FEC_ENET_TXF | FEC_ENET_RXF | FEC_ENET_MII | FEC_ENET_TS_TIMER)
-#define FEC_NAPI_IMASK  (FEC_ENET_MII | FEC_ENET_TS_TIMER)
+#define FEC_DEFAULT_IMASK (FEC_ENET_TXF | FEC_ENET_RXF | FEC_ENET_MII)
+#define FEC_NAPI_IMASK  FEC_ENET_MII
 #define FEC_RX_DISABLED_IMASK (FEC_DEFAULT_IMASK & (~FEC_ENET_RXF))
 
 /* ENET interrupt coalescing macro define */
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 56f56d6ada9c..3dc2d771a222 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1559,14 +1559,14 @@ fec_enet_collect_events(struct fec_enet_private *fep, uint int_events)
         if (int_events == 0)
                 return false;
 
-        if (int_events & FEC_ENET_RXF)
+        if (int_events & FEC_ENET_RXF_0)
                 fep->work_rx |= (1 << 2);
         if (int_events & FEC_ENET_RXF_1)
                 fep->work_rx |= (1 << 0);
         if (int_events & FEC_ENET_RXF_2)
                 fep->work_rx |= (1 << 1);
 
-        if (int_events & FEC_ENET_TXF)
+        if (int_events & FEC_ENET_TXF_0)
                 fep->work_tx |= (1 << 2);
         if (int_events & FEC_ENET_TXF_1)
                 fep->work_tx |= (1 << 0);
@@ -1604,8 +1604,8 @@ fec_enet_interrupt(int irq, void *dev_id)
         }
 
         if (fep->ptp_clock)
-                fec_ptp_check_pps_event(fep);
-
+                if (fec_ptp_check_pps_event(fep))
+                        ret = IRQ_HANDLED;
         return ret;
 }
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
index 59efbd605416..5bcb2238acb2 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -37,20 +37,15 @@ static bool hnae3_client_match(enum hnae3_client_type client_type,
 }
 
 static int hnae3_match_n_instantiate(struct hnae3_client *client,
-                                     struct hnae3_ae_dev *ae_dev,
-                                     bool is_reg, bool *matched)
+                                     struct hnae3_ae_dev *ae_dev, bool is_reg)
 {
         int ret;
 
-        *matched = false;
-
         /* check if this client matches the type of ae_dev */
         if (!(hnae3_client_match(client->type, ae_dev->dev_type) &&
               hnae_get_bit(ae_dev->flag, HNAE3_DEV_INITED_B))) {
                 return 0;
         }
-        /* there is a match of client and dev */
-        *matched = true;
 
         /* now, (un-)instantiate client by calling lower layer */
         if (is_reg) {
@@ -69,7 +64,6 @@ int hnae3_register_client(struct hnae3_client *client)
 {
         struct hnae3_client *client_tmp;
         struct hnae3_ae_dev *ae_dev;
-        bool matched;
         int ret = 0;
 
         mutex_lock(&hnae3_common_lock);
@@ -86,7 +80,7 @@ int hnae3_register_client(struct hnae3_client *client)
                 /* if the client could not be initialized on current port, for
                  * any error reasons, move on to next available port
                  */
-                ret = hnae3_match_n_instantiate(client, ae_dev, true, &matched);
+                ret = hnae3_match_n_instantiate(client, ae_dev, true);
                 if (ret)
                         dev_err(&ae_dev->pdev->dev,
                                 "match and instantiation failed for port\n");
@@ -102,12 +96,11 @@ EXPORT_SYMBOL(hnae3_register_client);
 void hnae3_unregister_client(struct hnae3_client *client)
 {
         struct hnae3_ae_dev *ae_dev;
-        bool matched;
 
         mutex_lock(&hnae3_common_lock);
         /* un-initialize the client on every matched port */
         list_for_each_entry(ae_dev, &hnae3_ae_dev_list, node) {
-                hnae3_match_n_instantiate(client, ae_dev, false, &matched);
+                hnae3_match_n_instantiate(client, ae_dev, false);
         }
 
         list_del(&client->node);
@@ -124,7 +117,6 @@ int hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo)
         const struct pci_device_id *id;
         struct hnae3_ae_dev *ae_dev;
         struct hnae3_client *client;
-        bool matched;
         int ret = 0;
 
         mutex_lock(&hnae3_common_lock);
@@ -151,13 +143,10 @@ int hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo)
                  * initialize the figure out client instance
                  */
                 list_for_each_entry(client, &hnae3_client_list, node) {
-                        ret = hnae3_match_n_instantiate(client, ae_dev, true,
-                                                        &matched);
+                        ret = hnae3_match_n_instantiate(client, ae_dev, true);
                         if (ret)
                                 dev_err(&ae_dev->pdev->dev,
                                         "match and instantiation failed\n");
-                        if (matched)
-                                break;
                 }
         }
 
@@ -175,7 +164,6 @@ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo)
         const struct pci_device_id *id;
         struct hnae3_ae_dev *ae_dev;
         struct hnae3_client *client;
-        bool matched;
 
         mutex_lock(&hnae3_common_lock);
         /* Check if there are matched ae_dev */
@@ -187,12 +175,8 @@ void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo)
                 /* check the client list for the match with this ae_dev type and
                  * un-initialize the figure out client instance
                  */
-                list_for_each_entry(client, &hnae3_client_list, node) {
-                        hnae3_match_n_instantiate(client, ae_dev, false,
-                                                  &matched);
-                        if (matched)
-                                break;
-                }
+                list_for_each_entry(client, &hnae3_client_list, node)
+                        hnae3_match_n_instantiate(client, ae_dev, false);
 
                 ae_algo->ops->uninit_ae_dev(ae_dev);
                 hnae_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
@@ -212,7 +196,6 @@ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
         const struct pci_device_id *id;
         struct hnae3_ae_algo *ae_algo;
         struct hnae3_client *client;
-        bool matched;
         int ret = 0;
 
         mutex_lock(&hnae3_common_lock);
@@ -246,13 +229,10 @@ int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev)
          * initialize the figure out client instance
          */
         list_for_each_entry(client, &hnae3_client_list, node) {
-                ret = hnae3_match_n_instantiate(client, ae_dev, true,
-                                                &matched);
+                ret = hnae3_match_n_instantiate(client, ae_dev, true);
                 if (ret)
                         dev_err(&ae_dev->pdev->dev,
                                 "match and instantiation failed\n");
-                if (matched)
-                        break;
         }
 
 out_err:
@@ -270,7 +250,6 @@ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev)
         const struct pci_device_id *id;
         struct hnae3_ae_algo *ae_algo;
         struct hnae3_client *client;
-        bool matched;
 
         mutex_lock(&hnae3_common_lock);
         /* Check if there are matched ae_algo */
@@ -279,12 +258,8 @@ void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev)
                 if (!id)
                         continue;
 
-                list_for_each_entry(client, &hnae3_client_list, node) {
-                        hnae3_match_n_instantiate(client, ae_dev, false,
-                                                  &matched);
-                        if (matched)
-                                break;
-                }
+                list_for_each_entry(client, &hnae3_client_list, node)
+                        hnae3_match_n_instantiate(client, ae_dev, false);
 
                 ae_algo->ops->uninit_ae_dev(ae_dev);
                 hnae_set_bit(ae_dev->flag, HNAE3_DEV_INITED_B, 0);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index b2f28ae81273..1a01cadfe5f3 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -49,7 +49,17 @@
 #define HNAE3_CLASS_NAME_SIZE 16
 
 #define HNAE3_DEV_INITED_B                      0x0
-#define HNAE_DEV_SUPPORT_ROCE_B                 0x1
+#define HNAE3_DEV_SUPPORT_ROCE_B                0x1
+#define HNAE3_DEV_SUPPORT_DCB_B                 0x2
+
+#define HNAE3_DEV_SUPPORT_ROCE_DCB_BITS (BIT(HNAE3_DEV_SUPPORT_DCB_B) |\
+                BIT(HNAE3_DEV_SUPPORT_ROCE_B))
+
+#define hnae3_dev_roce_supported(hdev) \
+        hnae_get_bit(hdev->ae_dev->flag, HNAE3_DEV_SUPPORT_ROCE_B)
+
+#define hnae3_dev_dcb_supported(hdev) \
+        hnae_get_bit(hdev->ae_dev->flag, HNAE3_DEV_SUPPORT_DCB_B)
 
 #define ring_ptr_move_fw(ring, p) \
         ((ring)->p = ((ring)->p + 1) % (ring)->desc_num)
@@ -366,12 +376,12 @@ struct hnae3_ae_algo {
 struct hnae3_tc_info {
         u16     tqp_offset;     /* TQP offset from base TQP */
         u16     tqp_count;      /* Total TQPs */
-        u8      up;             /* user priority */
         u8      tc;             /* TC index */
         bool    enable;         /* If this TC is enable or not */
 };
 
 #define HNAE3_MAX_TC            8
+#define HNAE3_MAX_USER_PRIO     8
 struct hnae3_knic_private_info {
         struct net_device *netdev; /* Set by KNIC client when init instance */
         u16 rss_size;              /* Allocated RSS queues */
@@ -379,6 +389,7 @@ struct hnae3_knic_private_info {
         u16 num_desc;
 
         u8 num_tc;                 /* Total number of enabled TCs */
+        u8 prio_tc[HNAE3_MAX_USER_PRIO];  /* TC indexed by prio */
         struct hnae3_tc_info tc_info[HNAE3_MAX_TC]; /* Idx of array is HW TC */
 
         u16 num_tqps;             /* total number of TQPs in this handle */
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
index 91ae0135ee50..758cf3948131 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
@@ -238,7 +238,7 @@ struct hclge_tqp_map {
         u8 rsv[18];
 };
 
-#define HCLGE_VECTOR_ELEMENTS_PER_CMD   11
+#define HCLGE_VECTOR_ELEMENTS_PER_CMD   10
 
 enum hclge_int_type {
         HCLGE_INT_TX,
@@ -252,8 +252,12 @@ struct hclge_ctrl_vector_chain {
 #define HCLGE_INT_TYPE_S        0
 #define HCLGE_INT_TYPE_M        0x3
 #define HCLGE_TQP_ID_S          2
-#define HCLGE_TQP_ID_M          (0x3fff << HCLGE_TQP_ID_S)
+#define HCLGE_TQP_ID_M          (0x7ff << HCLGE_TQP_ID_S)
+#define HCLGE_INT_GL_IDX_S      13
+#define HCLGE_INT_GL_IDX_M      (0x3 << HCLGE_INT_GL_IDX_S)
         __le16 tqp_type_and_id[HCLGE_VECTOR_ELEMENTS_PER_CMD];
+        u8 vfid;
+        u8 rsv;
 };
 
 #define HCLGE_TC_NUM            8
@@ -266,7 +270,8 @@ struct hclge_tx_buff_alloc {
 
 struct hclge_rx_priv_buff {
         __le16 buf_num[HCLGE_TC_NUM];
-        u8 rsv[8];
+        __le16 shared_buf;
+        u8 rsv[6];
 };
 
 struct hclge_query_version {
@@ -684,6 +689,7 @@ struct hclge_reset_tqp_queue {
 #define HCLGE_DEFAULT_TX_BUF            0x4000   /* 16k  bytes */
 #define HCLGE_TOTAL_PKT_BUF             0x108000 /* 1.03125M bytes */
 #define HCLGE_DEFAULT_DV                0xA000   /* 40k byte */
+#define HCLGE_DEFAULT_NON_DCB_DV        0x7800  /* 30K byte */
 
 #define HCLGE_TYPE_CRQ                  0
 #define HCLGE_TYPE_CSQ                  1
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index bb45365fb817..c1cdbfd83bdb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -46,17 +46,7 @@ static const struct pci_device_id ae_algo_pci_tbl[] = {
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 0},
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 0},
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 0},
-        /* Required last entry */
-        {0, }
-};
-
-static const struct pci_device_id roce_pci_tbl[] = {
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 0},
-        /* Required last entry */
+        /* required last entry */
         {0, }
 };
 
@@ -894,7 +884,7 @@ static int hclge_query_pf_resource(struct hclge_dev *hdev)
         hdev->num_tqps = __le16_to_cpu(req->tqp_num);
         hdev->pkt_buf_size = __le16_to_cpu(req->buf_size) << HCLGE_BUF_UNIT_S;
 
-        if (hnae_get_bit(hdev->ae_dev->flag, HNAE_DEV_SUPPORT_ROCE_B)) {
+        if (hnae3_dev_roce_supported(hdev)) {
                 hdev->num_roce_msix =
                 hnae_get_field(__le16_to_cpu(req->pf_intr_vector_number),
                                HCLGE_PF_VEC_NUM_M, HCLGE_PF_VEC_NUM_S);
@@ -1063,9 +1053,9 @@ static int hclge_configure(struct hclge_dev *hdev)
         hdev->base_tqp_pid = 0;
         hdev->rss_size_max = 1;
         hdev->rx_buf_len = cfg.rx_buf_len;
-        for (i = 0; i < ETH_ALEN; i++)
-                hdev->hw.mac.mac_addr[i] = cfg.mac_addr[i];
+        ether_addr_copy(hdev->hw.mac.mac_addr, cfg.mac_addr);
         hdev->hw.mac.media_type = cfg.media_type;
+        hdev->hw.mac.phy_addr = cfg.phy_addr;
         hdev->num_desc = cfg.tqp_desc_num;
         hdev->tm_info.num_pg = 1;
         hdev->tm_info.num_tc = cfg.tc_num;
@@ -1454,7 +1444,11 @@ static bool  hclge_is_rx_buf_ok(struct hclge_dev *hdev, u32 rx_all)
         tc_num = hclge_get_tc_num(hdev);
         pfc_enable_num = hclge_get_pfc_enalbe_num(hdev);
 
-        shared_buf_min = 2 * hdev->mps + HCLGE_DEFAULT_DV;
+        if (hnae3_dev_dcb_supported(hdev))
+                shared_buf_min = 2 * hdev->mps + HCLGE_DEFAULT_DV;
+        else
+                shared_buf_min = 2 * hdev->mps + HCLGE_DEFAULT_NON_DCB_DV;
+
         shared_buf_tc = pfc_enable_num * hdev->mps +
                         (tc_num - pfc_enable_num) * hdev->mps / 2 +
                         hdev->mps;
@@ -1495,6 +1489,16 @@ int hclge_rx_buffer_calc(struct hclge_dev *hdev, u32 tx_size)
         struct hclge_priv_buf *priv;
         int i;
 
+        /* When DCB is not supported, rx private
+         * buffer is not allocated.
+         */
+        if (!hnae3_dev_dcb_supported(hdev)) {
+                if (!hclge_is_rx_buf_ok(hdev, rx_all))
+                        return -ENOMEM;
+
+                return 0;
+        }
+
         /* step 1, try to alloc private buffer for all enabled tc */
         for (i = 0; i < HCLGE_MAX_TC_NUM; i++) {
                 priv = &hdev->priv_buf[i];
@@ -1510,6 +1514,11 @@ int hclge_rx_buffer_calc(struct hclge_dev *hdev, u32 tx_size)
                                 priv->wl.high = 2 * hdev->mps;
                                 priv->buf_size = priv->wl.high;
                         }
+                } else {
+                        priv->enable = 0;
+                        priv->wl.low = 0;
+                        priv->wl.high = 0;
+                        priv->buf_size = 0;
                 }
         }
 
@@ -1522,8 +1531,15 @@ int hclge_rx_buffer_calc(struct hclge_dev *hdev, u32 tx_size)
         for (i = 0; i < HCLGE_MAX_TC_NUM; i++) {
                 priv = &hdev->priv_buf[i];
 
-                if (hdev->hw_tc_map & BIT(i))
-                        priv->enable = 1;
+                priv->enable = 0;
+                priv->wl.low = 0;
+                priv->wl.high = 0;
+                priv->buf_size = 0;
+
+                if (!(hdev->hw_tc_map & BIT(i)))
+                        continue;
+
+                priv->enable = 1;
 
                 if (hdev->tm_info.hw_pfc_map & BIT(i)) {
                         priv->wl.low = 128;
@@ -1616,6 +1632,10 @@ static int hclge_rx_priv_buf_alloc(struct hclge_dev *hdev)
                         cpu_to_le16(true << HCLGE_TC0_PRI_BUF_EN_B);
         }
 
+        req->shared_buf =
+                cpu_to_le16((hdev->s_buf.buf_size >> HCLGE_BUF_UNIT_S) |
+                            (1 << HCLGE_TC0_PRI_BUF_EN_B));
+
         ret = hclge_cmd_send(&hdev->hw, &desc, 1);
         if (ret) {
                 dev_err(&hdev->pdev->dev,
@@ -1782,18 +1802,22 @@ int hclge_buffer_alloc(struct hclge_dev *hdev)
                 return ret;
         }
 
-        ret = hclge_rx_priv_wl_config(hdev);
-        if (ret) {
-                dev_err(&hdev->pdev->dev,
-                        "could not configure rx private waterline %d\n", ret);
-                return ret;
-        }
+        if (hnae3_dev_dcb_supported(hdev)) {
+                ret = hclge_rx_priv_wl_config(hdev);
+                if (ret) {
+                        dev_err(&hdev->pdev->dev,
+                                "could not configure rx private waterline %d\n",
+                                ret);
+                        return ret;
+                }
 
-        ret = hclge_common_thrd_config(hdev);
-        if (ret) {
-                dev_err(&hdev->pdev->dev,
-                        "could not configure common threshold %d\n", ret);
-                return ret;
+                ret = hclge_common_thrd_config(hdev);
+                if (ret) {
+                        dev_err(&hdev->pdev->dev,
+                                "could not configure common threshold %d\n",
+                                ret);
+                        return ret;
+                }
         }
 
         ret = hclge_common_wl_config(hdev);
@@ -2582,6 +2606,7 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
         u16 tc_valid[HCLGE_MAX_TC_NUM];
         u16 tc_size[HCLGE_MAX_TC_NUM];
         u32 *rss_indir = NULL;
+        u16 rss_size = 0, roundup_size;
         const u8 *key;
         int i, ret, j;
 
@@ -2596,7 +2621,13 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
         for (j = 0; j < hdev->num_vmdq_vport + 1; j++) {
                 for (i = 0; i < HCLGE_RSS_IND_TBL_SIZE; i++) {
                         vport[j].rss_indirection_tbl[i] =
-                                i % hdev->rss_size_max;
+                                i % vport[j].alloc_rss_size;
+
+                        /* vport 0 is for PF */
+                        if (j != 0)
+                                continue;
+
+                        rss_size = vport[j].alloc_rss_size;
                         rss_indir[i] = vport[j].rss_indirection_tbl[i];
                 }
         }
@@ -2613,42 +2644,32 @@ static int hclge_rss_init_hw(struct hclge_dev *hdev)
         if (ret)
                 goto err;
 
+        /* Each TC have the same queue size, and tc_size set to hardware is
+         * the log2 of roundup power of two of rss_size, the acutal queue
+         * size is limited by indirection table.
+         */
+        if (rss_size > HCLGE_RSS_TC_SIZE_7 || rss_size == 0) {
+                dev_err(&hdev->pdev->dev,
+                        "Configure rss tc size failed, invalid TC_SIZE = %d\n",
+                        rss_size);
+                ret = -EINVAL;
+                goto err;
+        }
+
+        roundup_size = roundup_pow_of_two(rss_size);
+        roundup_size = ilog2(roundup_size);
+
         for (i = 0; i < HCLGE_MAX_TC_NUM; i++) {
-                if (hdev->hw_tc_map & BIT(i))
-                        tc_valid[i] = 1;
-                else
-                        tc_valid[i] = 0;
+                tc_valid[i] = 0;
 
-                switch (hdev->rss_size_max) {
-                case HCLGE_RSS_TC_SIZE_0:
-                        tc_size[i] = 0;
-                        break;
-                case HCLGE_RSS_TC_SIZE_1:
-                        tc_size[i] = 1;
-                        break;
-                case HCLGE_RSS_TC_SIZE_2:
-                        tc_size[i] = 2;
-                        break;
-                case HCLGE_RSS_TC_SIZE_3:
-                        tc_size[i] = 3;
-                        break;
-                case HCLGE_RSS_TC_SIZE_4:
-                        tc_size[i] = 4;
-                        break;
-                case HCLGE_RSS_TC_SIZE_5:
-                        tc_size[i] = 5;
-                        break;
-                case HCLGE_RSS_TC_SIZE_6:
-                        tc_size[i] = 6;
-                        break;
-                case HCLGE_RSS_TC_SIZE_7:
-                        tc_size[i] = 7;
-                        break;
-                default:
-                        break;
-                }
-                tc_offset[i] = hdev->rss_size_max * i;
+                if (!(hdev->hw_tc_map & BIT(i)))
+                        continue;
+
+                tc_valid[i] = 1;
+                tc_size[i] = roundup_size;
+                tc_offset[i] = rss_size * i;
         }
+
         ret = hclge_set_rss_tc_mode(hdev, tc_valid, tc_size, tc_offset);
 
 err:
@@ -2679,7 +2700,11 @@ int hclge_map_vport_ring_to_vector(struct hclge_vport *vport, int vector_id,
                                hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
                 hnae_set_field(req->tqp_type_and_id[i], HCLGE_TQP_ID_M,
                                HCLGE_TQP_ID_S,  node->tqp_index);
+                hnae_set_field(req->tqp_type_and_id[i], HCLGE_INT_GL_IDX_M,
+                               HCLGE_INT_GL_IDX_S,
+                               hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
                 req->tqp_type_and_id[i] = cpu_to_le16(req->tqp_type_and_id[i]);
+                req->vfid = vport->vport_id;
 
                 if (++i >= HCLGE_VECTOR_ELEMENTS_PER_CMD) {
                         req->int_cause_num = HCLGE_VECTOR_ELEMENTS_PER_CMD;
@@ -2763,8 +2788,12 @@ static int hclge_unmap_ring_from_vector(
                                hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
                 hnae_set_field(req->tqp_type_and_id[i], HCLGE_TQP_ID_M,
                                HCLGE_TQP_ID_S,  node->tqp_index);
+                hnae_set_field(req->tqp_type_and_id[i], HCLGE_INT_GL_IDX_M,
+                               HCLGE_INT_GL_IDX_S,
+                               hnae_get_bit(node->flag, HNAE3_RING_TYPE_B));
 
                 req->tqp_type_and_id[i] = cpu_to_le16(req->tqp_type_and_id[i]);
+                req->vfid = vport->vport_id;
 
                 if (++i >= HCLGE_VECTOR_ELEMENTS_PER_CMD) {
                         req->int_cause_num = HCLGE_VECTOR_ELEMENTS_PER_CMD;
@@ -2778,7 +2807,7 @@ static int hclge_unmap_ring_from_vector(
                         }
                         i = 0;
                         hclge_cmd_setup_basic_desc(&desc,
-                                                   HCLGE_OPC_ADD_RING_TO_VECTOR,
+                                                   HCLGE_OPC_DEL_RING_TO_VECTOR,
                                                    false);
                         req->int_vector_id = vector_id;
                 }
@@ -3665,6 +3694,7 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
 {
 #define HCLGE_VLAN_TYPE_VF_TABLE   0
 #define HCLGE_VLAN_TYPE_PORT_TABLE 1
+        struct hnae3_handle *handle;
         int ret;
 
         ret = hclge_set_vlan_filter_ctrl(hdev, HCLGE_VLAN_TYPE_VF_TABLE,
@@ -3674,8 +3704,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
 
         ret = hclge_set_vlan_filter_ctrl(hdev, HCLGE_VLAN_TYPE_PORT_TABLE,
                                          true);
+        if (ret)
+                return ret;
 
-        return ret;
+        handle = &hdev->vport[0].nic;
+        return hclge_set_port_vlan_filter(handle, htons(ETH_P_8021Q), 0, false);
 }
 
 static int hclge_set_mtu(struct hnae3_handle *handle, int new_mtu)
@@ -3920,8 +3953,7 @@ static int hclge_init_client_instance(struct hnae3_client *client,
                                 goto err;
 
                         if (hdev->roce_client &&
-                            hnae_get_bit(hdev->ae_dev->flag,
-                                         HNAE_DEV_SUPPORT_ROCE_B)) {
+                            hnae3_dev_roce_supported(hdev)) {
                                 struct hnae3_client *rc = hdev->roce_client;
 
                                 ret = hclge_init_roce_base_info(vport);
@@ -3944,8 +3976,7 @@ static int hclge_init_client_instance(struct hnae3_client *client,
 
                         break;
                 case HNAE3_CLIENT_ROCE:
-                        if (hnae_get_bit(hdev->ae_dev->flag,
-                                         HNAE_DEV_SUPPORT_ROCE_B)) {
+                        if (hnae3_dev_roce_supported(hdev)) {
                                 hdev->roce_client = client;
                                 vport->roce.client = client;
                         }
@@ -4057,7 +4088,6 @@ static void hclge_pci_uninit(struct hclge_dev *hdev)
 static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
 {
         struct pci_dev *pdev = ae_dev->pdev;
-        const struct pci_device_id *id;
         struct hclge_dev *hdev;
         int ret;
 
@@ -4072,10 +4102,6 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
         hdev->ae_dev = ae_dev;
         ae_dev->priv = hdev;
 
-        id = pci_match_id(roce_pci_tbl, ae_dev->pdev);
-        if (id)
-                hnae_set_bit(ae_dev->flag, HNAE_DEV_SUPPORT_ROCE_B, 1);
-
         ret = hclge_pci_init(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "PCI init failed\n");
@@ -4138,12 +4164,6 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
                 return ret;
         }
 
-        ret = hclge_rss_init_hw(hdev);
-        if (ret) {
-                dev_err(&pdev->dev, "Rss init fail, ret =%d\n", ret);
-                return  ret;
-        }
-
         ret = hclge_init_vlan_config(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "VLAN init fail, ret =%d\n", ret);
@@ -4156,6 +4176,12 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
                 return ret;
         }
 
+        ret = hclge_rss_init_hw(hdev);
+        if (ret) {
+                dev_err(&pdev->dev, "Rss init fail, ret =%d\n", ret);
+                return ret;
+        }
+
         setup_timer(&hdev->service_timer, hclge_service_timer,
                     (unsigned long)hdev);
         INIT_WORK(&hdev->service_task, hclge_service_task);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index edb10ad075eb..9fcfd9395424 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -176,7 +176,6 @@ struct hclge_pg_info {
 struct hclge_tc_info {
         u8 tc_id;
         u8 tc_sch_mode;         /* 0: sp; 1: dwrr */
-        u8 up;
         u8 pgid;
         u32 bw_limit;
 };
@@ -197,6 +196,7 @@ struct hclge_tm_info {
         u8 num_tc;
         u8 num_pg;      /* It must be 1 if vNET-Base schd */
         u8 pg_dwrr[HCLGE_PG_NUM];
+        u8 prio_tc[HNAE3_MAX_USER_PRIO];
         struct hclge_pg_info pg_info[HCLGE_PG_NUM];
         struct hclge_tc_info tc_info[HNAE3_MAX_TC];
         enum hclge_fc_mode fc_mode;
@@ -477,6 +477,7 @@ struct hclge_vport {
         u8  rss_hash_key[HCLGE_RSS_KEY_SIZE]; /* User configured hash keys */
         /* User configured lookup table entries */
         u8  rss_indirection_tbl[HCLGE_RSS_IND_TBL_SIZE];
+        u16 alloc_rss_size;
 
         u16 qs_offset;
         u16 bw_limit;           /* VSI BW Limit (0 = disabled) */
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 1c577d268f00..73a75d7cc551 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -128,9 +128,7 @@ static int hclge_fill_pri_array(struct hclge_dev *hdev, u8 *pri, u8 pri_id)
 {
         u8 tc;
 
-        for (tc = 0; tc < hdev->tm_info.num_tc; tc++)
-                if (hdev->tm_info.tc_info[tc].up == pri_id)
-                        break;
+        tc = hdev->tm_info.prio_tc[pri_id];
 
         if (tc >= hdev->tm_info.num_tc)
                 return -EINVAL;
@@ -158,7 +156,7 @@ static int hclge_up_to_tc_map(struct hclge_dev *hdev)
 
         hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_PRI_TO_TC_MAPPING, false);
 
-        for (pri_id = 0; pri_id < hdev->tm_info.num_tc; pri_id++) {
+        for (pri_id = 0; pri_id < HNAE3_MAX_USER_PRIO; pri_id++) {
                 ret = hclge_fill_pri_array(hdev, pri, pri_id);
                 if (ret)
                         return ret;
@@ -280,11 +278,11 @@ static int hclge_tm_pg_shapping_cfg(struct hclge_dev *hdev,
 
         shap_cfg_cmd->pg_id = pg_id;
 
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, IR_B, ir_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, IR_U, ir_u);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, IR_S, ir_s);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, BS_B, bs_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pg_shapping_para, BS_S, bs_s);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, IR_B, ir_b);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, IR_U, ir_u);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, IR_S, ir_s);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, BS_B, bs_b);
+        hclge_tm_set_field(shap_cfg_cmd->pg_shapping_para, BS_S, bs_s);
 
         return hclge_cmd_send(&hdev->hw, &desc, 1);
 }
@@ -307,11 +305,11 @@ static int hclge_tm_pri_shapping_cfg(struct hclge_dev *hdev,
 
         shap_cfg_cmd->pri_id = pri_id;
 
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, IR_B, ir_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, IR_U, ir_u);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, IR_S, ir_s);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, BS_B, bs_b);
-        hclge_tm_set_feild(shap_cfg_cmd->pri_shapping_para, BS_S, bs_s);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, IR_B, ir_b);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, IR_U, ir_u);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, IR_S, ir_s);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, BS_B, bs_b);
+        hclge_tm_set_field(shap_cfg_cmd->pri_shapping_para, BS_S, bs_s);
 
         return hclge_cmd_send(&hdev->hw, &desc, 1);
 }
@@ -397,6 +395,7 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport)
                         kinfo->num_tqps / kinfo->num_tc);
         vport->qs_offset = hdev->tm_info.num_tc * vport->vport_id;
         vport->dwrr = 100;  /* 100 percent as init */
+        vport->alloc_rss_size = kinfo->rss_size;
 
         for (i = 0; i < kinfo->num_tc; i++) {
                 if (hdev->hw_tc_map & BIT(i)) {
@@ -404,16 +403,17 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport)
                         kinfo->tc_info[i].tqp_offset = i * kinfo->rss_size;
                         kinfo->tc_info[i].tqp_count = kinfo->rss_size;
                         kinfo->tc_info[i].tc = i;
-                        kinfo->tc_info[i].up = hdev->tm_info.tc_info[i].up;
                 } else {
                         /* Set to default queue if TC is disable */
                         kinfo->tc_info[i].enable = false;
                         kinfo->tc_info[i].tqp_offset = 0;
                         kinfo->tc_info[i].tqp_count = 1;
                         kinfo->tc_info[i].tc = 0;
-                        kinfo->tc_info[i].up = 0;
                 }
         }
+
+        memcpy(kinfo->prio_tc, hdev->tm_info.prio_tc,
+               FIELD_SIZEOF(struct hnae3_knic_private_info, prio_tc));
 }
 
 static void hclge_tm_vport_info_update(struct hclge_dev *hdev)
@@ -435,12 +435,15 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)
         for (i = 0; i < hdev->tm_info.num_tc; i++) {
                 hdev->tm_info.tc_info[i].tc_id = i;
                 hdev->tm_info.tc_info[i].tc_sch_mode = HCLGE_SCH_MODE_DWRR;
-                hdev->tm_info.tc_info[i].up = i;
                 hdev->tm_info.tc_info[i].pgid = 0;
                 hdev->tm_info.tc_info[i].bw_limit =
                         hdev->tm_info.pg_info[0].bw_limit;
         }
 
+        for (i = 0; i < HNAE3_MAX_USER_PRIO; i++)
+                hdev->tm_info.prio_tc[i] =
+                        (i >= hdev->tm_info.num_tc) ? 0 : i;
+
         hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
 }
 
@@ -976,6 +979,10 @@ int hclge_pause_setup_hw(struct hclge_dev *hdev)
         if (ret)
                 return ret;
 
+        /* Only DCB-supported dev supports qset back pressure setting */
+        if (!hnae3_dev_dcb_supported(hdev))
+                return 0;
+
         for (i = 0; i < hdev->tm_info.num_tc; i++) {
                 ret = hclge_tm_qs_bp_cfg(hdev, i);
                 if (ret)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
index 7e67337dfaf2..85158b0d73fe 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h
@@ -94,10 +94,10 @@ struct hclge_bp_to_qs_map_cmd {
         u32 rsvd1;
 };
 
-#define hclge_tm_set_feild(dest, string, val) \
+#define hclge_tm_set_field(dest, string, val) \
                         hnae_set_field((dest), (HCLGE_TM_SHAP_##string##_MSK), \
                                        (HCLGE_TM_SHAP_##string##_LSH), val)
-#define hclge_tm_get_feild(src, string) \
+#define hclge_tm_get_field(src, string) \
                         hnae_get_field((src), (HCLGE_TM_SHAP_##string##_MSK), \
                                        (HCLGE_TM_SHAP_##string##_LSH))
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
index 1c3e29447891..35369e1c8036 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
@@ -41,11 +41,16 @@ static struct hnae3_client client;
 static const struct pci_device_id hns3_pci_tbl[] = {
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_GE), 0},
         {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 0},
-        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 0},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
+        {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC),
+         HNAE3_DEV_SUPPORT_ROCE_DCB_BITS},
         /* required last entry */
         {0, }
 };
@@ -1348,6 +1353,7 @@ static int hns3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         ae_dev->pdev = pdev;
+        ae_dev->flag = ent->driver_data;
         ae_dev->dev_type = HNAE3_DEV_KNIC;
         pci_set_drvdata(pdev, ae_dev);
 
@@ -2705,10 +2711,11 @@ static void hns3_init_mac_addr(struct net_device *netdev)
                 eth_hw_addr_random(netdev);
                 dev_warn(priv->dev, "using random MAC address %pM\n",
                          netdev->dev_addr);
-                /* Also copy this new MAC address into hdev */
-                if (h->ae_algo->ops->set_mac_addr)
-                        h->ae_algo->ops->set_mac_addr(h, netdev->dev_addr);
         }
+
+        if (h->ae_algo->ops->set_mac_addr)
+                h->ae_algo->ops->set_mac_addr(h, netdev->dev_addr);
+
 }
 
 static void hns3_nic_set_priv_ops(struct net_device *netdev)
diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
index 2c74baa2398a..fff09dcf9e34 100644
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *napi, int budget)
         unsigned long flags;
 
         MAL_DBG2(mal, "poll(%d)" NL, budget);
- again:
+
         /* Process TX skbs */
         list_for_each(l, &mal->poll_list) {
                 struct mal_commac *mc =
@@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *napi, int budget)
                         spin_lock_irqsave(&mal->lock, flags);
                         mal_disable_eob_irq(mal);
                         spin_unlock_irqrestore(&mal->lock, flags);
-                        goto again;
                 }
                 mc->ops->poll_tx(mc->dev);
         }
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index dd0ee2691c86..9c86cb7cb988 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -333,7 +333,7 @@
 #define     MVPP2_GMAC_INBAND_AN_MASK           BIT(0)
 #define     MVPP2_GMAC_FLOW_CTRL_MASK           GENMASK(2, 1)
 #define     MVPP2_GMAC_PCS_ENABLE_MASK          BIT(3)
-#define     MVPP2_GMAC_PORT_RGMII_MASK          BIT(4)
+#define     MVPP2_GMAC_INTERNAL_CLK_MASK        BIT(4)
 #define     MVPP2_GMAC_DISABLE_PADDING          BIT(5)
 #define     MVPP2_GMAC_PORT_RESET_MASK          BIT(6)
 #define MVPP2_GMAC_AUTONEG_CONFIG               0xc
@@ -676,6 +676,7 @@ enum mvpp2_tag_type {
 #define MVPP2_PRS_RI_L3_MCAST                   BIT(15)
 #define MVPP2_PRS_RI_L3_BCAST                   (BIT(15) | BIT(16))
 #define MVPP2_PRS_RI_IP_FRAG_MASK               0x20000
+#define MVPP2_PRS_RI_IP_FRAG_TRUE               BIT(17)
 #define MVPP2_PRS_RI_UDF3_MASK                  0x300000
 #define MVPP2_PRS_RI_UDF3_RX_SPECIAL            BIT(21)
 #define MVPP2_PRS_RI_L4_PROTO_MASK              0x1c00000
@@ -792,6 +793,7 @@ struct mvpp2 {
         struct clk *pp_clk;
         struct clk *gop_clk;
         struct clk *mg_clk;
+        struct clk *axi_clk;
 
         /* List of pointers to port structures */
         struct mvpp2_port **port_list;
@@ -2315,7 +2317,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
             (proto != IPPROTO_IGMP))
                 return -EINVAL;
 
-        /* Fragmented packet */
+        /* Not fragmented packet */
         tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                         MVPP2_PE_LAST_FREE_TID);
         if (tid < 0)
@@ -2334,8 +2336,12 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
                                   MVPP2_PRS_SRAM_OP_SEL_UDF_ADD);
         mvpp2_prs_sram_ai_update(&pe, MVPP2_PRS_IPV4_DIP_AI_BIT,
                                  MVPP2_PRS_IPV4_DIP_AI_BIT);
-        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_MASK,
-                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+        mvpp2_prs_sram_ri_update(&pe, ri, ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK_L);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00,
+                                     MVPP2_PRS_TCAM_PROTO_MASK);
 
         mvpp2_prs_tcam_data_byte_set(&pe, 5, proto, MVPP2_PRS_TCAM_PROTO_MASK);
         mvpp2_prs_tcam_ai_update(&pe, 0, MVPP2_PRS_IPV4_DIP_AI_BIT);
@@ -2346,7 +2352,7 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
         mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
         mvpp2_prs_hw_write(priv, &pe);
 
-        /* Not fragmented packet */
+        /* Fragmented packet */
         tid = mvpp2_prs_tcam_first_free(priv, MVPP2_PE_FIRST_FREE_TID,
                                         MVPP2_PE_LAST_FREE_TID);
         if (tid < 0)
@@ -2358,8 +2364,11 @@ static int mvpp2_prs_ip4_proto(struct mvpp2 *priv, unsigned short proto,
         pe.sram.word[MVPP2_PRS_SRAM_RI_CTRL_WORD] = 0x0;
         mvpp2_prs_sram_ri_update(&pe, ri, ri_mask);
 
-        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, MVPP2_PRS_TCAM_PROTO_MASK_L);
-        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, MVPP2_PRS_TCAM_PROTO_MASK);
+        mvpp2_prs_sram_ri_update(&pe, ri | MVPP2_PRS_RI_IP_FRAG_TRUE,
+                                 ri_mask | MVPP2_PRS_RI_IP_FRAG_MASK);
+
+        mvpp2_prs_tcam_data_byte_set(&pe, 2, 0x00, 0x0);
+        mvpp2_prs_tcam_data_byte_set(&pe, 3, 0x00, 0x0);
 
         /* Update shadow table and hw entry */
         mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_IP4);
@@ -4591,7 +4600,6 @@ static void mvpp2_port_mii_gmac_configure(struct mvpp2_port *port)
                 val |= MVPP2_GMAC_INBAND_AN_MASK | MVPP2_GMAC_PCS_ENABLE_MASK;
         } else if (phy_interface_mode_is_rgmii(port->phy_interface)) {
                 val &= ~MVPP2_GMAC_PCS_ENABLE_MASK;
-                val |= MVPP2_GMAC_PORT_RGMII_MASK;
         }
         writel(val, port->base + MVPP2_GMAC_CTRL_2_REG);
 
@@ -7496,7 +7504,7 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv,
 /* Ports initialization */
 static int mvpp2_port_probe(struct platform_device *pdev,
                             struct device_node *port_node,
-                            struct mvpp2 *priv)
+                            struct mvpp2 *priv, int index)
 {
         struct device_node *phy_node;
         struct phy *comphy;
@@ -7670,7 +7678,7 @@ static int mvpp2_port_probe(struct platform_device *pdev,
         }
         netdev_info(dev, "Using %s mac address %pM\n", mac_from, dev->dev_addr);
 
-        priv->port_list[id] = port;
+        priv->port_list[index] = port;
         return 0;
 
 err_free_port_pcpu:
@@ -7963,6 +7971,18 @@ static int mvpp2_probe(struct platform_device *pdev)
                 err = clk_prepare_enable(priv->mg_clk);
                 if (err < 0)
                         goto err_gop_clk;
+
+                priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
+                if (IS_ERR(priv->axi_clk)) {
+                        err = PTR_ERR(priv->axi_clk);
+                        if (err == -EPROBE_DEFER)
+                                goto err_gop_clk;
+                        priv->axi_clk = NULL;
+                } else {
+                        err = clk_prepare_enable(priv->axi_clk);
+                        if (err < 0)
+                                goto err_gop_clk;
+                }
         }
 
         /* Get system's tclk rate */
@@ -8005,16 +8025,19 @@ static int mvpp2_probe(struct platform_device *pdev)
         }
 
         /* Initialize ports */
+        i = 0;
         for_each_available_child_of_node(dn, port_node) {
-                err = mvpp2_port_probe(pdev, port_node, priv);
+                err = mvpp2_port_probe(pdev, port_node, priv, i);
                 if (err < 0)
                         goto err_mg_clk;
+                i++;
         }
 
         platform_set_drvdata(pdev, priv);
         return 0;
 
 err_mg_clk:
+        clk_disable_unprepare(priv->axi_clk);
         if (priv->hw_version == MVPP22)
                 clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8052,6 +8075,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                                   aggr_txq->descs_dma);
         }
 
+        clk_disable_unprepare(priv->axi_clk);
         clk_disable_unprepare(priv->mg_clk);
         clk_disable_unprepare(priv->pp_clk);
         clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
index 1e3a6c3e4132..80eef4163f52 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.h
@@ -139,7 +139,7 @@ TRACE_EVENT(mlx5_fs_del_fg,
         {MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_PRIO, "NEXT_PRIO"}
 
 TRACE_EVENT(mlx5_fs_set_fte,
-            TP_PROTO(const struct fs_fte *fte, bool new_fte),
+            TP_PROTO(const struct fs_fte *fte, int new_fte),
             TP_ARGS(fte, new_fte),
             TP_STRUCT__entry(
                 __field(const struct fs_fte *, fte)
@@ -149,7 +149,7 @@ TRACE_EVENT(mlx5_fs_set_fte,
                 __field(u32, action)
                 __field(u32, flow_tag)
                 __field(u8,  mask_enable)
-                __field(bool, new_fte)
+                __field(int, new_fte)
                 __array(u32, mask_outer, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                 __array(u32, mask_inner, MLX5_ST_SZ_DW(fte_match_set_lyr_2_4))
                 __array(u32, mask_misc, MLX5_ST_SZ_DW(fte_match_set_misc))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index f11fd07ac4dd..850cdc980ab5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -291,7 +291,7 @@ void mlx5e_enable_vlan_filter(struct mlx5e_priv *priv)
         priv->fs.vlan.filter_disabled = false;
         if (priv->netdev->flags & IFF_PROMISC)
                 return;
-        mlx5e_del_any_vid_rules(priv);
+        mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 
 void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
@@ -302,7 +302,7 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv)
         priv->fs.vlan.filter_disabled = true;
         if (priv->netdev->flags & IFF_PROMISC)
                 return;
-        mlx5e_add_any_vid_rules(priv);
+        mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_ANY_CTAG_VID, 0);
 }
 
 int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index dfc29720ab77..cc11bbbd0309 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -184,7 +184,6 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
         struct mlx5e_sw_stats temp, *s = &temp;
         struct mlx5e_rq_stats *rq_stats;
         struct mlx5e_sq_stats *sq_stats;
-        u64 tx_offload_none = 0;
         int i, j;
 
         memset(s, 0, sizeof(*s));
@@ -199,6 +198,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                 s->rx_lro_bytes += rq_stats->lro_bytes;
                 s->rx_csum_none += rq_stats->csum_none;
                 s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
                 s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_xdp_drop += rq_stats->xdp_drop;
                 s->rx_xdp_tx += rq_stats->xdp_tx;
@@ -229,14 +229,11 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                         s->tx_queue_dropped     += sq_stats->dropped;
                         s->tx_xmit_more         += sq_stats->xmit_more;
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
-                        tx_offload_none         += sq_stats->csum_none;
+                        s->tx_csum_none         += sq_stats->csum_none;
+                        s->tx_csum_partial      += sq_stats->csum_partial;
                 }
         }
 
-        /* Update calculated offload counters */
-        s->tx_csum_partial = s->tx_packets - tx_offload_none - s->tx_csum_partial_inner;
-        s->rx_csum_unnecessary = s->rx_packets - s->rx_csum_none - s->rx_csum_complete;
-
         s->link_down_events_phy = MLX5_GET(ppcnt_reg,
                                 priv->stats.pport.phy_counters,
                                 counter_set.phys_layer_cntrs.link_down_events);
@@ -3333,8 +3330,8 @@ static int mlx5e_handle_feature(struct net_device *netdev,
 
         err = feature_handler(netdev, enable);
         if (err) {
-                netdev_err(netdev, "%s feature 0x%llx failed err %d\n",
-                           enable ? "Enable" : "Disable", feature, err);
+                netdev_err(netdev, "%s feature %pNF failed, err %d\n",
+                           enable ? "Enable" : "Disable", &feature, err);
                 return err;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f1dd638384d3..15a1687483cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -627,6 +627,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
 
         if (lro) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
+                rq->stats.csum_unnecessary++;
                 return;
         }
 
@@ -644,7 +645,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                         skb->csum_level = 1;
                         skb->encapsulation = 1;
                         rq->stats.csum_unnecessary_inner++;
+                        return;
                 }
+                rq->stats.csum_unnecessary++;
                 return;
         }
 csum_none:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 6d199ffb1c0b..f8637213afc0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -68,6 +68,7 @@ struct mlx5e_sw_stats {
         u64 rx_xdp_drop;
         u64 rx_xdp_tx;
         u64 rx_xdp_tx_full;
+        u64 tx_csum_none;
         u64 tx_csum_partial;
         u64 tx_csum_partial_inner;
         u64 tx_queue_stopped;
@@ -108,6 +109,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_tx_full) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_none) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
@@ -339,6 +341,7 @@ struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
         u64 csum_complete;
+        u64 csum_unnecessary;
         u64 csum_unnecessary_inner;
         u64 csum_none;
         u64 lro_packets;
@@ -363,6 +366,7 @@ static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, xdp_drop) },
@@ -392,6 +396,7 @@ struct mlx5e_sq_stats {
         u64 tso_bytes;
         u64 tso_inner_packets;
         u64 tso_inner_bytes;
+        u64 csum_partial;
         u64 csum_partial_inner;
         u64 nop;
         /* less likely accessed in data path */
@@ -408,6 +413,7 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_bytes) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial_inner) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, nop) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index da503e6411da..1aa2028ed995 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1317,6 +1317,69 @@ static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 upda
         return true;
 }
 
+static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
+                                          struct tcf_exts *exts)
+{
+        const struct tc_action *a;
+        bool modify_ip_header;
+        LIST_HEAD(actions);
+        u8 htype, ip_proto;
+        void *headers_v;
+        u16 ethertype;
+        int nkeys, i;
+
+        headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, outer_headers);
+        ethertype = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ethertype);
+
+        /* for non-IP we only re-write MACs, so we're okay */
+        if (ethertype != ETH_P_IP && ethertype != ETH_P_IPV6)
+                goto out_ok;
+
+        modify_ip_header = false;
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
+                if (!is_tcf_pedit(a))
+                        continue;
+
+                nkeys = tcf_pedit_nkeys(a);
+                for (i = 0; i < nkeys; i++) {
+                        htype = tcf_pedit_htype(a, i);
+                        if (htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 ||
+                            htype == TCA_PEDIT_KEY_EX_HDR_TYPE_IP6) {
+                                modify_ip_header = true;
+                                break;
+                        }
+                }
+        }
+
+        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
+        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+                pr_info("can't offload re-write of ip proto %d\n", ip_proto);
+                return false;
+        }
+
+out_ok:
+        return true;
+}
+
+static bool actions_match_supported(struct mlx5e_priv *priv,
+                                    struct tcf_exts *exts,
+                                    struct mlx5e_tc_flow_parse_attr *parse_attr,
+                                    struct mlx5e_tc_flow *flow)
+{
+        u32 actions;
+
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                actions = flow->esw_attr->action;
+        else
+                actions = flow->nic_attr->action;
+
+        if (actions & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
+                return modify_header_match_supported(&parse_attr->spec, exts);
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1378,6 +1441,9 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                 return -EINVAL;
         }
 
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
+
         return 0;
 }
 
@@ -1564,7 +1630,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
                 break;
         default:
                 err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
         }
         fl4.flowi4_tos = tun_key->tos;
         fl4.daddr = tun_key->u.ipv4.dst;
@@ -1573,7 +1639,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
         err = mlx5e_route_lookup_ipv4(priv, mirred_dev, &out_dev,
                                       &fl4, &n, &ttl);
         if (err)
-                goto out;
+                goto free_encap;
 
         /* used by mlx5e_detach_encap to lookup a neigh hash table
          * entry in the neigh hash table when a user deletes a rule
@@ -1590,7 +1656,7 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
          */
         err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
         if (err)
-                goto out;
+                goto free_encap;
 
         read_lock_bh(&n->lock);
         nud_state = n->nud_state;
@@ -1630,8 +1696,9 @@ static int mlx5e_create_encap_header_ipv4(struct mlx5e_priv *priv,
 
 destroy_neigh_entry:
         mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
         kfree(encap_header);
+out:
         if (n)
                 neigh_release(n);
         return err;
@@ -1668,7 +1735,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
                 break;
         default:
                 err = -EOPNOTSUPP;
-                goto out;
+                goto free_encap;
         }
 
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tun_key->tos), tun_key->label);
@@ -1678,7 +1745,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
         err = mlx5e_route_lookup_ipv6(priv, mirred_dev, &out_dev,
                                       &fl6, &n, &ttl);
         if (err)
-                goto out;
+                goto free_encap;
 
         /* used by mlx5e_detach_encap to lookup a neigh hash table
          * entry in the neigh hash table when a user deletes a rule
@@ -1695,7 +1762,7 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
          */
         err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e);
         if (err)
-                goto out;
+                goto free_encap;
 
         read_lock_bh(&n->lock);
         nud_state = n->nud_state;
@@ -1736,8 +1803,9 @@ static int mlx5e_create_encap_header_ipv6(struct mlx5e_priv *priv,
 
 destroy_neigh_entry:
         mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
-out:
+free_encap:
         kfree(encap_header);
+out:
         if (n)
                 neigh_release(n);
         return err;
@@ -1791,6 +1859,7 @@ vxlan_encap_offload_err:
                 }
         }
 
+        /* must verify if encap is valid or not */
         if (found)
                 goto attach_flow;
 
@@ -1817,6 +1886,8 @@ attach_flow:
         *encap_dev = e->out_dev;
         if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                 attr->encap_id = e->encap_id;
+        else
+                err = -EAGAIN;
 
         return err;
 
@@ -1934,6 +2005,10 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
 
                 return -EINVAL;
         }
+
+        if (!actions_match_supported(priv, exts, parse_attr, flow))
+                return -EOPNOTSUPP;
+
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index fee43e40fa16..1d6925d4369a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -193,6 +193,7 @@ mlx5e_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb, struct
                         sq->stats.csum_partial_inner++;
                 } else {
                         eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
+                        sq->stats.csum_partial++;
                 }
         } else
                 sq->stats.csum_none++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
index e37453d838db..c0fd2212e890 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.c
@@ -71,11 +71,11 @@ int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
         return 0;
 }
 
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps)
+int mlx5_fpga_caps(struct mlx5_core_dev *dev)
 {
         u32 in[MLX5_ST_SZ_DW(fpga_cap)] = {0};
 
-        return mlx5_core_access_reg(dev, in, sizeof(in), caps,
+        return mlx5_core_access_reg(dev, in, sizeof(in), dev->caps.fpga,
                                     MLX5_ST_SZ_BYTES(fpga_cap),
                                     MLX5_REG_FPGA_CAP, 0, 0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
index 94bdfd47c3f0..d05233c9b4f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/cmd.h
@@ -65,7 +65,7 @@ struct mlx5_fpga_qp_counters {
         u64 rx_total_drop;
 };
 
-int mlx5_fpga_caps(struct mlx5_core_dev *dev, u32 *caps);
+int mlx5_fpga_caps(struct mlx5_core_dev *dev);
 int mlx5_fpga_query(struct mlx5_core_dev *dev, struct mlx5_fpga_query *query);
 int mlx5_fpga_ctrl_op(struct mlx5_core_dev *dev, u8 op);
 int mlx5_fpga_access_reg(struct mlx5_core_dev *dev, u8 size, u64 addr,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
index 9034e9960a76..dc8970346521 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
@@ -139,8 +139,7 @@ int mlx5_fpga_device_start(struct mlx5_core_dev *mdev)
         if (err)
                 goto out;
 
-        err = mlx5_fpga_caps(fdev->mdev,
-                             fdev->mdev->caps.hca_cur[MLX5_CAP_FPGA]);
+        err = mlx5_fpga_caps(fdev->mdev);
         if (err)
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index e0d0efd903bc..36ecc2b2e187 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -293,6 +293,9 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
         }
 
         if (fte->action & MLX5_FLOW_CONTEXT_ACTION_COUNT) {
+                int max_list_size = BIT(MLX5_CAP_FLOWTABLE_TYPE(dev,
+                                        log_max_flow_counter,
+                                        ft->type));
                 int list_size = 0;
 
                 list_for_each_entry(dst, &fte->node.children, node.list) {
@@ -305,12 +308,17 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
                         in_dests += MLX5_ST_SZ_BYTES(dest_format_struct);
                         list_size++;
                 }
+                if (list_size > max_list_size) {
+                        err = -EINVAL;
+                        goto err_out;
+                }
 
                 MLX5_SET(flow_context, in_flow_context, flow_counter_list_size,
                          list_size);
         }
 
         err = mlx5_cmd_exec(dev, in, inlen, out, sizeof(out));
+err_out:
         kvfree(in);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 5509a752f98e..48dd78975062 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -52,6 +52,7 @@ enum fs_flow_table_type {
         FS_FT_FDB             = 0X4,
         FS_FT_SNIFFER_RX        = 0X5,
         FS_FT_SNIFFER_TX        = 0X6,
+        FS_FT_MAX_TYPE = FS_FT_SNIFFER_TX,
 };
 
 enum fs_flow_table_op_mod {
@@ -260,4 +261,14 @@ void mlx5_cleanup_fs(struct mlx5_core_dev *dev);
 #define fs_for_each_dst(pos, fte)                       \
         fs_list_for_each_entry(pos, &(fte)->node.children)
 
+#define MLX5_CAP_FLOWTABLE_TYPE(mdev, cap, type) (              \
+        (type == FS_FT_NIC_RX) ? MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) :         \
+        (type == FS_FT_ESW_EGRESS_ACL) ? MLX5_CAP_ESW_EGRESS_ACL(mdev, cap) :           \
+        (type == FS_FT_ESW_INGRESS_ACL) ? MLX5_CAP_ESW_INGRESS_ACL(mdev, cap) :         \
+        (type == FS_FT_FDB) ? MLX5_CAP_ESW_FLOWTABLE_FDB(mdev, cap) :           \
+        (type == FS_FT_SNIFFER_RX) ? MLX5_CAP_FLOWTABLE_SNIFFER_RX(mdev, cap) :         \
+        (type == FS_FT_SNIFFER_TX) ? MLX5_CAP_FLOWTABLE_SNIFFER_TX(mdev, cap) :         \
+        (BUILD_BUG_ON_ZERO(FS_FT_SNIFFER_TX != FS_FT_MAX_TYPE))\
+        )
+
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 85298051a3e4..145e392ab849 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev)
 {
         struct mlx5e_priv          *priv    = mlx5i_epriv(netdev);
         const struct mlx5e_profile *profile = priv->profile;
+        struct mlx5_core_dev       *mdev    = priv->mdev;
 
         mlx5e_detach_netdev(priv);
         profile->cleanup(priv);
         destroy_workqueue(priv->wq);
         free_netdev(netdev);
 
-        mlx5e_destroy_mdev_resources(priv->mdev);
+        mlx5e_destroy_mdev_resources(mdev);
 }
 EXPORT_SYMBOL(mlx5_rdma_netdev_free);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
index 6c48e9959b65..2a8b529ce6dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c
@@ -109,7 +109,7 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs)
                                 mlx5_core_warn(dev,
                                                "failed to restore VF %d settings, err %d\n",
                                                vf, err);
-                        continue;
+                                continue;
                         }
                 }
                 mlx5_core_dbg(dev, "successfully enabled VF* %d\n", vf);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 2cfb3f5d092d..032089efc1a0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -2723,6 +2723,7 @@ static void mlxsw_sp_nexthop_type_fini(struct mlxsw_sp *mlxsw_sp,
                 mlxsw_sp_nexthop_rif_fini(nh);
                 break;
         case MLXSW_SP_NEXTHOP_TYPE_IPIP:
+                mlxsw_sp_nexthop_rif_fini(nh);
                 mlxsw_sp_nexthop_ipip_fini(mlxsw_sp, nh);
                 break;
         }
@@ -2742,7 +2743,11 @@ static int mlxsw_sp_nexthop4_type_init(struct mlxsw_sp *mlxsw_sp,
             router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                      MLXSW_SP_L3_PROTO_IPV4)) {
                 nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
         }
 
         nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -4009,7 +4014,11 @@ static int mlxsw_sp_nexthop6_type_init(struct mlxsw_sp *mlxsw_sp,
             router->ipip_ops_arr[ipipt]->can_offload(mlxsw_sp, dev,
                                                      MLXSW_SP_L3_PROTO_IPV6)) {
                 nh->type = MLXSW_SP_NEXTHOP_TYPE_IPIP;
-                return mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                err = mlxsw_sp_nexthop_ipip_init(mlxsw_sp, ipipt, nh, dev);
+                if (err)
+                        return err;
+                mlxsw_sp_nexthop_rif_init(nh, &nh->ipip_entry->ol_lb->common);
+                return 0;
         }
 
         nh->type = MLXSW_SP_NEXTHOP_TYPE_ETH;
@@ -5068,6 +5077,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
         vr = mlxsw_sp_vr_get(mlxsw_sp, tb_id ? : RT_TABLE_MAIN);
         if (IS_ERR(vr))
                 return ERR_CAST(vr);
+        vr->rif_count++;
 
         err = mlxsw_sp_rif_index_alloc(mlxsw_sp, &rif_index);
         if (err)
@@ -5099,7 +5109,6 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
 
         mlxsw_sp_rif_counters_alloc(rif);
         mlxsw_sp->router->rifs[rif_index] = rif;
-        vr->rif_count++;
 
         return rif;
 
@@ -5110,6 +5119,7 @@ err_fid_get:
         kfree(rif);
 err_rif_alloc:
 err_rif_index_alloc:
+        vr->rif_count--;
         mlxsw_sp_vr_put(vr);
         return ERR_PTR(err);
 }
@@ -5124,7 +5134,6 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
         mlxsw_sp_router_rif_gone_sync(mlxsw_sp, rif);
         vr = &mlxsw_sp->router->vrs[rif->vr_id];
 
-        vr->rif_count--;
         mlxsw_sp->router->rifs[rif->rif_index] = NULL;
         mlxsw_sp_rif_counters_free(rif);
         ops->deconfigure(rif);
@@ -5132,6 +5141,7 @@ void mlxsw_sp_rif_destroy(struct mlxsw_sp_rif *rif)
                 /* Loopback RIFs are not associated with a FID. */
                 mlxsw_sp_fid_put(fid);
         kfree(rif);
+        vr->rif_count--;
         mlxsw_sp_vr_put(vr);
 }
 
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c b/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c
index bbe24639aa5a..c8c6231b87f3 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-ethtool.c
@@ -88,6 +88,8 @@ static void emac_set_msglevel(struct net_device *netdev, u32 data)
 static int emac_get_sset_count(struct net_device *netdev, int sset)
 {
         switch (sset) {
+        case ETH_SS_PRIV_FLAGS:
+                return 1;
         case ETH_SS_STATS:
                 return EMAC_STATS_LEN;
         default:
@@ -100,6 +102,10 @@ static void emac_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
         unsigned int i;
 
         switch (stringset) {
+        case ETH_SS_PRIV_FLAGS:
+                strcpy(data, "single-pause-mode");
+                break;
+
         case ETH_SS_STATS:
                 for (i = 0; i < EMAC_STATS_LEN; i++) {
                         strlcpy(data, emac_ethtool_stat_strings[i],
@@ -230,6 +236,27 @@ static int emac_get_regs_len(struct net_device *netdev)
         return EMAC_MAX_REG_SIZE * sizeof(u32);
 }
 
+#define EMAC_PRIV_ENABLE_SINGLE_PAUSE   BIT(0)
+
+static int emac_set_priv_flags(struct net_device *netdev, u32 flags)
+{
+        struct emac_adapter *adpt = netdev_priv(netdev);
+
+        adpt->single_pause_mode = !!(flags & EMAC_PRIV_ENABLE_SINGLE_PAUSE);
+
+        if (netif_running(netdev))
+                return emac_reinit_locked(adpt);
+
+        return 0;
+}
+
+static u32 emac_get_priv_flags(struct net_device *netdev)
+{
+        struct emac_adapter *adpt = netdev_priv(netdev);
+
+        return adpt->single_pause_mode ? EMAC_PRIV_ENABLE_SINGLE_PAUSE : 0;
+}
+
 static const struct ethtool_ops emac_ethtool_ops = {
         .get_link_ksettings = phy_ethtool_get_link_ksettings,
         .set_link_ksettings = phy_ethtool_set_link_ksettings,
@@ -253,6 +280,9 @@ static const struct ethtool_ops emac_ethtool_ops = {
 
         .get_regs_len    = emac_get_regs_len,
         .get_regs        = emac_get_regs,
+
+        .set_priv_flags = emac_set_priv_flags,
+        .get_priv_flags = emac_get_priv_flags,
 };
 
 void emac_set_ethtool_ops(struct net_device *netdev)
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index bcd4708b3745..3ed9033e56db 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -551,6 +551,28 @@ static void emac_mac_start(struct emac_adapter *adpt)
         mac &= ~(HUGEN | VLAN_STRIP | TPAUSE | SIMR | HUGE | MULTI_ALL |
                  DEBUG_MODE | SINGLE_PAUSE_MODE);
 
+        /* Enable single-pause-frame mode if requested.
+         *
+         * If enabled, the EMAC will send a single pause frame when the RX
+         * queue is full.  This normally leads to packet loss because
+         * the pause frame disables the remote MAC only for 33ms (the quanta),
+         * and then the remote MAC continues sending packets even though
+         * the RX queue is still full.
+         *
+         * If disabled, the EMAC sends a pause frame every 31ms until the RX
+         * queue is no longer full.  Normally, this is the preferred
+         * method of operation.  However, when the system is hung (e.g.
+         * cores are halted), the EMAC interrupt handler is never called
+         * and so the RX queue fills up quickly and stays full.  The resuling
+         * non-stop "flood" of pause frames sometimes has the effect of
+         * disabling nearby switches.  In some cases, other nearby switches
+         * are also affected, shutting down the entire network.
+         *
+         * The user can enable or disable single-pause-frame mode
+         * via ethtool.
+         */
+        mac |= adpt->single_pause_mode ? SINGLE_PAUSE_MODE : 0;
+
         writel_relaxed(csr1, adpt->csr + EMAC_EMAC_WRAPPER_CSR1);
 
         writel_relaxed(mac, adpt->base + EMAC_MAC_CTRL);
@@ -876,7 +898,8 @@ static void emac_mac_rx_descs_refill(struct emac_adapter *adpt,
 
                 curr_rxbuf->dma_addr =
                         dma_map_single(adpt->netdev->dev.parent, skb->data,
-                                       curr_rxbuf->length, DMA_FROM_DEVICE);
+                                       adpt->rxbuf_size, DMA_FROM_DEVICE);
+
                 ret = dma_mapping_error(adpt->netdev->dev.parent,
                                         curr_rxbuf->dma_addr);
                 if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 60850bfa3d32..759543512117 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -443,6 +443,9 @@ static void emac_init_adapter(struct emac_adapter *adpt)
 
         /* default to automatic flow control */
         adpt->automatic = true;
+
+        /* Disable single-pause-frame mode by default */
+        adpt->single_pause_mode = false;
 }
 
 /* Get the clock */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.h b/drivers/net/ethernet/qualcomm/emac/emac.h
index 8ee4ec6aef2e..d7c9f44209d4 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.h
+++ b/drivers/net/ethernet/qualcomm/emac/emac.h
@@ -363,6 +363,9 @@ struct emac_adapter {
         bool                            tx_flow_control;
         bool                            rx_flow_control;
 
+        /* True == use single-pause-frame mode. */
+        bool                            single_pause_mode;
+
         /* Ring parameter */
         u8                              tpd_burst;
         u8                              rfd_burst;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 98f22551eb45..1e33aea59f50 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -51,10 +51,7 @@ struct rmnet_walk_data {
 
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
-        rx_handler_func_t *rx_handler;
-
-        rx_handler = rcu_dereference(real_dev->rx_handler);
-        return (rx_handler == rmnet_rx_handler);
+        return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
 }
 
 /* Needs rtnl lock */
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index ca22f2898664..d24b47b8e0b2 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -2135,11 +2135,12 @@ static int rtl8139_poll(struct napi_struct *napi, int budget)
         if (likely(RTL_R16(IntrStatus) & RxAckBits))
                 work_done += rtl8139_rx(dev, tp, budget);
 
-        if (work_done < budget && napi_complete_done(napi, work_done)) {
+        if (work_done < budget) {
                 unsigned long flags;
 
                 spin_lock_irqsave(&tp->lock, flags);
-                RTL_W16_F(IntrMask, rtl8139_intr_mask);
+                if (napi_complete_done(napi, work_done))
+                        RTL_W16_F(IntrMask, rtl8139_intr_mask);
                 spin_unlock_irqrestore(&tp->lock, flags);
         }
         spin_unlock(&tp->rx_lock);
diff --git a/drivers/net/ethernet/rocker/rocker_tlv.h b/drivers/net/ethernet/rocker/rocker_tlv.h
index a63ef82e7c72..dfae3c9d57c6 100644
--- a/drivers/net/ethernet/rocker/rocker_tlv.h
+++ b/drivers/net/ethernet/rocker/rocker_tlv.h
@@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_info *desc_info)
 int rocker_tlv_put(struct rocker_desc_info *desc_info,
                    int attrtype, int attrlen, const void *data);
 
-static inline int rocker_tlv_put_u8(struct rocker_desc_info *desc_info,
-                                    int attrtype, u8 value)
+static inline int
+rocker_tlv_put_u8(struct rocker_desc_info *desc_info, int attrtype, u8 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &value);
+        u8 tmp = value; /* work around GCC PR81715 */
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u8), &tmp);
 }
 
-static inline int rocker_tlv_put_u16(struct rocker_desc_info *desc_info,
-                                     int attrtype, u16 value)
+static inline int
+rocker_tlv_put_u16(struct rocker_desc_info *desc_info, int attrtype, u16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &value);
+        u16 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u16), &tmp);
 }
 
-static inline int rocker_tlv_put_be16(struct rocker_desc_info *desc_info,
-                                      int attrtype, __be16 value)
+static inline int
+rocker_tlv_put_be16(struct rocker_desc_info *desc_info, int attrtype, __be16 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &value);
+        __be16 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be16), &tmp);
 }
 
-static inline int rocker_tlv_put_u32(struct rocker_desc_info *desc_info,
-                                     int attrtype, u32 value)
+static inline int
+rocker_tlv_put_u32(struct rocker_desc_info *desc_info, int attrtype, u32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &value);
+        u32 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u32), &tmp);
 }
 
-static inline int rocker_tlv_put_be32(struct rocker_desc_info *desc_info,
-                                      int attrtype, __be32 value)
+static inline int
+rocker_tlv_put_be32(struct rocker_desc_info *desc_info, int attrtype, __be32 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &value);
+        __be32 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(__be32), &tmp);
 }
 
-static inline int rocker_tlv_put_u64(struct rocker_desc_info *desc_info,
-                                     int attrtype, u64 value)
+static inline int
+rocker_tlv_put_u64(struct rocker_desc_info *desc_info, int attrtype, u64 value)
 {
-        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &value);
+        u64 tmp = value;
+
+        return rocker_tlv_put(desc_info, attrtype, sizeof(u64), &tmp);
 }
 
 static inline struct rocker_tlv *
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
index dd6a2f9791cc..5efef8001edf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
@@ -511,6 +511,7 @@ static struct platform_driver dwc_eth_dwmac_driver = {
         .remove = dwc_eth_dwmac_remove,
         .driver = {
                 .name           = "dwc-eth-dwmac",
+                .pm             = &stmmac_pltfr_pm_ops,
                 .of_match_table = dwc_eth_dwmac_match,
         },
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 99823f54696a..13133b30b575 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -83,6 +83,117 @@ struct rk_priv_data {
         (((tx) ? soc##_GMAC_TXCLK_DLY_ENABLE : soc##_GMAC_TXCLK_DLY_DISABLE) | \
          ((rx) ? soc##_GMAC_RXCLK_DLY_ENABLE : soc##_GMAC_RXCLK_DLY_DISABLE))
 
+#define RK3128_GRF_MAC_CON0     0x0168
+#define RK3128_GRF_MAC_CON1     0x016c
+
+/* RK3128_GRF_MAC_CON0 */
+#define RK3128_GMAC_TXCLK_DLY_ENABLE   GRF_BIT(14)
+#define RK3128_GMAC_TXCLK_DLY_DISABLE  GRF_CLR_BIT(14)
+#define RK3128_GMAC_RXCLK_DLY_ENABLE   GRF_BIT(15)
+#define RK3128_GMAC_RXCLK_DLY_DISABLE  GRF_CLR_BIT(15)
+#define RK3128_GMAC_CLK_RX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 7)
+#define RK3128_GMAC_CLK_TX_DL_CFG(val) HIWORD_UPDATE(val, 0x7F, 0)
+
+/* RK3128_GRF_MAC_CON1 */
+#define RK3128_GMAC_PHY_INTF_SEL_RGMII  \
+                (GRF_BIT(6) | GRF_CLR_BIT(7) | GRF_CLR_BIT(8))
+#define RK3128_GMAC_PHY_INTF_SEL_RMII   \
+                (GRF_CLR_BIT(6) | GRF_CLR_BIT(7) | GRF_BIT(8))
+#define RK3128_GMAC_FLOW_CTRL          GRF_BIT(9)
+#define RK3128_GMAC_FLOW_CTRL_CLR      GRF_CLR_BIT(9)
+#define RK3128_GMAC_SPEED_10M          GRF_CLR_BIT(10)
+#define RK3128_GMAC_SPEED_100M         GRF_BIT(10)
+#define RK3128_GMAC_RMII_CLK_25M       GRF_BIT(11)
+#define RK3128_GMAC_RMII_CLK_2_5M      GRF_CLR_BIT(11)
+#define RK3128_GMAC_CLK_125M           (GRF_CLR_BIT(12) | GRF_CLR_BIT(13))
+#define RK3128_GMAC_CLK_25M            (GRF_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_CLK_2_5M           (GRF_CLR_BIT(12) | GRF_BIT(13))
+#define RK3128_GMAC_RMII_MODE          GRF_BIT(14)
+#define RK3128_GMAC_RMII_MODE_CLR      GRF_CLR_BIT(14)
+
+static void rk3128_set_to_rgmii(struct rk_priv_data *bsp_priv,
+                                int tx_delay, int rx_delay)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RGMII |
+                     RK3128_GMAC_RMII_MODE_CLR);
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON0,
+                     DELAY_ENABLE(RK3128, tx_delay, rx_delay) |
+                     RK3128_GMAC_CLK_RX_DL_CFG(rx_delay) |
+                     RK3128_GMAC_CLK_TX_DL_CFG(tx_delay));
+}
+
+static void rk3128_set_to_rmii(struct rk_priv_data *bsp_priv)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                     RK3128_GMAC_PHY_INTF_SEL_RMII | RK3128_GMAC_RMII_MODE);
+}
+
+static void rk3128_set_rgmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        if (speed == 10)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_2_5M);
+        else if (speed == 100)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_25M);
+        else if (speed == 1000)
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_CLK_125M);
+        else
+                dev_err(dev, "unknown speed value for RGMII! speed=%d", speed);
+}
+
+static void rk3128_set_rmii_speed(struct rk_priv_data *bsp_priv, int speed)
+{
+        struct device *dev = &bsp_priv->pdev->dev;
+
+        if (IS_ERR(bsp_priv->grf)) {
+                dev_err(dev, "Missing rockchip,grf property\n");
+                return;
+        }
+
+        if (speed == 10) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_2_5M |
+                             RK3128_GMAC_SPEED_10M);
+        } else if (speed == 100) {
+                regmap_write(bsp_priv->grf, RK3128_GRF_MAC_CON1,
+                             RK3128_GMAC_RMII_CLK_25M |
+                             RK3128_GMAC_SPEED_100M);
+        } else {
+                dev_err(dev, "unknown speed value for RMII! speed=%d", speed);
+        }
+}
+
+static const struct rk_gmac_ops rk3128_ops = {
+        .set_to_rgmii = rk3128_set_to_rgmii,
+        .set_to_rmii = rk3128_set_to_rmii,
+        .set_rgmii_speed = rk3128_set_rgmii_speed,
+        .set_rmii_speed = rk3128_set_rmii_speed,
+};
+
 #define RK3228_GRF_MAC_CON0     0x0900
 #define RK3228_GRF_MAC_CON1     0x0904
 
@@ -1313,6 +1424,7 @@ static int rk_gmac_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(rk_gmac_pm_ops, rk_gmac_suspend, rk_gmac_resume);
 
 static const struct of_device_id rk_gmac_dwmac_match[] = {
+        { .compatible = "rockchip,rk3128-gmac", .data = &rk3128_ops },
         { .compatible = "rockchip,rk3228-gmac", .data = &rk3228_ops },
         { .compatible = "rockchip,rk3288-gmac", .data = &rk3288_ops },
         { .compatible = "rockchip,rk3328-gmac", .data = &rk3328_ops },
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index c4407e8e39a3..2f7d7ec59962 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -296,6 +296,7 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
 {
         void __iomem *ioaddr = hw->pcsr;
         unsigned int pmt = 0;
+        u32 config;
 
         if (mode & WAKE_MAGIC) {
                 pr_debug("GMAC: WOL Magic frame\n");
@@ -306,6 +307,12 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
                 pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
+        if (pmt) {
+                /* The receiver must be enabled for WOL before powering down */
+                config = readl(ioaddr + GMAC_CONFIG);
+                config |= GMAC_CONFIG_RE;
+                writel(config, ioaddr + GMAC_CONFIG);
+        }
         writel(pmt, ioaddr + GMAC_PMT);
 }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index a366b3747eeb..8a280b48e3a9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -315,6 +315,7 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
                 { .compatible = "allwinner,sun8i-h3-emac" },
                 { .compatible = "allwinner,sun8i-v3s-emac" },
                 { .compatible = "allwinner,sun50i-a64-emac" },
+                {},
         };
 
         /* If phy-handle property is passed from DT, use it as the PHY */
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index d98cdfb1536b..5176be76ca7d 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -150,6 +150,8 @@ struct netvsc_device_info {
         u32  num_chn;
         u32  send_sections;
         u32  recv_sections;
+        u32  send_section_size;
+        u32  recv_section_size;
 };
 
 enum rndis_device_state {
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index a5511b7326af..8d5077fb0492 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -76,9 +76,6 @@ static struct netvsc_device *alloc_net_device(void)
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
 
-        net_device->recv_section_size = NETVSC_RECV_SECTION_SIZE;
-        net_device->send_section_size = NETVSC_SEND_SECTION_SIZE;
-
         init_completion(&net_device->channel_init_wait);
         init_waitqueue_head(&net_device->subchan_open);
         INIT_WORK(&net_device->subchan_work, rndis_set_subchannel);
@@ -262,7 +259,7 @@ static int netvsc_init_buf(struct hv_device *device,
         int ret = 0;
 
         /* Get receive buffer area. */
-        buf_size = device_info->recv_sections * net_device->recv_section_size;
+        buf_size = device_info->recv_sections * device_info->recv_section_size;
         buf_size = roundup(buf_size, PAGE_SIZE);
 
         net_device->recv_buf = vzalloc(buf_size);
@@ -344,7 +341,7 @@ static int netvsc_init_buf(struct hv_device *device,
                 goto cleanup;
 
         /* Now setup the send buffer. */
-        buf_size = device_info->send_sections * net_device->send_section_size;
+        buf_size = device_info->send_sections * device_info->send_section_size;
         buf_size = round_up(buf_size, PAGE_SIZE);
 
         net_device->send_buf = vzalloc(buf_size);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index d4902ee5f260..a32ae02e1b6c 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -848,7 +848,9 @@ static int netvsc_set_channels(struct net_device *net,
         device_info.num_chn = count;
         device_info.ring_size = ring_size;
         device_info.send_sections = nvdev->send_section_cnt;
+        device_info.send_section_size = nvdev->send_section_size;
         device_info.recv_sections = nvdev->recv_section_cnt;
+        device_info.recv_section_size = nvdev->recv_section_size;
 
         rndis_filter_device_remove(dev, nvdev);
 
@@ -963,7 +965,9 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
         device_info.ring_size = ring_size;
         device_info.num_chn = nvdev->num_chn;
         device_info.send_sections = nvdev->send_section_cnt;
+        device_info.send_section_size = nvdev->send_section_size;
         device_info.recv_sections = nvdev->recv_section_cnt;
+        device_info.recv_section_size = nvdev->recv_section_size;
 
         rndis_filter_device_remove(hdev, nvdev);
 
@@ -1485,7 +1489,9 @@ static int netvsc_set_ringparam(struct net_device *ndev,
         device_info.num_chn = nvdev->num_chn;
         device_info.ring_size = ring_size;
         device_info.send_sections = new_tx;
+        device_info.send_section_size = nvdev->send_section_size;
         device_info.recv_sections = new_rx;
+        device_info.recv_section_size = nvdev->recv_section_size;
 
         netif_device_detach(ndev);
         was_opened = rndis_filter_opened(nvdev);
@@ -1934,7 +1940,9 @@ static int netvsc_probe(struct hv_device *dev,
         device_info.ring_size = ring_size;
         device_info.num_chn = VRSS_CHANNEL_DEFAULT;
         device_info.send_sections = NETVSC_DEFAULT_TX;
+        device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
         device_info.recv_sections = NETVSC_DEFAULT_RX;
+        device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
 
         nvdev = rndis_filter_device_add(dev, &device_info);
         if (IS_ERR(nvdev)) {
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index a9d16a3af514..cd931cf9dcc2 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -160,15 +160,6 @@ config MDIO_XGENE
 
 endif
 
-menuconfig PHYLIB
-        tristate "PHY Device support and infrastructure"
-        depends on NETDEVICES
-        select MDIO_DEVICE
-        help
-          Ethernet controllers are usually attached to PHY
-          devices.  This option provides infrastructure for
-          managing PHY devices.
-
 config PHYLINK
         tristate
         depends on NETDEVICES
@@ -179,6 +170,15 @@ config PHYLINK
           configuration links, PHYs, and Serdes links with MAC level
           autonegotiation modes.
 
+menuconfig PHYLIB
+        tristate "PHY Device support and infrastructure"
+        depends on NETDEVICES
+        select MDIO_DEVICE
+        help
+          Ethernet controllers are usually attached to PHY
+          devices.  This option provides infrastructure for
+          managing PHY devices.
+
 if PHYLIB
 
 config SWPHY
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index e842d2cd1ee7..2b1e67bc1e73 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -373,7 +373,8 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
                 cmd->base.port = PORT_BNC;
         else
                 cmd->base.port = PORT_MII;
-
+        cmd->base.transceiver = phy_is_internal(phydev) ?
+                                XCVR_INTERNAL : XCVR_EXTERNAL;
         cmd->base.phy_address = phydev->mdio.addr;
         cmd->base.autoneg = phydev->autoneg;
         cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 8cf0c5901f95..67f25ac29025 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -879,7 +879,7 @@ void phy_attached_print(struct phy_device *phydev, const char *fmt, ...)
 {
         const char *drv_name = phydev->drv ? phydev->drv->name : "unbound";
         char *irq_str;
-        char irq_num[4];
+        char irq_num[8];
 
         switch(phydev->irq) {
         case PHY_POLL:
diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
index d15dd3938ba8..2e5150b0b8d5 100644
--- a/drivers/net/phy/xilinx_gmii2rgmii.c
+++ b/drivers/net/phy/xilinx_gmii2rgmii.c
@@ -44,7 +44,7 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
         priv->phy_drv->read_status(phydev);
 
         val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG);
-        val &= XILINX_GMII2RGMII_SPEED_MASK;
+        val &= ~XILINX_GMII2RGMII_SPEED_MASK;
 
         if (phydev->speed == SPEED_1000)
                 val |= BMCR_SPEED1000;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index a404552555d4..c3f77e3b7819 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -120,7 +120,7 @@ struct ppp {
         int             n_channels;     /* how many channels are attached 54 */
         spinlock_t      rlock;          /* lock for receive side 58 */
         spinlock_t      wlock;          /* lock for transmit side 5c */
-        int             *xmit_recursion __percpu; /* xmit recursion detect */
+        int __percpu    *xmit_recursion; /* xmit recursion detect */
         int             mru;            /* max receive unit 60 */
         unsigned int    flags;          /* control bits 64 */
         unsigned int    xstate;         /* transmit state bits 68 */
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 3c9985f29950..5ce580f413b9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1496,11 +1496,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         switch (tun->flags & TUN_TYPE_MASK) {
         case IFF_TUN:
                 if (tun->flags & IFF_NO_PI) {
-                        switch (skb->data[0] & 0xf0) {
-                        case 0x40:
+                        u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+
+                        switch (ip_version) {
+                        case 4:
                                 pi.proto = htons(ETH_P_IP);
                                 break;
-                        case 0x60:
+                        case 6:
                                 pi.proto = htons(ETH_P_IPV6);
                                 break;
                         default:
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 8ab281b478f2..29c7e2ec0dcb 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -54,11 +54,19 @@ static int is_wireless_rndis(struct usb_interface_descriptor *desc)
                 desc->bInterfaceProtocol == 3);
 }
 
+static int is_novatel_rndis(struct usb_interface_descriptor *desc)
+{
+        return (desc->bInterfaceClass == USB_CLASS_MISC &&
+                desc->bInterfaceSubClass == 4 &&
+                desc->bInterfaceProtocol == 1);
+}
+
 #else
 
 #define is_rndis(desc)          0
 #define is_activesync(desc)     0
 #define is_wireless_rndis(desc) 0
+#define is_novatel_rndis(desc)  0
 
 #endif
 
@@ -150,7 +158,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
          */
         rndis = (is_rndis(&intf->cur_altsetting->desc) ||
                  is_activesync(&intf->cur_altsetting->desc) ||
-                 is_wireless_rndis(&intf->cur_altsetting->desc));
+                 is_wireless_rndis(&intf->cur_altsetting->desc) ||
+                 is_novatel_rndis(&intf->cur_altsetting->desc));
 
         memset(info, 0, sizeof(*info));
         info->control = intf;
@@ -547,6 +556,7 @@ static const struct driver_info wwan_info = {
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
+#define LINKSYS_VENDOR_ID       0x13b1
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
 #define MICROSOFT_VENDOR_ID     0x045e
@@ -737,6 +747,15 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+#if IS_ENABLED(CONFIG_USB_RTL8152)
+/* Linksys USB3GIGV1 Ethernet Adapter */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LINKSYS_VENDOR_ID, 0x0041, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+#endif
+
 /* ThinkPad USB-C Dock (based on Realtek RTL8153) */
 {
         USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3062, USB_CLASS_COMM,
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index b99a7fb09f8e..0161f77641fa 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1265,30 +1265,45 @@ static int lan78xx_ethtool_get_eeprom(struct net_device *netdev,
                                       struct ethtool_eeprom *ee, u8 *data)
 {
         struct lan78xx_net *dev = netdev_priv(netdev);
+        int ret;
+
+        ret = usb_autopm_get_interface(dev->intf);
+        if (ret)
+                return ret;
 
         ee->magic = LAN78XX_EEPROM_MAGIC;
 
-        return lan78xx_read_raw_eeprom(dev, ee->offset, ee->len, data);
+        ret = lan78xx_read_raw_eeprom(dev, ee->offset, ee->len, data);
+
+        usb_autopm_put_interface(dev->intf);
+
+        return ret;
 }
 
 static int lan78xx_ethtool_set_eeprom(struct net_device *netdev,
                                       struct ethtool_eeprom *ee, u8 *data)
 {
         struct lan78xx_net *dev = netdev_priv(netdev);
+        int ret;
+
+        ret = usb_autopm_get_interface(dev->intf);
+        if (ret)
+                return ret;
 
-        /* Allow entire eeprom update only */
-        if ((ee->magic == LAN78XX_EEPROM_MAGIC) &&
-            (ee->offset == 0) &&
-            (ee->len == 512) &&
-            (data[0] == EEPROM_INDICATOR))
-                return lan78xx_write_raw_eeprom(dev, ee->offset, ee->len, data);
+        /* Invalid EEPROM_INDICATOR at offset zero will result in a failure
+         * to load data from EEPROM
+         */
+        if (ee->magic == LAN78XX_EEPROM_MAGIC)
+                ret = lan78xx_write_raw_eeprom(dev, ee->offset, ee->len, data);
         else if ((ee->magic == LAN78XX_OTP_MAGIC) &&
                  (ee->offset == 0) &&
                  (ee->len == 512) &&
                  (data[0] == OTP_INDICATOR_1))
-                return lan78xx_write_raw_otp(dev, ee->offset, ee->len, data);
+                ret = lan78xx_write_raw_otp(dev, ee->offset, ee->len, data);
+
+        usb_autopm_put_interface(dev->intf);
 
-        return -EINVAL;
+        return ret;
 }
 
 static void lan78xx_get_strings(struct net_device *netdev, u32 stringset,
@@ -2434,7 +2449,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
         /* LAN7801 only has RGMII mode */
         if (dev->chipid == ID_REV_CHIP_ID_7801_)
                 buf &= ~MAC_CR_GMII_EN_;
-        buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
         ret = lan78xx_write_reg(dev, MAC_CR, buf);
 
         ret = lan78xx_read_reg(dev, MAC_TX, &buf);
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ceb78e2ea4f0..941ece08ba78 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -613,6 +613,7 @@ enum rtl8152_flags {
 #define VENDOR_ID_MICROSOFT             0x045e
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
+#define VENDOR_ID_LINKSYS               0x13b1
 #define VENDOR_ID_NVIDIA                0x0955
 
 #define MCU_TYPE_PLA                    0x0100
@@ -5316,6 +5317,7 @@ static const struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x720c)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
         {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
         {}
 };
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a151f267aebb..b807c91abe1d 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -632,6 +632,10 @@ static const struct usb_device_id	products [] = {
         /* RNDIS for tethering */
         USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
         .driver_info = (unsigned long) &rndis_info,
+}, {
+        /* Novatel Verizon USB730L */
+        USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1),
+        .driver_info = (unsigned long) &rndis_info,
 },
         { },            // END
 };
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index bc1633945a56..195dafb98131 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3396,9 +3396,7 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
 
 MODULE_DEVICE_TABLE(pci, ath10k_pci_id_table);
 
-#ifdef CONFIG_PM
-
-static int ath10k_pci_pm_suspend(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_suspend(struct device *dev)
 {
         struct ath10k *ar = dev_get_drvdata(dev);
         int ret;
@@ -3414,7 +3412,7 @@ static int ath10k_pci_pm_suspend(struct device *dev)
         return ret;
 }
 
-static int ath10k_pci_pm_resume(struct device *dev)
+static __maybe_unused int ath10k_pci_pm_resume(struct device *dev)
 {
         struct ath10k *ar = dev_get_drvdata(dev);
         int ret;
@@ -3433,7 +3431,6 @@ static int ath10k_pci_pm_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ath10k_pci_pm_ops,
                          ath10k_pci_pm_suspend,
                          ath10k_pci_pm_resume);
-#endif
 
 static struct pci_driver ath10k_pci_driver = {
         .name = "ath10k_pci",
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index aaed4ab503ad..4157c90ad973 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 
         eth_broadcast_addr(params_le->bssid);
         params_le->bss_type = DOT11_BSSTYPE_ANY;
-        params_le->scan_type = 0;
+        params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
         params_le->channel_num = 0;
         params_le->nprobes = cpu_to_le32(-1);
         params_le->active_time = cpu_to_le32(-1);
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
         params_le->home_time = cpu_to_le32(-1);
         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 
-        /* if request is null exit so it will be all channel broadcast scan */
-        if (!request)
-                return;
-
         n_ssids = request->n_ssids;
         n_channels = request->n_channels;
+
         /* Copy channel array if applicable */
         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
                   n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
                         ptr += sizeof(ssid_le);
                 }
         } else {
-                brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
-                if ((request->ssids) && request->ssids->ssid_len) {
-                        brcmf_dbg(SCAN, "SSID %s len=%d\n",
-                                  params_le->ssid_le.SSID,
-                                  request->ssids->ssid_len);
-                        params_le->ssid_le.SSID_len =
-                                cpu_to_le32(request->ssids->ssid_len);
-                        memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
-                                request->ssids->ssid_len);
-                }
+                brcmf_dbg(SCAN, "Performing passive scan\n");
+                params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
         }
         /* Adding mask to channel numbers */
         params_le->channel_num =
@@ -3162,6 +3151,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
         s32 status;
         struct brcmf_escan_result_le *escan_result_le;
+        u32 escan_buflen;
         struct brcmf_bss_info_le *bss_info_le;
         struct brcmf_bss_info_le *bss = NULL;
         u32 bi_length;
@@ -3181,11 +3171,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
 
         if (status == BRCMF_E_STATUS_PARTIAL) {
                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
+                if (e->datalen < sizeof(*escan_result_le)) {
+                        brcmf_err("invalid event data length\n");
+                        goto exit;
+                }
                 escan_result_le = (struct brcmf_escan_result_le *) data;
                 if (!escan_result_le) {
                         brcmf_err("Invalid escan result (NULL pointer)\n");
                         goto exit;
                 }
+                escan_buflen = le32_to_cpu(escan_result_le->buflen);
+                if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+                    escan_buflen > e->datalen ||
+                    escan_buflen < sizeof(*escan_result_le)) {
+                        brcmf_err("Invalid escan buffer length: %d\n",
+                                  escan_buflen);
+                        goto exit;
+                }
                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
                         brcmf_err("Invalid bss_count %d: ignoring\n",
                                   escan_result_le->bss_count);
@@ -3202,9 +3204,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                 }
 
                 bi_length = le32_to_cpu(bss_info_le->length);
-                if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
-                                        WL_ESCAN_RESULTS_FIXED_SIZE)) {
-                        brcmf_err("Invalid bss_info length %d: ignoring\n",
+                if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+                        brcmf_err("Ignoring invalid bss_info length: %d\n",
                                   bi_length);
                         goto exit;
                 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 8391989b1882..e0d22fedb2b4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -45,6 +45,11 @@
 #define BRCMF_SCAN_PARAMS_COUNT_MASK    0x0000ffff
 #define BRCMF_SCAN_PARAMS_NSSID_SHIFT   16
 
+/* scan type definitions */
+#define BRCMF_SCANTYPE_DEFAULT          0xFF
+#define BRCMF_SCANTYPE_ACTIVE           0
+#define BRCMF_SCANTYPE_PASSIVE          1
+
 #define BRCMF_WSEC_MAX_PSK_LEN          32
 #define BRCMF_WSEC_PASSPHRASE           BIT(0)
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 5de19ea10575..b205a7bfb828 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2167,7 +2167,7 @@ out:
          * 1. We are not using a unified image
          * 2. We are using a unified image but had an error while exiting D3
          */
-        set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
+        set_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status);
         set_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status);
         /*
          * When switching images we return 1, which causes mac80211
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 15f2d826bb4b..3bcaa82f59b2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -1546,6 +1546,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         struct iwl_mvm_mc_iter_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
         struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
+        struct iwl_host_cmd hcmd = {
+                .id = MCAST_FILTER_CMD,
+                .flags = CMD_ASYNC,
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
         int ret, len;
 
         /* if we don't have free ports, mcast frames will be dropped */
@@ -1560,7 +1565,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
+        hcmd.len[0] = len;
+        hcmd.data[0] = cmd;
+
+        ret = iwl_mvm_send_cmd(mvm, &hcmd);
         if (ret)
                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
 }
@@ -1635,6 +1643,12 @@ static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
         if (!cmd)
                 goto out;
 
+        if (changed_flags & FIF_ALLMULTI)
+                cmd->pass_all = !!(*total_flags & FIF_ALLMULTI);
+
+        if (cmd->pass_all)
+                cmd->count = 0;
+
         iwl_mvm_recalc_multicast(mvm);
 out:
         mutex_unlock(&mvm->mutex);
@@ -2563,7 +2577,7 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
                          * queues, so we should never get a second deferred
                          * frame for the RA/TID.
                          */
-                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
+                        iwl_mvm_start_mac_queues(mvm, BIT(info->hw_queue));
                         ieee80211_free_txskb(mvm->hw, skb);
                 }
         }
@@ -3975,6 +3989,43 @@ out_unlock:
         return ret;
 }
 
+static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)
+{
+        if (drop) {
+                if (iwl_mvm_has_new_tx_api(mvm))
+                        /* TODO new tx api */
+                        WARN_ONCE(1,
+                                  "Need to implement flush TX queue\n");
+                else
+                        iwl_mvm_flush_tx_path(mvm,
+                                iwl_mvm_flushable_queues(mvm) & queues,
+                                0);
+        } else {
+                if (iwl_mvm_has_new_tx_api(mvm)) {
+                        struct ieee80211_sta *sta;
+                        int i;
+
+                        mutex_lock(&mvm->mutex);
+
+                        for (i = 0; i < ARRAY_SIZE(mvm->fw_id_to_mac_id); i++) {
+                                sta = rcu_dereference_protected(
+                                                mvm->fw_id_to_mac_id[i],
+                                                lockdep_is_held(&mvm->mutex));
+                                if (IS_ERR_OR_NULL(sta))
+                                        continue;
+
+                                iwl_mvm_wait_sta_queues_empty(mvm,
+                                                iwl_mvm_sta_from_mac80211(sta));
+                        }
+
+                        mutex_unlock(&mvm->mutex);
+                } else {
+                        iwl_trans_wait_tx_queues_empty(mvm->trans,
+                                                       queues);
+                }
+        }
+}
+
 static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, u32 queues, bool drop)
 {
@@ -3985,7 +4036,12 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
         int i;
         u32 msk = 0;
 
-        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+        if (!vif) {
+                iwl_mvm_flush_no_vif(mvm, queues, drop);
+                return;
+        }
+
+        if (vif->type != NL80211_IFTYPE_STATION)
                 return;
 
         /* Make sure we're done with the deferred traffic before flushing */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index ba7bd049d3d4..0fe723ca844e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -661,7 +661,8 @@ static void rs_tl_turn_on_agg(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
             (lq_sta->tx_agg_tid_en & BIT(tid)) &&
             (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) {
                 IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid);
-                rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta);
+                if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0)
+                        tid_data->state = IWL_AGG_QUEUED;
         }
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 67ffd9774712..77f77bc5d083 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -672,11 +672,12 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
          * If there was a significant jump in the nssn - adjust.
          * If the SN is smaller than the NSSN it might need to first go into
          * the reorder buffer, in which case we just release up to it and the
-         * rest of the function will take of storing it and releasing up to the
-         * nssn
+         * rest of the function will take care of storing it and releasing up to
+         * the nssn
          */
         if (!iwl_mvm_is_sn_less(nssn, buffer->head_sn + buffer->buf_size,
-                                buffer->buf_size)) {
+                                buffer->buf_size) ||
+            !ieee80211_sn_less(sn, buffer->head_sn + buffer->buf_size)) {
                 u16 min_sn = ieee80211_sn_less(sn, nssn) ? sn : nssn;
 
                 iwl_mvm_release_frames(mvm, sta, napi, buffer, min_sn);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 50983615dce6..774122fed454 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -555,7 +555,7 @@ static int iwl_mvm_lmac_scan_abort(struct iwl_mvm *mvm)
         struct iwl_host_cmd cmd = {
                 .id = SCAN_OFFLOAD_ABORT_CMD,
         };
-        u32 status;
+        u32 status = CAN_ABORT_STATUS;
 
         ret = iwl_mvm_send_cmd_status(mvm, &cmd, &status);
         if (ret)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 411a2055dc45..c4a343534c5e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1285,7 +1285,7 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_add_sta_cmd cmd;
         int ret;
-        u32 status;
+        u32 status = ADD_STA_SUCCESS;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -2385,8 +2385,10 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
                 return -EINVAL;
 
-        if (mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
-                IWL_ERR(mvm, "Start AGG when state is not IWL_AGG_OFF %d!\n",
+        if (mvmsta->tid_data[tid].state != IWL_AGG_QUEUED &&
+            mvmsta->tid_data[tid].state != IWL_AGG_OFF) {
+                IWL_ERR(mvm,
+                        "Start AGG when state is not IWL_AGG_QUEUED or IWL_AGG_OFF %d!\n",
                         mvmsta->tid_data[tid].state);
                 return -ENXIO;
         }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index d13893806513..aedabe101cf0 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -281,6 +281,7 @@ struct iwl_mvm_vif;
  * These states relate to a specific RA / TID.
  *
  * @IWL_AGG_OFF: aggregation is not used
+ * @IWL_AGG_QUEUED: aggregation start work has been queued
  * @IWL_AGG_STARTING: aggregation are starting (between start and oper)
  * @IWL_AGG_ON: aggregation session is up
  * @IWL_EMPTYING_HW_QUEUE_ADDBA: establishing a BA session - waiting for the
@@ -290,6 +291,7 @@ struct iwl_mvm_vif;
  */
 enum iwl_mvm_agg_state {
         IWL_AGG_OFF = 0,
+        IWL_AGG_QUEUED,
         IWL_AGG_STARTING,
         IWL_AGG_ON,
         IWL_EMPTYING_HW_QUEUE_ADDBA,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 8876c2abc440..4d907f60bce9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -529,6 +529,7 @@ int iwl_mvm_ctdp_command(struct iwl_mvm *mvm, u32 op, u32 state)
 
         lockdep_assert_held(&mvm->mutex);
 
+        status = 0;
         ret = iwl_mvm_send_cmd_pdu_status(mvm, WIDE_ID(PHY_OPS_GROUP,
                                                        CTDP_CONFIG_CMD),
                                           sizeof(cmd), &cmd, &status);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 172b5e63d3fb..6f2e2af23219 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -564,8 +564,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_ADHOC:
                 /*
-                 * Handle legacy hostapd as well, where station will be added
-                 * only just before sending the association response.
+                 * Non-bufferable frames use the broadcast station, thus they
+                 * use the probe queue.
                  * Also take care of the case where we send a deauth to a
                  * station that we don't have, or similarly an association
                  * response (with non-success status) for a station we can't
@@ -573,9 +573,9 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
                  * Also, disassociate frames might happen, particular with
                  * reason 7 ("Class 3 frame received from nonassociated STA").
                  */
-                if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc) ||
-                    ieee80211_is_deauth(fc) || ieee80211_is_assoc_resp(fc) ||
-                    ieee80211_is_disassoc(fc))
+                if (ieee80211_is_mgmt(fc) &&
+                    (!ieee80211_is_bufferable_mmpdu(fc) ||
+                     ieee80211_is_deauth(fc) || ieee80211_is_disassoc(fc)))
                         return mvm->probe_queue;
                 if (info->hw_queue == info->control.vif->cab_queue)
                         return mvmvif->cab_queue;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 856fa6e8327e..a450bc6bc774 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -115,6 +115,8 @@ int qtnf_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 
         vif = qtnf_netdev_get_priv(wdev->netdev);
 
+        qtnf_scan_done(vif->mac, true);
+
         if (qtnf_cmd_send_del_intf(vif))
                 pr_err("VIF%u.%u: failed to delete VIF\n", vif->mac->macid,
                        vif->vifid);
@@ -335,6 +337,8 @@ static int qtnf_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         struct qtnf_vif *vif = qtnf_netdev_get_priv(dev);
         int ret;
 
+        qtnf_scan_done(vif->mac, true);
+
         ret = qtnf_cmd_send_stop_ap(vif);
         if (ret) {
                 pr_err("VIF%u.%u: failed to stop AP operation in FW\n",
@@ -570,8 +574,6 @@ qtnf_del_station(struct wiphy *wiphy, struct net_device *dev,
             !qtnf_sta_list_lookup(&vif->sta_list, params->mac))
                 return 0;
 
-        qtnf_scan_done(vif->mac, true);
-
         ret = qtnf_cmd_send_del_sta(vif, params);
         if (ret)
                 pr_err("VIF%u.%u: failed to delete STA %pM\n",
@@ -1134,8 +1136,9 @@ void qtnf_virtual_intf_cleanup(struct net_device *ndev)
                 }
 
                 vif->sta_state = QTNF_STA_DISCONNECTED;
-                qtnf_scan_done(mac, true);
         }
+
+        qtnf_scan_done(mac, true);
 }
 
 void qtnf_cfg80211_vif_reset(struct qtnf_vif *vif)
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
index 6a4af52522b8..66db26613b1f 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.h
@@ -34,6 +34,9 @@ static inline void qtnf_scan_done(struct qtnf_wmac *mac, bool aborted)
                 .aborted = aborted,
         };
 
+        if (timer_pending(&mac->scan_timeout))
+                del_timer_sync(&mac->scan_timeout);
+
         mutex_lock(&mac->mac_lock);
 
         if (mac->scan_req) {
diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c
index 0fc2814eafad..43d2e7fd6e02 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
@@ -345,8 +345,6 @@ qtnf_event_handle_scan_complete(struct qtnf_wmac *mac,
                 return -EINVAL;
         }
 
-        if (timer_pending(&mac->scan_timeout))
-                del_timer_sync(&mac->scan_timeout);
         qtnf_scan_done(mac, le32_to_cpu(status->flags) & QLINK_SCAN_ABORTED);
 
         return 0;
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
index 502e72b7cdcc..69131965a298 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c
@@ -661,14 +661,18 @@ static int qtnf_pcie_data_tx(struct qtnf_bus *bus, struct sk_buff *skb)
         struct qtnf_pcie_bus_priv *priv = (void *)get_bus_priv(bus);
         dma_addr_t txbd_paddr, skb_paddr;
         struct qtnf_tx_bd *txbd;
+        unsigned long flags;
         int len, i;
         u32 info;
         int ret = 0;
 
+        spin_lock_irqsave(&priv->tx0_lock, flags);
+
         if (!qtnf_tx_queue_ready(priv)) {
                 if (skb->dev)
                         netif_stop_queue(skb->dev);
 
+                spin_unlock_irqrestore(&priv->tx0_lock, flags);
                 return NETDEV_TX_BUSY;
         }
 
@@ -717,8 +721,10 @@ tx_done:
                 dev_kfree_skb_any(skb);
         }
 
-        qtnf_pcie_data_tx_reclaim(priv);
         priv->tx_done_count++;
+        spin_unlock_irqrestore(&priv->tx0_lock, flags);
+
+        qtnf_pcie_data_tx_reclaim(priv);
 
         return NETDEV_TX_OK;
 }
@@ -1247,6 +1253,7 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         strcpy(bus->fwname, QTN_PCI_PEARL_FW_NAME);
         init_completion(&bus->request_firmware_complete);
         mutex_init(&bus->bus_lock);
+        spin_lock_init(&pcie_priv->tx0_lock);
         spin_lock_init(&pcie_priv->irq_lock);
         spin_lock_init(&pcie_priv->tx_reclaim_lock);
 
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
index e76a23716ee0..86ac1ccedb52 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
+++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie_bus_priv.h
@@ -34,6 +34,8 @@ struct qtnf_pcie_bus_priv {
 
         /* lock for tx reclaim operations */
         spinlock_t tx_reclaim_lock;
+        /* lock for tx0 operations */
+        spinlock_t tx0_lock;
         u8 msi_enabled;
         int mps;
 
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index 1427a386a033..3e4d1e7998da 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -1417,6 +1417,15 @@ static int btt_claim_class(struct device *dev)
                 struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
                 struct nd_namespace_index *nsindex;
 
+                /*
+                 * If any of the DIMMs do not support labels the only
+                 * possible BTT format is v1.
+                 */
+                if (!ndd) {
+                        loop_bitmask = 0;
+                        break;
+                }
+
                 nsindex = to_namespace_index(ndd, ndd->ns_current);
                 if (nsindex == NULL)
                         loop_bitmask |= 1;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index acc816b67582..5a14cc7f28ee 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -134,8 +134,6 @@ static inline bool nvme_req_needs_retry(struct request *req)
                 return false;
         if (nvme_req(req)->status & NVME_SC_DNR)
                 return false;
-        if (jiffies - req->start_time >= req->timeout)
-                return false;
         if (nvme_req(req)->retries >= nvme_max_retries)
                 return false;
         return true;
@@ -2138,7 +2136,7 @@ static umode_t nvme_ns_attrs_are_visible(struct kobject *kobj,
         struct nvme_ns *ns = nvme_get_ns_from_dev(dev);
 
         if (a == &dev_attr_uuid.attr) {
-                if (uuid_is_null(&ns->uuid) ||
+                if (uuid_is_null(&ns->uuid) &&
                     !memchr_inv(ns->nguid, 0, sizeof(ns->nguid)))
                         return 0;
         }
@@ -2590,7 +2588,7 @@ static void nvme_async_event_work(struct work_struct *work)
                 container_of(work, struct nvme_ctrl, async_event_work);
 
         spin_lock_irq(&ctrl->lock);
-        while (ctrl->event_limit > 0) {
+        while (ctrl->state == NVME_CTRL_LIVE && ctrl->event_limit > 0) {
                 int aer_idx = --ctrl->event_limit;
 
                 spin_unlock_irq(&ctrl->lock);
@@ -2677,7 +2675,8 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                 /*FALLTHRU*/
         case NVME_SC_ABORT_REQ:
                 ++ctrl->event_limit;
-                queue_work(nvme_wq, &ctrl->async_event_work);
+                if (ctrl->state == NVME_CTRL_LIVE)
+                        queue_work(nvme_wq, &ctrl->async_event_work);
                 break;
         default:
                 break;
@@ -2692,7 +2691,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
                 nvme_queue_scan(ctrl);
                 break;
         case NVME_AER_NOTICE_FW_ACT_STARTING:
-                schedule_work(&ctrl->fw_act_work);
+                queue_work(nvme_wq, &ctrl->fw_act_work);
                 break;
         default:
                 dev_warn(ctrl->device, "async event result %08x\n", result);
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 47307752dc65..555c976cc2ee 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -565,6 +565,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
         opts->queue_size = NVMF_DEF_QUEUE_SIZE;
         opts->nr_io_queues = num_online_cpus();
         opts->reconnect_delay = NVMF_DEF_RECONNECT_DELAY;
+        opts->kato = NVME_DEFAULT_KATO;
 
         options = o = kstrdup(buf, GFP_KERNEL);
         if (!options)
@@ -655,21 +656,22 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
                                 goto out;
                         }
 
-                        if (opts->discovery_nqn) {
-                                pr_err("Discovery controllers cannot accept keep_alive_tmo != 0\n");
-                                ret = -EINVAL;
-                                goto out;
-                        }
-
                         if (token < 0) {
                                 pr_err("Invalid keep_alive_tmo %d\n", token);
                                 ret = -EINVAL;
                                 goto out;
-                        } else if (token == 0) {
+                        } else if (token == 0 && !opts->discovery_nqn) {
                                 /* Allowed for debug */
                                 pr_warn("keep_alive_tmo 0 won't execute keep alives!!!\n");
                         }
                         opts->kato = token;
+
+                        if (opts->discovery_nqn && opts->kato) {
+                                pr_err("Discovery controllers cannot accept KATO != 0\n");
+                                ret = -EINVAL;
+                                goto out;
+                        }
+
                         break;
                 case NVMF_OPT_CTRL_LOSS_TMO:
                         if (match_int(args, &token)) {
@@ -762,8 +764,6 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
         uuid_copy(&opts->host->id, &hostid);
 
 out:
-        if (!opts->discovery_nqn && !opts->kato)
-                opts->kato = NVME_DEFAULT_KATO;
         kfree(options);
         return ret;
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index d2e882c0f496..af075e998944 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1376,7 +1376,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         if (atomic_read(&op->state) == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16((NVME_SC_ABORT_REQ | NVME_SC_DNR) << 1);
         else if (freq->status)
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
 
         /*
          * For the linux implementation, if we have an unsuccesful
@@ -1404,7 +1404,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                  */
                 if (freq->transferred_length !=
                         be32_to_cpu(op->cmd_iu.data_len)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                         goto done;
                 }
                 result.u64 = 0;
@@ -1421,7 +1421,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                                         freq->transferred_length ||
                              op->rsp_iu.status_code ||
                              sqe->common.command_id != cqe->command_id)) {
-                        status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                        status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                         goto done;
                 }
                 result = cqe->result;
@@ -1429,7 +1429,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 break;
 
         default:
-                status = cpu_to_le16(NVME_SC_FC_TRANSPORT_ERROR << 1);
+                status = cpu_to_le16(NVME_SC_INTERNAL << 1);
                 goto done;
         }
 
@@ -1989,16 +1989,17 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
          * as well as those by FC-NVME spec.
          */
         WARN_ON_ONCE(sqe->common.metadata);
-        WARN_ON_ONCE(sqe->common.dptr.prp1);
-        WARN_ON_ONCE(sqe->common.dptr.prp2);
         sqe->common.flags |= NVME_CMD_SGL_METABUF;
 
         /*
-         * format SQE DPTR field per FC-NVME rules
-         *    type=data block descr; subtype=offset;
-         *    offset is currently 0.
+         * format SQE DPTR field per FC-NVME rules:
+         *    type=0x5     Transport SGL Data Block Descriptor
+         *    subtype=0xA  Transport-specific value
+         *    address=0
+         *    length=length of the data series
          */
-        sqe->rw.dptr.sgl.type = NVME_SGL_FMT_OFFSET;
+        sqe->rw.dptr.sgl.type = (NVME_TRANSPORT_SGL_DATA_DESC << 4) |
+                                        NVME_SGL_FMT_TRANSPORT_A;
         sqe->rw.dptr.sgl.length = cpu_to_le32(data_len);
         sqe->rw.dptr.sgl.addr = 0;
 
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4a2121335f48..3f5a04c586ce 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -24,6 +24,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/once.h>
 #include <linux/pci.h>
 #include <linux/poison.h>
 #include <linux/t10-pi.h>
@@ -93,7 +94,7 @@ struct nvme_dev {
         struct mutex shutdown_lock;
         bool subsystem;
         void __iomem *cmb;
-        dma_addr_t cmb_dma_addr;
+        pci_bus_addr_t cmb_bus_addr;
         u64 cmb_size;
         u32 cmbsz;
         u32 cmbloc;
@@ -540,6 +541,20 @@ static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
 }
 #endif
 
+static void nvme_print_sgl(struct scatterlist *sgl, int nents)
+{
+        int i;
+        struct scatterlist *sg;
+
+        for_each_sg(sgl, sg, nents, i) {
+                dma_addr_t phys = sg_phys(sg);
+                pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
+                        "dma_address:%pad dma_length:%d\n",
+                        i, &phys, sg->offset, sg->length, &sg_dma_address(sg),
+                        sg_dma_len(sg));
+        }
+}
+
 static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
 {
         struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
@@ -622,19 +637,10 @@ static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
         return BLK_STS_OK;
 
  bad_sgl:
-        if (WARN_ONCE(1, "Invalid SGL for payload:%d nents:%d\n",
-                                blk_rq_payload_bytes(req), iod->nents)) {
-                for_each_sg(iod->sg, sg, iod->nents, i) {
-                        dma_addr_t phys = sg_phys(sg);
-                        pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
-                               "dma_address:%pad dma_length:%d\n", i, &phys,
-                                        sg->offset, sg->length,
-                                        &sg_dma_address(sg),
-                                        sg_dma_len(sg));
-                }
-        }
+        WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents),
+                        "Invalid SGL for payload:%d nents:%d\n",
+                        blk_rq_payload_bytes(req), iod->nents);
         return BLK_STS_IOERR;
-
 }
 
 static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
@@ -1220,7 +1226,7 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
         if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) {
                 unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
                                                       dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset;
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
                 nvmeq->sq_cmds_io = dev->cmb + offset;
         } else {
                 nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
@@ -1313,11 +1319,11 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         if (result < 0)
                 goto release_cq;
 
+        nvme_init_queue(nvmeq, qid);
         result = queue_request_irq(nvmeq);
         if (result < 0)
                 goto release_sq;
 
-        nvme_init_queue(nvmeq, qid);
         return result;
 
  release_sq:
@@ -1464,6 +1470,7 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev)
                 return result;
 
         nvmeq->cq_vector = 0;
+        nvme_init_queue(nvmeq, 0);
         result = queue_request_irq(nvmeq);
         if (result) {
                 nvmeq->cq_vector = -1;
@@ -1520,7 +1527,7 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         resource_size_t bar_size;
         struct pci_dev *pdev = to_pci_dev(dev->dev);
         void __iomem *cmb;
-        dma_addr_t dma_addr;
+        int bar;
 
         dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ);
         if (!(NVME_CMB_SZ(dev->cmbsz)))
@@ -1533,7 +1540,8 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         szu = (u64)1 << (12 + 4 * NVME_CMB_SZU(dev->cmbsz));
         size = szu * NVME_CMB_SZ(dev->cmbsz);
         offset = szu * NVME_CMB_OFST(dev->cmbloc);
-        bar_size = pci_resource_len(pdev, NVME_CMB_BIR(dev->cmbloc));
+        bar = NVME_CMB_BIR(dev->cmbloc);
+        bar_size = pci_resource_len(pdev, bar);
 
         if (offset > bar_size)
                 return NULL;
@@ -1546,12 +1554,11 @@ static void __iomem *nvme_map_cmb(struct nvme_dev *dev)
         if (size > bar_size - offset)
                 size = bar_size - offset;
 
-        dma_addr = pci_resource_start(pdev, NVME_CMB_BIR(dev->cmbloc)) + offset;
-        cmb = ioremap_wc(dma_addr, size);
+        cmb = ioremap_wc(pci_resource_start(pdev, bar) + offset, size);
         if (!cmb)
                 return NULL;
 
-        dev->cmb_dma_addr = dma_addr;
+        dev->cmb_bus_addr = pci_bus_address(pdev, bar) + offset;
         dev->cmb_size = size;
         return cmb;
 }
@@ -2156,7 +2163,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (result)
                 goto out;
 
-        nvme_init_queue(dev->queues[0], 0);
         result = nvme_alloc_admin_tags(dev);
         if (result)
                 goto out;
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 58983000964b..92a03ff5fb4d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -942,7 +942,12 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
-        WARN_ON_ONCE(!changed);
+        if (!changed) {
+                /* state change failure is ok if we're in DELETING state */
+                WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING);
+                return;
+        }
+
         ctrl->ctrl.nr_reconnects = 0;
 
         nvme_start_ctrl(&ctrl->ctrl);
@@ -962,7 +967,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                         struct nvme_rdma_ctrl, err_work);
 
-        nvme_stop_ctrl(&ctrl->ctrl);
+        nvme_stop_keep_alive(&ctrl->ctrl);
 
         if (ctrl->ctrl.queue_count > 1) {
                 nvme_stop_queues(&ctrl->ctrl);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 7c23eaf8e563..1b208beeef50 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -390,10 +390,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
         if (status)
                 nvmet_set_status(req, status);
 
-        /* XXX: need to fill in something useful for sq_head */
-        req->rsp->sq_head = 0;
-        if (likely(req->sq)) /* may happen during early failure */
-                req->rsp->sq_id = cpu_to_le16(req->sq->qid);
+        if (req->sq->size)
+                req->sq->sqhd = (req->sq->sqhd + 1) % req->sq->size;
+        req->rsp->sq_head = cpu_to_le16(req->sq->sqhd);
+        req->rsp->sq_id = cpu_to_le16(req->sq->qid);
         req->rsp->command_id = req->cmd->common.command_id;
 
         if (req->ns)
@@ -420,6 +420,7 @@ void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq,
 void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
                 u16 qid, u16 size)
 {
+        sq->sqhd = 0;
         sq->qid = qid;
         sq->size = size;
 
diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 859a66725291..db3bf6b8bf9e 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -109,9 +109,14 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)
                 pr_warn("queue already connected!\n");
                 return NVME_SC_CONNECT_CTRL_BUSY | NVME_SC_DNR;
         }
+        if (!sqsize) {
+                pr_warn("queue size zero!\n");
+                return NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+        }
 
-        nvmet_cq_setup(ctrl, req->cq, qid, sqsize);
-        nvmet_sq_setup(ctrl, req->sq, qid, sqsize);
+        /* note: convert queue size from 0's-based value to 1's-based value */
+        nvmet_cq_setup(ctrl, req->cq, qid, sqsize + 1);
+        nvmet_sq_setup(ctrl, req->sq, qid, sqsize + 1);
         return 0;
 }
 
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 421e43bf1dd7..58e010bdda3e 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -148,7 +148,7 @@ struct nvmet_fc_tgt_assoc {
         u32                             a_id;
         struct nvmet_fc_tgtport         *tgtport;
         struct list_head                a_list;
-        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES];
+        struct nvmet_fc_tgt_queue       *queues[NVMET_NR_QUEUES + 1];
         struct kref                     ref;
 };
 
@@ -608,7 +608,7 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
         unsigned long flags;
         int ret;
 
-        if (qid >= NVMET_NR_QUEUES)
+        if (qid > NVMET_NR_QUEUES)
                 return NULL;
 
         queue = kzalloc((sizeof(*queue) +
@@ -783,6 +783,9 @@ nvmet_fc_find_target_queue(struct nvmet_fc_tgtport *tgtport,
         u16 qid = nvmet_fc_getqueueid(connection_id);
         unsigned long flags;
 
+        if (qid > NVMET_NR_QUEUES)
+                return NULL;
+
         spin_lock_irqsave(&tgtport->lock, flags);
         list_for_each_entry(assoc, &tgtport->assoc_list, a_list) {
                 if (association_id == assoc->association_id) {
@@ -888,7 +891,7 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
         int i;
 
         spin_lock_irqsave(&tgtport->lock, flags);
-        for (i = NVMET_NR_QUEUES - 1; i >= 0; i--) {
+        for (i = NVMET_NR_QUEUES; i >= 0; i--) {
                 queue = assoc->queues[i];
                 if (queue) {
                         if (!nvmet_fc_tgt_q_get(queue))
@@ -1910,8 +1913,7 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport,
                         spin_lock_irqsave(&fod->flock, flags);
                         fod->writedataactive = false;
                         spin_unlock_irqrestore(&fod->flock, flags);
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                 } else /* NVMET_FCOP_READDATA or NVMET_FCOP_READDATA_RSP */ {
                         fcpreq->fcp_error = ret;
                         fcpreq->transferred_length = 0;
@@ -1929,8 +1931,7 @@ __nvmet_fc_fod_op_abort(struct nvmet_fc_fcp_iod *fod, bool abort)
         /* if in the middle of an io and we need to tear down */
         if (abort) {
                 if (fcpreq->op == NVMET_FCOP_WRITEDATA) {
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                         return true;
                 }
 
@@ -1968,8 +1969,7 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod)
                         fod->abort = true;
                         spin_unlock(&fod->flock);
 
-                        nvmet_req_complete(&fod->req,
-                                        NVME_SC_FC_TRANSPORT_ERROR);
+                        nvmet_req_complete(&fod->req, NVME_SC_INTERNAL);
                         return;
                 }
 
@@ -2533,13 +2533,17 @@ nvmet_fc_remove_port(struct nvmet_port *port)
 {
         struct nvmet_fc_tgtport *tgtport = port->priv;
         unsigned long flags;
+        bool matched = false;
 
         spin_lock_irqsave(&nvmet_fc_tgtlock, flags);
         if (tgtport->port == port) {
-                nvmet_fc_tgtport_put(tgtport);
+                matched = true;
                 tgtport->port = NULL;
         }
         spin_unlock_irqrestore(&nvmet_fc_tgtlock, flags);
+
+        if (matched)
+                nvmet_fc_tgtport_put(tgtport);
 }
 
 static struct nvmet_fabrics_ops nvmet_fc_tgt_fcp_ops = {
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 1cb9847ec261..7b75d9de55ab 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -224,8 +224,6 @@ struct fcloop_nport {
         struct fcloop_lport *lport;
         struct list_head nport_list;
         struct kref ref;
-        struct completion rport_unreg_done;
-        struct completion tport_unreg_done;
         u64 node_name;
         u64 port_name;
         u32 port_role;
@@ -576,7 +574,7 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
         tfcp_req->aborted = true;
         spin_unlock(&tfcp_req->reqlock);
 
-        tfcp_req->status = NVME_SC_FC_TRANSPORT_ABORTED;
+        tfcp_req->status = NVME_SC_INTERNAL;
 
         /*
          * nothing more to do. If io wasn't active, the transport should
@@ -631,6 +629,32 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
 }
 
 static void
+fcloop_nport_free(struct kref *ref)
+{
+        struct fcloop_nport *nport =
+                container_of(ref, struct fcloop_nport, ref);
+        unsigned long flags;
+
+        spin_lock_irqsave(&fcloop_lock, flags);
+        list_del(&nport->nport_list);
+        spin_unlock_irqrestore(&fcloop_lock, flags);
+
+        kfree(nport);
+}
+
+static void
+fcloop_nport_put(struct fcloop_nport *nport)
+{
+        kref_put(&nport->ref, fcloop_nport_free);
+}
+
+static int
+fcloop_nport_get(struct fcloop_nport *nport)
+{
+        return kref_get_unless_zero(&nport->ref);
+}
+
+static void
 fcloop_localport_delete(struct nvme_fc_local_port *localport)
 {
         struct fcloop_lport *lport = localport->private;
@@ -644,8 +668,7 @@ fcloop_remoteport_delete(struct nvme_fc_remote_port *remoteport)
 {
         struct fcloop_rport *rport = remoteport->private;
 
-        /* release any threads waiting for the unreg to complete */
-        complete(&rport->nport->rport_unreg_done);
+        fcloop_nport_put(rport->nport);
 }
 
 static void
@@ -653,8 +676,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
 {
         struct fcloop_tport *tport = targetport->private;
 
-        /* release any threads waiting for the unreg to complete */
-        complete(&tport->nport->tport_unreg_done);
+        fcloop_nport_put(tport->nport);
 }
 
 #define FCLOOP_HW_QUEUES                4
@@ -722,6 +744,7 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr,
                 goto out_free_opts;
         }
 
+        memset(&pinfo, 0, sizeof(pinfo));
         pinfo.node_name = opts->wwnn;
         pinfo.port_name = opts->wwpn;
         pinfo.port_role = opts->roles;
@@ -804,32 +827,6 @@ fcloop_delete_local_port(struct device *dev, struct device_attribute *attr,
         return ret ? ret : count;
 }
 
-static void
-fcloop_nport_free(struct kref *ref)
-{
-        struct fcloop_nport *nport =
-                container_of(ref, struct fcloop_nport, ref);
-        unsigned long flags;
-
-        spin_lock_irqsave(&fcloop_lock, flags);
-        list_del(&nport->nport_list);
-        spin_unlock_irqrestore(&fcloop_lock, flags);
-
-        kfree(nport);
-}
-
-static void
-fcloop_nport_put(struct fcloop_nport *nport)
-{
-        kref_put(&nport->ref, fcloop_nport_free);
-}
-
-static int
-fcloop_nport_get(struct fcloop_nport *nport)
-{
-        return kref_get_unless_zero(&nport->ref);
-}
-
 static struct fcloop_nport *
 fcloop_alloc_nport(const char *buf, size_t count, bool remoteport)
 {
@@ -938,6 +935,7 @@ fcloop_create_remote_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -EIO;
 
+        memset(&pinfo, 0, sizeof(pinfo));
         pinfo.node_name = nport->node_name;
         pinfo.port_name = nport->port_name;
         pinfo.port_role = nport->port_role;
@@ -979,24 +977,12 @@ __unlink_remote_port(struct fcloop_nport *nport)
 }
 
 static int
-__wait_remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
+__remoteport_unreg(struct fcloop_nport *nport, struct fcloop_rport *rport)
 {
-        int ret;
-
         if (!rport)
                 return -EALREADY;
 
-        init_completion(&nport->rport_unreg_done);
-
-        ret = nvme_fc_unregister_remoteport(rport->remoteport);
-        if (ret)
-                return ret;
-
-        wait_for_completion(&nport->rport_unreg_done);
-
-        fcloop_nport_put(nport);
-
-        return ret;
+        return nvme_fc_unregister_remoteport(rport->remoteport);
 }
 
 static ssize_t
@@ -1029,7 +1015,7 @@ fcloop_delete_remote_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -ENOENT;
 
-        ret = __wait_remoteport_unreg(nport, rport);
+        ret = __remoteport_unreg(nport, rport);
 
         return ret ? ret : count;
 }
@@ -1086,24 +1072,12 @@ __unlink_target_port(struct fcloop_nport *nport)
 }
 
 static int
-__wait_targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
+__targetport_unreg(struct fcloop_nport *nport, struct fcloop_tport *tport)
 {
-        int ret;
-
         if (!tport)
                 return -EALREADY;
 
-        init_completion(&nport->tport_unreg_done);
-
-        ret = nvmet_fc_unregister_targetport(tport->targetport);
-        if (ret)
-                return ret;
-
-        wait_for_completion(&nport->tport_unreg_done);
-
-        fcloop_nport_put(nport);
-
-        return ret;
+        return nvmet_fc_unregister_targetport(tport->targetport);
 }
 
 static ssize_t
@@ -1136,7 +1110,7 @@ fcloop_delete_target_port(struct device *dev, struct device_attribute *attr,
         if (!nport)
                 return -ENOENT;
 
-        ret = __wait_targetport_unreg(nport, tport);
+        ret = __targetport_unreg(nport, tport);
 
         return ret ? ret : count;
 }
@@ -1223,11 +1197,11 @@ static void __exit fcloop_exit(void)
 
                 spin_unlock_irqrestore(&fcloop_lock, flags);
 
-                ret = __wait_targetport_unreg(nport, tport);
+                ret = __targetport_unreg(nport, tport);
                 if (ret)
                         pr_warn("%s: Failed deleting target port\n", __func__);
 
-                ret = __wait_remoteport_unreg(nport, rport);
+                ret = __remoteport_unreg(nport, rport);
                 if (ret)
                         pr_warn("%s: Failed deleting remote port\n", __func__);
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7d261ab894f4..7b8e20adf760 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -74,6 +74,7 @@ struct nvmet_sq {
         struct percpu_ref       ref;
         u16                     qid;
         u16                     size;
+        u16                     sqhd;
         struct completion       free_done;
         struct completion       confirm_done;
 };
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index de54c7f5048a..d12e5de78e70 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -135,7 +135,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
 
         /* Stop the user from writing */
         if (pos >= nvmem->size)
-                return 0;
+                return -EFBIG;
 
         if (count < nvmem->word_size)
                 return -EINVAL;
@@ -789,6 +789,7 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
                 return ERR_PTR(-EINVAL);
 
         nvmem = __nvmem_device_get(nvmem_np, NULL, NULL);
+        of_node_put(nvmem_np);
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 4ddc6e8f9fe7..f9308c2f22e6 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -251,9 +251,8 @@ err:
         return ret;
 }
 
-static void pci_epf_test_raise_irq(struct pci_epf_test *epf_test)
+static void pci_epf_test_raise_irq(struct pci_epf_test *epf_test, u8 irq)
 {
-        u8 irq;
         u8 msi_count;
         struct pci_epf *epf = epf_test->epf;
         struct pci_epc *epc = epf->epc;
@@ -262,7 +261,6 @@ static void pci_epf_test_raise_irq(struct pci_epf_test *epf_test)
 
         reg->status |= STATUS_IRQ_RAISED;
         msi_count = pci_epc_get_msi(epc);
-        irq = (reg->command & MSI_NUMBER_MASK) >> MSI_NUMBER_SHIFT;
         if (irq > msi_count || msi_count <= 0)
                 pci_epc_raise_irq(epc, PCI_EPC_IRQ_LEGACY, 0);
         else
@@ -289,6 +287,8 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
         reg->command = 0;
         reg->status = 0;
 
+        irq = (command & MSI_NUMBER_MASK) >> MSI_NUMBER_SHIFT;
+
         if (command & COMMAND_RAISE_LEGACY_IRQ) {
                 reg->status = STATUS_IRQ_RAISED;
                 pci_epc_raise_irq(epc, PCI_EPC_IRQ_LEGACY, 0);
@@ -301,7 +301,7 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
                         reg->status |= STATUS_WRITE_FAIL;
                 else
                         reg->status |= STATUS_WRITE_SUCCESS;
-                pci_epf_test_raise_irq(epf_test);
+                pci_epf_test_raise_irq(epf_test, irq);
                 goto reset_handler;
         }
 
@@ -311,7 +311,7 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
                         reg->status |= STATUS_READ_SUCCESS;
                 else
                         reg->status |= STATUS_READ_FAIL;
-                pci_epf_test_raise_irq(epf_test);
+                pci_epf_test_raise_irq(epf_test, irq);
                 goto reset_handler;
         }
 
@@ -321,13 +321,12 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
                         reg->status |= STATUS_COPY_SUCCESS;
                 else
                         reg->status |= STATUS_COPY_FAIL;
-                pci_epf_test_raise_irq(epf_test);
+                pci_epf_test_raise_irq(epf_test, irq);
                 goto reset_handler;
         }
 
         if (command & COMMAND_RAISE_MSI_IRQ) {
                 msi_count = pci_epc_get_msi(epc);
-                irq = (command & MSI_NUMBER_MASK) >> MSI_NUMBER_SHIFT;
                 if (irq > msi_count || msi_count <= 0)
                         goto reset_handler;
                 reg->status = STATUS_IRQ_RAISED;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 1eecfa301f7f..8e075ea2743e 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -686,7 +686,7 @@ static ssize_t driver_override_store(struct device *dev,
                                      const char *buf, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
-        char *driver_override, *old = pdev->driver_override, *cp;
+        char *driver_override, *old, *cp;
 
         /* We need to keep extra room for a newline */
         if (count >= (PAGE_SIZE - 1))
@@ -700,12 +700,15 @@ static ssize_t driver_override_store(struct device *dev,
         if (cp)
                 *cp = '\0';
 
+        device_lock(dev);
+        old = pdev->driver_override;
         if (strlen(driver_override)) {
                 pdev->driver_override = driver_override;
         } else {
                 kfree(driver_override);
                 pdev->driver_override = NULL;
         }
+        device_unlock(dev);
 
         kfree(old);
 
@@ -716,8 +719,12 @@ static ssize_t driver_override_show(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
+        ssize_t len;
 
-        return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_lock(dev);
+        len = snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
+        device_unlock(dev);
+        return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index 0a9b78705ee8..3303dd8d8eb5 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -235,6 +235,7 @@ int arm_pmu_acpi_probe(armpmu_init_fn init_fn)
                 ret = armpmu_register(pmu);
                 if (ret) {
                         pr_warn("Failed to register PMU for CPU%d\n", cpu);
+                        kfree(pmu->name);
                         return ret;
                 }
         }
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 85de30f93a9c..56a8195096a2 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -254,10 +254,12 @@ static int bl_update_status(struct backlight_device *b)
 {
         struct acpi_device *device = bl_get_data(b);
 
-        if (b->props.power == FB_BLANK_POWERDOWN)
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
-        else
-                call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        if (fext) {
+                if (b->props.power == FB_BLANK_POWERDOWN)
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x3);
+                else
+                        call_fext_func(fext, FUNC_BACKLIGHT, 0x1, 0x4, 0x0);
+        }
 
         return set_lcd_level(device, b->props.brightness);
 }
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 315a4be8dc1e..9a68914100ad 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -51,6 +51,8 @@ module_param(mbox_sel, byte, S_IRUGO);
 MODULE_PARM_DESC(mbox_sel,
                  "RIO Messaging MBOX Selection Mask (default: 0x0f = all)");
 
+static DEFINE_SPINLOCK(tsi721_maint_lock);
+
 static void tsi721_omsg_handler(struct tsi721_device *priv, int ch);
 static void tsi721_imsg_handler(struct tsi721_device *priv, int ch);
 
@@ -124,12 +126,15 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
         void __iomem *regs = priv->regs + TSI721_DMAC_BASE(priv->mdma.ch_id);
         struct tsi721_dma_desc *bd_ptr;
         u32 rd_count, swr_ptr, ch_stat;
+        unsigned long flags;
         int i, err = 0;
         u32 op = do_wr ? MAINT_WR : MAINT_RD;
 
         if (offset > (RIO_MAINT_SPACE_SZ - len) || (len != sizeof(u32)))
                 return -EINVAL;
 
+        spin_lock_irqsave(&tsi721_maint_lock, flags);
+
         bd_ptr = priv->mdma.bd_base;
 
         rd_count = ioread32(regs + TSI721_DMAC_DRDCNT);
@@ -197,7 +202,9 @@ static int tsi721_maint_dma(struct tsi721_device *priv, u32 sys_size,
          */
         swr_ptr = ioread32(regs + TSI721_DMAC_DSWP);
         iowrite32(swr_ptr, regs + TSI721_DMAC_DSRP);
+
 err_out:
+        spin_unlock_irqrestore(&tsi721_maint_lock, flags);
 
         return err;
 }
diff --git a/drivers/rapidio/rio-access.c b/drivers/rapidio/rio-access.c
index a3824baca2e5..3ee9af83b638 100644
--- a/drivers/rapidio/rio-access.c
+++ b/drivers/rapidio/rio-access.c
@@ -14,16 +14,8 @@
 #include <linux/module.h>
 
 /*
- * These interrupt-safe spinlocks protect all accesses to RIO
- * configuration space and doorbell access.
- */
-static DEFINE_SPINLOCK(rio_config_lock);
-static DEFINE_SPINLOCK(rio_doorbell_lock);
-
-/*
  *  Wrappers for all RIO configuration access functions.  They just check
- *  alignment, do locking and call the low-level functions pointed to
- *  by rio_mport->ops.
+ *  alignment and call the low-level functions pointed to by rio_mport->ops.
  */
 
 #define RIO_8_BAD 0
@@ -44,13 +36,10 @@ int __rio_local_read_config_##size \
         (struct rio_mport *mport, u32 offset, type *value)              \
 {                                                                       \
         int res;                                                        \
-        unsigned long flags;                                            \
         u32 data = 0;                                                   \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
         res = mport->ops->lcread(mport, mport->id, offset, len, &data); \
         *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
         return res;                                                     \
 }
 
@@ -67,13 +56,8 @@ int __rio_local_read_config_##size \
 int __rio_local_write_config_##size \
         (struct rio_mport *mport, u32 offset, type value)               \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
-        res = mport->ops->lcwrite(mport, mport->id, offset, len, value);\
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
+        return mport->ops->lcwrite(mport, mport->id, offset, len, value);\
 }
 
 RIO_LOP_READ(8, u8, 1)
@@ -104,13 +88,10 @@ int rio_mport_read_config_##size \
         (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type *value)     \
 {                                                                       \
         int res;                                                        \
-        unsigned long flags;                                            \
         u32 data = 0;                                                   \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
         res = mport->ops->cread(mport, mport->id, destid, hopcount, offset, len, &data); \
         *value = (type)data;                                            \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
         return res;                                                     \
 }
 
@@ -127,13 +108,9 @@ int rio_mport_read_config_##size \
 int rio_mport_write_config_##size \
         (struct rio_mport *mport, u16 destid, u8 hopcount, u32 offset, type value)      \
 {                                                                       \
-        int res;                                                        \
-        unsigned long flags;                                            \
         if (RIO_##size##_BAD) return RIO_BAD_SIZE;                      \
-        spin_lock_irqsave(&rio_config_lock, flags);                     \
-        res = mport->ops->cwrite(mport, mport->id, destid, hopcount, offset, len, value); \
-        spin_unlock_irqrestore(&rio_config_lock, flags);                \
-        return res;                                                     \
+        return mport->ops->cwrite(mport, mport->id, destid, hopcount,   \
+                        offset, len, value);                            \
 }
 
 RIO_OP_READ(8, u8, 1)
@@ -162,14 +139,7 @@ EXPORT_SYMBOL_GPL(rio_mport_write_config_32);
  */
 int rio_mport_send_doorbell(struct rio_mport *mport, u16 destid, u16 data)
 {
-        int res;
-        unsigned long flags;
-
-        spin_lock_irqsave(&rio_doorbell_lock, flags);
-        res = mport->ops->dsend(mport, mport->id, destid, data);
-        spin_unlock_irqrestore(&rio_doorbell_lock, flags);
-
-        return res;
+        return mport->ops->dsend(mport, mport->id, destid, data);
 }
 
 EXPORT_SYMBOL_GPL(rio_mport_send_doorbell);
diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig
index e0c393214264..e2baecbb9dd3 100644
--- a/drivers/reset/Kconfig
+++ b/drivers/reset/Kconfig
@@ -34,11 +34,12 @@ config RESET_BERLIN
         help
           This enables the reset controller driver for Marvell Berlin SoCs.
 
-config RESET_HSDK_V1
-        bool "HSDK v1 Reset Driver"
-        default n
+config RESET_HSDK
+        bool "Synopsys HSDK Reset Driver"
+        depends on HAS_IOMEM
+        depends on ARC_SOC_HSDK || COMPILE_TEST
         help
-          This enables the reset controller driver for HSDK v1.
+          This enables the reset controller driver for HSDK board.
 
 config RESET_IMX7
         bool "i.MX7 Reset Driver" if COMPILE_TEST
diff --git a/drivers/reset/Makefile b/drivers/reset/Makefile
index d368367110e5..af1c15c330b3 100644
--- a/drivers/reset/Makefile
+++ b/drivers/reset/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_RESET_A10SR) += reset-a10sr.o
 obj-$(CONFIG_RESET_ATH79) += reset-ath79.o
 obj-$(CONFIG_RESET_BERLIN) += reset-berlin.o
-obj-$(CONFIG_RESET_HSDK_V1) += reset-hsdk-v1.o
+obj-$(CONFIG_RESET_HSDK) += reset-hsdk.o
 obj-$(CONFIG_RESET_IMX7) += reset-imx7.o
 obj-$(CONFIG_RESET_LANTIQ) += reset-lantiq.o
 obj-$(CONFIG_RESET_LPC18XX) += reset-lpc18xx.o
diff --git a/drivers/reset/reset-hsdk-v1.c b/drivers/reset/reset-hsdk.c
index bca13e4bf622..8bce391c6943 100644
--- a/drivers/reset/reset-hsdk-v1.c
+++ b/drivers/reset/reset-hsdk.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2017 Synopsys.
  *
- * Synopsys HSDKv1 SDP reset driver.
+ * Synopsys HSDK Development platform reset driver.
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -18,9 +18,9 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 
-#define to_hsdkv1_rst(p)        container_of((p), struct hsdkv1_rst, rcdev)
+#define to_hsdk_rst(p)  container_of((p), struct hsdk_rst, rcdev)
 
-struct hsdkv1_rst {
+struct hsdk_rst {
         void __iomem                    *regs_ctl;
         void __iomem                    *regs_rst;
         spinlock_t                      lock;
@@ -49,12 +49,12 @@ static const u32 rst_map[] = {
 #define CGU_IP_SW_RESET_RESET           BIT(0)
 #define SW_RESET_TIMEOUT                10000
 
-static void hsdkv1_reset_config(struct hsdkv1_rst *rst, unsigned long id)
+static void hsdk_reset_config(struct hsdk_rst *rst, unsigned long id)
 {
         writel(rst_map[id], rst->regs_ctl + CGU_SYS_RST_CTRL);
 }
 
-static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
+static int hsdk_reset_do(struct hsdk_rst *rst)
 {
         u32 reg;
 
@@ -69,28 +69,28 @@ static int hsdkv1_reset_do(struct hsdkv1_rst *rst)
                 !(reg & CGU_IP_SW_RESET_RESET), 5, SW_RESET_TIMEOUT);
 }
 
-static int hsdkv1_reset_reset(struct reset_controller_dev *rcdev,
+static int hsdk_reset_reset(struct reset_controller_dev *rcdev,
                               unsigned long id)
 {
-        struct hsdkv1_rst *rst = to_hsdkv1_rst(rcdev);
+        struct hsdk_rst *rst = to_hsdk_rst(rcdev);
         unsigned long flags;
         int ret;
 
         spin_lock_irqsave(&rst->lock, flags);
-        hsdkv1_reset_config(rst, id);
-        ret = hsdkv1_reset_do(rst);
+        hsdk_reset_config(rst, id);
+        ret = hsdk_reset_do(rst);
         spin_unlock_irqrestore(&rst->lock, flags);
 
         return ret;
 }
 
-static const struct reset_control_ops hsdkv1_reset_ops = {
-        .reset  = hsdkv1_reset_reset,
+static const struct reset_control_ops hsdk_reset_ops = {
+        .reset  = hsdk_reset_reset,
 };
 
-static int hsdkv1_reset_probe(struct platform_device *pdev)
+static int hsdk_reset_probe(struct platform_device *pdev)
 {
-        struct hsdkv1_rst *rst;
+        struct hsdk_rst *rst;
         struct resource *mem;
 
         rst = devm_kzalloc(&pdev->dev, sizeof(*rst), GFP_KERNEL);
@@ -110,7 +110,7 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
         spin_lock_init(&rst->lock);
 
         rst->rcdev.owner = THIS_MODULE;
-        rst->rcdev.ops = &hsdkv1_reset_ops;
+        rst->rcdev.ops = &hsdk_reset_ops;
         rst->rcdev.of_node = pdev->dev.of_node;
         rst->rcdev.nr_resets = HSDK_MAX_RESETS;
         rst->rcdev.of_reset_n_cells = 1;
@@ -118,20 +118,20 @@ static int hsdkv1_reset_probe(struct platform_device *pdev)
         return reset_controller_register(&rst->rcdev);
 }
 
-static const struct of_device_id hsdkv1_reset_dt_match[] = {
-        { .compatible = "snps,hsdk-v1.0-reset" },
+static const struct of_device_id hsdk_reset_dt_match[] = {
+        { .compatible = "snps,hsdk-reset" },
         { },
 };
 
-static struct platform_driver hsdkv1_reset_driver = {
-        .probe  = hsdkv1_reset_probe,
+static struct platform_driver hsdk_reset_driver = {
+        .probe  = hsdk_reset_probe,
         .driver = {
-                .name = "hsdk-v1.0-reset",
-                .of_match_table = hsdkv1_reset_dt_match,
+                .name = "hsdk-reset",
+                .of_match_table = hsdk_reset_dt_match,
         },
 };
-builtin_platform_driver(hsdkv1_reset_driver);
+builtin_platform_driver(hsdk_reset_driver);
 
 MODULE_AUTHOR("Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>");
-MODULE_DESCRIPTION("Synopsys HSDKv1 SDP reset driver");
+MODULE_DESCRIPTION("Synopsys HSDK SDP reset driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index ea19b4ff87a2..29f35e29d480 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1644,7 +1644,9 @@ void dasd_generic_handle_state_change(struct dasd_device *device)
         dasd_schedule_device_bh(device);
         if (device->block) {
                 dasd_schedule_block_bh(device->block);
-                blk_mq_run_hw_queues(device->block->request_queue, true);
+                if (device->block->request_queue)
+                        blk_mq_run_hw_queues(device->block->request_queue,
+                                             true);
         }
 }
 EXPORT_SYMBOL_GPL(dasd_generic_handle_state_change);
@@ -3759,7 +3761,9 @@ int dasd_generic_path_operational(struct dasd_device *device)
         dasd_schedule_device_bh(device);
         if (device->block) {
                 dasd_schedule_block_bh(device->block);
-                blk_mq_run_hw_queues(device->block->request_queue, true);
+                if (device->block->request_queue)
+                        blk_mq_run_hw_queues(device->block->request_queue,
+                                             true);
                 }
 
         if (!device->stopped)
@@ -4025,7 +4029,9 @@ int dasd_generic_restore_device(struct ccw_device *cdev)
 
         if (device->block) {
                 dasd_schedule_block_bh(device->block);
-                blk_mq_run_hw_queues(device->block->request_queue, true);
+                if (device->block->request_queue)
+                        blk_mq_run_hw_queues(device->block->request_queue,
+                                             true);
         }
 
         clear_bit(DASD_FLAG_SUSPENDED, &device->flags);
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 2e7fd966c515..eb51893c74a4 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -249,7 +249,7 @@ static void scm_request_requeue(struct scm_request *scmrq)
 static void scm_request_finish(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
-        int *error;
+        blk_status_t *error;
         int i;
 
         for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
@@ -415,7 +415,7 @@ void scm_blk_irq(struct scm_device *scmdev, void *data, blk_status_t error)
 
 static void scm_blk_request_done(struct request *req)
 {
-        int *error = blk_mq_rq_to_pdu(req);
+        blk_status_t *error = blk_mq_rq_to_pdu(req);
 
         blk_mq_end_request(req, *error);
 }
@@ -450,7 +450,7 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
         atomic_set(&bdev->queued_reqs, 0);
 
         bdev->tag_set.ops = &scm_mq_ops;
-        bdev->tag_set.cmd_size = sizeof(int);
+        bdev->tag_set.cmd_size = sizeof(blk_status_t);
         bdev->tag_set.nr_hw_queues = nr_requests;
         bdev->tag_set.queue_depth = nr_requests_per_io * nr_requests;
         bdev->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 489b583f263d..e5c32f4b5287 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1225,10 +1225,16 @@ static int device_is_disconnected(struct ccw_device *cdev)
 static int recovery_check(struct device *dev, void *data)
 {
         struct ccw_device *cdev = to_ccwdev(dev);
+        struct subchannel *sch;
         int *redo = data;
 
         spin_lock_irq(cdev->ccwlock);
         switch (cdev->private->state) {
+        case DEV_STATE_ONLINE:
+                sch = to_subchannel(cdev->dev.parent);
+                if ((sch->schib.pmcw.pam & sch->opm) == sch->vpm)
+                        break;
+                /* fall through */
         case DEV_STATE_DISCONNECTED:
                 CIO_MSG_EVENT(3, "recovery: trigger 0.%x.%04x\n",
                               cdev->private->dev_id.ssid,
@@ -1260,7 +1266,7 @@ static void recovery_work_func(struct work_struct *unused)
                 }
                 spin_unlock_irq(&recovery_lock);
         } else
-                CIO_MSG_EVENT(4, "recovery: end\n");
+                CIO_MSG_EVENT(3, "recovery: end\n");
 }
 
 static DECLARE_WORK(recovery_work, recovery_work_func);
@@ -1274,11 +1280,11 @@ static void recovery_func(unsigned long data)
         schedule_work(&recovery_work);
 }
 
-static void ccw_device_schedule_recovery(void)
+void ccw_device_schedule_recovery(void)
 {
         unsigned long flags;
 
-        CIO_MSG_EVENT(4, "recovery: schedule\n");
+        CIO_MSG_EVENT(3, "recovery: schedule\n");
         spin_lock_irqsave(&recovery_lock, flags);
         if (!timer_pending(&recovery_timer) || (recovery_phase != 0)) {
                 recovery_phase = 0;
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index ec497af99dd8..69cb70f080a5 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -134,6 +134,7 @@ void ccw_device_set_disconnected(struct ccw_device *cdev);
 void ccw_device_set_notoper(struct ccw_device *cdev);
 
 void ccw_device_set_timeout(struct ccw_device *, int);
+void ccw_device_schedule_recovery(void);
 
 /* Channel measurement facility related */
 void retry_set_schib(struct ccw_device *cdev);
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 12016e32e519..f98ea674c3d8 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -476,6 +476,17 @@ static void create_fake_irb(struct irb *irb, int type)
         }
 }
 
+static void ccw_device_handle_broken_paths(struct ccw_device *cdev)
+{
+        struct subchannel *sch = to_subchannel(cdev->dev.parent);
+        u8 broken_paths = (sch->schib.pmcw.pam & sch->opm) ^ sch->vpm;
+
+        if (broken_paths && (cdev->private->path_broken_mask != broken_paths))
+                ccw_device_schedule_recovery();
+
+        cdev->private->path_broken_mask = broken_paths;
+}
+
 void ccw_device_verify_done(struct ccw_device *cdev, int err)
 {
         struct subchannel *sch;
@@ -508,6 +519,7 @@ callback:
                         memset(&cdev->private->irb, 0, sizeof(struct irb));
                 }
                 ccw_device_report_path_events(cdev);
+                ccw_device_handle_broken_paths(cdev);
                 break;
         case -ETIME:
         case -EUSERS:
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 220f49145b2f..9a1b56b2df3e 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -131,6 +131,8 @@ struct ccw_device_private {
                                    not operable */
         u8 path_gone_mask;      /* mask of paths, that became unavailable */
         u8 path_new_mask;       /* mask of paths, that became available */
+        u8 path_broken_mask;    /* mask of paths, which were found to be
+                                   unusable */
         struct {
                 unsigned int fast:1;    /* post with "channel end" */
                 unsigned int repall:1;  /* report every interrupt status */
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index a64285ab0728..af3e4d3f9735 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -699,13 +699,13 @@ static void _aac_probe_container1(void * context, struct fib * fibptr)
         int status;
 
         dresp = (struct aac_mount *) fib_data(fibptr);
-        if (!(fibptr->dev->supplement_adapter_info.supported_options2 &
-            AAC_OPTION_VARIABLE_BLOCK_SIZE))
+        if (!aac_supports_2T(fibptr->dev)) {
                 dresp->mnt[0].capacityhigh = 0;
-        if ((le32_to_cpu(dresp->status) != ST_OK) ||
-            (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
-                _aac_probe_container2(context, fibptr);
-                return;
+                if ((le32_to_cpu(dresp->status) == ST_OK) &&
+                        (le32_to_cpu(dresp->mnt[0].vol) != CT_NONE)) {
+                        _aac_probe_container2(context, fibptr);
+                        return;
+                }
         }
         scsicmd = (struct scsi_cmnd *) context;
 
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 92fabf2b0c24..403a639574e5 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2701,6 +2701,11 @@ static inline int aac_is_src(struct aac_dev *dev)
         return 0;
 }
 
+static inline int aac_supports_2T(struct aac_dev *dev)
+{
+        return (dev->adapter_info.options & AAC_OPT_NEW_COMM_64);
+}
+
 char * get_container_type(unsigned type);
 extern int numacb;
 extern char aac_driver_version[];
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 87cc4a93e637..62beb2596466 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -906,12 +906,14 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
 
         bus = aac_logical_to_phys(scmd_channel(cmd));
         cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
                 return FAILED;
 
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                 return FAILED;
 
         pr_err("%s: Host adapter reset request. SCSI hang ?\n",
@@ -962,12 +964,14 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
 
         bus = aac_logical_to_phys(scmd_channel(cmd));
         cid = scmd_id(cmd);
-        info = &aac->hba_map[bus][cid];
-        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
-            info->devtype != AAC_DEVTYPE_NATIVE_RAW)
+
+        if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS)
                 return FAILED;
 
-        if (info->reset_state > 0)
+        info = &aac->hba_map[bus][cid];
+
+        if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+            info->reset_state > 0)
                 return FAILED;
 
         pr_err("%s: Host adapter reset request. SCSI hang ?\n",
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 48c2b2b34b72..0c9361c87ec8 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -740,6 +740,8 @@ static void aac_send_iop_reset(struct aac_dev *dev)
         aac_set_intx_mode(dev);
 
         src_writel(dev, MUnit.IDR, IOP_SRC_RESET_MASK);
+
+        msleep(5000);
 }
 
 static void aac_send_hardware_soft_reset(struct aac_dev *dev)
diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
index 690816f3c6af..421fe869a11e 100644
--- a/drivers/scsi/arm/acornscsi.c
+++ b/drivers/scsi/arm/acornscsi.c
@@ -2725,9 +2725,9 @@ int acornscsi_abort(struct scsi_cmnd *SCpnt)
  * Params   : SCpnt  - command causing reset
  * Returns  : one of SCSI_RESET_ macros
  */
-int acornscsi_host_reset(struct Scsi_Host *shpnt)
+int acornscsi_host_reset(struct scsi_cmnd *SCpnt)
 {
-        AS_Host *host = (AS_Host *)shpnt->hostdata;
+        AS_Host *host = (AS_Host *)SCpnt->device->host->hostdata;
         struct scsi_cmnd *SCptr;
     
     host->stats.resets += 1;
@@ -2741,7 +2741,7 @@ int acornscsi_host_reset(struct Scsi_Host *shpnt)
 
         printk(KERN_WARNING "acornscsi_reset: ");
         print_sbic_status(asr, ssr, host->scsi.phase);
-        for (devidx = 0; devidx < 9; devidx ++) {
+        for (devidx = 0; devidx < 9; devidx++)
             acornscsi_dumplog(host, devidx);
     }
 #endif
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 785fb42f6650..2799a6b08f73 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3767,7 +3767,7 @@ static int ibmvscsis_write_pending(struct se_cmd *se_cmd)
          */
         if ((vscsi->flags & (CLIENT_FAILED | RESPONSE_Q_DOWN))) {
                 pr_err("write_pending failed since: %d\n", vscsi->flags);
-                return 0;
+                return -EIO;
         }
 
         rc = srp_transfer_data(cmd, &vio_iu(iue)->srp.cmd, ibmvscsis_rdma,
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index bd4605a34f54..c62e8d111fd9 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2851,9 +2851,6 @@ EXPORT_SYMBOL_GPL(iscsi_session_setup);
 /**
  * iscsi_session_teardown - destroy session, host, and cls_session
  * @cls_session: iscsi session
- *
- * The driver must have called iscsi_remove_session before
- * calling this.
  */
 void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 {
@@ -2863,6 +2860,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
 
         iscsi_pool_free(&session->cmdpool);
 
+        iscsi_remove_session(cls_session);
+
         kfree(session->password);
         kfree(session->password_in);
         kfree(session->username);
@@ -2877,7 +2876,8 @@ void iscsi_session_teardown(struct iscsi_cls_session *cls_session)
         kfree(session->portal_type);
         kfree(session->discovery_parent_type);
 
-        iscsi_destroy_session(cls_session);
+        iscsi_free_session(cls_session);
+
         iscsi_host_dec_session_cnt(shost);
         module_put(owner);
 }
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 7e7ae786121b..100bc4c8798d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -6131,6 +6131,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                                 "Extents and RPI headers enabled.\n");
                 }
                 mempool_free(mboxq, phba->mbox_mem_pool);
+                rc = -EIO;
                 goto out_free_bsmbx;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 79ba3ce063a4..23bdb1ca106e 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -884,7 +884,7 @@ out_err:
                                          wcqe->total_data_placed);
                         nCmd->transferred_length = 0;
                         nCmd->rcv_rsplen = 0;
-                        nCmd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                        nCmd->status = NVME_SC_INTERNAL;
                 }
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 1f59e7a74c7b..6b33a1f24f56 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -180,7 +180,7 @@ static void qla_nvme_sp_done(void *ptr, int res)
                 goto rel;
 
         if (unlikely(res == QLA_FUNCTION_FAILED))
-                fd->status = NVME_SC_FC_TRANSPORT_ERROR;
+                fd->status = NVME_SC_INTERNAL;
         else
                 fd->status = 0;
 
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 38942050b265..dab876c65473 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -580,7 +580,8 @@ int scsi_check_sense(struct scsi_cmnd *scmd)
                 if (sshdr.asc == 0x20 || /* Invalid command operation code */
                     sshdr.asc == 0x21 || /* Logical block address out of range */
                     sshdr.asc == 0x24 || /* Invalid field in cdb */
-                    sshdr.asc == 0x26) { /* Parameter value invalid */
+                    sshdr.asc == 0x26 || /* Parameter value invalid */
+                    sshdr.asc == 0x27) { /* Write protected */
                         set_host_byte(scmd, DID_TARGET_FAILURE);
                 }
                 return SUCCESS;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index e7818afeda2b..15590a063ad9 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -956,6 +956,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
         if (*bflags & BLIST_NO_DIF)
                 sdev->no_dif = 1;
 
+        if (*bflags & BLIST_UNMAP_LIMIT_WS)
+                sdev->unmap_limit_for_ws = 1;
+
         sdev->eh_timeout = SCSI_DEFAULT_EH_TIMEOUT;
 
         if (*bflags & BLIST_TRY_VPD_PAGES)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 3c6bc0081fcb..cbd4495d0ff9 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -2739,7 +2739,8 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
 
         list_for_each_entry(rport, &fc_host->rports, peers) {
 
-                if ((rport->port_state == FC_PORTSTATE_BLOCKED) &&
+                if ((rport->port_state == FC_PORTSTATE_BLOCKED ||
+                     rport->port_state == FC_PORTSTATE_NOTPRESENT) &&
                         (rport->channel == channel)) {
 
                         switch (fc_host->tgtid_bind_type) {
@@ -2876,7 +2877,6 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                         memcpy(&rport->port_name, &ids->port_name,
                                 sizeof(rport->port_name));
                         rport->port_id = ids->port_id;
-                        rport->roles = ids->roles;
                         rport->port_state = FC_PORTSTATE_ONLINE;
                         rport->flags &= ~FC_RPORT_FAST_FAIL_TIMEDOUT;
 
@@ -2885,15 +2885,7 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
                                                 fci->f->dd_fcrport_size);
                         spin_unlock_irqrestore(shost->host_lock, flags);
 
-                        if (ids->roles & FC_PORT_ROLE_FCP_TARGET) {
-                                scsi_target_unblock(&rport->dev, SDEV_RUNNING);
-
-                                /* initiate a scan of the target */
-                                spin_lock_irqsave(shost->host_lock, flags);
-                                rport->flags |= FC_RPORT_SCAN_PENDING;
-                                scsi_queue_work(shost, &rport->scan_work);
-                                spin_unlock_irqrestore(shost->host_lock, flags);
-                        }
+                        fc_remote_port_rolechg(rport, ids->roles);
                         return rport;
                 }
         }
@@ -3571,7 +3563,7 @@ fc_vport_sched_delete(struct work_struct *work)
 static enum blk_eh_timer_return
 fc_bsg_job_timeout(struct request *req)
 {
-        struct bsg_job *job = (void *) req->special;
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
         struct Scsi_Host *shost = fc_bsg_to_shost(job);
         struct fc_rport *rport = fc_bsg_to_rport(job);
         struct fc_internal *i = to_fc_internal(shost->transportt);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 8934f19bce8e..7404d26895f5 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2211,22 +2211,6 @@ void iscsi_free_session(struct iscsi_cls_session *session)
 EXPORT_SYMBOL_GPL(iscsi_free_session);
 
 /**
- * iscsi_destroy_session - destroy iscsi session
- * @session: iscsi_session
- *
- * Can be called by a LLD or iscsi_transport. There must not be
- * any running connections.
- */
-int iscsi_destroy_session(struct iscsi_cls_session *session)
-{
-        iscsi_remove_session(session);
-        ISCSI_DBG_TRANS_SESSION(session, "Completing session destruction\n");
-        iscsi_free_session(session);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(iscsi_destroy_session);
-
-/**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
  * @dd_size: private driver data size
@@ -3689,7 +3673,7 @@ iscsi_if_rx(struct sk_buff *skb)
                 uint32_t group;
 
                 nlh = nlmsg_hdr(skb);
-                if (nlh->nlmsg_len < sizeof(*nlh) ||
+                if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
                     skb->len < nlh->nlmsg_len) {
                         break;
                 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 11c1738c2100..d175c5c5ccf8 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -715,13 +715,21 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
                 break;
 
         case SD_LBP_WS16:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
-                                          (u32)SD_MAX_WS16_BLOCKS);
+                if (sdkp->device->unmap_limit_for_ws)
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS16_BLOCKS);
                 break;
 
         case SD_LBP_WS10:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks,
-                                          (u32)SD_MAX_WS10_BLOCKS);
+                if (sdkp->device->unmap_limit_for_ws)
+                        max_blocks = sdkp->max_unmap_blocks;
+                else
+                        max_blocks = sdkp->max_ws_blocks;
+
+                max_blocks = min_not_zero(max_blocks, (u32)SD_MAX_WS10_BLOCKS);
                 break;
 
         case SD_LBP_ZERO:
@@ -2915,8 +2923,6 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
                                 sd_config_discard(sdkp, SD_LBP_WS16);
                         else if (sdkp->lbpws10)
                                 sd_config_discard(sdkp, SD_LBP_WS10);
-                        else if (sdkp->lbpu && sdkp->max_unmap_blocks)
-                                sd_config_discard(sdkp, SD_LBP_UNMAP);
                         else
                                 sd_config_discard(sdkp, SD_LBP_DISABLE);
                 }
@@ -3101,8 +3107,6 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 sd_read_security(sdkp, buffer);
         }
 
-        sdkp->first_scan = 0;
-
         /*
          * We now have all cache related info, determine how we deal
          * with flush requests.
@@ -3117,7 +3121,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
         q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max);
 
         /*
-         * Use the device's preferred I/O size for reads and writes
+         * Determine the device's preferred I/O size for reads and writes
          * unless the reported value is unreasonably small, large, or
          * garbage.
          */
@@ -3131,8 +3135,19 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
                                       (sector_t)BLK_DEF_MAX_SECTORS);
 
-        /* Combine with controller limits */
-        q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+        /* Do not exceed controller limit */
+        rw_max = min(rw_max, queue_max_hw_sectors(q));
+
+        /*
+         * Only update max_sectors if previously unset or if the current value
+         * exceeds the capabilities of the hardware.
+         */
+        if (sdkp->first_scan ||
+            q->limits.max_sectors > q->limits.max_dev_sectors ||
+            q->limits.max_sectors > q->limits.max_hw_sectors)
+                q->limits.max_sectors = rw_max;
+
+        sdkp->first_scan = 0;
 
         set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
         sd_config_write_same(sdkp);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index cf0e71db9e51..0419c2298eab 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -828,6 +828,39 @@ static int max_sectors_bytes(struct request_queue *q)
         return max_sectors << 9;
 }
 
+static void
+sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
+{
+        Sg_request *srp;
+        int val;
+        unsigned int ms;
+
+        val = 0;
+        list_for_each_entry(srp, &sfp->rq_list, entry) {
+                if (val > SG_MAX_QUEUE)
+                        break;
+                rinfo[val].req_state = srp->done + 1;
+                rinfo[val].problem =
+                        srp->header.masked_status &
+                        srp->header.host_status &
+                        srp->header.driver_status;
+                if (srp->done)
+                        rinfo[val].duration =
+                                srp->header.duration;
+                else {
+                        ms = jiffies_to_msecs(jiffies);
+                        rinfo[val].duration =
+                                (ms > srp->header.duration) ?
+                                (ms - srp->header.duration) : 0;
+                }
+                rinfo[val].orphan = srp->orphan;
+                rinfo[val].sg_io_owned = srp->sg_io_owned;
+                rinfo[val].pack_id = srp->header.pack_id;
+                rinfo[val].usr_ptr = srp->header.usr_ptr;
+                val++;
+        }
+}
+
 static long
 sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
 {
@@ -1012,38 +1045,13 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                         return -EFAULT;
                 else {
                         sg_req_info_t *rinfo;
-                        unsigned int ms;
 
-                        rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
-                                                                GFP_KERNEL);
+                        rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
+                                        GFP_KERNEL);
                         if (!rinfo)
                                 return -ENOMEM;
                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
-                        val = 0;
-                        list_for_each_entry(srp, &sfp->rq_list, entry) {
-                                if (val >= SG_MAX_QUEUE)
-                                        break;
-                                memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
-                                rinfo[val].req_state = srp->done + 1;
-                                rinfo[val].problem =
-                                        srp->header.masked_status &
-                                        srp->header.host_status &
-                                        srp->header.driver_status;
-                                if (srp->done)
-                                        rinfo[val].duration =
-                                                srp->header.duration;
-                                else {
-                                        ms = jiffies_to_msecs(jiffies);
-                                        rinfo[val].duration =
-                                                (ms > srp->header.duration) ?
-                                                (ms - srp->header.duration) : 0;
-                                }
-                                rinfo[val].orphan = srp->orphan;
-                                rinfo[val].sg_io_owned = srp->sg_io_owned;
-                                rinfo[val].pack_id = srp->header.pack_id;
-                                rinfo[val].usr_ptr = srp->header.usr_ptr;
-                                val++;
-                        }
+                        sg_fill_request_table(sfp, rinfo);
                         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
                         result = __copy_to_user(p, rinfo,
                                                 SZ_SG_REQ_INFO * SG_MAX_QUEUE);
diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
index d577d7b32c71..1617628c34f9 100644
--- a/drivers/staging/iio/adc/ad7192.c
+++ b/drivers/staging/iio/adc/ad7192.c
@@ -223,11 +223,9 @@ static int ad7192_setup(struct ad7192_state *st,
         struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi);
         unsigned long long scale_uv;
         int i, ret, id;
-        u8 ones[6];
 
         /* reset the serial interface */
-        memset(&ones, 0xFF, 6);
-        ret = spi_write(st->sd.spi, &ones, 6);
+        ret = ad_sd_reset(&st->sd, 48);
         if (ret < 0)
                 goto out;
         usleep_range(500, 1000); /* Wait for at least 500us */
diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
index 13eaf16ecd16..87595c594b12 100644
--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
+++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
@@ -496,8 +496,12 @@ static int spinand_program_page(struct spi_device *spi_nand,
         if (!wbuf)
                 return -ENOMEM;
 
-        enable_read_hw_ecc = 0;
-        spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        enable_read_hw_ecc = 1;
+        retval = spinand_read_page(spi_nand, page_id, 0, CACHE_BUF, wbuf);
+        if (retval < 0) {
+                dev_err(&spi_nand->dev, "ecc error on read page!!!\n");
+                return retval;
+        }
 
         for (i = offset, j = 0; i < len; i++, j++)
                 wbuf[i] &= buf[j];
diff --git a/drivers/staging/pi433/rf69.c b/drivers/staging/pi433/rf69.c
index f5b90aa759ea..0305edc16861 100644
--- a/drivers/staging/pi433/rf69.c
+++ b/drivers/staging/pi433/rf69.c
@@ -570,12 +570,6 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
                 dev_dbg(&spi->dev, "set: DIO mapping");
         #endif
 
-        // check DIO number
-        if (DIONumber > 5) {
-                dev_dbg(&spi->dev, "set: illegal input param");
-                return -EINVAL;
-        }
-
         switch (DIONumber) {
         case 0: mask=MASK_DIO0; shift=SHIFT_DIO0; regaddr=REG_DIOMAPPING1; break;
         case 1: mask=MASK_DIO1; shift=SHIFT_DIO1; regaddr=REG_DIOMAPPING1; break;
@@ -583,6 +577,9 @@ int rf69_set_dio_mapping(struct spi_device *spi, u8 DIONumber, u8 value)
         case 3: mask=MASK_DIO3; shift=SHIFT_DIO3; regaddr=REG_DIOMAPPING1; break;
         case 4: mask=MASK_DIO4; shift=SHIFT_DIO4; regaddr=REG_DIOMAPPING2; break;
         case 5: mask=MASK_DIO5; shift=SHIFT_DIO5; regaddr=REG_DIOMAPPING2; break;
+        default:
+                dev_dbg(&spi->dev, "set: illegal input param");
+                return -EINVAL;
         }
 
         // read reg
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 008063a181cb..f9247a0a1539 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -116,9 +116,8 @@ void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
 
 void _rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
 {
-        rtw_free_mlme_priv_ie_data(pmlmepriv);
-
         if (pmlmepriv) {
+                rtw_free_mlme_priv_ie_data(pmlmepriv);
                 if (pmlmepriv->free_bss_buf) {
                         vfree(pmlmepriv->free_bss_buf);
                 }
diff --git a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
index 92277457aba4..ce1dd6f9036f 100644
--- a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
+++ b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
@@ -311,6 +311,8 @@ static ssize_t proc_set_cam(struct file *file, const char __user *buffer, size_t
 
                 if (num < 2)
                         return count;
+                if (id >= TOTAL_CAM_ENTRY)
+                        return -EINVAL;
 
                 if (strcmp("c", cmd) == 0) {
                         _clear_cam_entry(adapter, id);
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
index 5f84526cb5b5..edbf6af1c8b7 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_api_88xx.c
@@ -2901,11 +2901,11 @@ halmac_update_datapack_88xx(struct halmac_adapter *halmac_adapter,
         if (halmac_adapter->fw_version.h2c_version < 4)
                 return HALMAC_RET_FW_NO_SUPPORT;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "[TRACE]%s ==========>\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
-
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "[TRACE]%s <==========\n", __func__);
 
diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
index c4a8eb4c82bb..c4cb217d3d1f 100644
--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
@@ -1603,10 +1603,11 @@ halmac_send_h2c_set_pwr_mode_88xx(struct halmac_adapter *halmac_adapter,
         void *driver_adapter = NULL;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "%s!!\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
         h2c_header = h2c_buff;
         h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
 
@@ -1698,10 +1699,11 @@ halmac_media_status_rpt_88xx(struct halmac_adapter *halmac_adapter, u8 op_mode,
         void *driver_adapter = NULL;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "halmac_send_h2c_set_pwr_mode_88xx!!\n");
 
-        driver_adapter = halmac_adapter->driver_adapter;
         h2c_header = H2c_buff;
         h2c_cmd = h2c_header + HALMAC_H2C_CMD_HDR_SIZE_88XX;
 
@@ -2128,10 +2130,11 @@ halmac_func_ctrl_ch_switch_88xx(struct halmac_adapter *halmac_adapter,
         enum halmac_cmd_process_status *process_status =
                 &halmac_adapter->halmac_state.scan_state_set.process_status;
 
+        driver_adapter = halmac_adapter->driver_adapter;
+
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "halmac_ctrl_ch_switch!!\n");
 
-        driver_adapter = halmac_adapter->driver_adapter;
         halmac_api = (struct halmac_api *)halmac_adapter->halmac_api;
 
         if (halmac_transition_scan_state_88xx(
@@ -2261,15 +2264,13 @@ enum halmac_ret_status halmac_send_h2c_update_bcn_parse_info_88xx(
 {
         u8 h2c_buff[HALMAC_H2C_CMD_SIZE_88XX] = {0};
         u16 h2c_seq_mum = 0;
-        void *driver_adapter = NULL;
+        void *driver_adapter = halmac_adapter->driver_adapter;
         struct halmac_h2c_header_info h2c_header_info;
         enum halmac_ret_status status = HALMAC_RET_SUCCESS;
 
         HALMAC_RT_TRACE(driver_adapter, HALMAC_MSG_H2C, DBG_DMESG,
                         "%s!!\n", __func__);
 
-        driver_adapter = halmac_adapter->driver_adapter;
-
         UPDATE_BEACON_PARSING_INFO_SET_FUNC_EN(h2c_buff, bcn_ie_info->func_en);
         UPDATE_BEACON_PARSING_INFO_SET_SIZE_TH(h2c_buff, bcn_ie_info->size_th);
         UPDATE_BEACON_PARSING_INFO_SET_TIMEOUT(h2c_buff, bcn_ie_info->timeout);
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index e215d05fcffe..3809cd2ad838 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1376,6 +1376,8 @@ static void reset_highlight_buffers(struct vc_data *);
 
 static int read_all_key;
 
+static int in_keyboard_notifier;
+
 static void start_read_all_timer(struct vc_data *vc, int command);
 
 enum {
@@ -1408,7 +1410,10 @@ static void read_all_doc(struct vc_data *vc)
         cursor_track = read_all_mode;
         spk_reset_index_count(0);
         if (get_sentence_buf(vc, 0) == -1) {
-                kbd_fakekey2(vc, RA_DOWN_ARROW);
+                del_timer(&cursor_timer);
+                if (!in_keyboard_notifier)
+                        speakup_fake_down_arrow();
+                start_read_all_timer(vc, RA_DOWN_ARROW);
         } else {
                 say_sentence_num(0, 0);
                 synth_insert_next_index(0);
@@ -2212,8 +2217,10 @@ static int keyboard_notifier_call(struct notifier_block *nb,
         int ret = NOTIFY_OK;
         static int keycode;     /* to hold the current keycode */
 
+        in_keyboard_notifier = 1;
+
         if (vc->vc_mode == KD_GRAPHICS)
-                return ret;
+                goto out;
 
         /*
          * First, determine whether we are handling a fake keypress on
@@ -2225,7 +2232,7 @@ static int keyboard_notifier_call(struct notifier_block *nb,
          */
 
         if (speakup_fake_key_pressed())
-                return ret;
+                goto out;
 
         switch (code) {
         case KBD_KEYCODE:
@@ -2266,6 +2273,8 @@ static int keyboard_notifier_call(struct notifier_block *nb,
                         break;
                 }
         }
+out:
+        in_keyboard_notifier = 0;
         return ret;
 }
 
diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c
index d9045a4b7620..fed554a43151 100644
--- a/drivers/staging/unisys/visorbus/visorchipset.c
+++ b/drivers/staging/unisys/visorbus/visorchipset.c
@@ -1668,7 +1668,7 @@ static __init int visorutil_spar_detect(void)
         return 0;
 }
 
-static int init_unisys(void)
+static int __init init_unisys(void)
 {
         int result;
 
@@ -1681,7 +1681,7 @@ static int init_unisys(void)
         return 0;
 };
 
-static void exit_unisys(void)
+static void __exit exit_unisys(void)
 {
         acpi_bus_unregister_driver(&unisys_acpi_driver);
 }
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index a96bae0dd6a6..81827b8a7601 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -610,18 +610,20 @@ free_pagelist(struct vchiq_pagelist_info *pagelistinfo,
                         if (head_bytes > actual)
                                 head_bytes = actual;
 
-                        memcpy((char *)page_address(pages[0]) +
+                        memcpy((char *)kmap(pages[0]) +
                                 pagelist->offset,
                                 fragments,
                                 head_bytes);
+                        kunmap(pages[0]);
                 }
                 if ((actual >= 0) && (head_bytes < actual) &&
                         (tail_bytes != 0)) {
-                        memcpy((char *)page_address(pages[num_pages - 1]) +
+                        memcpy((char *)kmap(pages[num_pages - 1]) +
                                 ((pagelist->offset + actual) &
                                 (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)),
                                 fragments + g_cache_line_size,
                                 tail_bytes);
+                        kunmap(pages[num_pages - 1]);
                 }
 
                 down(&g_free_fragments_mutex);
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 1c0c9553bc05..7dd38047ba23 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -246,11 +246,11 @@ struct mxser_port {
         unsigned char err_shadow;
 
         struct async_icount icount; /* kernel counters for 4 input interrupts */
-        int timeout;
+        unsigned int timeout;
 
         int read_status_mask;
         int ignore_status_mask;
-        int xmit_fifo_size;
+        unsigned int xmit_fifo_size;
         int xmit_head;
         int xmit_tail;
         int xmit_cnt;
@@ -572,8 +572,9 @@ static void mxser_dtr_rts(struct tty_port *port, int on)
 static int mxser_set_baud(struct tty_struct *tty, long newspd)
 {
         struct mxser_port *info = tty->driver_data;
-        int quot = 0, baud;
+        unsigned int quot = 0, baud;
         unsigned char cval;
+        u64 timeout;
 
         if (!info->ioaddr)
                 return -1;
@@ -594,8 +595,13 @@ static int mxser_set_baud(struct tty_struct *tty, long newspd)
                 quot = 0;
         }
 
-        info->timeout = ((info->xmit_fifo_size * HZ * 10 * quot) / info->baud_base);
-        info->timeout += HZ / 50;       /* Add .02 seconds of slop */
+        /*
+         * worst case (128 * 1000 * 10 * 18432) needs 35 bits, so divide in the
+         * u64 domain
+         */
+        timeout = (u64)info->xmit_fifo_size * HZ * 10 * quot;
+        do_div(timeout, info->baud_base);
+        info->timeout = timeout + HZ / 50; /* Add .02 seconds of slop */
 
         if (quot) {
                 info->MCR |= UART_MCR_DTR;
diff --git a/drivers/tty/serial/bcm63xx_uart.c b/drivers/tty/serial/bcm63xx_uart.c
index 583c9a0c7ecc..8c48c3784831 100644
--- a/drivers/tty/serial/bcm63xx_uart.c
+++ b/drivers/tty/serial/bcm63xx_uart.c
@@ -507,9 +507,14 @@ static void bcm_uart_set_termios(struct uart_port *port,
 {
         unsigned int ctl, baud, quot, ier;
         unsigned long flags;
+        int tries;
 
         spin_lock_irqsave(&port->lock, flags);
 
+        /* Drain the hot tub fully before we power it off for the winter. */
+        for (tries = 3; !bcm_uart_tx_empty(port) && tries; tries--)
+                mdelay(10);
+
         /* disable uart while changing speed */
         bcm_uart_disable(port);
         bcm_uart_flush(port);
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 849c1f9991ce..f0252184291e 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1276,7 +1276,6 @@ static void rx_dma_timer_init(struct lpuart_port *sport)
 static int lpuart_startup(struct uart_port *port)
 {
         struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
         unsigned long flags;
         unsigned char temp;
 
@@ -1291,11 +1290,6 @@ static int lpuart_startup(struct uart_port *port)
         sport->rxfifo_size = 0x1 << (((temp >> UARTPFIFO_RXSIZE_OFF) &
                 UARTPFIFO_FIFOSIZE_MASK) + 1);
 
-        ret = devm_request_irq(port->dev, port->irq, lpuart_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
-
         spin_lock_irqsave(&sport->port.lock, flags);
 
         lpuart_setup_watermark(sport);
@@ -1333,7 +1327,6 @@ static int lpuart_startup(struct uart_port *port)
 static int lpuart32_startup(struct uart_port *port)
 {
         struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
-        int ret;
         unsigned long flags;
         unsigned long temp;
 
@@ -1346,11 +1339,6 @@ static int lpuart32_startup(struct uart_port *port)
         sport->rxfifo_size = 0x1 << (((temp >> UARTFIFO_RXSIZE_OFF) &
                 UARTFIFO_FIFOSIZE_MASK) - 1);
 
-        ret = devm_request_irq(port->dev, port->irq, lpuart32_int, 0,
-                                DRIVER_NAME, sport);
-        if (ret)
-                return ret;
-
         spin_lock_irqsave(&sport->port.lock, flags);
 
         lpuart32_setup_watermark(sport);
@@ -1380,8 +1368,6 @@ static void lpuart_shutdown(struct uart_port *port)
 
         spin_unlock_irqrestore(&port->lock, flags);
 
-        devm_free_irq(port->dev, port->irq, sport);
-
         if (sport->lpuart_dma_rx_use) {
                 del_timer_sync(&sport->lpuart_timer);
                 lpuart_dma_rx_free(&sport->port);
@@ -1400,7 +1386,6 @@ static void lpuart_shutdown(struct uart_port *port)
 
 static void lpuart32_shutdown(struct uart_port *port)
 {
-        struct lpuart_port *sport = container_of(port, struct lpuart_port, port);
         unsigned long temp;
         unsigned long flags;
 
@@ -1413,8 +1398,6 @@ static void lpuart32_shutdown(struct uart_port *port)
         lpuart32_write(port, temp, UARTCTRL);
 
         spin_unlock_irqrestore(&port->lock, flags);
-
-        devm_free_irq(port->dev, port->irq, sport);
 }
 
 static void
@@ -2212,16 +2195,22 @@ static int lpuart_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, &sport->port);
 
-        if (lpuart_is_32(sport))
+        if (lpuart_is_32(sport)) {
                 lpuart_reg.cons = LPUART32_CONSOLE;
-        else
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0,
+                                        DRIVER_NAME, sport);
+        } else {
                 lpuart_reg.cons = LPUART_CONSOLE;
+                ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0,
+                                        DRIVER_NAME, sport);
+        }
+
+        if (ret)
+                goto failed_irq_request;
 
         ret = uart_add_one_port(&lpuart_reg, &sport->port);
-        if (ret) {
-                clk_disable_unprepare(sport->clk);
-                return ret;
-        }
+        if (ret)
+                goto failed_attach_port;
 
         sport->dma_tx_chan = dma_request_slave_channel(sport->port.dev, "tx");
         if (!sport->dma_tx_chan)
@@ -2240,6 +2229,11 @@ static int lpuart_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+failed_attach_port:
+failed_irq_request:
+        clk_disable_unprepare(sport->clk);
+        return ret;
 }
 
 static int lpuart_remove(struct platform_device *pdev)
diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index cdd2f942317c..b9c7a904c1ea 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -889,7 +889,16 @@ static int sccnxp_probe(struct platform_device *pdev)
                         goto err_out;
                 uartclk = 0;
         } else {
-                clk_prepare_enable(clk);
+                ret = clk_prepare_enable(clk);
+                if (ret)
+                        goto err_out;
+
+                ret = devm_add_action_or_reset(&pdev->dev,
+                                (void(*)(void *))clk_disable_unprepare,
+                                clk);
+                if (ret)
+                        goto err_out;
+
                 uartclk = clk_get_rate(clk);
         }
 
@@ -988,7 +997,7 @@ static int sccnxp_probe(struct platform_device *pdev)
         uart_unregister_driver(&s->uart);
 err_out:
         if (!IS_ERR(s->regulator))
-                return regulator_disable(s->regulator);
+                regulator_disable(s->regulator);
 
         return ret;
 }
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 5aacea1978a5..3e865dbf878c 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -190,8 +190,10 @@ static void wdm_in_callback(struct urb *urb)
         /*
          * only set a new error if there is no previous error.
          * Errors are only cleared during read/open
+         * Avoid propagating -EPIPE (stall) to userspace since it is
+         * better handled as an empty read
          */
-        if (desc->rerr  == 0)
+        if (desc->rerr == 0 && status != -EPIPE)
                 desc->rerr = status;
 
         if (length + desc->length > desc->wMaxCommand) {
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 4be52c602e9b..68b54bd88d1e 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
 
                 } else if (header->bDescriptorType ==
                                 USB_DT_INTERFACE_ASSOCIATION) {
+                        struct usb_interface_assoc_descriptor *d;
+
+                        d = (struct usb_interface_assoc_descriptor *)header;
+                        if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+                                dev_warn(ddev,
+                                         "config %d has an invalid interface association descriptor of length %d, skipping\n",
+                                         cfgno, d->bLength);
+                                continue;
+                        }
+
                         if (iad_num == USB_MAXIADS) {
                                 dev_warn(ddev, "found more Interface "
                                                "Association Descriptors "
                                                "than allocated for in "
                                                "configuration %d\n", cfgno);
                         } else {
-                                config->intf_assoc[iad_num] =
-                                        (struct usb_interface_assoc_descriptor
-                                        *)header;
+                                config->intf_assoc[iad_num] = d;
                                 iad_num++;
                         }
 
@@ -852,7 +860,7 @@ int usb_get_configuration(struct usb_device *dev)
                 }
 
                 if (dev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(100);
+                        msleep(200);
 
                 result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
                     bigbuffer, length);
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 318bb3b96687..4664e543cf2f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644);
 MODULE_PARM_DESC(usbfs_memory_mb,
                 "maximum MB allowed for usbfs buffers (0 = no limit)");
 
+/* Hard limit, necessary to avoid arithmetic overflow */
+#define USBFS_XFER_MAX         (UINT_MAX / 2 - 1000000)
+
 static atomic64_t usbfs_memory_usage;   /* Total memory currently allocated */
 
 /* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                                 USBDEVFS_URB_ZERO_PACKET |
                                 USBDEVFS_URB_NO_INTERRUPT))
                 return -EINVAL;
+        if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
+                return -EINVAL;
         if (uurb->buffer_length > 0 && !uurb->buffer)
                 return -EINVAL;
         if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
@@ -1571,7 +1576,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
                         totlen += isopkt[u].length;
                 }
                 u *= sizeof(struct usb_iso_packet_descriptor);
-                uurb->buffer_length = totlen;
+                if (totlen <= uurb->buffer_length)
+                        uurb->buffer_length = totlen;
+                else
+                        WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d",
+                                  totlen, uurb->buffer_length);
                 break;
 
         default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 41eaf0b52518..b5c733613823 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4838,7 +4838,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                         goto loop;
 
                 if (udev->quirks & USB_QUIRK_DELAY_INIT)
-                        msleep(1000);
+                        msleep(2000);
 
                 /* consecutive bus-powered hubs aren't reliable; they can
                  * violate the voltage drop budget.  if the new child has
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 4c38ea41ae96..371a07d874a3 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr,
                         elength = 1;
                         goto next_desc;
                 }
+                if ((buflen < elength) || (elength < 3)) {
+                        dev_err(&intf->dev, "invalid descriptor buffer length\n");
+                        break;
+                }
                 if (buffer[1] != USB_DT_CS_INTERFACE) {
                         dev_err(&intf->dev, "skipping garbage\n");
                         goto next_desc;
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 4cef7d4f9cd0..a26d1fde0f5e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -177,6 +177,7 @@ static const struct of_device_id of_dwc3_simple_match[] = {
         { .compatible = "rockchip,rk3399-dwc3" },
         { .compatible = "xlnx,zynqmp-dwc3" },
         { .compatible = "cavium,octeon-7130-usb-uctl" },
+        { .compatible = "sprd,sc9860-dwc3" },
         { /* Sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, of_dwc3_simple_match);
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 827e376bfa97..75e6cb044eb2 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                          DWC3_TRBCTL_CONTROL_DATA,
                                          true);
 
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                 /* Now prepare one extra TRB to align transfer size */
                 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                          maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                                          DWC3_TRBCTL_CONTROL_DATA,
                                          true);
 
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue - 1];
+
                 /* Now prepare one extra TRB to align transfer size */
                 dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr,
                                          0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
                 dwc3_ep0_prepare_one_trb(dep, req->request.dma,
                                 req->request.length, DWC3_TRBCTL_CONTROL_DATA,
                                 false);
+
+                req->trb = &dwc->ep0_trb[dep->trb_enqueue];
+
                 ret = dwc3_ep0_start_trans(dep);
         }
 
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 9990944a7245..8b342587f8ad 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -46,7 +46,8 @@
 static void ffs_data_get(struct ffs_data *ffs);
 static void ffs_data_put(struct ffs_data *ffs);
 /* Creates new ffs_data object. */
-static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
+static struct ffs_data *__must_check ffs_data_new(const char *dev_name)
+        __attribute__((malloc));
 
 /* Opened counter handling. */
 static void ffs_data_opened(struct ffs_data *ffs);
@@ -780,11 +781,12 @@ static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
                                          struct usb_request *req)
 {
         struct ffs_io_data *io_data = req->context;
+        struct ffs_data *ffs = io_data->ffs;
 
         ENTER();
 
         INIT_WORK(&io_data->work, ffs_user_copy_worker);
-        schedule_work(&io_data->work);
+        queue_work(ffs->io_completion_wq, &io_data->work);
 }
 
 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
@@ -1500,7 +1502,7 @@ ffs_fs_mount(struct file_system_type *t, int flags,
         if (unlikely(ret < 0))
                 return ERR_PTR(ret);
 
-        ffs = ffs_data_new();
+        ffs = ffs_data_new(dev_name);
         if (unlikely(!ffs))
                 return ERR_PTR(-ENOMEM);
         ffs->file_perms = data.perms;
@@ -1610,6 +1612,7 @@ static void ffs_data_put(struct ffs_data *ffs)
                 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
                        waitqueue_active(&ffs->ep0req_completion.wait) ||
                        waitqueue_active(&ffs->wait));
+                destroy_workqueue(ffs->io_completion_wq);
                 kfree(ffs->dev_name);
                 kfree(ffs);
         }
@@ -1642,7 +1645,7 @@ static void ffs_data_closed(struct ffs_data *ffs)
         ffs_data_put(ffs);
 }
 
-static struct ffs_data *ffs_data_new(void)
+static struct ffs_data *ffs_data_new(const char *dev_name)
 {
         struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
         if (unlikely(!ffs))
@@ -1650,6 +1653,12 @@ static struct ffs_data *ffs_data_new(void)
 
         ENTER();
 
+        ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name);
+        if (!ffs->io_completion_wq) {
+                kfree(ffs);
+                return NULL;
+        }
+
         refcount_set(&ffs->ref, 1);
         atomic_set(&ffs->opened, 0);
         ffs->state = FFS_READ_DESCRIPTORS;
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index d6bd0244b008..5153e29870c3 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -307,8 +307,6 @@ struct fsg_common {
         struct completion       thread_notifier;
         struct task_struct      *thread_task;
 
-        /* Callback functions. */
-        const struct fsg_operations     *ops;
         /* Gadget's private data. */
         void                    *private_data;
 
@@ -2438,6 +2436,7 @@ static void handle_exception(struct fsg_common *common)
 static int fsg_main_thread(void *common_)
 {
         struct fsg_common       *common = common_;
+        int                     i;
 
         /*
          * Allow the thread to be killed by a signal, but set the signal mask
@@ -2476,21 +2475,16 @@ static int fsg_main_thread(void *common_)
         common->thread_task = NULL;
         spin_unlock_irq(&common->lock);
 
-        if (!common->ops || !common->ops->thread_exits
-         || common->ops->thread_exits(common) < 0) {
-                int i;
+        /* Eject media from all LUNs */
 
-                down_write(&common->filesem);
-                for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
-                        struct fsg_lun *curlun = common->luns[i];
-                        if (!curlun || !fsg_lun_is_open(curlun))
-                                continue;
+        down_write(&common->filesem);
+        for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
+                struct fsg_lun *curlun = common->luns[i];
 
+                if (curlun && fsg_lun_is_open(curlun))
                         fsg_lun_close(curlun);
-                        curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
-                }
-                up_write(&common->filesem);
         }
+        up_write(&common->filesem);
 
         /* Let fsg_unbind() know the thread has exited */
         complete_and_exit(&common->thread_notifier, 0);
@@ -2681,13 +2675,6 @@ void fsg_common_remove_luns(struct fsg_common *common)
 }
 EXPORT_SYMBOL_GPL(fsg_common_remove_luns);
 
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops)
-{
-        common->ops = ops;
-}
-EXPORT_SYMBOL_GPL(fsg_common_set_ops);
-
 void fsg_common_free_buffers(struct fsg_common *common)
 {
         _fsg_common_free_buffers(common->buffhds, common->fsg_num_buffers);
diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h
index d3902313b8ac..dc05ca0c4359 100644
--- a/drivers/usb/gadget/function/f_mass_storage.h
+++ b/drivers/usb/gadget/function/f_mass_storage.h
@@ -60,17 +60,6 @@ struct fsg_module_parameters {
 struct fsg_common;
 
 /* FSF callback functions */
-struct fsg_operations {
-        /*
-         * Callback function to call when thread exits.  If no
-         * callback is set or it returns value lower then zero MSF
-         * will force eject all LUNs it operates on (including those
-         * marked as non-removable or with prevent_medium_removal flag
-         * set).
-         */
-        int (*thread_exits)(struct fsg_common *common);
-};
-
 struct fsg_lun_opts {
         struct config_group group;
         struct fsg_lun *lun;
@@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_lun *lun);
 
 void fsg_common_remove_luns(struct fsg_common *common);
 
-void fsg_common_set_ops(struct fsg_common *common,
-                        const struct fsg_operations *ops);
-
 int fsg_common_create_lun(struct fsg_common *common, struct fsg_lun_config *cfg,
                           unsigned int id, const char *name,
                           const char **name_pfx);
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index 8df244fc9d80..ea0da35a44e2 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -555,6 +555,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         size_t                  size;   /* Amount of data in a TX request. */
         size_t                  bytes_copied = 0;
         struct usb_request      *req;
+        int                     value;
 
         DBG(dev, "printer_write trying to send %d bytes\n", (int)len);
 
@@ -634,7 +635,11 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         return -EAGAIN;
                 }
 
-                if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
+                /* here, we unlock, and only unlock, to avoid deadlock. */
+                spin_unlock(&dev->lock);
+                value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC);
+                spin_lock(&dev->lock);
+                if (value) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
                         mutex_unlock(&dev->lock_printer_io);
diff --git a/drivers/usb/gadget/function/u_fs.h b/drivers/usb/gadget/function/u_fs.h
index 540f1c48c1a8..79f70ebf85dc 100644
--- a/drivers/usb/gadget/function/u_fs.h
+++ b/drivers/usb/gadget/function/u_fs.h
@@ -279,6 +279,7 @@ struct ffs_data {
         }                               file_perms;
 
         struct eventfd_ctx *ffs_eventfd;
+        struct workqueue_struct *io_completion_wq;
         bool no_disconnect;
         struct work_struct reset_work;
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 684900fcfe24..5c28bee327e1 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -28,7 +28,7 @@
 #include <linux/aio.h>
 #include <linux/uio.h>
 #include <linux/refcount.h>
-
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/moduleparam.h>
 
@@ -116,6 +116,7 @@ enum ep0_state {
 struct dev_data {
         spinlock_t                      lock;
         refcount_t                      count;
+        int                             udc_usage;
         enum ep0_state                  state;          /* P: lock */
         struct usb_gadgetfs_event       event [N_EVENT];
         unsigned                        ev_next;
@@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
                 INIT_WORK(&priv->work, ep_user_copy_worker);
                 schedule_work(&priv->work);
         }
-        spin_unlock(&epdata->dev->lock);
 
         usb_ep_free_request(ep, req);
+        spin_unlock(&epdata->dev->lock);
         put_ep(epdata);
 }
 
@@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                         struct usb_request      *req = dev->req;
 
                         if ((retval = setup_req (ep, req, 0)) == 0) {
+                                ++dev->udc_usage;
                                 spin_unlock_irq (&dev->lock);
                                 retval = usb_ep_queue (ep, req, GFP_KERNEL);
                                 spin_lock_irq (&dev->lock);
+                                --dev->udc_usage;
                         }
                         dev->state = STATE_DEV_CONNECTED;
 
@@ -983,11 +986,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                                 retval = -EIO;
                         else {
                                 len = min (len, (size_t)dev->req->actual);
-// FIXME don't call this with the spinlock held ...
+                                ++dev->udc_usage;
+                                spin_unlock_irq(&dev->lock);
                                 if (copy_to_user (buf, dev->req->buf, len))
                                         retval = -EFAULT;
                                 else
                                         retval = len;
+                                spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                 clean_req (dev->gadget->ep0, dev->req);
                                 /* NOTE userspace can't yet choose to stall */
                         }
@@ -1131,6 +1137,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                         retval = setup_req (dev->gadget->ep0, dev->req, len);
                         if (retval == 0) {
                                 dev->state = STATE_DEV_CONNECTED;
+                                ++dev->udc_usage;
                                 spin_unlock_irq (&dev->lock);
                                 if (copy_from_user (dev->req->buf, buf, len))
                                         retval = -EFAULT;
@@ -1142,6 +1149,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                                                 GFP_KERNEL);
                                 }
                                 spin_lock_irq(&dev->lock);
+                                --dev->udc_usage;
                                 if (retval < 0) {
                                         clean_req (dev->gadget->ep0, dev->req);
                                 } else
@@ -1243,9 +1251,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         struct usb_gadget       *gadget = dev->gadget;
         long ret = -ENOTTY;
 
-        if (gadget->ops->ioctl)
+        spin_lock_irq(&dev->lock);
+        if (dev->state == STATE_DEV_OPENED ||
+                        dev->state == STATE_DEV_UNBOUND) {
+                /* Not bound to a UDC */
+        } else if (gadget->ops->ioctl) {
+                ++dev->udc_usage;
+                spin_unlock_irq(&dev->lock);
+
                 ret = gadget->ops->ioctl (gadget, code, value);
 
+                spin_lock_irq(&dev->lock);
+                --dev->udc_usage;
+        }
+        spin_unlock_irq(&dev->lock);
+
         return ret;
 }
 
@@ -1463,10 +1483,12 @@ delegate:
                                 if (value < 0)
                                         break;
 
+                                ++dev->udc_usage;
                                 spin_unlock (&dev->lock);
                                 value = usb_ep_queue (gadget->ep0, dev->req,
                                                         GFP_KERNEL);
                                 spin_lock (&dev->lock);
+                                --dev->udc_usage;
                                 if (value < 0) {
                                         clean_req (gadget->ep0, dev->req);
                                         break;
@@ -1490,8 +1512,12 @@ delegate:
                 req->length = value;
                 req->zero = value < w_length;
 
+                ++dev->udc_usage;
                 spin_unlock (&dev->lock);
                 value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
+                spin_lock(&dev->lock);
+                --dev->udc_usage;
+                spin_unlock(&dev->lock);
                 if (value < 0) {
                         DBG (dev, "ep_queue --> %d\n", value);
                         req->status = 0;
@@ -1518,21 +1544,24 @@ static void destroy_ep_files (struct dev_data *dev)
                 /* break link to FS */
                 ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);
                 list_del_init (&ep->epfiles);
+                spin_unlock_irq (&dev->lock);
+
                 dentry = ep->dentry;
                 ep->dentry = NULL;
                 parent = d_inode(dentry->d_parent);
 
                 /* break link to controller */
+                mutex_lock(&ep->lock);
                 if (ep->state == STATE_EP_ENABLED)
                         (void) usb_ep_disable (ep->ep);
                 ep->state = STATE_EP_UNBOUND;
                 usb_ep_free_request (ep->ep, ep->req);
                 ep->ep = NULL;
+                mutex_unlock(&ep->lock);
+
                 wake_up (&ep->wait);
                 put_ep (ep);
 
-                spin_unlock_irq (&dev->lock);
-
                 /* break link to dcache */
                 inode_lock(parent);
                 d_delete (dentry);
@@ -1603,6 +1632,11 @@ gadgetfs_unbind (struct usb_gadget *gadget)
 
         spin_lock_irq (&dev->lock);
         dev->state = STATE_DEV_UNBOUND;
+        while (dev->udc_usage > 0) {
+                spin_unlock_irq(&dev->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dev->lock);
+        }
         spin_unlock_irq (&dev->lock);
 
         destroy_ep_files (dev);
diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c
index e99ab57ee3e5..fcba59782f26 100644
--- a/drivers/usb/gadget/legacy/mass_storage.c
+++ b/drivers/usb/gadget/legacy/mass_storage.c
@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS;
 
 FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
 
-static unsigned long msg_registered;
-static void msg_cleanup(void);
-
-static int msg_thread_exits(struct fsg_common *common)
-{
-        msg_cleanup();
-        return 0;
-}
-
 static int msg_do_config(struct usb_configuration *c)
 {
         struct fsg_opts *opts;
@@ -154,9 +145,6 @@ static struct usb_configuration msg_config_driver = {
 
 static int msg_bind(struct usb_composite_dev *cdev)
 {
-        static const struct fsg_operations ops = {
-                .thread_exits = msg_thread_exits,
-        };
         struct fsg_opts *opts;
         struct fsg_config config;
         int status;
@@ -173,8 +161,6 @@ static int msg_bind(struct usb_composite_dev *cdev)
         if (status)
                 goto fail;
 
-        fsg_common_set_ops(opts->common, &ops);
-
         status = fsg_common_set_cdev(opts->common, cdev, config.can_stall);
         if (status)
                 goto fail_set_cdev;
@@ -256,18 +242,12 @@ MODULE_LICENSE("GPL");
 
 static int __init msg_init(void)
 {
-        int ret;
-
-        ret = usb_composite_probe(&msg_driver);
-        set_bit(0, &msg_registered);
-
-        return ret;
+        return usb_composite_probe(&msg_driver);
 }
 module_init(msg_init);
 
-static void msg_cleanup(void)
+static void __exit msg_cleanup(void)
 {
-        if (test_and_clear_bit(0, &msg_registered))
-                usb_composite_unregister(&msg_driver);
+        usb_composite_unregister(&msg_driver);
 }
 module_exit(msg_cleanup);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 7cd5c969fcbe..1e9567091d86 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -273,6 +273,7 @@ config USB_SNP_CORE
 config USB_SNP_UDC_PLAT
         tristate "Synopsys USB 2.0 Device controller"
         depends on USB_GADGET && OF && HAS_DMA
+        depends on EXTCON || EXTCON=n
         select USB_GADGET_DUALSPEED
         select USB_SNP_CORE
         default ARCH_BCM_IPROC
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 98d71400f8a1..a884c022df7a 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -29,6 +29,8 @@
 #include <linux/of_gpio.h>
 
 #include "atmel_usba_udc.h"
+#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \
+                           | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING)
 
 #ifdef CONFIG_USB_GADGET_DEBUG_FS
 #include <linux/debugfs.h>
@@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platform_device *pdev)
                                         IRQ_NOAUTOEN);
                         ret = devm_request_threaded_irq(&pdev->dev,
                                         gpio_to_irq(udc->vbus_pin), NULL,
-                                        usba_vbus_irq_thread, IRQF_ONESHOT,
+                                        usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS,
                                         "atmel_usba_udc", udc);
                         if (ret) {
                                 udc->vbus_pin = -ENODEV;
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 75c51ca4ee0f..d41d07aae0ce 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1320,8 +1320,7 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri
         udc->dev.driver = &driver->driver;
         udc->gadget->dev.driver = &driver->driver;
 
-        if (driver->max_speed < udc->gadget->max_speed)
-                usb_gadget_udc_set_speed(udc, driver->max_speed);
+        usb_gadget_udc_set_speed(udc, driver->max_speed);
 
         ret = driver->bind(udc->gadget, driver);
         if (ret)
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index a030d7923d7d..b17618a55f1b 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -237,6 +237,8 @@ struct dummy_hcd {
 
         struct usb_device               *udev;
         struct list_head                urbp_list;
+        struct urbp                     *next_frame_urbp;
+
         u32                             stream_en_ep;
         u8                              num_stream[30 / 2];
 
@@ -253,11 +255,13 @@ struct dummy {
          */
         struct dummy_ep                 ep[DUMMY_ENDPOINTS];
         int                             address;
+        int                             callback_usage;
         struct usb_gadget               gadget;
         struct usb_gadget_driver        *driver;
         struct dummy_request            fifo_req;
         u8                              fifo_buf[FIFO_SIZE];
         u16                             devstatus;
+        unsigned                        ints_enabled:1;
         unsigned                        udc_suspended:1;
         unsigned                        pullup:1;
 
@@ -375,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
                              USB_PORT_STAT_CONNECTION) == 0)
                                 dum_hcd->port_status |=
                                         (USB_PORT_STAT_C_CONNECTION << 16);
-                        if ((dum_hcd->port_status &
-                             USB_PORT_STAT_ENABLE) == 1 &&
-                                (dum_hcd->port_status &
-                                 USB_SS_PORT_LS_U0) == 1 &&
-                                dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
+                        if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
+                            (dum_hcd->port_status &
+                             USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
+                            dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
                                 dum_hcd->active = 1;
                 }
         } else {
@@ -440,18 +443,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                                 (~dum_hcd->old_status) & dum_hcd->port_status;
 
                 /* Report reset and disconnect events to the driver */
-                if (dum->driver && (disconnect || reset)) {
+                if (dum->ints_enabled && (disconnect || reset)) {
                         stop_activity(dum);
+                        ++dum->callback_usage;
+                        spin_unlock(&dum->lock);
                         if (reset)
                                 usb_gadget_udc_reset(&dum->gadget, dum->driver);
                         else
                                 dum->driver->disconnect(&dum->gadget);
+                        spin_lock(&dum->lock);
+                        --dum->callback_usage;
                 }
-        } else if (dum_hcd->active != dum_hcd->old_active) {
+        } else if (dum_hcd->active != dum_hcd->old_active &&
+                        dum->ints_enabled) {
+                ++dum->callback_usage;
+                spin_unlock(&dum->lock);
                 if (dum_hcd->old_active && dum->driver->suspend)
                         dum->driver->suspend(&dum->gadget);
                 else if (!dum_hcd->old_active &&  dum->driver->resume)
                         dum->driver->resume(&dum->gadget);
+                spin_lock(&dum->lock);
+                --dum->callback_usage;
         }
 
         dum_hcd->old_status = dum_hcd->port_status;
@@ -972,8 +984,11 @@ static int dummy_udc_start(struct usb_gadget *g,
          * can't enumerate without help from the driver we're binding.
          */
 
+        spin_lock_irq(&dum->lock);
         dum->devstatus = 0;
         dum->driver = driver;
+        dum->ints_enabled = 1;
+        spin_unlock_irq(&dum->lock);
 
         return 0;
 }
@@ -984,6 +999,16 @@ static int dummy_udc_stop(struct usb_gadget *g)
         struct dummy            *dum = dum_hcd->dum;
 
         spin_lock_irq(&dum->lock);
+        dum->ints_enabled = 0;
+        stop_activity(dum);
+
+        /* emulate synchronize_irq(): wait for callbacks to finish */
+        while (dum->callback_usage > 0) {
+                spin_unlock_irq(&dum->lock);
+                usleep_range(1000, 2000);
+                spin_lock_irq(&dum->lock);
+        }
+
         dum->driver = NULL;
         spin_unlock_irq(&dum->lock);
 
@@ -1037,7 +1062,12 @@ static int dummy_udc_probe(struct platform_device *pdev)
         memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
-        dum->gadget.max_speed = USB_SPEED_SUPER;
+        if (mod_data.is_super_speed)
+                dum->gadget.max_speed = USB_SPEED_SUPER;
+        else if (mod_data.is_high_speed)
+                dum->gadget.max_speed = USB_SPEED_HIGH;
+        else
+                dum->gadget.max_speed = USB_SPEED_FULL;
 
         dum->gadget.dev.parent = &pdev->dev;
         init_dummy_udc_hw(dum);
@@ -1246,6 +1276,8 @@ static int dummy_urb_enqueue(
 
         list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list);
         urb->hcpriv = urbp;
+        if (!dum_hcd->next_frame_urbp)
+                dum_hcd->next_frame_urbp = urbp;
         if (usb_pipetype(urb->pipe) == PIPE_CONTROL)
                 urb->error_count = 1;           /* mark as a new urb */
 
@@ -1521,6 +1553,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address)
         if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ?
                         dum->ss_hcd : dum->hs_hcd)))
                 return NULL;
+        if (!dum->ints_enabled)
+                return NULL;
         if ((address & ~USB_DIR_IN) == 0)
                 return &dum->ep[0];
         for (i = 1; i < DUMMY_ENDPOINTS; i++) {
@@ -1762,6 +1796,7 @@ static void dummy_timer(unsigned long _dum_hcd)
                 spin_unlock_irqrestore(&dum->lock, flags);
                 return;
         }
+        dum_hcd->next_frame_urbp = NULL;
 
         for (i = 0; i < DUMMY_ENDPOINTS; i++) {
                 if (!ep_info[i].name)
@@ -1778,6 +1813,10 @@ restart:
                 int                     type;
                 int                     status = -EINPROGRESS;
 
+                /* stop when we reach URBs queued after the timer interrupt */
+                if (urbp == dum_hcd->next_frame_urbp)
+                        break;
+
                 urb = urbp->urb;
                 if (urb->unlinked)
                         goto return_urb;
@@ -1857,10 +1896,12 @@ restart:
                          * until setup() returns; no reentrancy issues etc.
                          */
                         if (value > 0) {
+                                ++dum->callback_usage;
                                 spin_unlock(&dum->lock);
                                 value = dum->driver->setup(&dum->gadget,
                                                 &setup);
                                 spin_lock(&dum->lock);
+                                --dum->callback_usage;
 
                                 if (value >= 0) {
                                         /* no delays (max 64KB data stage) */
@@ -2561,8 +2602,6 @@ static struct hc_driver dummy_hcd = {
         .product_desc =         "Dummy host controller",
         .hcd_priv_size =        sizeof(struct dummy_hcd),
 
-        .flags =                HCD_USB3 | HCD_SHARED,
-
         .reset =                dummy_setup,
         .start =                dummy_start,
         .stop =                 dummy_stop,
@@ -2591,8 +2630,12 @@ static int dummy_hcd_probe(struct platform_device *pdev)
         dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc);
         dum = *((void **)dev_get_platdata(&pdev->dev));
 
-        if (!mod_data.is_super_speed)
+        if (mod_data.is_super_speed)
+                dummy_hcd.flags = HCD_USB3 | HCD_SHARED;
+        else if (mod_data.is_high_speed)
                 dummy_hcd.flags = HCD_USB2;
+        else
+                dummy_hcd.flags = HCD_USB11;
         hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev));
         if (!hs_hcd)
                 return -ENOMEM;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index df37c1e6e9d5..63a206122058 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -1038,7 +1038,7 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                         usb3_ep->ep.maxpacket);
         u8 *buf = usb3_req->req.buf + usb3_req->req.actual;
         u32 tmp = 0;
-        bool is_last;
+        bool is_last = !len ? true : false;
 
         if (usb3_wait_pipe_status(usb3_ep, PX_STA_BUFSTS) < 0)
                 return -EBUSY;
@@ -1059,7 +1059,8 @@ static int usb3_write_pipe(struct renesas_usb3_ep *usb3_ep,
                 usb3_write(usb3, tmp, fifo_reg);
         }
 
-        is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
+        if (!is_last)
+                is_last = usb3_is_transfer_complete(usb3_ep, usb3_req);
         /* Send the data */
         usb3_set_px_con_send(usb3_ep, len, is_last);
 
@@ -1150,7 +1151,8 @@ static void usb3_start_pipe0(struct renesas_usb3_ep *usb3_ep,
                 usb3_set_p0_con_for_ctrl_read_data(usb3);
         } else {
                 usb3_clear_bit(usb3, P0_MOD_DIR, USB3_P0_MOD);
-                usb3_set_p0_con_for_ctrl_write_data(usb3);
+                if (usb3_req->req.length)
+                        usb3_set_p0_con_for_ctrl_write_data(usb3);
         }
 
         usb3_p0_xfer(usb3_ep, usb3_req);
@@ -2053,7 +2055,16 @@ static u32 usb3_calc_ramarea(int ram_size)
 static u32 usb3_calc_rammap_val(struct renesas_usb3_ep *usb3_ep,
                                 const struct usb_endpoint_descriptor *desc)
 {
-        return usb3_ep->rammap_val | PN_RAMMAP_MPKT(usb_endpoint_maxp(desc));
+        int i;
+        const u32 max_packet_array[] = {8, 16, 32, 64, 512};
+        u32 mpkt = PN_RAMMAP_MPKT(1024);
+
+        for (i = 0; i < ARRAY_SIZE(max_packet_array); i++) {
+                if (usb_endpoint_maxp(desc) <= max_packet_array[i])
+                        mpkt = PN_RAMMAP_MPKT(max_packet_array[i]);
+        }
+
+        return usb3_ep->rammap_val | mpkt;
 }
 
 static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 658d9d1f9ea3..6dda3623a276 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(struct pci_dev *pdev)
                 if ((value & ASMT_CONTROL_WRITE_BIT) == 0)
                         return 0;
 
-                usleep_range(40, 60);
+                udelay(50);
         }
 
         dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__);
@@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports);
  *
  * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS.
  * It signals to the BIOS that the OS wants control of the host controller,
- * and then waits 5 seconds for the BIOS to hand over control.
+ * and then waits 1 second for the BIOS to hand over control.
  * If we timeout, assume the BIOS is broken and take control anyway.
  */
 static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
@@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev)
         if (val & XHCI_HC_BIOS_OWNED) {
                 writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
 
-                /* Wait for 5 seconds with 10 microsecond polling interval */
+                /* Wait for 1 second with 10 microsecond polling interval */
                 timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
-                                0, 5000, 10);
+                                0, 1000000, 10);
 
                 /* Assume a buggy BIOS and take HC ownership anyway */
                 if (timeout) {
@@ -1100,7 +1100,7 @@ hc_init:
          * operational or runtime registers.  Wait 5 seconds and no more.
          */
         timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0,
-                        5000, 10);
+                        5000000, 10);
         /* Assume a buggy HC and start HC initialization anyway */
         if (timeout) {
                 val = readl(op_reg_base + XHCI_STS_OFFSET);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index ad89a6d4111b..da9158f171cb 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
 
         /* If PSI table exists, add the custom speed attributes from it */
         if (usb3_1 && xhci->usb3_rhub.psi_count) {
-                u32 ssp_cap_base, bm_attrib, psi;
+                u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;
                 int offset;
 
                 ssp_cap_base = USB_DT_BOS_SIZE + USB_DT_USB_SS_CAP_SIZE;
@@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(struct xhci_hcd *xhci, char *buf,
                 for (i = 0; i < xhci->usb3_rhub.psi_count; i++) {
                         psi = xhci->usb3_rhub.psi[i];
                         psi &= ~USB_SSP_SUBLINK_SPEED_RSVD;
+                        psi_exp = XHCI_EXT_PORT_PSIE(psi);
+                        psi_mant = XHCI_EXT_PORT_PSIM(psi);
+
+                        /* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */
+                        for (; psi_exp < 3; psi_exp++)
+                                psi_mant /= 1000;
+                        if (psi_mant >= 10)
+                                psi |= BIT(14);
+
                         if ((psi & PLT_MASK) == PLT_SYM) {
                         /* Symmetric, create SSA RX and TX from one PSI entry */
                                 put_unaligned_le32(psi, &buf[offset]);
@@ -1506,9 +1515,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                                 t2 |= PORT_WKOC_E | PORT_WKCONN_E;
                                 t2 &= ~PORT_WKDISC_E;
                         }
-                        if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
-                            (hcd->speed < HCD_USB3))
-                                t2 &= ~PORT_WAKE_BITS;
                 } else
                         t2 &= ~PORT_WAKE_BITS;
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 8071c8fdd15e..76f392954733 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -54,11 +54,6 @@
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
 #define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_4                 0x43b9
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_3                 0x43ba
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
-#define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
-
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 
 static const char hcd_name[] = "xhci_hcd";
@@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
-        if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
-                ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
-                (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
-                xhci->quirks |= XHCI_U2_DISABLE_WAKE;
-
         if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
                 xhci->quirks |= XHCI_LPM_SUPPORT;
                 xhci->quirks |= XHCI_INTEL_HOST;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 163bafde709f..1cb6eaef4ae1 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -178,14 +178,18 @@ static int xhci_plat_probe(struct platform_device *pdev)
          * 2. xhci_plat is child of a device from firmware (dwc3-plat)
          * 3. xhci_plat is grandchild of a pci device (dwc3-pci)
          */
-        sysdev = &pdev->dev;
-        if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node)
-                sysdev = sysdev->parent;
+        for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) {
+                if (is_of_node(sysdev->fwnode) ||
+                        is_acpi_device_node(sysdev->fwnode))
+                        break;
 #ifdef CONFIG_PCI
-        else if (sysdev->parent && sysdev->parent->parent &&
-                 sysdev->parent->parent->bus == &pci_bus_type)
-                sysdev = sysdev->parent->parent;
+                else if (sysdev->bus == &pci_bus_type)
+                        break;
 #endif
+        }
+
+        if (!sysdev)
+                sysdev = &pdev->dev;
 
         /* Try to set 64-bit DMA first */
         if (WARN_ON(!sysdev->dma_mask))
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b2ff1ff1a02f..ee198ea47f49 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         if (xhci->quirks & XHCI_MTK_HOST) {
                 ret = xhci_mtk_add_ep_quirk(hcd, udev, ep);
                 if (ret < 0) {
-                        xhci_free_endpoint_ring(xhci, virt_dev, ep_index);
+                        xhci_ring_free(xhci, virt_dev->eps[ep_index].new_ring);
+                        virt_dev->eps[ep_index].new_ring = NULL;
                         return ret;
                 }
         }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 2abaa4d6d39d..2b48aa4f6b76 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -735,6 +735,8 @@ struct xhci_ep_ctx {
 #define EP_MAXPSTREAMS(p)       (((p) << 10) & EP_MAXPSTREAMS_MASK)
 /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
 #define EP_HAS_LSA              (1 << 15)
+/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
+#define CTX_TO_MAX_ESIT_PAYLOAD_HI(p)   (((p) >> 24) & 0xff)
 
 /* ep_info2 bitmasks */
 /*
@@ -1681,7 +1683,7 @@ struct xhci_bus_state {
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
-        if (hcd->speed == HCD_USB3)
+        if (hcd->speed >= HCD_USB3)
                 return 0;
         else
                 return 1;
@@ -1826,7 +1828,7 @@ struct xhci_hcd {
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
-#define XHCI_U2_DISABLE_WAKE    (1 << 27)
+/* Reserved. It was XHCI_U2_DISABLE_WAKE */
 #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
 
         unsigned int            num_active_eps;
@@ -2540,8 +2542,8 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
         u8 lsa;
         u8 hid;
 
-        esit = EP_MAX_ESIT_PAYLOAD_HI(info) << 16 |
-                EP_MAX_ESIT_PAYLOAD_LO(tx_info);
+        esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 |
+                CTX_TO_MAX_ESIT_PAYLOAD(tx_info);
 
         ep_state = info & EP_STATE_MASK;
         max_pstr = info & EP_MAXPSTREAMS_MASK;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index d1af831f43eb..68f26904c316 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -282,11 +282,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe,
                               struct usbhs_fifo *fifo)
 {
         struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+        int ret = 0;
 
-        if (!usbhs_pipe_is_dcp(pipe))
-                usbhsf_fifo_barrier(priv, fifo);
+        if (!usbhs_pipe_is_dcp(pipe)) {
+                /*
+                 * This driver checks the pipe condition first to avoid -EBUSY
+                 * from usbhsf_fifo_barrier() with about 10 msec delay in
+                 * the interrupt handler if the pipe is RX direction and empty.
+                 */
+                if (usbhs_pipe_is_dir_in(pipe))
+                        ret = usbhs_pipe_is_accessible(pipe);
+                if (!ret)
+                        ret = usbhsf_fifo_barrier(priv, fifo);
+        }
 
-        usbhs_write(priv, fifo->ctr, BCLR);
+        /*
+         * if non-DCP pipe, this driver should set BCLR when
+         * usbhsf_fifo_barrier() returns 0.
+         */
+        if (!ret)
+                usbhs_write(priv, fifo->ctr, BCLR);
 }
 
 static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 1a59f335b063..a3ccb899df60 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -834,13 +834,25 @@ Retry_Sense:
                         if (result == USB_STOR_TRANSPORT_GOOD) {
                                 srb->result = SAM_STAT_GOOD;
                                 srb->sense_buffer[0] = 0x0;
+                        }
+
+                        /*
+                         * ATA-passthru commands use sense data to report
+                         * the command completion status, and often devices
+                         * return Check Condition status when nothing is
+                         * wrong.
+                         */
+                        else if (srb->cmnd[0] == ATA_16 ||
+                                        srb->cmnd[0] == ATA_12) {
+                                /* leave the data alone */
+                        }
 
                         /*
                          * If there was a problem, report an unspecified
                          * hardware error to prevent the higher layers from
                          * entering an infinite retry loop.
                          */
-                        } else {
+                        else {
                                 srb->result = DID_ERROR << 16;
                                 if ((sshdr.response_code & 0x72) == 0x72)
                                         srb->sense_buffer[1] = HARDWARE_ERROR;
diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
index f58caa9e6a27..a155cd02bce2 100644
--- a/drivers/usb/storage/uas-detect.h
+++ b/drivers/usb/storage/uas-detect.h
@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf)
                 intf->desc.bInterfaceProtocol == USB_PR_UAS);
 }
 
-static int uas_find_uas_alt_setting(struct usb_interface *intf)
+static struct usb_host_interface *uas_find_uas_alt_setting(
+                struct usb_interface *intf)
 {
         int i;
 
@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf)
                 struct usb_host_interface *alt = &intf->altsetting[i];
 
                 if (uas_is_interface(alt))
-                        return alt->desc.bAlternateSetting;
+                        return alt;
         }
 
-        return -ENODEV;
+        return NULL;
 }
 
 static int uas_find_endpoints(struct usb_host_interface *alt,
@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf,
         struct usb_device *udev = interface_to_usbdev(intf);
         struct usb_hcd *hcd = bus_to_hcd(udev->bus);
         unsigned long flags = id->driver_info;
-        int r, alt;
-
+        struct usb_host_interface *alt;
+        int r;
 
         alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
+        if (!alt)
                 return 0;
 
-        r = uas_find_endpoints(&intf->altsetting[alt], eps);
+        r = uas_find_endpoints(alt, eps);
         if (r < 0)
                 return 0;
 
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index cfb1e3bbd434..63cf981ed81c 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids);
 static int uas_switch_interface(struct usb_device *udev,
                                 struct usb_interface *intf)
 {
-        int alt;
+        struct usb_host_interface *alt;
 
         alt = uas_find_uas_alt_setting(intf);
-        if (alt < 0)
-                return alt;
+        if (!alt)
+                return -ENODEV;
 
-        return usb_set_interface(udev,
-                        intf->altsetting[0].desc.bInterfaceNumber, alt);
+        return usb_set_interface(udev, alt->desc.bInterfaceNumber,
+                        alt->desc.bAlternateSetting);
 }
 
 static int uas_configure_endpoints(struct uas_dev_info *devinfo)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 5a70c33ef0e0..eb06d88b41d6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_SANE_SENSE ),
 
+/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */
+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999,
+                "Seagate",
+                "External",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_WP_DETECT ),
+
 UNUSUAL_DEV(  0x0d49, 0x7310, 0x0000, 0x9999,
                 "Maxtor",
                 "USB to SATA",
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 35a1e777b449..9a53912bdfe9 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interface *iface,
 
         if (iface->cur_altsetting->desc.bNumEndpoints < 1)
                 return -ENODEV;
+        if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc))
+                return -ENODEV;
 
         result = -ENOMEM;
         uwb_rc = uwb_rc_alloc();
diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index 01c20a260a8b..39dd4ef53c77 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -302,18 +302,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
-        rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
-        if (rc->uwbd.task == NULL)
+        struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
+        if (IS_ERR(task)) {
+                rc->uwbd.task = NULL;
                 printk(KERN_ERR "UWB: Cannot start management daemon; "
                        "UWB won't work\n");
-        else
+        } else {
+                rc->uwbd.task = task;
                 rc->uwbd.pid = rc->uwbd.task->pid;
+        }
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
-        kthread_stop(rc->uwbd.task);
+        if (rc->uwbd.task)
+                kthread_stop(rc->uwbd.task);
         uwbd_flush(rc);
 }
 
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index 5fbfd9cfb6d6..5b3d57fc82d3 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -169,6 +169,9 @@ static int rom_write(struct pci_dev *dev, int offset, u32 value, void *data)
 static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
 {
         struct pci_bar_info *bar = data;
+        unsigned int pos = (offset - PCI_BASE_ADDRESS_0) / 4;
+        const struct resource *res = dev->resource;
+        u32 mask;
 
         if (unlikely(!bar)) {
                 pr_warn(DRV_NAME ": driver data not found for %s\n",
@@ -179,7 +182,13 @@ static int bar_write(struct pci_dev *dev, int offset, u32 value, void *data)
         /* A write to obtain the length must happen as a 32-bit write.
          * This does not (yet) support writing individual bytes
          */
-        if (value == ~0)
+        if (res[pos].flags & IORESOURCE_IO)
+                mask = ~PCI_BASE_ADDRESS_IO_MASK;
+        else if (pos && (res[pos - 1].flags & IORESOURCE_MEM_64))
+                mask = 0;
+        else
+                mask = ~PCI_BASE_ADDRESS_MEM_MASK;
+        if ((value | mask) == ~0U)
                 bar->which = 1;
         else {
                 u32 tmpval;
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 82a8866758ee..a1c17000129b 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -519,64 +519,6 @@ static int __xenbus_map_ring(struct xenbus_device *dev,
         return err;
 }
 
-static int xenbus_map_ring_valloc_pv(struct xenbus_device *dev,
-                                     grant_ref_t *gnt_refs,
-                                     unsigned int nr_grefs,
-                                     void **vaddr)
-{
-        struct xenbus_map_node *node;
-        struct vm_struct *area;
-        pte_t *ptes[XENBUS_MAX_RING_GRANTS];
-        phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
-        int err = GNTST_okay;
-        int i;
-        bool leaked;
-
-        *vaddr = NULL;
-
-        if (nr_grefs > XENBUS_MAX_RING_GRANTS)
-                return -EINVAL;
-
-        node = kzalloc(sizeof(*node), GFP_KERNEL);
-        if (!node)
-                return -ENOMEM;
-
-        area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, ptes);
-        if (!area) {
-                kfree(node);
-                return -ENOMEM;
-        }
-
-        for (i = 0; i < nr_grefs; i++)
-                phys_addrs[i] = arbitrary_virt_to_machine(ptes[i]).maddr;
-
-        err = __xenbus_map_ring(dev, gnt_refs, nr_grefs, node->handles,
-                                phys_addrs,
-                                GNTMAP_host_map | GNTMAP_contains_pte,
-                                &leaked);
-        if (err)
-                goto failed;
-
-        node->nr_handles = nr_grefs;
-        node->pv.area = area;
-
-        spin_lock(&xenbus_valloc_lock);
-        list_add(&node->next, &xenbus_valloc_pages);
-        spin_unlock(&xenbus_valloc_lock);
-
-        *vaddr = area->addr;
-        return 0;
-
-failed:
-        if (!leaked)
-                free_vm_area(area);
-        else
-                pr_alert("leaking VM area %p size %u page(s)", area, nr_grefs);
-
-        kfree(node);
-        return err;
-}
-
 struct map_ring_valloc_hvm
 {
         unsigned int idx;
@@ -725,6 +667,65 @@ int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
 }
 EXPORT_SYMBOL_GPL(xenbus_unmap_ring_vfree);
 
+#ifdef CONFIG_XEN_PV
+static int xenbus_map_ring_valloc_pv(struct xenbus_device *dev,
+                                     grant_ref_t *gnt_refs,
+                                     unsigned int nr_grefs,
+                                     void **vaddr)
+{
+        struct xenbus_map_node *node;
+        struct vm_struct *area;
+        pte_t *ptes[XENBUS_MAX_RING_GRANTS];
+        phys_addr_t phys_addrs[XENBUS_MAX_RING_GRANTS];
+        int err = GNTST_okay;
+        int i;
+        bool leaked;
+
+        *vaddr = NULL;
+
+        if (nr_grefs > XENBUS_MAX_RING_GRANTS)
+                return -EINVAL;
+
+        node = kzalloc(sizeof(*node), GFP_KERNEL);
+        if (!node)
+                return -ENOMEM;
+
+        area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, ptes);
+        if (!area) {
+                kfree(node);
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < nr_grefs; i++)
+                phys_addrs[i] = arbitrary_virt_to_machine(ptes[i]).maddr;
+
+        err = __xenbus_map_ring(dev, gnt_refs, nr_grefs, node->handles,
+                                phys_addrs,
+                                GNTMAP_host_map | GNTMAP_contains_pte,
+                                &leaked);
+        if (err)
+                goto failed;
+
+        node->nr_handles = nr_grefs;
+        node->pv.area = area;
+
+        spin_lock(&xenbus_valloc_lock);
+        list_add(&node->next, &xenbus_valloc_pages);
+        spin_unlock(&xenbus_valloc_lock);
+
+        *vaddr = area->addr;
+        return 0;
+
+failed:
+        if (!leaked)
+                free_vm_area(area);
+        else
+                pr_alert("leaking VM area %p size %u page(s)", area, nr_grefs);
+
+        kfree(node);
+        return err;
+}
+
 static int xenbus_unmap_ring_vfree_pv(struct xenbus_device *dev, void *vaddr)
 {
         struct xenbus_map_node *node;
@@ -788,6 +789,12 @@ static int xenbus_unmap_ring_vfree_pv(struct xenbus_device *dev, void *vaddr)
         return err;
 }
 
+static const struct xenbus_ring_ops ring_ops_pv = {
+        .map = xenbus_map_ring_valloc_pv,
+        .unmap = xenbus_unmap_ring_vfree_pv,
+};
+#endif
+
 struct unmap_ring_vfree_hvm
 {
         unsigned int idx;
@@ -916,11 +923,6 @@ enum xenbus_state xenbus_read_driver_state(const char *path)
 }
 EXPORT_SYMBOL_GPL(xenbus_read_driver_state);
 
-static const struct xenbus_ring_ops ring_ops_pv = {
-        .map = xenbus_map_ring_valloc_pv,
-        .unmap = xenbus_unmap_ring_vfree_pv,
-};
-
 static const struct xenbus_ring_ops ring_ops_hvm = {
         .map = xenbus_map_ring_valloc_hvm,
         .unmap = xenbus_unmap_ring_vfree_hvm,
@@ -928,8 +930,10 @@ static const struct xenbus_ring_ops ring_ops_hvm = {
 
 void __init xenbus_ring_ops_init(void)
 {
+#ifdef CONFIG_XEN_PV
         if (!xen_feature(XENFEAT_auto_translated_physmap))
                 ring_ops = &ring_ops_pv;
         else
+#endif
                 ring_ops = &ring_ops_hvm;
 }
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index ce7181ea60fa..2a46762def31 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -54,7 +54,7 @@ typedef struct {
         int size;                       /* size of magic/mask */
         char *magic;                    /* magic or filename extension */
         char *mask;                     /* mask, NULL for exact match */
-        char *interpreter;              /* filename of interpreter */
+        const char *interpreter;        /* filename of interpreter */
         char *name;
         struct dentry *dentry;
         struct file *interp_file;
@@ -131,27 +131,26 @@ static int load_misc_binary(struct linux_binprm *bprm)
 {
         Node *fmt;
         struct file *interp_file = NULL;
-        char iname[BINPRM_BUF_SIZE];
-        const char *iname_addr = iname;
         int retval;
         int fd_binary = -1;
 
         retval = -ENOEXEC;
         if (!enabled)
-                goto ret;
+                return retval;
 
         /* to keep locking time low, we copy the interpreter string */
         read_lock(&entries_lock);
         fmt = check_file(bprm);
         if (fmt)
-                strlcpy(iname, fmt->interpreter, BINPRM_BUF_SIZE);
+                dget(fmt->dentry);
         read_unlock(&entries_lock);
         if (!fmt)
-                goto ret;
+                return retval;
 
         /* Need to be able to load the file after exec */
+        retval = -ENOENT;
         if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE)
-                return -ENOENT;
+                goto ret;
 
         if (!(fmt->flags & MISC_FMT_PRESERVE_ARGV0)) {
                 retval = remove_arg_zero(bprm);
@@ -195,22 +194,22 @@ static int load_misc_binary(struct linux_binprm *bprm)
         bprm->argc++;
 
         /* add the interp as argv[0] */
-        retval = copy_strings_kernel(1, &iname_addr, bprm);
+        retval = copy_strings_kernel(1, &fmt->interpreter, bprm);
         if (retval < 0)
                 goto error;
         bprm->argc++;
 
         /* Update interp in case binfmt_script needs it. */
-        retval = bprm_change_interp(iname, bprm);
+        retval = bprm_change_interp(fmt->interpreter, bprm);
         if (retval < 0)
                 goto error;
 
-        if (fmt->flags & MISC_FMT_OPEN_FILE && fmt->interp_file) {
+        if (fmt->flags & MISC_FMT_OPEN_FILE) {
                 interp_file = filp_clone_open(fmt->interp_file);
                 if (!IS_ERR(interp_file))
                         deny_write_access(interp_file);
         } else {
-                interp_file = open_exec(iname);
+                interp_file = open_exec(fmt->interpreter);
         }
         retval = PTR_ERR(interp_file);
         if (IS_ERR(interp_file))
@@ -238,6 +237,7 @@ static int load_misc_binary(struct linux_binprm *bprm)
                 goto error;
 
 ret:
+        dput(fmt->dentry);
         return retval;
 error:
         if (fd_binary > 0)
@@ -594,8 +594,13 @@ static struct inode *bm_get_inode(struct super_block *sb, int mode)
 
 static void bm_evict_inode(struct inode *inode)
 {
+        Node *e = inode->i_private;
+
+        if (e->flags & MISC_FMT_OPEN_FILE)
+                filp_close(e->interp_file, NULL);
+
         clear_inode(inode);
-        kfree(inode->i_private);
+        kfree(e);
 }
 
 static void kill_node(Node *e)
@@ -603,24 +608,14 @@ static void kill_node(Node *e)
         struct dentry *dentry;
 
         write_lock(&entries_lock);
-        dentry = e->dentry;
-        if (dentry) {
-                list_del_init(&e->list);
-                e->dentry = NULL;
-        }
+        list_del_init(&e->list);
         write_unlock(&entries_lock);
 
-        if ((e->flags & MISC_FMT_OPEN_FILE) && e->interp_file) {
-                filp_close(e->interp_file, NULL);
-                e->interp_file = NULL;
-        }
-
-        if (dentry) {
-                drop_nlink(d_inode(dentry));
-                d_drop(dentry);
-                dput(dentry);
-                simple_release_fs(&bm_mnt, &entry_count);
-        }
+        dentry = e->dentry;
+        drop_nlink(d_inode(dentry));
+        d_drop(dentry);
+        dput(dentry);
+        simple_release_fs(&bm_mnt, &entry_count);
 }
 
 /* /<entry> */
@@ -665,7 +660,8 @@ static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
                 root = file_inode(file)->i_sb->s_root;
                 inode_lock(d_inode(root));
 
-                kill_node(e);
+                if (!list_empty(&e->list))
+                        kill_node(e);
 
                 inode_unlock(d_inode(root));
                 break;
@@ -794,7 +790,7 @@ static ssize_t bm_status_write(struct file *file, const char __user *buffer,
                 inode_lock(d_inode(root));
 
                 while (!list_empty(&entries))
-                        kill_node(list_entry(entries.next, Node, list));
+                        kill_node(list_first_entry(&entries, Node, list));
 
                 inode_unlock(d_inode(root));
                 break;
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index afdf4e3cafc2..7cde3f46ad26 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -19,7 +19,6 @@ static int load_script(struct linux_binprm *bprm)
         const char *i_arg, *i_name;
         char *cp;
         struct file *file;
-        char interp[BINPRM_BUF_SIZE];
         int retval;
 
         if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
@@ -55,7 +54,7 @@ static int load_script(struct linux_binprm *bprm)
                         break;
         }
         for (cp = bprm->buf+2; (*cp == ' ') || (*cp == '\t'); cp++);
-        if (*cp == '\0') 
+        if (*cp == '\0')
                 return -ENOEXEC; /* No interpreter name found */
         i_name = cp;
         i_arg = NULL;
@@ -65,7 +64,6 @@ static int load_script(struct linux_binprm *bprm)
                 *cp++ = '\0';
         if (*cp)
                 i_arg = cp;
-        strcpy (interp, i_name);
         /*
          * OK, we've parsed out the interpreter name and
          * (optional) argument.
@@ -80,24 +78,27 @@ static int load_script(struct linux_binprm *bprm)
         if (retval)
                 return retval;
         retval = copy_strings_kernel(1, &bprm->interp, bprm);
-        if (retval < 0) return retval; 
+        if (retval < 0)
+                return retval;
         bprm->argc++;
         if (i_arg) {
                 retval = copy_strings_kernel(1, &i_arg, bprm);
-                if (retval < 0) return retval; 
+                if (retval < 0)
+                        return retval;
                 bprm->argc++;
         }
         retval = copy_strings_kernel(1, &i_name, bprm);
-        if (retval) return retval; 
+        if (retval)
+                return retval;
         bprm->argc++;
-        retval = bprm_change_interp(interp, bprm);
+        retval = bprm_change_interp(i_name, bprm);
         if (retval < 0)
                 return retval;
 
         /*
          * OK, now restart the process with the interpreter's dentry.
          */
-        file = open_exec(interp);
+        file = open_exec(i_name);
         if (IS_ERR(file))
                 return PTR_ERR(file);
 
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index b51d23f5cafa..280384bf34f1 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -107,7 +107,8 @@ static void end_compressed_bio_read(struct bio *bio)
         struct inode *inode;
         struct page *page;
         unsigned long index;
-        int ret;
+        unsigned int mirror = btrfs_io_bio(bio)->mirror_num;
+        int ret = 0;
 
         if (bio->bi_status)
                 cb->errors = 1;
@@ -118,6 +119,21 @@ static void end_compressed_bio_read(struct bio *bio)
         if (!refcount_dec_and_test(&cb->pending_bios))
                 goto out;
 
+        /*
+         * Record the correct mirror_num in cb->orig_bio so that
+         * read-repair can work properly.
+         */
+        ASSERT(btrfs_io_bio(cb->orig_bio));
+        btrfs_io_bio(cb->orig_bio)->mirror_num = mirror;
+        cb->mirror_num = mirror;
+
+        /*
+         * Some IO in this cb have failed, just skip checksum as there
+         * is no way it could be correct.
+         */
+        if (cb->errors == 1)
+                goto csum_failed;
+
         inode = cb->inode;
         ret = check_compressed_csum(BTRFS_I(inode), cb,
                                     (u64)bio->bi_iter.bi_sector << 9);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 5a8933da39a7..8fc690384c58 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -709,7 +709,6 @@ struct btrfs_delayed_root;
 #define BTRFS_FS_OPEN                           5
 #define BTRFS_FS_QUOTA_ENABLED                  6
 #define BTRFS_FS_QUOTA_ENABLING                 7
-#define BTRFS_FS_QUOTA_DISABLING                8
 #define BTRFS_FS_UPDATE_UUID_TREE_GEN           9
 #define BTRFS_FS_CREATING_FREE_SPACE_TREE       10
 #define BTRFS_FS_BTREE_ERR                      11
@@ -723,7 +722,7 @@ struct btrfs_delayed_root;
  * Indicate that a whole-filesystem exclusive operation is running
  * (device replace, resize, device add/delete, balance)
  */
-#define BTRFS_FS_EXCL_OP                        14
+#define BTRFS_FS_EXCL_OP                        16
 
 struct btrfs_fs_info {
         u8 fsid[BTRFS_FSID_SIZE];
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 487bbe4fb3c6..dfdab849037b 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3643,7 +3643,14 @@ int write_all_supers(struct btrfs_fs_info *fs_info, int max_mirrors)
         u64 flags;
 
         do_barriers = !btrfs_test_opt(fs_info, NOBARRIER);
-        backup_super_roots(fs_info);
+
+        /*
+         * max_mirrors == 0 indicates we're from commit_transaction,
+         * not from fsync where the tree roots in fs_info have not
+         * been consistent on disk.
+         */
+        if (max_mirrors == 0)
+                backup_super_roots(fs_info);
 
         sb = fs_info->super_for_commit;
         dev_item = &sb->dev_item;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 3e5bb0cdd3cd..970190cd347e 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2801,7 +2801,7 @@ static int submit_extent_page(unsigned int opf, struct extent_io_tree *tree,
                 }
         }
 
-        bio = btrfs_bio_alloc(bdev, sector << 9);
+        bio = btrfs_bio_alloc(bdev, (u64)sector << 9);
         bio_add_page(bio, page, page_size, offset);
         bio->bi_end_io = end_io_func;
         bio->bi_private = tree;
@@ -3471,8 +3471,7 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         unsigned int write_flags = 0;
         unsigned long nr_written = 0;
 
-        if (wbc->sync_mode == WB_SYNC_ALL)
-                write_flags = REQ_SYNC;
+        write_flags = wbc_to_write_flags(wbc);
 
         trace___extent_writepage(page, inode, wbc);
 
@@ -3718,7 +3717,7 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
         unsigned long i, num_pages;
         unsigned long bio_flags = 0;
         unsigned long start, end;
-        unsigned int write_flags = (epd->sync_io ? REQ_SYNC : 0) | REQ_META;
+        unsigned int write_flags = wbc_to_write_flags(wbc) | REQ_META;
         int ret = 0;
 
         clear_bit(EXTENT_BUFFER_WRITE_ERR, &eb->bflags);
@@ -4063,9 +4062,6 @@ static void flush_epd_write_bio(struct extent_page_data *epd)
         if (epd->bio) {
                 int ret;
 
-                bio_set_op_attrs(epd->bio, REQ_OP_WRITE,
-                                 epd->sync_io ? REQ_SYNC : 0);
-
                 ret = submit_one_bio(epd->bio, 0, epd->bio_flags);
                 BUG_ON(ret < 0); /* -ENOMEM */
                 epd->bio = NULL;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 128f3e58634f..d94e3f68b9b1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -135,6 +135,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
                                                  const u64 offset,
                                                  const u64 bytes)
 {
+        unsigned long index = offset >> PAGE_SHIFT;
+        unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
+        struct page *page;
+
+        while (index <= end_index) {
+                page = find_get_page(inode->i_mapping, index);
+                index++;
+                if (!page)
+                        continue;
+                ClearPagePrivate2(page);
+                put_page(page);
+        }
         return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
                                             bytes - PAGE_SIZE, false);
 }
@@ -8357,11 +8369,8 @@ static void btrfs_endio_direct_read(struct bio *bio)
         struct btrfs_io_bio *io_bio = btrfs_io_bio(bio);
         blk_status_t err = bio->bi_status;
 
-        if (dip->flags & BTRFS_DIO_ORIG_BIO_SUBMITTED) {
+        if (dip->flags & BTRFS_DIO_ORIG_BIO_SUBMITTED)
                 err = btrfs_subio_endio_read(inode, io_bio, err);
-                if (!err)
-                        bio->bi_status = 0;
-        }
 
         unlock_extent(&BTRFS_I(inode)->io_tree, dip->logical_offset,
                       dip->logical_offset + dip->bytes - 1);
@@ -8369,7 +8378,7 @@ static void btrfs_endio_direct_read(struct bio *bio)
 
         kfree(dip);
 
-        dio_bio->bi_status = bio->bi_status;
+        dio_bio->bi_status = err;
         dio_end_io(dio_bio);
 
         if (io_bio->end_io)
@@ -8387,6 +8396,7 @@ static void __endio_write_update_ordered(struct inode *inode,
         btrfs_work_func_t func;
         u64 ordered_offset = offset;
         u64 ordered_bytes = bytes;
+        u64 last_offset;
         int ret;
 
         if (btrfs_is_free_space_inode(BTRFS_I(inode))) {
@@ -8398,6 +8408,7 @@ static void __endio_write_update_ordered(struct inode *inode,
         }
 
 again:
+        last_offset = ordered_offset;
         ret = btrfs_dec_test_first_ordered_pending(inode, &ordered,
                                                    &ordered_offset,
                                                    ordered_bytes,
@@ -8409,6 +8420,12 @@ again:
         btrfs_queue_work(wq, &ordered->work);
 out_test:
         /*
+         * If btrfs_dec_test_ordered_pending does not find any ordered extent
+         * in the range, we can exit.
+         */
+        if (ordered_offset == last_offset)
+                return;
+        /*
          * our bio might span multiple ordered extents.  If we haven't
          * completed the accounting for the whole dio, go back and try again
          */
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index d6715c2bcdc4..6c7a49faf4e0 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2773,9 +2773,9 @@ static long btrfs_ioctl_fs_info(struct btrfs_fs_info *fs_info,
         }
         mutex_unlock(&fs_devices->device_list_mutex);
 
-        fi_args->nodesize = fs_info->super_copy->nodesize;
-        fi_args->sectorsize = fs_info->super_copy->sectorsize;
-        fi_args->clone_alignment = fs_info->super_copy->sectorsize;
+        fi_args->nodesize = fs_info->nodesize;
+        fi_args->sectorsize = fs_info->sectorsize;
+        fi_args->clone_alignment = fs_info->sectorsize;
 
         if (copy_to_user(arg, fi_args, sizeof(*fi_args)))
                 ret = -EFAULT;
@@ -3032,7 +3032,7 @@ static int btrfs_cmp_data_prepare(struct inode *src, u64 loff,
 out:
         if (ret)
                 btrfs_cmp_data_free(cmp);
-        return 0;
+        return ret;
 }
 
 static int btrfs_cmp_data(u64 len, struct cmp_pages *cmp)
@@ -4061,6 +4061,10 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
                 ret = PTR_ERR(new_root);
                 goto out;
         }
+        if (!is_fstree(new_root->objectid)) {
+                ret = -ENOENT;
+                goto out;
+        }
 
         path = btrfs_alloc_path();
         if (!path) {
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 5c8b61c86e61..e172d4843eae 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -807,7 +807,6 @@ static int btrfs_clean_quota_tree(struct btrfs_trans_handle *trans,
         }
         ret = 0;
 out:
-        set_bit(BTRFS_FS_QUOTA_DISABLING, &root->fs_info->flags);
         btrfs_free_path(path);
         return ret;
 }
@@ -953,7 +952,6 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
         if (!fs_info->quota_root)
                 goto out;
         clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
-        set_bit(BTRFS_FS_QUOTA_DISABLING, &fs_info->flags);
         btrfs_qgroup_wait_for_completion(fs_info, false);
         spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
@@ -1307,6 +1305,8 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans,
                 }
         }
         ret = del_qgroup_item(trans, quota_root, qgroupid);
+        if (ret && ret != -ENOENT)
+                goto out;
 
         while (!list_empty(&qgroup->groups)) {
                 list = list_first_entry(&qgroup->groups,
@@ -2086,8 +2086,6 @@ int btrfs_run_qgroups(struct btrfs_trans_handle *trans,
 
         if (test_and_clear_bit(BTRFS_FS_QUOTA_ENABLING, &fs_info->flags))
                 set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
-        if (test_and_clear_bit(BTRFS_FS_QUOTA_DISABLING, &fs_info->flags))
-                clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
 
         spin_lock(&fs_info->qgroup_lock);
         while (!list_empty(&fs_info->dirty_qgroups)) {
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 3a49a3c2fca4..9841faef08ea 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2400,11 +2400,11 @@ void free_reloc_roots(struct list_head *list)
         while (!list_empty(list)) {
                 reloc_root = list_entry(list->next, struct btrfs_root,
                                         root_list);
+                __del_reloc_root(reloc_root);
                 free_extent_buffer(reloc_root->node);
                 free_extent_buffer(reloc_root->commit_root);
                 reloc_root->node = NULL;
                 reloc_root->commit_root = NULL;
-                __del_reloc_root(reloc_root);
         }
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 32b043ef8ac9..8fd195cfe81b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -2630,7 +2630,7 @@ static int send_create_inode(struct send_ctx *sctx, u64 ino)
         } else {
                 btrfs_warn(sctx->send_root->fs_info, "unexpected inode type %o",
                                 (int)(mode & S_IFMT));
-                ret = -ENOTSUPP;
+                ret = -EOPNOTSUPP;
                 goto out;
         }
 
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index ad7f4bab640b..c800d067fcbf 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4181,6 +4181,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         struct extent_map *em, *n;
         struct list_head extents;
         struct extent_map_tree *tree = &inode->extent_tree;
+        u64 logged_start, logged_end;
         u64 test_gen;
         int ret = 0;
         int num = 0;
@@ -4190,10 +4191,11 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         down_write(&inode->dio_sem);
         write_lock(&tree->lock);
         test_gen = root->fs_info->last_trans_committed;
+        logged_start = start;
+        logged_end = end;
 
         list_for_each_entry_safe(em, n, &tree->modified_extents, list) {
                 list_del_init(&em->list);
-
                 /*
                  * Just an arbitrary number, this can be really CPU intensive
                  * once we start getting a lot of extents, and really once we
@@ -4208,6 +4210,12 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
 
                 if (em->generation <= test_gen)
                         continue;
+
+                if (em->start < logged_start)
+                        logged_start = em->start;
+                if ((em->start + em->len - 1) > logged_end)
+                        logged_end = em->start + em->len - 1;
+
                 /* Need a ref to keep it from getting evicted from cache */
                 refcount_inc(&em->refs);
                 set_bit(EXTENT_FLAG_LOGGING, &em->flags);
@@ -4216,7 +4224,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
         }
 
         list_sort(NULL, &extents, extent_cmp);
-        btrfs_get_logged_extents(inode, logged_list, start, end);
+        btrfs_get_logged_extents(inode, logged_list, logged_start, logged_end);
         /*
          * Some ordered extents started by fsync might have completed
          * before we could collect them into the list logged_list, which
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0e8f16c305df..b39737568c22 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6166,7 +6166,7 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
         map_length = length;
 
         btrfs_bio_counter_inc_blocked(fs_info);
-        ret = __btrfs_map_block(fs_info, bio_op(bio), logical,
+        ret = __btrfs_map_block(fs_info, btrfs_op(bio), logical,
                                 &map_length, &bbio, mirror_num, 1);
         if (ret) {
                 btrfs_bio_counter_dec(fs_info);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 9dd6b836ac9e..f23c820daaed 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -7,7 +7,6 @@
 #include <linux/sched.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
-#include <linux/utsname.h>
 #include <linux/ratelimit.h>
 
 #include "super.h"
@@ -735,12 +734,13 @@ static int __choose_mds(struct ceph_mds_client *mdsc,
                         inode = req->r_inode;
                         ihold(inode);
                 } else {
-                        /* req->r_dentry is non-null for LSSNAP request.
-                         * fall-thru */
-                        WARN_ON_ONCE(!req->r_dentry);
+                        /* req->r_dentry is non-null for LSSNAP request */
+                        rcu_read_lock();
+                        inode = get_nonsnap_parent(req->r_dentry);
+                        rcu_read_unlock();
+                        dout("__choose_mds using snapdir's parent %p\n", inode);
                 }
-        }
-        if (!inode && req->r_dentry) {
+        } else if (req->r_dentry) {
                 /* ignore race with rename; old or new d_parent is okay */
                 struct dentry *parent;
                 struct inode *dir;
@@ -884,8 +884,8 @@ static struct ceph_msg *create_session_open_msg(struct ceph_mds_client *mdsc, u6
         void *p;
 
         const char* metadata[][2] = {
-                {"hostname", utsname()->nodename},
-                {"kernel_version", utsname()->release},
+                {"hostname", mdsc->nodename},
+                {"kernel_version", init_utsname()->release},
                 {"entity_id", opt->name ? : ""},
                 {"root", fsopt->server_path ? : "/"},
                 {NULL, NULL}
@@ -3539,6 +3539,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
         init_rwsem(&mdsc->pool_perm_rwsem);
         mdsc->pool_perm_tree = RB_ROOT;
 
+        strncpy(mdsc->nodename, utsname()->nodename,
+                sizeof(mdsc->nodename) - 1);
         return 0;
 }
 
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index db57ae98ed34..636d6b2ec49c 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -8,6 +8,7 @@
 #include <linux/rbtree.h>
 #include <linux/spinlock.h>
 #include <linux/refcount.h>
+#include <linux/utsname.h>
 
 #include <linux/ceph/types.h>
 #include <linux/ceph/messenger.h>
@@ -368,6 +369,8 @@ struct ceph_mds_client {
 
         struct rw_semaphore     pool_perm_rwsem;
         struct rb_root          pool_perm_tree;
+
+        char nodename[__NEW_UTS_LEN + 1];
 };
 
 extern const char *ceph_mds_op_name(int op);
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 1ffc8b426c1c..7fc0b850c352 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -374,12 +374,10 @@ static int build_snap_context(struct ceph_snap_realm *realm,
              realm->ino, realm, snapc, snapc->seq,
              (unsigned int) snapc->num_snaps);
 
-        if (realm->cached_context) {
-                ceph_put_snap_context(realm->cached_context);
-                /* queue realm for cap_snap creation */
-                list_add_tail(&realm->dirty_item, dirty_realms);
-        }
+        ceph_put_snap_context(realm->cached_context);
         realm->cached_context = snapc;
+        /* queue realm for cap_snap creation */
+        list_add_tail(&realm->dirty_item, dirty_realms);
         return 0;
 
 fail:
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 9727e1dcacd5..cbb9534b89b4 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -160,8 +160,13 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
                         if ((ses->serverDomain == NULL) ||
                                 (ses->serverOS == NULL) ||
                                 (ses->serverNOS == NULL)) {
-                                seq_printf(m, "\n%d) entry for %s not fully "
-                                           "displayed\n\t", i, ses->serverName);
+                                seq_printf(m, "\n%d) Name: %s Uses: %d Capability: 0x%x\tSession Status: %d\t",
+                                        i, ses->serverName, ses->ses_count,
+                                        ses->capabilities, ses->status);
+                                if (ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
+                                        seq_printf(m, "Guest\t");
+                                else if (ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
+                                        seq_printf(m, "Anonymous\t");
                         } else {
                                 seq_printf(m,
                                     "\n%d) Name: %s  Domain: %s Uses: %d OS:"
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 180b3356ff86..8c8b75d33f31 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -461,6 +461,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
                 seq_puts(s, ",nocase");
         if (tcon->retry)
                 seq_puts(s, ",hard");
+        else
+                seq_puts(s, ",soft");
         if (tcon->use_persistent)
                 seq_puts(s, ",persistenthandles");
         else if (tcon->use_resilient)
@@ -1447,7 +1449,7 @@ exit_cifs(void)
         exit_cifs_idmap();
 #endif
 #ifdef CONFIG_CIFS_UPCALL
-        unregister_key_type(&cifs_spnego_key_type);
+        exit_cifs_spnego();
 #endif
         cifs_destroy_request_bufs();
         cifs_destroy_mids();
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 30bf89b1fd9a..5a10e566f0e6 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -149,5 +149,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "2.09"
+#define CIFS_VERSION   "2.10"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 808486c29f0d..de5b2e1fcce5 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -188,6 +188,8 @@ enum smb_version {
 #ifdef CONFIG_CIFS_SMB311
         Smb_311,
 #endif /* SMB311 */
+        Smb_3any,
+        Smb_default,
         Smb_version_err
 };
 
@@ -1701,6 +1703,10 @@ extern struct smb_version_values smb20_values;
 #define SMB21_VERSION_STRING    "2.1"
 extern struct smb_version_operations smb21_operations;
 extern struct smb_version_values smb21_values;
+#define SMBDEFAULT_VERSION_STRING "default"
+extern struct smb_version_values smbdefault_values;
+#define SMB3ANY_VERSION_STRING "3"
+extern struct smb_version_values smb3any_values;
 #define SMB30_VERSION_STRING    "3.0"
 extern struct smb_version_operations smb30_operations;
 extern struct smb_version_values smb30_values;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 5aa2d278ca84..0bfc2280436d 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -301,6 +301,8 @@ static const match_table_t cifs_smb_version_tokens = {
         { Smb_311, SMB311_VERSION_STRING },
         { Smb_311, ALT_SMB311_VERSION_STRING },
 #endif /* SMB311 */
+        { Smb_3any, SMB3ANY_VERSION_STRING },
+        { Smb_default, SMBDEFAULT_VERSION_STRING },
         { Smb_version_err, NULL }
 };
 
@@ -1148,6 +1150,14 @@ cifs_parse_smb_version(char *value, struct smb_vol *vol)
                 vol->vals = &smb311_values;
                 break;
 #endif /* SMB311 */
+        case Smb_3any:
+                vol->ops = &smb30_operations; /* currently identical with 3.0 */
+                vol->vals = &smb3any_values;
+                break;
+        case Smb_default:
+                vol->ops = &smb30_operations; /* currently identical with 3.0 */
+                vol->vals = &smbdefault_values;
+                break;
         default:
                 cifs_dbg(VFS, "Unknown vers= option specified: %s\n", value);
                 return 1;
@@ -1274,9 +1284,9 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
         vol->actimeo = CIFS_DEF_ACTIMEO;
 
-        /* FIXME: add autonegotiation for SMB3 or later rather than just SMB3 */
-        vol->ops = &smb30_operations; /* both secure and accepted widely */
-        vol->vals = &smb30_values;
+        /* offer SMB2.1 and later (SMB3 etc). Secure and widely accepted */
+        vol->ops = &smb30_operations;
+        vol->vals = &smbdefault_values;
 
         vol->echo_interval = SMB_ECHO_INTERVAL_DEFAULT;
 
@@ -1988,11 +1998,10 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
 
         if (got_version == false)
                 pr_warn("No dialect specified on mount. Default has changed to "
-                        "a more secure dialect, SMB3 (vers=3.0), from CIFS "
+                        "a more secure dialect, SMB2.1 or later (e.g. SMB3), from CIFS "
                         "(SMB1). To use the less secure SMB1 dialect to access "
-                        "old servers which do not support SMB3 specify vers=1.0"
-                        " on mount. For somewhat newer servers such as Windows "
-                        "7 try vers=2.1.\n");
+                        "old servers which do not support SMB3 (or SMB2.1) specify vers=1.0"
+                        " on mount.\n");
 
         kfree(mountdata_copy);
         return 0;
@@ -2133,6 +2142,7 @@ static int match_server(struct TCP_Server_Info *server, struct smb_vol *vol)
         if (vol->nosharesock)
                 return 0;
 
+        /* BB update this for smb3any and default case */
         if ((server->vals != vol->vals) || (server->ops != vol->ops))
                 return 0;
 
@@ -4144,6 +4154,14 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses,
         cifs_dbg(FYI, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d\n",
                  server->sec_mode, server->capabilities, server->timeAdj);
 
+        if (ses->auth_key.response) {
+                cifs_dbg(VFS, "Free previous auth_key.response = %p\n",
+                         ses->auth_key.response);
+                kfree(ses->auth_key.response);
+                ses->auth_key.response = NULL;
+                ses->auth_key.len = 0;
+        }
+
         if (server->ops->sess_setup)
                 rc = server->ops->sess_setup(xid, ses, nls_info);
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 0786f19d288f..92fdf9c35de2 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -224,6 +224,13 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
         if (backup_cred(cifs_sb))
                 create_options |= CREATE_OPEN_BACKUP_INTENT;
 
+        /* O_SYNC also has bit for O_DSYNC so following check picks up either */
+        if (f_flags & O_SYNC)
+                create_options |= CREATE_WRITE_THROUGH;
+
+        if (f_flags & O_DIRECT)
+                create_options |= CREATE_NO_BUFFER;
+
         oparms.tcon = tcon;
         oparms.cifs_sb = cifs_sb;
         oparms.desired_access = desired_access;
@@ -1102,8 +1109,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
         struct cifs_tcon *tcon;
         unsigned int num, max_num, max_buf;
         LOCKING_ANDX_RANGE *buf, *cur;
-        int types[] = {LOCKING_ANDX_LARGE_FILES,
-                       LOCKING_ANDX_SHARED_LOCK | LOCKING_ANDX_LARGE_FILES};
+        static const int types[] = {
+                LOCKING_ANDX_LARGE_FILES,
+                LOCKING_ANDX_SHARED_LOCK | LOCKING_ANDX_LARGE_FILES
+        };
         int i;
 
         xid = get_xid();
@@ -1434,8 +1443,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
                   unsigned int xid)
 {
         int rc = 0, stored_rc;
-        int types[] = {LOCKING_ANDX_LARGE_FILES,
-                       LOCKING_ANDX_SHARED_LOCK | LOCKING_ANDX_LARGE_FILES};
+        static const int types[] = {
+                LOCKING_ANDX_LARGE_FILES,
+                LOCKING_ANDX_SHARED_LOCK | LOCKING_ANDX_LARGE_FILES
+        };
         unsigned int i;
         unsigned int max_num, num, max_buf;
         LOCKING_ANDX_RANGE *buf, *cur;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index a8693632235f..7c732cb44164 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -234,6 +234,8 @@ cifs_unix_basic_to_fattr(struct cifs_fattr *fattr, FILE_UNIX_BASIC_INFO *info,
         fattr->cf_atime = cifs_NTtimeToUnix(info->LastAccessTime);
         fattr->cf_mtime = cifs_NTtimeToUnix(info->LastModificationTime);
         fattr->cf_ctime = cifs_NTtimeToUnix(info->LastStatusChange);
+        /* old POSIX extensions don't get create time */
+
         fattr->cf_mode = le64_to_cpu(info->Permissions);
 
         /*
@@ -2024,6 +2026,19 @@ int cifs_getattr(const struct path *path, struct kstat *stat,
         stat->blksize = CIFS_MAX_MSGSIZE;
         stat->ino = CIFS_I(inode)->uniqueid;
 
+        /* old CIFS Unix Extensions doesn't return create time */
+        if (CIFS_I(inode)->createtime) {
+                stat->result_mask |= STATX_BTIME;
+                stat->btime =
+                      cifs_NTtimeToUnix(cpu_to_le64(CIFS_I(inode)->createtime));
+        }
+
+        stat->attributes_mask |= (STATX_ATTR_COMPRESSED | STATX_ATTR_ENCRYPTED);
+        if (CIFS_I(inode)->cifsAttrs & FILE_ATTRIBUTE_COMPRESSED)
+                stat->attributes |= STATX_ATTR_COMPRESSED;
+        if (CIFS_I(inode)->cifsAttrs & FILE_ATTRIBUTE_ENCRYPTED)
+                stat->attributes |= STATX_ATTR_ENCRYPTED;
+
         /*
          * If on a multiuser mount without unix extensions or cifsacl being
          * enabled, and the admin hasn't overridden them, set the ownership
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index fb2934b9b97c..0dafdbae1f8c 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -426,6 +426,7 @@ smb2_query_file_info(const unsigned int xid, struct cifs_tcon *tcon,
         return rc;
 }
 
+#ifdef CONFIG_CIFS_XATTR
 static ssize_t
 move_smb2_ea_to_cifs(char *dst, size_t dst_size,
                      struct smb2_file_full_ea_info *src, size_t src_size,
@@ -613,6 +614,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
 
         return rc;
 }
+#endif
 
 static bool
 smb2_can_echo(struct TCP_Server_Info *server)
@@ -3110,6 +3112,46 @@ struct smb_version_values smb21_values = {
         .create_lease_size = sizeof(struct create_lease),
 };
 
+struct smb_version_values smb3any_values = {
+        .version_string = SMB3ANY_VERSION_STRING,
+        .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .large_lock_type = 0,
+        .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
+        .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
+        .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+        .header_size = sizeof(struct smb2_hdr),
+        .max_header_size = MAX_SMB2_HDR_SIZE,
+        .read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+        .lock_cmd = SMB2_LOCK,
+        .cap_unix = 0,
+        .cap_nt_find = SMB2_NT_FIND,
+        .cap_large_files = SMB2_LARGE_FILES,
+        .signing_enabled = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED,
+        .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
+        .create_lease_size = sizeof(struct create_lease_v2),
+};
+
+struct smb_version_values smbdefault_values = {
+        .version_string = SMBDEFAULT_VERSION_STRING,
+        .protocol_id = SMB302_PROT_ID, /* doesn't matter, send protocol array */
+        .req_capabilities = SMB2_GLOBAL_CAP_DFS | SMB2_GLOBAL_CAP_LEASING | SMB2_GLOBAL_CAP_LARGE_MTU | SMB2_GLOBAL_CAP_PERSISTENT_HANDLES | SMB2_GLOBAL_CAP_ENCRYPTION,
+        .large_lock_type = 0,
+        .exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
+        .shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
+        .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
+        .header_size = sizeof(struct smb2_hdr),
+        .max_header_size = MAX_SMB2_HDR_SIZE,
+        .read_rsp_size = sizeof(struct smb2_read_rsp) - 1,
+        .lock_cmd = SMB2_LOCK,
+        .cap_unix = 0,
+        .cap_nt_find = SMB2_NT_FIND,
+        .cap_large_files = SMB2_LARGE_FILES,
+        .signing_enabled = SMB2_NEGOTIATE_SIGNING_ENABLED | SMB2_NEGOTIATE_SIGNING_REQUIRED,
+        .signing_required = SMB2_NEGOTIATE_SIGNING_REQUIRED,
+        .create_lease_size = sizeof(struct create_lease_v2),
+};
+
 struct smb_version_values smb30_values = {
         .version_string = SMB30_VERSION_STRING,
         .protocol_id = SMB30_PROT_ID,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5531e7ee1210..6f0e6343c15e 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -439,7 +439,7 @@ assemble_neg_contexts(struct smb2_negotiate_req *req)
         build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt);
         req->NegotiateContextOffset = cpu_to_le32(OFFSET_OF_NEG_CONTEXT);
         req->NegotiateContextCount = cpu_to_le16(2);
-        inc_rfc1001_len(req, 4 + sizeof(struct smb2_preauth_neg_context) + 2
+        inc_rfc1001_len(req, 4 + sizeof(struct smb2_preauth_neg_context)
                         + sizeof(struct smb2_encryption_neg_context)); /* calculate hash */
 }
 #else
@@ -491,10 +491,25 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
 
         req->hdr.sync_hdr.SessionId = 0;
 
-        req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
-
-        req->DialectCount = cpu_to_le16(1); /* One vers= at a time for now */
-        inc_rfc1001_len(req, 2);
+        if (strcmp(ses->server->vals->version_string,
+                   SMB3ANY_VERSION_STRING) == 0) {
+                req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
+                req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
+                req->DialectCount = cpu_to_le16(2);
+                inc_rfc1001_len(req, 4);
+        } else if (strcmp(ses->server->vals->version_string,
+                   SMBDEFAULT_VERSION_STRING) == 0) {
+                req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
+                req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
+                req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
+                req->DialectCount = cpu_to_le16(3);
+                inc_rfc1001_len(req, 6);
+        } else {
+                /* otherwise send specific dialect */
+                req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
+                req->DialectCount = cpu_to_le16(1);
+                inc_rfc1001_len(req, 2);
+        }
 
         /* only one of SMB2 signing flags may be set in SMB2 request */
         if (ses->sign)
@@ -528,16 +543,43 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
          */
         if (rc == -EOPNOTSUPP) {
                 cifs_dbg(VFS, "Dialect not supported by server. Consider "
-                        "specifying vers=1.0 or vers=2.1 on mount for accessing"
+                        "specifying vers=1.0 or vers=2.0 on mount for accessing"
                         " older servers\n");
                 goto neg_exit;
         } else if (rc != 0)
                 goto neg_exit;
 
+        if (strcmp(ses->server->vals->version_string,
+                   SMB3ANY_VERSION_STRING) == 0) {
+                if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
+                        cifs_dbg(VFS,
+                                "SMB2 dialect returned but not requested\n");
+                        return -EIO;
+                } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
+                        cifs_dbg(VFS,
+                                "SMB2.1 dialect returned but not requested\n");
+                        return -EIO;
+                }
+        } else if (strcmp(ses->server->vals->version_string,
+                   SMBDEFAULT_VERSION_STRING) == 0) {
+                if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
+                        cifs_dbg(VFS,
+                                "SMB2 dialect returned but not requested\n");
+                        return -EIO;
+                } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
+                        /* ops set to 3.0 by default for default so update */
+                        ses->server->ops = &smb21_operations;
+                }
+        } else if (le16_to_cpu(rsp->DialectRevision) !=
+                                ses->server->vals->protocol_id) {
+                /* if requested single dialect ensure returned dialect matched */
+                cifs_dbg(VFS, "Illegal 0x%x dialect returned: not requested\n",
+                        le16_to_cpu(rsp->DialectRevision));
+                return -EIO;
+        }
+
         cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
 
-        /* BB we may eventually want to match the negotiated vs. requested
-           dialect, even though we are only requesting one at a time */
         if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
                 cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
         else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
@@ -558,6 +600,8 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
         }
         server->dialect = le16_to_cpu(rsp->DialectRevision);
 
+        /* BB: add check that dialect was valid given dialect(s) we asked for */
+
         /* SMB2 only has an extended negflavor */
         server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
         /* set it to the maximum buffer size value we can send with 1 credit */
@@ -606,20 +650,28 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
         struct validate_negotiate_info_req vneg_inbuf;
         struct validate_negotiate_info_rsp *pneg_rsp;
         u32 rsplen;
+        u32 inbuflen; /* max of 4 dialects */
 
         cifs_dbg(FYI, "validate negotiate\n");
 
         /*
          * validation ioctl must be signed, so no point sending this if we
-         * can not sign it.  We could eventually change this to selectively
+         * can not sign it (ie are not known user).  Even if signing is not
+         * required (enabled but not negotiated), in those cases we selectively
          * sign just this, the first and only signed request on a connection.
-         * This is good enough for now since a user who wants better security
-         * would also enable signing on the mount. Having validation of
-         * negotiate info for signed connections helps reduce attack vectors
+         * Having validation of negotiate info  helps reduce attack vectors.
          */
-        if (tcon->ses->server->sign == false)
+        if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
                 return 0; /* validation requires signing */
 
+        if (tcon->ses->user_name == NULL) {
+                cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
+                return 0; /* validation requires signing */
+        }
+
+        if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
+                cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");
+
         vneg_inbuf.Capabilities =
                         cpu_to_le32(tcon->ses->server->vals->req_capabilities);
         memcpy(vneg_inbuf.Guid, tcon->ses->server->client_guid,
@@ -634,9 +686,30 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
         else
                 vneg_inbuf.SecurityMode = 0;
 
-        vneg_inbuf.DialectCount = cpu_to_le16(1);
-        vneg_inbuf.Dialects[0] =
-                cpu_to_le16(tcon->ses->server->vals->protocol_id);
+
+        if (strcmp(tcon->ses->server->vals->version_string,
+                SMB3ANY_VERSION_STRING) == 0) {
+                vneg_inbuf.Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
+                vneg_inbuf.Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
+                vneg_inbuf.DialectCount = cpu_to_le16(2);
+                /* structure is big enough for 3 dialects, sending only 2 */
+                inbuflen = sizeof(struct validate_negotiate_info_req) - 2;
+        } else if (strcmp(tcon->ses->server->vals->version_string,
+                SMBDEFAULT_VERSION_STRING) == 0) {
+                vneg_inbuf.Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
+                vneg_inbuf.Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
+                vneg_inbuf.Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
+                vneg_inbuf.DialectCount = cpu_to_le16(3);
+                /* structure is big enough for 3 dialects */
+                inbuflen = sizeof(struct validate_negotiate_info_req);
+        } else {
+                /* otherwise specific dialect was requested */
+                vneg_inbuf.Dialects[0] =
+                        cpu_to_le16(tcon->ses->server->vals->protocol_id);
+                vneg_inbuf.DialectCount = cpu_to_le16(1);
+                /* structure is big enough for 3 dialects, sending only 1 */
+                inbuflen = sizeof(struct validate_negotiate_info_req) - 4;
+        }
 
         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
                 FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
@@ -1110,6 +1183,8 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
         while (sess_data->func)
                 sess_data->func(sess_data);
 
+        if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign))
+                cifs_dbg(VFS, "signing requested but authenticated as guest\n");
         rc = sess_data->result;
 out:
         kfree(sess_data);
@@ -1634,7 +1709,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
         struct cifs_tcon *tcon = oparms->tcon;
         struct cifs_ses *ses = tcon->ses;
         struct kvec iov[4];
-        struct kvec rsp_iov;
+        struct kvec rsp_iov = {NULL, 0};
         int resp_buftype;
         int uni_path_len;
         __le16 *copy_path = NULL;
@@ -1763,7 +1838,7 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
 
         if (rc != 0) {
                 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
-                if (err_buf)
+                if (err_buf && rsp)
                         *err_buf = kmemdup(rsp, get_rfc1002_length(rsp) + 4,
                                            GFP_KERNEL);
                 goto creat_exit;
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 393ed5f4e1b6..6c9653a130c8 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -716,7 +716,7 @@ struct validate_negotiate_info_req {
         __u8   Guid[SMB2_CLIENT_GUID_SIZE];
         __le16 SecurityMode;
         __le16 DialectCount;
-        __le16 Dialects[1]; /* dialect (someday maybe list) client asked for */
+        __le16 Dialects[3]; /* BB expand this if autonegotiate > 3 dialects */
 } __packed;
 
 struct validate_negotiate_info_rsp {
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 5fa2211e49ae..62cf812ed0e5 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -229,6 +229,7 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, bool is_async)
 {
         loff_t offset = dio->iocb->ki_pos;
         ssize_t transferred = 0;
+        int err;
 
         /*
          * AIO submission can race with bio completion to get here while
@@ -258,8 +259,22 @@ static ssize_t dio_complete(struct dio *dio, ssize_t ret, bool is_async)
         if (ret == 0)
                 ret = transferred;
 
+        /*
+         * Try again to invalidate clean pages which might have been cached by
+         * non-direct readahead, or faulted in by get_user_pages() if the source
+         * of the write was an mmap'ed region of the file we're writing.  Either
+         * one is a pretty crazy thing to do, so we don't support it 100%.  If
+         * this invalidation fails, tough, the write still worked...
+         */
+        if (ret > 0 && dio->op == REQ_OP_WRITE &&
+            dio->inode->i_mapping->nrpages) {
+                err = invalidate_inode_pages2_range(dio->inode->i_mapping,
+                                        offset >> PAGE_SHIFT,
+                                        (offset + ret - 1) >> PAGE_SHIFT);
+                WARN_ON_ONCE(err);
+        }
+
         if (dio->end_io) {
-                int err;
 
                 // XXX: ki_pos??
                 err = dio->end_io(dio->iocb, offset, ret, dio->private);
@@ -304,6 +319,7 @@ static void dio_bio_end_aio(struct bio *bio)
         struct dio *dio = bio->bi_private;
         unsigned long remaining;
         unsigned long flags;
+        bool defer_completion = false;
 
         /* cleanup the bio */
         dio_bio_complete(dio, bio);
@@ -315,7 +331,19 @@ static void dio_bio_end_aio(struct bio *bio)
         spin_unlock_irqrestore(&dio->bio_lock, flags);
 
         if (remaining == 0) {
-                if (dio->result && dio->defer_completion) {
+                /*
+                 * Defer completion when defer_completion is set or
+                 * when the inode has pages mapped and this is AIO write.
+                 * We need to invalidate those pages because there is a
+                 * chance they contain stale data in the case buffered IO
+                 * went in between AIO submission and completion into the
+                 * same region.
+                 */
+                if (dio->result)
+                        defer_completion = dio->defer_completion ||
+                                           (dio->op == REQ_OP_WRITE &&
+                                            dio->inode->i_mapping->nrpages);
+                if (defer_completion) {
                         INIT_WORK(&dio->complete_work, dio_aio_complete_work);
                         queue_work(dio->inode->i_sb->s_dio_done_wq,
                                    &dio->complete_work);
@@ -1210,10 +1238,19 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
          * For AIO O_(D)SYNC writes we need to defer completions to a workqueue
          * so that we can call ->fsync.
          */
-        if (dio->is_async && iov_iter_rw(iter) == WRITE &&
-            ((iocb->ki_filp->f_flags & O_DSYNC) ||
-             IS_SYNC(iocb->ki_filp->f_mapping->host))) {
-                retval = dio_set_defer_completion(dio);
+        if (dio->is_async && iov_iter_rw(iter) == WRITE) {
+                retval = 0;
+                if ((iocb->ki_filp->f_flags & O_DSYNC) ||
+                    IS_SYNC(iocb->ki_filp->f_mapping->host))
+                        retval = dio_set_defer_completion(dio);
+                else if (!dio->inode->i_sb->s_dio_done_wq) {
+                        /*
+                         * In case of AIO write racing with buffered read we
+                         * need to defer completion. We can't decide this now,
+                         * however the workqueue needs to be initialized here.
+                         */
+                        retval = sb_init_dio_done_wq(dio->inode->i_sb);
+                }
                 if (retval) {
                         /*
                          * We grab i_mutex only for reads so we don't have
diff --git a/fs/exec.c b/fs/exec.c
index ac34d9724684..5470d3c1892a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1410,7 +1410,7 @@ static void free_bprm(struct linux_binprm *bprm)
         kfree(bprm);
 }
 
-int bprm_change_interp(char *interp, struct linux_binprm *bprm)
+int bprm_change_interp(const char *interp, struct linux_binprm *bprm)
 {
         /* If a binfmt changed the interp, free it first. */
         if (bprm->interp != bprm->filename)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 0491da3b28c3..448a1119f0be 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -749,7 +749,7 @@ static void send_sigio_to_task(struct task_struct *p,
                          * specific si_codes.  In that case use SI_SIGIO instead
                          * to remove the ambiguity.
                          */
-                        if (sig_specific_sicodes(signum))
+                        if ((signum != SIGPOLL) && sig_specific_sicodes(signum))
                                 si.si_code = SI_SIGIO;
 
                         /* Make sure we are called with one of the POLL_*
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 98e845b7841b..11066d8647d2 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1945,13 +1945,9 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct gfs2_glock_iter *gi = seq->private;
         loff_t n = *pos;
-        int ret;
-
-        if (gi->last_pos <= *pos)
-                n = (*pos - gi->last_pos);
 
-        ret = rhashtable_walk_start(&gi->hti);
-        if (ret)
+        rhashtable_walk_enter(&gl_hash_table, &gi->hti);
+        if (rhashtable_walk_start(&gi->hti) != 0)
                 return NULL;
 
         do {
@@ -1959,6 +1955,7 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
         } while (gi->gl && n--);
 
         gi->last_pos = *pos;
+
         return gi->gl;
 }
 
@@ -1970,6 +1967,7 @@ static void *gfs2_glock_seq_next(struct seq_file *seq, void *iter_ptr,
         (*pos)++;
         gi->last_pos = *pos;
         gfs2_glock_iter_next(gi);
+
         return gi->gl;
 }
 
@@ -1980,6 +1978,7 @@ static void gfs2_glock_seq_stop(struct seq_file *seq, void *iter_ptr)
 
         gi->gl = NULL;
         rhashtable_walk_stop(&gi->hti);
+        rhashtable_walk_exit(&gi->hti);
 }
 
 static int gfs2_glock_seq_show(struct seq_file *seq, void *iter_ptr)
@@ -2042,12 +2041,10 @@ static int __gfs2_glocks_open(struct inode *inode, struct file *file,
                 struct gfs2_glock_iter *gi = seq->private;
 
                 gi->sdp = inode->i_private;
-                gi->last_pos = 0;
                 seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN);
                 if (seq->buf)
                         seq->size = GFS2_SEQ_GOODSIZE;
                 gi->gl = NULL;
-                rhashtable_walk_enter(&gl_hash_table, &gi->hti);
         }
         return ret;
 }
@@ -2063,7 +2060,6 @@ static int gfs2_glocks_release(struct inode *inode, struct file *file)
         struct gfs2_glock_iter *gi = seq->private;
 
         gi->gl = NULL;
-        rhashtable_walk_exit(&gi->hti);
         return seq_release_private(inode, file);
 }
 
diff --git a/fs/iomap.c b/fs/iomap.c
index 269b24a01f32..be61cf742b5e 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -713,8 +713,24 @@ struct iomap_dio {
 static ssize_t iomap_dio_complete(struct iomap_dio *dio)
 {
         struct kiocb *iocb = dio->iocb;
+        struct inode *inode = file_inode(iocb->ki_filp);
         ssize_t ret;
 
+        /*
+         * Try again to invalidate clean pages which might have been cached by
+         * non-direct readahead, or faulted in by get_user_pages() if the source
+         * of the write was an mmap'ed region of the file we're writing.  Either
+         * one is a pretty crazy thing to do, so we don't support it 100%.  If
+         * this invalidation fails, tough, the write still worked...
+         */
+        if (!dio->error &&
+            (dio->flags & IOMAP_DIO_WRITE) && inode->i_mapping->nrpages) {
+                ret = invalidate_inode_pages2_range(inode->i_mapping,
+                                iocb->ki_pos >> PAGE_SHIFT,
+                                (iocb->ki_pos + dio->size - 1) >> PAGE_SHIFT);
+                WARN_ON_ONCE(ret);
+        }
+
         if (dio->end_io) {
                 ret = dio->end_io(iocb,
                                 dio->error ? dio->error : dio->size,
@@ -993,6 +1009,13 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         WARN_ON_ONCE(ret);
         ret = 0;
 
+        if (iov_iter_rw(iter) == WRITE && !is_sync_kiocb(iocb) &&
+            !inode->i_sb->s_dio_done_wq) {
+                ret = sb_init_dio_done_wq(inode->i_sb);
+                if (ret < 0)
+                        goto out_free_dio;
+        }
+
         inode_dio_begin(inode);
 
         blk_start_plug(&plug);
@@ -1015,13 +1038,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         if (ret < 0)
                 iomap_dio_set_error(dio, ret);
 
-        if (ret >= 0 && iov_iter_rw(iter) == WRITE && !is_sync_kiocb(iocb) &&
-                        !inode->i_sb->s_dio_done_wq) {
-                ret = sb_init_dio_done_wq(inode->i_sb);
-                if (ret < 0)
-                        iomap_dio_set_error(dio, ret);
-        }
-
         if (!atomic_dec_and_test(&dio->ref)) {
                 if (!is_sync_kiocb(iocb))
                         return -EIOCBQUEUED;
@@ -1042,19 +1058,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
 
         ret = iomap_dio_complete(dio);
 
-        /*
-         * Try again to invalidate clean pages which might have been cached by
-         * non-direct readahead, or faulted in by get_user_pages() if the source
-         * of the write was an mmap'ed region of the file we're writing.  Either
-         * one is a pretty crazy thing to do, so we don't support it 100%.  If
-         * this invalidation fails, tough, the write still worked...
-         */
-        if (iov_iter_rw(iter) == WRITE) {
-                int err = invalidate_inode_pages2_range(mapping,
-                                start >> PAGE_SHIFT, end >> PAGE_SHIFT);
-                WARN_ON_ONCE(err);
-        }
-
         return ret;
 
 out_free_dio:
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index db692f554158..447a24d77b89 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -514,9 +514,11 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
         if (sbi->s_fmode != ISOFS_INVALID_MODE)
                 seq_printf(m, ",fmode=%o", sbi->s_fmode);
 
+#ifdef CONFIG_JOLIET
         if (sbi->s_nls_iocharset &&
             strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0)
                 seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset);
+#endif
         return 0;
 }
 
diff --git a/fs/namespace.c b/fs/namespace.c
index 54059b142d6b..3b601f115b6c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -468,7 +468,9 @@ static inline int may_write_real(struct file *file)
 
         /* File refers to upper, writable layer? */
         upperdentry = d_real(dentry, NULL, 0, D_REAL_UPPER);
-        if (upperdentry && file_inode(file) == d_inode(upperdentry))
+        if (upperdentry &&
+            (file_inode(file) == d_inode(upperdentry) ||
+             file_inode(file) == d_inode(dentry)))
                 return 0;
 
         /* Lower layer: can't write to real file, sorry... */
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index aad97b30d5e6..c441f9387a1b 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -561,10 +561,8 @@ static int ovl_do_copy_up(struct ovl_copy_up_ctx *c)
                 c->tmpfile = true;
                 err = ovl_copy_up_locked(c);
         } else {
-                err = -EIO;
-                if (lock_rename(c->workdir, c->destdir) != NULL) {
-                        pr_err("overlayfs: failed to lock workdir+upperdir\n");
-                } else {
+                err = ovl_lock_rename_workdir(c->workdir, c->destdir);
+                if (!err) {
                         err = ovl_copy_up_locked(c);
                         unlock_rename(c->workdir, c->destdir);
                 }
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 3309b1912241..cc961a3bd3bd 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -216,26 +216,6 @@ out_unlock:
         return err;
 }
 
-static int ovl_lock_rename_workdir(struct dentry *workdir,
-                                   struct dentry *upperdir)
-{
-        /* Workdir should not be the same as upperdir */
-        if (workdir == upperdir)
-                goto err;
-
-        /* Workdir should not be subdir of upperdir and vice versa */
-        if (lock_rename(workdir, upperdir) != NULL)
-                goto err_unlock;
-
-        return 0;
-
-err_unlock:
-        unlock_rename(workdir, upperdir);
-err:
-        pr_err("overlayfs: failed to lock workdir+upperdir\n");
-        return -EIO;
-}
-
 static struct dentry *ovl_clear_empty(struct dentry *dentry,
                                       struct list_head *list)
 {
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index c3addd1114f1..654bea1a5ac9 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -506,6 +506,7 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
 
         index = lookup_one_len_unlocked(name.name, ofs->indexdir, name.len);
         if (IS_ERR(index)) {
+                err = PTR_ERR(index);
                 pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n"
                                     "overlayfs: mount with '-o index=off' to disable inodes index.\n",
                                     d_inode(origin)->i_ino, name.len, name.name,
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index d4e8c1a08fb0..c706a6f99928 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -235,6 +235,7 @@ bool ovl_inuse_trylock(struct dentry *dentry);
 void ovl_inuse_unlock(struct dentry *dentry);
 int ovl_nlink_start(struct dentry *dentry, bool *locked);
 void ovl_nlink_end(struct dentry *dentry, bool locked);
+int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir);
 
 static inline bool ovl_is_impuredir(struct dentry *dentry)
 {
diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index 878a750986dd..25d9b5adcd42 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -37,6 +37,9 @@ struct ovl_fs {
         bool noxattr;
         /* sb common to all layers */
         struct super_block *same_sb;
+        /* Did we take the inuse lock? */
+        bool upperdir_locked;
+        bool workdir_locked;
 };
 
 /* private information held for every overlayfs dentry */
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 62e9b22a2077..0f85ee9c3268 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -988,6 +988,7 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
                          struct path *lowerstack, unsigned int numlower)
 {
         int err;
+        struct dentry *index = NULL;
         struct inode *dir = dentry->d_inode;
         struct path path = { .mnt = mnt, .dentry = dentry };
         LIST_HEAD(list);
@@ -1007,8 +1008,6 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
 
         inode_lock_nested(dir, I_MUTEX_PARENT);
         list_for_each_entry(p, &list, l_node) {
-                struct dentry *index;
-
                 if (p->name[0] == '.') {
                         if (p->len == 1)
                                 continue;
@@ -1018,6 +1017,7 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
                 index = lookup_one_len(p->name, dentry, p->len);
                 if (IS_ERR(index)) {
                         err = PTR_ERR(index);
+                        index = NULL;
                         break;
                 }
                 err = ovl_verify_index(index, lowerstack, numlower);
@@ -1029,7 +1029,9 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
                                 break;
                 }
                 dput(index);
+                index = NULL;
         }
+        dput(index);
         inode_unlock(dir);
 out:
         ovl_cache_free(&list);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index fd5ea4facc62..092d150643c1 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -211,9 +211,10 @@ static void ovl_put_super(struct super_block *sb)
 
         dput(ufs->indexdir);
         dput(ufs->workdir);
-        ovl_inuse_unlock(ufs->workbasedir);
+        if (ufs->workdir_locked)
+                ovl_inuse_unlock(ufs->workbasedir);
         dput(ufs->workbasedir);
-        if (ufs->upper_mnt)
+        if (ufs->upper_mnt && ufs->upperdir_locked)
                 ovl_inuse_unlock(ufs->upper_mnt->mnt_root);
         mntput(ufs->upper_mnt);
         for (i = 0; i < ufs->numlower; i++)
@@ -881,9 +882,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                         goto out_put_upperpath;
 
                 err = -EBUSY;
-                if (!ovl_inuse_trylock(upperpath.dentry)) {
-                        pr_err("overlayfs: upperdir is in-use by another mount\n");
+                if (ovl_inuse_trylock(upperpath.dentry)) {
+                        ufs->upperdir_locked = true;
+                } else if (ufs->config.index) {
+                        pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
                         goto out_put_upperpath;
+                } else {
+                        pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
                 }
 
                 err = ovl_mount_dir(ufs->config.workdir, &workpath);
@@ -901,9 +906,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                 }
 
                 err = -EBUSY;
-                if (!ovl_inuse_trylock(workpath.dentry)) {
-                        pr_err("overlayfs: workdir is in-use by another mount\n");
+                if (ovl_inuse_trylock(workpath.dentry)) {
+                        ufs->workdir_locked = true;
+                } else if (ufs->config.index) {
+                        pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n");
                         goto out_put_workpath;
+                } else {
+                        pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
                 }
 
                 ufs->workbasedir = workpath.dentry;
@@ -1156,11 +1165,13 @@ out_put_lowerpath:
 out_free_lowertmp:
         kfree(lowertmp);
 out_unlock_workdentry:
-        ovl_inuse_unlock(workpath.dentry);
+        if (ufs->workdir_locked)
+                ovl_inuse_unlock(workpath.dentry);
 out_put_workpath:
         path_put(&workpath);
 out_unlock_upperdentry:
-        ovl_inuse_unlock(upperpath.dentry);
+        if (ufs->upperdir_locked)
+                ovl_inuse_unlock(upperpath.dentry);
 out_put_upperpath:
         path_put(&upperpath);
 out_free_config:
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 117794582f9f..b9b239fa5cfd 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -430,7 +430,7 @@ void ovl_inuse_unlock(struct dentry *dentry)
         }
 }
 
-/* Called must hold OVL_I(inode)->oi_lock */
+/* Caller must hold OVL_I(inode)->lock */
 static void ovl_cleanup_index(struct dentry *dentry)
 {
         struct inode *dir = ovl_indexdir(dentry->d_sb)->d_inode;
@@ -469,6 +469,9 @@ static void ovl_cleanup_index(struct dentry *dentry)
         err = PTR_ERR(index);
         if (!IS_ERR(index))
                 err = ovl_cleanup(dir, index);
+        else
+                index = NULL;
+
         inode_unlock(dir);
         if (err)
                 goto fail;
@@ -557,3 +560,22 @@ void ovl_nlink_end(struct dentry *dentry, bool locked)
                 mutex_unlock(&OVL_I(d_inode(dentry))->lock);
         }
 }
+
+int ovl_lock_rename_workdir(struct dentry *workdir, struct dentry *upperdir)
+{
+        /* Workdir should not be the same as upperdir */
+        if (workdir == upperdir)
+                goto err;
+
+        /* Workdir should not be subdir of upperdir and vice versa */
+        if (lock_rename(workdir, upperdir) != NULL)
+                goto err_unlock;
+
+        return 0;
+
+err_unlock:
+        unlock_rename(workdir, upperdir);
+err:
+        pr_err("overlayfs: failed to lock workdir+upperdir\n");
+        return -EIO;
+}
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 88c355574aa0..77a8eacbe032 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -62,6 +62,7 @@
 #include <linux/mman.h>
 #include <linux/sched/mm.h>
 #include <linux/sched/numa_balancing.h>
+#include <linux/sched/task_stack.h>
 #include <linux/sched/task.h>
 #include <linux/sched/cputime.h>
 #include <linux/proc_fs.h>
@@ -118,30 +119,25 @@ static inline void task_name(struct seq_file *m, struct task_struct *p)
  * simple bit tests.
  */
 static const char * const task_state_array[] = {
-        "R (running)",          /*   0 */
-        "S (sleeping)",         /*   1 */
-        "D (disk sleep)",       /*   2 */
-        "T (stopped)",          /*   4 */
-        "t (tracing stop)",     /*   8 */
-        "X (dead)",             /*  16 */
-        "Z (zombie)",           /*  32 */
+
+        /* states in TASK_REPORT: */
+        "R (running)",          /* 0x00 */
+        "S (sleeping)",         /* 0x01 */
+        "D (disk sleep)",       /* 0x02 */
+        "T (stopped)",          /* 0x04 */
+        "t (tracing stop)",     /* 0x08 */
+        "X (dead)",             /* 0x10 */
+        "Z (zombie)",           /* 0x20 */
+        "P (parked)",           /* 0x40 */
+
+        /* states beyond TASK_REPORT: */
+        "I (idle)",             /* 0x80 */
 };
 
 static inline const char *get_task_state(struct task_struct *tsk)
 {
-        unsigned int state = (tsk->state | tsk->exit_state) & TASK_REPORT;
-
-        /*
-         * Parked tasks do not run; they sit in __kthread_parkme().
-         * Without this check, we would report them as running, which is
-         * clearly wrong, so we report them as sleeping instead.
-         */
-        if (tsk->state == TASK_PARKED)
-                state = TASK_INTERRUPTIBLE;
-
-        BUILD_BUG_ON(1 + ilog2(TASK_REPORT) != ARRAY_SIZE(task_state_array)-1);
-
-        return task_state_array[fls(state)];
+        BUILD_BUG_ON(1 + ilog2(TASK_REPORT_MAX) != ARRAY_SIZE(task_state_array));
+        return task_state_array[__get_task_state(tsk)];
 }
 
 static inline int get_task_umask(struct task_struct *tsk)
@@ -421,7 +417,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                  * esp and eip are intentionally zeroed out.  There is no
                  * non-racy way to read them without freezing the task.
                  * Programs that need reliable values can use ptrace(2).
+                 *
+                 * The only exception is if the task is core dumping because
+                 * a program is not able to use ptrace(2) in that case. It is
+                 * safe because the task has stopped executing permanently.
                  */
+                if (permitted && (task->flags & PF_DUMPCORE)) {
+                        eip = KSTK_EIP(task);
+                        esp = KSTK_ESP(task);
+                }
         }
 
         get_task_comm(tcomm, task);
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8381db9db6d9..50b0556a124f 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1980,7 +1980,9 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
                 ret = dquot_add_space(transfer_to[cnt], cur_space, rsv_space, 0,
                                       &warn_to[cnt]);
                 if (ret) {
+                        spin_lock(&transfer_to[cnt]->dq_dqb_lock);
                         dquot_decr_inodes(transfer_to[cnt], inode_usage);
+                        spin_unlock(&transfer_to[cnt]->dq_dqb_lock);
                         goto over_quota;
                 }
         }
diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
index c0187cda2c1e..a73e5b34db41 100644
--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -328,12 +328,16 @@ static int v2_write_dquot(struct dquot *dquot)
         if (!dquot->dq_off) {
                 alloc = true;
                 down_write(&dqopt->dqio_sem);
+        } else {
+                down_read(&dqopt->dqio_sem);
         }
         ret = qtree_write_dquot(
                         sb_dqinfo(dquot->dq_sb, dquot->dq_id.type)->dqi_priv,
                         dquot);
         if (alloc)
                 up_write(&dqopt->dqio_sem);
+        else
+                up_read(&dqopt->dqio_sem);
         return ret;
 }
 
diff --git a/fs/read_write.c b/fs/read_write.c
index a2b9a47235c5..f0d4b16873e8 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -112,7 +112,7 @@ generic_file_llseek_size(struct file *file, loff_t offset, int whence,
                  * In the generic case the entire file is data, so as long as
                  * offset isn't at the end of the file then the offset is data.
                  */
-                if (offset >= eof)
+                if ((unsigned long long)offset >= eof)
                         return -ENXIO;
                 break;
         case SEEK_HOLE:
@@ -120,7 +120,7 @@ generic_file_llseek_size(struct file *file, loff_t offset, int whence,
                  * There is a virtual hole at the end of the file, so as long as
                  * offset isn't i_size or larger, return i_size.
                  */
-                if (offset >= eof)
+                if ((unsigned long long)offset >= eof)
                         return -ENXIO;
                 offset = eof;
                 break;
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ef4b48d1ea42..1c713fd5b3e6 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -588,6 +588,12 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                         break;
                 if (ACCESS_ONCE(ctx->released) ||
                     fatal_signal_pending(current)) {
+                        /*
+                         * &ewq->wq may be queued in fork_event, but
+                         * __remove_wait_queue ignores the head
+                         * parameter. It would be a problem if it
+                         * didn't.
+                         */
                         __remove_wait_queue(&ctx->event_wqh, &ewq->wq);
                         if (ewq->msg.event == UFFD_EVENT_FORK) {
                                 struct userfaultfd_ctx *new;
@@ -1061,6 +1067,12 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
                                         (unsigned long)
                                         uwq->msg.arg.reserved.reserved1;
                                 list_move(&uwq->wq.entry, &fork_event);
+                                /*
+                                 * fork_nctx can be freed as soon as
+                                 * we drop the lock, unless we take a
+                                 * reference on it.
+                                 */
+                                userfaultfd_ctx_get(fork_nctx);
                                 spin_unlock(&ctx->event_wqh.lock);
                                 ret = 0;
                                 break;
@@ -1091,19 +1103,53 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
 
         if (!ret && msg->event == UFFD_EVENT_FORK) {
                 ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+                spin_lock(&ctx->event_wqh.lock);
+                if (!list_empty(&fork_event)) {
+                        /*
+                         * The fork thread didn't abort, so we can
+                         * drop the temporary refcount.
+                         */
+                        userfaultfd_ctx_put(fork_nctx);
+
+                        uwq = list_first_entry(&fork_event,
+                                               typeof(*uwq),
+                                               wq.entry);
+                        /*
+                         * If fork_event list wasn't empty and in turn
+                         * the event wasn't already released by fork
+                         * (the event is allocated on fork kernel
+                         * stack), put the event back to its place in
+                         * the event_wq. fork_event head will be freed
+                         * as soon as we return so the event cannot
+                         * stay queued there no matter the current
+                         * "ret" value.
+                         */
+                        list_del(&uwq->wq.entry);
+                        __add_wait_queue(&ctx->event_wqh, &uwq->wq);
 
-                if (!ret) {
-                        spin_lock(&ctx->event_wqh.lock);
-                        if (!list_empty(&fork_event)) {
-                                uwq = list_first_entry(&fork_event,
-                                                       typeof(*uwq),
-                                                       wq.entry);
-                                list_del(&uwq->wq.entry);
-                                __add_wait_queue(&ctx->event_wqh, &uwq->wq);
+                        /*
+                         * Leave the event in the waitqueue and report
+                         * error to userland if we failed to resolve
+                         * the userfault fork.
+                         */
+                        if (likely(!ret))
                                 userfaultfd_event_complete(ctx, uwq);
-                        }
-                        spin_unlock(&ctx->event_wqh.lock);
+                } else {
+                        /*
+                         * Here the fork thread aborted and the
+                         * refcount from the fork thread on fork_nctx
+                         * has already been released. We still hold
+                         * the reference we took before releasing the
+                         * lock above. If resolve_userfault_fork
+                         * failed we've to drop it because the
+                         * fork_nctx has to be freed in such case. If
+                         * it succeeded we'll hold it because the new
+                         * uffd references it.
+                         */
+                        if (ret)
+                                userfaultfd_ctx_put(fork_nctx);
                 }
+                spin_unlock(&ctx->event_wqh.lock);
         }
 
         return ret;
diff --git a/fs/xattr.c b/fs/xattr.c
index 4424f7fecf14..61cd28ba25f3 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -250,7 +250,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value,
         }
         memcpy(value, buffer, len);
 out:
-        security_release_secctx(buffer, len);
+        kfree(buffer);
 out_noalloc:
         return len;
 }
diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
index b008ff3250eb..df3e600835e8 100644
--- a/fs/xfs/libxfs/xfs_ag_resv.c
+++ b/fs/xfs/libxfs/xfs_ag_resv.c
@@ -156,7 +156,8 @@ __xfs_ag_resv_free(
         trace_xfs_ag_resv_free(pag, type, 0);
 
         resv = xfs_perag_resv(pag, type);
-        pag->pag_mount->m_ag_max_usable += resv->ar_asked;
+        if (pag->pag_agno == 0)
+                pag->pag_mount->m_ag_max_usable += resv->ar_asked;
         /*
          * AGFL blocks are always considered "free", so whatever
          * was reserved at mount time must be given back at umount.
@@ -216,7 +217,14 @@ __xfs_ag_resv_init(
                 return error;
         }
 
-        mp->m_ag_max_usable -= ask;
+        /*
+         * Reduce the maximum per-AG allocation length by however much we're
+         * trying to reserve for an AG.  Since this is a filesystem-wide
+         * counter, we only make the adjustment for AG 0.  This assumes that
+         * there aren't any AGs hungrier for per-AG reservation than AG 0.
+         */
+        if (pag->pag_agno == 0)
+                mp->m_ag_max_usable -= ask;
 
         resv = xfs_perag_resv(pag, type);
         resv->ar_asked = ask;
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 459f4b4f08fe..044a363119be 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -49,7 +49,6 @@
 #include "xfs_rmap.h"
 #include "xfs_ag_resv.h"
 #include "xfs_refcount.h"
-#include "xfs_rmap_btree.h"
 #include "xfs_icache.h"
 
 
@@ -192,12 +191,8 @@ xfs_bmap_worst_indlen(
         int             maxrecs;        /* maximum record count at this level */
         xfs_mount_t     *mp;            /* mount structure */
         xfs_filblks_t   rval;           /* return value */
-        xfs_filblks_t   orig_len;
 
         mp = ip->i_mount;
-
-        /* Calculate the worst-case size of the bmbt. */
-        orig_len = len;
         maxrecs = mp->m_bmap_dmxr[0];
         for (level = 0, rval = 0;
              level < XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK);
@@ -205,20 +200,12 @@ xfs_bmap_worst_indlen(
                 len += maxrecs - 1;
                 do_div(len, maxrecs);
                 rval += len;
-                if (len == 1) {
-                        rval += XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) -
+                if (len == 1)
+                        return rval + XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) -
                                 level - 1;
-                        break;
-                }
                 if (level == 0)
                         maxrecs = mp->m_bmap_dmxr[1];
         }
-
-        /* Calculate the worst-case size of the rmapbt. */
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
-                rval += 1 + xfs_rmapbt_calc_size(mp, orig_len) +
-                                mp->m_rmap_maxlevels;
-
         return rval;
 }
 
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index 29172609f2a3..f18e5932aec4 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -343,7 +343,8 @@ xfs_end_io(
                 error = xfs_reflink_end_cow(ip, offset, size);
                 break;
         case XFS_IO_UNWRITTEN:
-                error = xfs_iomap_write_unwritten(ip, offset, size);
+                /* writeback should never update isize */
+                error = xfs_iomap_write_unwritten(ip, offset, size, false);
                 break;
         default:
                 ASSERT(!xfs_ioend_is_append(ioend) || ioend->io_append_trans);
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index cd9a5400ba4f..e9db7fc95b70 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1459,7 +1459,19 @@ xfs_shift_file_space(
                 return error;
 
         /*
-         * The extent shiting code works on extent granularity. So, if
+         * Clean out anything hanging around in the cow fork now that
+         * we've flushed all the dirty data out to disk to avoid having
+         * CoW extents at the wrong offsets.
+         */
+        if (xfs_is_reflink_inode(ip)) {
+                error = xfs_reflink_cancel_cow_range(ip, offset, NULLFILEOFF,
+                                true);
+                if (error)
+                        return error;
+        }
+
+        /*
+         * The extent shifting code works on extent granularity. So, if
          * stop_fsb is not the starting block of extent, we need to split
          * the extent at stop_fsb.
          */
@@ -2110,11 +2122,31 @@ xfs_swap_extents(
                 ip->i_d.di_flags2 |= tip->i_d.di_flags2 & XFS_DIFLAG2_REFLINK;
                 tip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
                 tip->i_d.di_flags2 |= f & XFS_DIFLAG2_REFLINK;
+        }
+
+        /* Swap the cow forks. */
+        if (xfs_sb_version_hasreflink(&mp->m_sb)) {
+                xfs_extnum_t    extnum;
+
+                ASSERT(ip->i_cformat == XFS_DINODE_FMT_EXTENTS);
+                ASSERT(tip->i_cformat == XFS_DINODE_FMT_EXTENTS);
+
+                extnum = ip->i_cnextents;
+                ip->i_cnextents = tip->i_cnextents;
+                tip->i_cnextents = extnum;
+
                 cowfp = ip->i_cowfp;
                 ip->i_cowfp = tip->i_cowfp;
                 tip->i_cowfp = cowfp;
-                xfs_inode_set_cowblocks_tag(ip);
-                xfs_inode_set_cowblocks_tag(tip);
+
+                if (ip->i_cowfp && ip->i_cnextents)
+                        xfs_inode_set_cowblocks_tag(ip);
+                else
+                        xfs_inode_clear_cowblocks_tag(ip);
+                if (tip->i_cowfp && tip->i_cnextents)
+                        xfs_inode_set_cowblocks_tag(tip);
+                else
+                        xfs_inode_clear_cowblocks_tag(tip);
         }
 
         xfs_trans_log_inode(tp, ip,  src_log_flags);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index da14658da310..2f97c12ca75e 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1258,8 +1258,6 @@ xfs_buf_ioapply_map(
         int             size;
         int             offset;
 
-        total_nr_pages = bp->b_page_count;
-
         /* skip the pages in the buffer before the start offset */
         page_index = 0;
         offset = *buf_offset;
diff --git a/fs/xfs/xfs_error.c b/fs/xfs/xfs_error.c
index bd786a9ac2c3..eaf86f55b7f2 100644
--- a/fs/xfs/xfs_error.c
+++ b/fs/xfs/xfs_error.c
@@ -347,7 +347,7 @@ xfs_verifier_error(
 {
         struct xfs_mount *mp = bp->b_target->bt_mount;
 
-        xfs_alert(mp, "Metadata %s detected at %pF, %s block 0x%llx",
+        xfs_alert(mp, "Metadata %s detected at %pS, %s block 0x%llx",
                   bp->b_error == -EFSBADCRC ? "CRC error" : "corruption",
                   __return_address, bp->b_ops->name, bp->b_bn);
 
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ebdd0bd2b261..309e26c9dddb 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -58,7 +58,7 @@ xfs_zero_range(
         xfs_off_t               count,
         bool                    *did_zero)
 {
-        return iomap_zero_range(VFS_I(ip), pos, count, NULL, &xfs_iomap_ops);
+        return iomap_zero_range(VFS_I(ip), pos, count, did_zero, &xfs_iomap_ops);
 }
 
 int
@@ -377,8 +377,6 @@ restart:
          */
         spin_lock(&ip->i_flags_lock);
         if (iocb->ki_pos > i_size_read(inode)) {
-                bool    zero = false;
-
                 spin_unlock(&ip->i_flags_lock);
                 if (!drained_dio) {
                         if (*iolock == XFS_IOLOCK_SHARED) {
@@ -399,7 +397,7 @@ restart:
                         drained_dio = true;
                         goto restart;
                 }
-                error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), &zero);
+                error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), NULL);
                 if (error)
                         return error;
         } else
@@ -436,7 +434,6 @@ xfs_dio_write_end_io(
         struct inode            *inode = file_inode(iocb->ki_filp);
         struct xfs_inode        *ip = XFS_I(inode);
         loff_t                  offset = iocb->ki_pos;
-        bool                    update_size = false;
         int                     error = 0;
 
         trace_xfs_end_io_direct_write(ip, offset, size);
@@ -447,6 +444,21 @@ xfs_dio_write_end_io(
         if (size <= 0)
                 return size;
 
+        if (flags & IOMAP_DIO_COW) {
+                error = xfs_reflink_end_cow(ip, offset, size);
+                if (error)
+                        return error;
+        }
+
+        /*
+         * Unwritten conversion updates the in-core isize after extent
+         * conversion but before updating the on-disk size. Updating isize any
+         * earlier allows a racing dio read to find unwritten extents before
+         * they are converted.
+         */
+        if (flags & IOMAP_DIO_UNWRITTEN)
+                return xfs_iomap_write_unwritten(ip, offset, size, true);
+
         /*
          * We need to update the in-core inode size here so that we don't end up
          * with the on-disk inode size being outside the in-core inode size. We
@@ -461,20 +473,11 @@ xfs_dio_write_end_io(
         spin_lock(&ip->i_flags_lock);
         if (offset + size > i_size_read(inode)) {
                 i_size_write(inode, offset + size);
-                update_size = true;
-        }
-        spin_unlock(&ip->i_flags_lock);
-
-        if (flags & IOMAP_DIO_COW) {
-                error = xfs_reflink_end_cow(ip, offset, size);
-                if (error)
-                        return error;
-        }
-
-        if (flags & IOMAP_DIO_UNWRITTEN)
-                error = xfs_iomap_write_unwritten(ip, offset, size);
-        else if (update_size)
+                spin_unlock(&ip->i_flags_lock);
                 error = xfs_setfilesize(ip, offset, size);
+        } else {
+                spin_unlock(&ip->i_flags_lock);
+        }
 
         return error;
 }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 5599dda4727a..4ec5b7f45401 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1624,10 +1624,12 @@ xfs_itruncate_extents(
                 goto out;
 
         /*
-         * Clear the reflink flag if we truncated everything.
+         * Clear the reflink flag if there are no data fork blocks and
+         * there are no extents staged in the cow fork.
          */
-        if (ip->i_d.di_nblocks == 0 && xfs_is_reflink_inode(ip)) {
-                ip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
+        if (xfs_is_reflink_inode(ip) && ip->i_cnextents == 0) {
+                if (ip->i_d.di_nblocks == 0)
+                        ip->i_d.di_flags2 &= ~XFS_DIFLAG2_REFLINK;
                 xfs_inode_clear_cowblocks_tag(ip);
         }
 
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 6d0f74ec31e8..a705f34b58fa 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -745,7 +745,7 @@ xfs_iflush_done(
                  */
                 iip = INODE_ITEM(blip);
                 if ((iip->ili_logged && blip->li_lsn == iip->ili_flush_lsn) ||
-                    lip->li_flags & XFS_LI_FAILED)
+                    (blip->li_flags & XFS_LI_FAILED))
                         need_ail++;
 
                 blip = next;
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 5049e8ab6e30..aa75389be8cf 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1088,6 +1088,7 @@ xfs_ioctl_setattr_dax_invalidate(
         int                     *join_flags)
 {
         struct inode            *inode = VFS_I(ip);
+        struct super_block      *sb = inode->i_sb;
         int                     error;
 
         *join_flags = 0;
@@ -1100,7 +1101,7 @@ xfs_ioctl_setattr_dax_invalidate(
         if (fa->fsx_xflags & FS_XFLAG_DAX) {
                 if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)))
                         return -EINVAL;
-                if (ip->i_mount->m_sb.sb_blocksize != PAGE_SIZE)
+                if (bdev_dax_supported(sb, sb->s_blocksize) < 0)
                         return -EINVAL;
         }
 
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index a1909bc064e9..f179bdf1644d 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -829,7 +829,8 @@ int
 xfs_iomap_write_unwritten(
         xfs_inode_t     *ip,
         xfs_off_t       offset,
-        xfs_off_t       count)
+        xfs_off_t       count,
+        bool            update_isize)
 {
         xfs_mount_t     *mp = ip->i_mount;
         xfs_fileoff_t   offset_fsb;
@@ -840,6 +841,7 @@ xfs_iomap_write_unwritten(
         xfs_trans_t     *tp;
         xfs_bmbt_irec_t imap;
         struct xfs_defer_ops dfops;
+        struct inode    *inode = VFS_I(ip);
         xfs_fsize_t     i_size;
         uint            resblks;
         int             error;
@@ -899,7 +901,8 @@ xfs_iomap_write_unwritten(
                 i_size = XFS_FSB_TO_B(mp, offset_fsb + count_fsb);
                 if (i_size > offset + count)
                         i_size = offset + count;
-
+                if (update_isize && i_size > i_size_read(inode))
+                        i_size_write(inode, i_size);
                 i_size = xfs_new_eof(ip, i_size);
                 if (i_size) {
                         ip->i_d.di_size = i_size;
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index 00db3ecea084..ee535065c5d0 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -27,7 +27,7 @@ int xfs_iomap_write_direct(struct xfs_inode *, xfs_off_t, size_t,
                         struct xfs_bmbt_irec *, int);
 int xfs_iomap_write_allocate(struct xfs_inode *, int, xfs_off_t,
                         struct xfs_bmbt_irec *);
-int xfs_iomap_write_unwritten(struct xfs_inode *, xfs_off_t, xfs_off_t);
+int xfs_iomap_write_unwritten(struct xfs_inode *, xfs_off_t, xfs_off_t, bool);
 
 void xfs_bmbt_to_iomap(struct xfs_inode *, struct iomap *,
                 struct xfs_bmbt_irec *);
diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c
index 2f2dc3c09ad0..4246876df7b7 100644
--- a/fs/xfs/xfs_pnfs.c
+++ b/fs/xfs/xfs_pnfs.c
@@ -274,7 +274,7 @@ xfs_fs_commit_blocks(
                                         (end - 1) >> PAGE_SHIFT);
                 WARN_ON_ONCE(error);
 
-                error = xfs_iomap_write_unwritten(ip, start, length);
+                error = xfs_iomap_write_unwritten(ip, start, length, false);
                 if (error)
                         goto out_drop_iolock;
         }
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index 3246815c24d6..37e603bf1591 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -736,7 +736,13 @@ xfs_reflink_end_cow(
         /* If there is a hole at end_fsb - 1 go to the previous extent */
         if (!xfs_iext_lookup_extent(ip, ifp, end_fsb - 1, &idx, &got) ||
             got.br_startoff > end_fsb) {
-                ASSERT(idx > 0);
+                /*
+                 * In case of racing, overlapping AIO writes no COW extents
+                 * might be left by the time I/O completes for the loser of
+                 * the race.  In that case we are done.
+                 */
+                if (idx <= 0)
+                        goto out_cancel;
                 xfs_iext_get_extent(ifp, --idx, &got);
         }
 
@@ -809,6 +815,7 @@ next_extent:
 
 out_defer:
         xfs_defer_cancel(&dfops);
+out_cancel:
         xfs_trans_cancel(tp);
         xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out:
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index c996f4ae4a5f..584cf2d573ba 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1654,6 +1654,16 @@ xfs_fs_fill_super(
                 "DAX and reflink have not been tested together!");
         }
 
+        if (mp->m_flags & XFS_MOUNT_DISCARD) {
+                struct request_queue *q = bdev_get_queue(sb->s_bdev);
+
+                if (!blk_queue_discard(q)) {
+                        xfs_warn(mp, "mounting with \"discard\" option, but "
+                                        "the device does not support discard");
+                        mp->m_flags &= ~XFS_MOUNT_DISCARD;
+                }
+        }
+
         if (xfs_sb_version_hasrmapbt(&mp->m_sb)) {
                 if (mp->m_sb.sb_rblocks) {
                         xfs_alert(mp,
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index dedf9d789166..fa1505292f6c 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -399,17 +399,12 @@ extern const struct fwnode_operations acpi_device_fwnode_ops;
 extern const struct fwnode_operations acpi_data_fwnode_ops;
 extern const struct fwnode_operations acpi_static_fwnode_ops;
 
+bool is_acpi_device_node(const struct fwnode_handle *fwnode);
+bool is_acpi_data_node(const struct fwnode_handle *fwnode);
+
 static inline bool is_acpi_node(const struct fwnode_handle *fwnode)
 {
-        return !IS_ERR_OR_NULL(fwnode) &&
-                (fwnode->ops == &acpi_device_fwnode_ops
-                 || fwnode->ops == &acpi_data_fwnode_ops);
-}
-
-static inline bool is_acpi_device_node(const struct fwnode_handle *fwnode)
-{
-        return !IS_ERR_OR_NULL(fwnode) &&
-                fwnode->ops == &acpi_device_fwnode_ops;
+        return (is_acpi_device_node(fwnode) || is_acpi_data_node(fwnode));
 }
 
 #define to_acpi_device_node(__fwnode)                                   \
@@ -422,11 +417,6 @@ static inline bool is_acpi_device_node(const struct fwnode_handle *fwnode)
                         NULL;                                           \
         })
 
-static inline bool is_acpi_data_node(const struct fwnode_handle *fwnode)
-{
-        return !IS_ERR_OR_NULL(fwnode) && fwnode->ops == &acpi_data_fwnode_ops;
-}
-
 #define to_acpi_data_node(__fwnode)                                     \
         ({                                                              \
                 typeof(__fwnode) __to_acpi_data_node_fwnode = __fwnode; \
diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 0504ef8f3aa3..976f8ac26665 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -115,15 +115,35 @@ do {									\
         (__ret);                                                        \
 })
 
-#define this_cpu_generic_read(pcp)                                      \
+#define __this_cpu_generic_read_nopreempt(pcp)                          \
 ({                                                                      \
         typeof(pcp) __ret;                                              \
         preempt_disable_notrace();                                      \
-        __ret = raw_cpu_generic_read(pcp);                              \
+        __ret = READ_ONCE(*raw_cpu_ptr(&(pcp)));                        \
         preempt_enable_notrace();                                       \
         __ret;                                                          \
 })
 
+#define __this_cpu_generic_read_noirq(pcp)                              \
+({                                                                      \
+        typeof(pcp) __ret;                                              \
+        unsigned long __flags;                                          \
+        raw_local_irq_save(__flags);                                    \
+        __ret = raw_cpu_generic_read(pcp);                              \
+        raw_local_irq_restore(__flags);                                 \
+        __ret;                                                          \
+})
+
+#define this_cpu_generic_read(pcp)                                      \
+({                                                                      \
+        typeof(pcp) __ret;                                              \
+        if (__native_word(pcp))                                         \
+                __ret = __this_cpu_generic_read_nopreempt(pcp);         \
+        else                                                            \
+                __ret = __this_cpu_generic_read_noirq(pcp);             \
+        __ret;                                                          \
+})
+
 #define this_cpu_generic_to_op(pcp, val, op)                            \
 do {                                                                    \
         unsigned long __flags;                                          \
diff --git a/include/dt-bindings/reset/snps,hsdk-reset.h b/include/dt-bindings/reset/snps,hsdk-reset.h
new file mode 100644
index 000000000000..e1a643e4bc91
--- /dev/null
+++ b/include/dt-bindings/reset/snps,hsdk-reset.h
@@ -0,0 +1,17 @@
+/**
+ * This header provides index for the HSDK reset controller.
+ */
+#ifndef _DT_BINDINGS_RESET_CONTROLLER_SNPS_HSDK
+#define _DT_BINDINGS_RESET_CONTROLLER_SNPS_HSDK
+
+#define HSDK_APB_RESET  0
+#define HSDK_AXI_RESET  1
+#define HSDK_ETH_RESET  2
+#define HSDK_USB_RESET  3
+#define HSDK_SDIO_RESET 4
+#define HSDK_HDMI_RESET 5
+#define HSDK_GFX_RESET  6
+#define HSDK_DMAC_RESET 7
+#define HSDK_EBI_RESET  8
+
+#endif /*_DT_BINDINGS_RESET_CONTROLLER_SNPS_HSDK*/
diff --git a/include/dt-bindings/reset/snps,hsdk-v1-reset.h b/include/dt-bindings/reset/snps,hsdk-v1-reset.h
deleted file mode 100644
index d898c89b7123..000000000000
--- a/include/dt-bindings/reset/snps,hsdk-v1-reset.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * This header provides index for the HSDK v1 reset controller.
- */
-#ifndef _DT_BINDINGS_RESET_CONTROLLER_HSDK_V1
-#define _DT_BINDINGS_RESET_CONTROLLER_HSDK_V1
-
-#define HSDK_V1_APB_RESET       0
-#define HSDK_V1_AXI_RESET       1
-#define HSDK_V1_ETH_RESET       2
-#define HSDK_V1_USB_RESET       3
-#define HSDK_V1_SDIO_RESET      4
-#define HSDK_V1_HDMI_RESET      5
-#define HSDK_V1_GFX_RESET       6
-#define HSDK_V1_DMAC_RESET      7
-#define HSDK_V1_EBI_RESET       8
-
-#endif /*_DT_BINDINGS_RESET_CONTROLLER_HSDK_V1*/
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 74d4d4e8e3db..cb708eb8accc 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -314,11 +314,7 @@ void audit_core_dumps(long signr);
 
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 {
-        if (!audit_enabled)
-                return;
-
-        /* Force a record to be reported if a signal was delivered. */
-        if (signr || unlikely(!audit_dummy_context()))
+        if (audit_enabled && unlikely(!audit_dummy_context()))
                 __audit_seccomp(syscall, signr, code);
 }
 
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index fb44d6180ca0..18d05b5491f3 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -131,7 +131,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
                            int executable_stack);
 extern int transfer_args_to_stack(struct linux_binprm *bprm,
                                   unsigned long *sp_location);
-extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
+extern int bprm_change_interp(const char *interp, struct linux_binprm *bprm);
 extern int copy_strings_kernel(int argc, const char *const *argv,
                                struct linux_binprm *bprm);
 extern int prepare_bprm_creds(struct linux_binprm *bprm);
diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
index 8b9d6fff002d..f2deb71958b2 100644
--- a/include/linux/bitfield.h
+++ b/include/linux/bitfield.h
@@ -92,7 +92,7 @@
 /**
  * FIELD_GET() - extract a bitfield element
  * @_mask: shifted mask defining the field's length and position
- * @_reg:  32bit value of entire bitfield
+ * @_reg:  value of entire bitfield
  *
  * FIELD_GET() extracts the field specified by @_mask from the
  * bitfield passed in as @_reg by masking and shifting it down.
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 460294bb0fa5..02fa42d24b52 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -551,6 +551,7 @@ struct request_queue {
         int                     node;
 #ifdef CONFIG_BLK_DEV_IO_TRACE
         struct blk_trace        *blk_trace;
+        struct mutex            blk_trace_mutex;
 #endif
         /*
          * for flush operations
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index f24bfb2b9a2d..6d508767e144 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -3,8 +3,27 @@
 
 #include <linux/types.h>
 
+/*
+ * CPU-up                       CPU-down
+ *
+ * BP           AP              BP              AP
+ *
+ * OFFLINE                      OFFLINE
+ *   |                            ^
+ *   v                            |
+ * BRINGUP_CPU->AP_OFFLINE      BRINGUP_CPU  <- AP_IDLE_DEAD (idle thread/play_dead)
+ *                |                             AP_OFFLINE
+ *                v (IRQ-off)     ,---------------^
+ *              AP_ONLNE          | (stop_machine)
+ *                |             TEARDOWN_CPU <- AP_ONLINE_IDLE
+ *                |                               ^
+ *                v                               |
+ *              AP_ACTIVE                       AP_ACTIVE
+ */
+
 enum cpuhp_state {
-        CPUHP_OFFLINE,
+        CPUHP_INVALID = -1,
+        CPUHP_OFFLINE = 0,
         CPUHP_CREATE_THREADS,
         CPUHP_PERF_PREPARE,
         CPUHP_PERF_X86_PREPARE,
diff --git a/include/linux/device.h b/include/linux/device.h
index c6f27207dbe8..66fe271c2544 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -307,8 +307,6 @@ struct driver_attribute {
                          size_t count);
 };
 
-#define DRIVER_ATTR(_name, _mode, _show, _store) \
-        struct driver_attribute driver_attr_##_name = __ATTR(_name, _mode, _show, _store)
 #define DRIVER_ATTR_RW(_name) \
         struct driver_attribute driver_attr_##_name = __ATTR_RW(_name)
 #define DRIVER_ATTR_RO(_name) \
@@ -838,7 +836,7 @@ struct dev_links_info {
  * @driver_data: Private pointer for driver specific info.
  * @links:      Links to suppliers and consumers of this device.
  * @power:      For device power management.
- *              See Documentation/power/admin-guide/devices.rst for details.
+ *              See Documentation/driver-api/pm/devices.rst for details.
  * @pm_domain:  Provide callbacks that are executed during system suspend,
  *              hibernation, system resume and during runtime PM transitions
  *              along with subsystem-level and driver-level callbacks.
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 339e73742e73..13dab191a23e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -403,7 +403,7 @@ struct address_space {
         unsigned long           flags;          /* error bits */
         spinlock_t              private_lock;   /* for use by the address_space */
         gfp_t                   gfp_mask;       /* implicit gfp mask for allocations */
-        struct list_head        private_list;   /* ditto */
+        struct list_head        private_list;   /* for use by the address_space */
         void                    *private_data;  /* ditto */
         errseq_t                wb_err;
 } __attribute__((aligned(sizeof(long)))) __randomize_layout;
diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h
index 5ba430cc9a87..1fc7abd28b0b 100644
--- a/include/linux/iio/adc/ad_sigma_delta.h
+++ b/include/linux/iio/adc/ad_sigma_delta.h
@@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
 int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg,
         unsigned int size, unsigned int *val);
 
+int ad_sd_reset(struct ad_sigma_delta *sigma_delta,
+        unsigned int reset_length);
+
 int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
         const struct iio_chan_spec *chan, int *val);
 int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta,
diff --git a/include/linux/input.h b/include/linux/input.h
index a65e3b24fb18..fb5e23c7ed98 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -529,6 +529,7 @@ int input_ff_event(struct input_dev *dev, unsigned int type, unsigned int code,
 
 int input_ff_upload(struct input_dev *dev, struct ff_effect *effect, struct file *file);
 int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file);
+int input_ff_flush(struct input_dev *dev, struct file *file);
 
 int input_ff_create_memless(struct input_dev *dev, void *data,
                 int (*play_effect)(struct input_dev *, void *, struct ff_effect *));
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index a7f2ac689d29..41b8c5757859 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -167,11 +167,11 @@ struct iommu_resv_region {
  * @map: map a physically contiguous memory region to an iommu domain
  * @unmap: unmap a physically contiguous memory region from an iommu domain
  * @map_sg: map a scatter-gather list of physically contiguous memory chunks
+ *          to an iommu domain
  * @flush_tlb_all: Synchronously flush all hardware TLBs for this domain
  * @tlb_range_add: Add a given iova range to the flush queue for this domain
  * @tlb_sync: Flush all queued ranges from the hardware TLBs and empty flush
  *            queue
- * to an iommu domain
  * @iova_to_phys: translate iova to physical address
  * @add_device: add device to iommu grouping
  * @remove_device: remove device from iommu grouping
diff --git a/include/linux/irq.h b/include/linux/irq.h
index b99a784635ff..d4728bf6a537 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -783,10 +783,7 @@ static inline struct cpumask *irq_data_get_affinity_mask(struct irq_data *d)
 static inline
 struct cpumask *irq_data_get_effective_affinity_mask(struct irq_data *d)
 {
-        if (!cpumask_empty(d->common->effective_affinity))
-                return d->common->effective_affinity;
-
-        return d->common->affinity;
+        return d->common->effective_affinity;
 }
 static inline void irq_data_update_effective_affinity(struct irq_data *d,
                                                       const struct cpumask *m)
diff --git a/include/linux/key.h b/include/linux/key.h
index 044114185120..e315e16b6ff8 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -187,6 +187,7 @@ struct key {
 #define KEY_FLAG_BUILTIN        8       /* set if key is built in to the kernel */
 #define KEY_FLAG_ROOT_CAN_INVAL 9       /* set if key can be invalidated by root without permission */
 #define KEY_FLAG_KEEP           10      /* set if key should not be removed */
+#define KEY_FLAG_UID_KEYRING    11      /* set if key is a user or user session keyring */
 
         /* the key type and key description string
          * - the desc is used to match a key against search criteria
@@ -243,6 +244,7 @@ extern struct key *key_alloc(struct key_type *type,
 #define KEY_ALLOC_NOT_IN_QUOTA          0x0002  /* not in quota */
 #define KEY_ALLOC_BUILT_IN              0x0004  /* Key is built into kernel */
 #define KEY_ALLOC_BYPASS_RESTRICTION    0x0008  /* Override the check on restricted keyrings */
+#define KEY_ALLOC_UID_KEYRING           0x0010  /* allocating a user or user session keyring */
 
 extern void key_revoke(struct key *key);
 extern void key_invalidate(struct key *key);
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index eaf4ad209c8f..e32dbc4934db 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -980,7 +980,6 @@ enum mlx5_cap_type {
         MLX5_CAP_RESERVED,
         MLX5_CAP_VECTOR_CALC,
         MLX5_CAP_QOS,
-        MLX5_CAP_FPGA,
         /* NUM OF CAP Types */
         MLX5_CAP_NUM
 };
@@ -1110,10 +1109,10 @@ enum mlx5_mcam_feature_groups {
         MLX5_GET(mcam_reg, (mdev)->caps.mcam, mng_feature_cap_mask.enhanced_features.fld)
 
 #define MLX5_CAP_FPGA(mdev, cap) \
-        MLX5_GET(fpga_cap, (mdev)->caps.hca_cur[MLX5_CAP_FPGA], cap)
+        MLX5_GET(fpga_cap, (mdev)->caps.fpga, cap)
 
 #define MLX5_CAP64_FPGA(mdev, cap) \
-        MLX5_GET64(fpga_cap, (mdev)->caps.hca_cur[MLX5_CAP_FPGA], cap)
+        MLX5_GET64(fpga_cap, (mdev)->caps.fpga, cap)
 
 enum {
         MLX5_CMD_STAT_OK                        = 0x0,
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 02ff700e4f30..401c8972cc3a 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -774,6 +774,7 @@ struct mlx5_core_dev {
                 u32 hca_max[MLX5_CAP_NUM][MLX5_UN_SZ_DW(hca_cap_union)];
                 u32 pcam[MLX5_ST_SZ_DW(pcam_reg)];
                 u32 mcam[MLX5_ST_SZ_DW(mcam_reg)];
+                u32 fpga[MLX5_ST_SZ_DW(fpga_cap)];
         } caps;
         phys_addr_t             iseg_base;
         struct mlx5_init_seg __iomem *iseg;
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index a528b35a022e..69772347f866 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -327,7 +327,8 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
         u8         reserved_at_80[0x18];
         u8         log_max_destination[0x8];
 
-        u8         reserved_at_a0[0x18];
+        u8         log_max_flow_counter[0x8];
+        u8         reserved_at_a8[0x10];
         u8         log_max_flow[0x8];
 
         u8         reserved_at_c0[0x40];
diff --git a/include/linux/mm.h b/include/linux/mm.h
index f8c10d336e42..065d99deb847 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -240,7 +240,7 @@ extern unsigned int kobjsize(const void *objp);
 
 #if defined(CONFIG_X86_INTEL_MPX)
 /* MPX specific bounds table or bounds directory */
-# define VM_MPX         VM_HIGH_ARCH_BIT_4
+# define VM_MPX         VM_HIGH_ARCH_4
 #else
 # define VM_MPX         VM_NONE
 #endif
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index f3f2d07feb2a..9a43763a68ad 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -316,7 +316,7 @@ struct mmc_host {
 #define MMC_CAP_UHS_SDR50       (1 << 18)       /* Host supports UHS SDR50 mode */
 #define MMC_CAP_UHS_SDR104      (1 << 19)       /* Host supports UHS SDR104 mode */
 #define MMC_CAP_UHS_DDR50       (1 << 20)       /* Host supports UHS DDR50 mode */
-#define MMC_CAP_NO_BOUNCE_BUFF  (1 << 21)       /* Disable bounce buffers on host */
+/* (1 << 21) is free for reuse */
 #define MMC_CAP_DRIVER_TYPE_A   (1 << 23)       /* Host supports Driver Type A */
 #define MMC_CAP_DRIVER_TYPE_C   (1 << 24)       /* Host supports Driver Type C */
 #define MMC_CAP_DRIVER_TYPE_D   (1 << 25)       /* Host supports Driver Type D */
diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
index 7b2e31b1745a..6866e8126982 100644
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -400,6 +400,11 @@ extern void mmu_notifier_synchronize(void);
 
 #else /* CONFIG_MMU_NOTIFIER */
 
+static inline int mm_has_notifiers(struct mm_struct *mm)
+{
+        return 0;
+}
+
 static inline void mmu_notifier_release(struct mm_struct *mm)
 {
 }
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 356a814e7c8e..c8f89417740b 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -1094,8 +1094,14 @@ static inline unsigned long early_pfn_to_nid(unsigned long pfn)
 #error Allocator MAX_ORDER exceeds SECTION_SIZE
 #endif
 
-#define pfn_to_section_nr(pfn) ((pfn) >> PFN_SECTION_SHIFT)
-#define section_nr_to_pfn(sec) ((sec) << PFN_SECTION_SHIFT)
+static inline unsigned long pfn_to_section_nr(unsigned long pfn)
+{
+        return pfn >> PFN_SECTION_SHIFT;
+}
+static inline unsigned long section_nr_to_pfn(unsigned long sec)
+{
+        return sec << PFN_SECTION_SHIFT;
+}
 
 #define SECTION_ALIGN_UP(pfn)   (((pfn) + PAGES_PER_SECTION - 1) & PAGE_SECTION_MASK)
 #define SECTION_ALIGN_DOWN(pfn) ((pfn) & PAGE_SECTION_MASK)
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index a36abe2da13e..27e249ed7c5c 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -12,11 +12,31 @@
 
 #ifdef CONFIG_LOCKUP_DETECTOR
 void lockup_detector_init(void);
+void lockup_detector_soft_poweroff(void);
+void lockup_detector_cleanup(void);
+bool is_hardlockup(void);
+
+extern int watchdog_user_enabled;
+extern int nmi_watchdog_user_enabled;
+extern int soft_watchdog_user_enabled;
+extern int watchdog_thresh;
+extern unsigned long watchdog_enabled;
+
+extern struct cpumask watchdog_cpumask;
+extern unsigned long *watchdog_cpumask_bits;
+#ifdef CONFIG_SMP
+extern int sysctl_softlockup_all_cpu_backtrace;
+extern int sysctl_hardlockup_all_cpu_backtrace;
 #else
-static inline void lockup_detector_init(void)
-{
-}
-#endif
+#define sysctl_softlockup_all_cpu_backtrace 0
+#define sysctl_hardlockup_all_cpu_backtrace 0
+#endif /* !CONFIG_SMP */
+
+#else /* CONFIG_LOCKUP_DETECTOR */
+static inline void lockup_detector_init(void) { }
+static inline void lockup_detector_soft_poweroff(void) { }
+static inline void lockup_detector_cleanup(void) { }
+#endif /* !CONFIG_LOCKUP_DETECTOR */
 
 #ifdef CONFIG_SOFTLOCKUP_DETECTOR
 extern void touch_softlockup_watchdog_sched(void);
@@ -24,29 +44,17 @@ extern void touch_softlockup_watchdog(void);
 extern void touch_softlockup_watchdog_sync(void);
 extern void touch_all_softlockup_watchdogs(void);
 extern unsigned int  softlockup_panic;
-extern int soft_watchdog_enabled;
-extern atomic_t watchdog_park_in_progress;
 #else
-static inline void touch_softlockup_watchdog_sched(void)
-{
-}
-static inline void touch_softlockup_watchdog(void)
-{
-}
-static inline void touch_softlockup_watchdog_sync(void)
-{
-}
-static inline void touch_all_softlockup_watchdogs(void)
-{
-}
+static inline void touch_softlockup_watchdog_sched(void) { }
+static inline void touch_softlockup_watchdog(void) { }
+static inline void touch_softlockup_watchdog_sync(void) { }
+static inline void touch_all_softlockup_watchdogs(void) { }
 #endif
 
 #ifdef CONFIG_DETECT_HUNG_TASK
 void reset_hung_task_detector(void);
 #else
-static inline void reset_hung_task_detector(void)
-{
-}
+static inline void reset_hung_task_detector(void) { }
 #endif
 
 /*
@@ -54,12 +62,12 @@ static inline void reset_hung_task_detector(void)
  * 'watchdog_enabled' variable. Each lockup detector has its dedicated bit -
  * bit 0 for the hard lockup detector and bit 1 for the soft lockup detector.
  *
- * 'watchdog_user_enabled', 'nmi_watchdog_enabled' and 'soft_watchdog_enabled'
- * are variables that are only used as an 'interface' between the parameters
- * in /proc/sys/kernel and the internal state bits in 'watchdog_enabled'. The
- * 'watchdog_thresh' variable is handled differently because its value is not
- * boolean, and the lockup detectors are 'suspended' while 'watchdog_thresh'
- * is equal zero.
+ * 'watchdog_user_enabled', 'nmi_watchdog_user_enabled' and
+ * 'soft_watchdog_user_enabled' are variables that are only used as an
+ * 'interface' between the parameters in /proc/sys/kernel and the internal
+ * state bits in 'watchdog_enabled'. The 'watchdog_thresh' variable is
+ * handled differently because its value is not boolean, and the lockup
+ * detectors are 'suspended' while 'watchdog_thresh' is equal zero.
  */
 #define NMI_WATCHDOG_ENABLED_BIT   0
 #define SOFT_WATCHDOG_ENABLED_BIT  1
@@ -73,17 +81,41 @@ extern unsigned int hardlockup_panic;
 static inline void hardlockup_detector_disable(void) {}
 #endif
 
+#if defined(CONFIG_HAVE_NMI_WATCHDOG) || defined(CONFIG_HARDLOCKUP_DETECTOR)
+# define NMI_WATCHDOG_SYSCTL_PERM       0644
+#else
+# define NMI_WATCHDOG_SYSCTL_PERM       0444
+#endif
+
 #if defined(CONFIG_HARDLOCKUP_DETECTOR_PERF)
 extern void arch_touch_nmi_watchdog(void);
+extern void hardlockup_detector_perf_stop(void);
+extern void hardlockup_detector_perf_restart(void);
+extern void hardlockup_detector_perf_disable(void);
+extern void hardlockup_detector_perf_enable(void);
+extern void hardlockup_detector_perf_cleanup(void);
+extern int hardlockup_detector_perf_init(void);
 #else
-#if !defined(CONFIG_HAVE_NMI_WATCHDOG)
+static inline void hardlockup_detector_perf_stop(void) { }
+static inline void hardlockup_detector_perf_restart(void) { }
+static inline void hardlockup_detector_perf_disable(void) { }
+static inline void hardlockup_detector_perf_enable(void) { }
+static inline void hardlockup_detector_perf_cleanup(void) { }
+# if !defined(CONFIG_HAVE_NMI_WATCHDOG)
+static inline int hardlockup_detector_perf_init(void) { return -ENODEV; }
 static inline void arch_touch_nmi_watchdog(void) {}
+# else
+static inline int hardlockup_detector_perf_init(void) { return 0; }
+# endif
 #endif
-#endif
+
+void watchdog_nmi_stop(void);
+void watchdog_nmi_start(void);
+int watchdog_nmi_probe(void);
 
 /**
  * touch_nmi_watchdog - restart NMI watchdog timeout.
- * 
+ *
  * If the architecture supports the NMI watchdog, touch_nmi_watchdog()
  * may be used to reset the timeout - for code which intentionally
  * disables interrupts for a long time. This call is stateless.
@@ -153,22 +185,6 @@ static inline bool trigger_single_cpu_backtrace(int cpu)
 u64 hw_nmi_get_sample_period(int watchdog_thresh);
 #endif
 
-#ifdef CONFIG_LOCKUP_DETECTOR
-extern int nmi_watchdog_enabled;
-extern int watchdog_user_enabled;
-extern int watchdog_thresh;
-extern unsigned long watchdog_enabled;
-extern struct cpumask watchdog_cpumask;
-extern unsigned long *watchdog_cpumask_bits;
-extern int __read_mostly watchdog_suspended;
-#ifdef CONFIG_SMP
-extern int sysctl_softlockup_all_cpu_backtrace;
-extern int sysctl_hardlockup_all_cpu_backtrace;
-#else
-#define sysctl_softlockup_all_cpu_backtrace 0
-#define sysctl_hardlockup_all_cpu_backtrace 0
-#endif
-
 #if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
     defined(CONFIG_HARDLOCKUP_DETECTOR)
 void watchdog_update_hrtimer_threshold(u64 period);
@@ -176,7 +192,6 @@ void watchdog_update_hrtimer_threshold(u64 period);
 static inline void watchdog_update_hrtimer_threshold(u64 period) { }
 #endif
 
-extern bool is_hardlockup(void);
 struct ctl_table;
 extern int proc_watchdog(struct ctl_table *, int ,
                          void __user *, size_t *, loff_t *);
@@ -188,18 +203,6 @@ extern int proc_watchdog_thresh(struct ctl_table *, int ,
                                 void __user *, size_t *, loff_t *);
 extern int proc_watchdog_cpumask(struct ctl_table *, int,
                                  void __user *, size_t *, loff_t *);
-extern int lockup_detector_suspend(void);
-extern void lockup_detector_resume(void);
-#else
-static inline int lockup_detector_suspend(void)
-{
-        return 0;
-}
-
-static inline void lockup_detector_resume(void)
-{
-}
-#endif
 
 #ifdef CONFIG_HAVE_ACPI_APEI_NMI
 #include <asm/nmi.h>
diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
index 9c5cb4480806..a726f96010d5 100644
--- a/include/linux/nvme-fc-driver.h
+++ b/include/linux/nvme-fc-driver.h
@@ -346,11 +346,6 @@ struct nvme_fc_remote_port {
  *       indicating an FC transport Aborted status.
  *       Entrypoint is Mandatory.
  *
- * @defer_rcv:  Called by the transport to signal the LLLD that it has
- *       begun processing of a previously received NVME CMD IU. The LLDD
- *       is now free to re-use the rcv buffer associated with the
- *       nvmefc_tgt_fcp_req.
- *
  * @max_hw_queues:  indicates the maximum number of hw queues the LLDD
  *       supports for cpu affinitization.
  *       Value is Mandatory. Must be at least 1.
@@ -806,11 +801,19 @@ struct nvmet_fc_target_port {
  *       outstanding operation (if there was one) to complete, then will
  *       call the fcp_req_release() callback to return the command's
  *       exchange context back to the LLDD.
+ *       Entrypoint is Mandatory.
  *
  * @fcp_req_release:  Called by the transport to return a nvmefc_tgt_fcp_req
  *       to the LLDD after all operations on the fcp operation are complete.
  *       This may be due to the command completing or upon completion of
  *       abort cleanup.
+ *       Entrypoint is Mandatory.
+ *
+ * @defer_rcv:  Called by the transport to signal the LLLD that it has
+ *       begun processing of a previously received NVME CMD IU. The LLDD
+ *       is now free to re-use the rcv buffer associated with the
+ *       nvmefc_tgt_fcp_req.
+ *       Entrypoint is Optional.
  *
  * @max_hw_queues:  indicates the maximum number of hw queues the LLDD
  *       supports for cpu affinitization.
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index 87723c86f136..9310ce77d8e1 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -471,12 +471,14 @@ enum nvme_opcode {
  *
  * @NVME_SGL_FMT_ADDRESS:     absolute address of the data block
  * @NVME_SGL_FMT_OFFSET:      relative offset of the in-capsule data block
+ * @NVME_SGL_FMT_TRANSPORT_A: transport defined format, value 0xA
  * @NVME_SGL_FMT_INVALIDATE:  RDMA transport specific remote invalidation
  *                            request subtype
  */
 enum {
         NVME_SGL_FMT_ADDRESS            = 0x00,
         NVME_SGL_FMT_OFFSET             = 0x01,
+        NVME_SGL_FMT_TRANSPORT_A        = 0x0A,
         NVME_SGL_FMT_INVALIDATE         = 0x0f,
 };
 
@@ -490,12 +492,16 @@ enum {
  *
  * For struct nvme_keyed_sgl_desc:
  *   @NVME_KEY_SGL_FMT_DATA_DESC:       keyed data block descriptor
+ *
+ * Transport-specific SGL types:
+ *   @NVME_TRANSPORT_SGL_DATA_DESC:     Transport SGL data dlock descriptor
  */
 enum {
         NVME_SGL_FMT_DATA_DESC          = 0x00,
         NVME_SGL_FMT_SEG_DESC           = 0x02,
         NVME_SGL_FMT_LAST_SEG_DESC      = 0x03,
         NVME_KEY_SGL_FMT_DATA_DESC      = 0x04,
+        NVME_TRANSPORT_SGL_DATA_DESC    = 0x05,
 };
 
 struct nvme_sgl_desc {
@@ -1127,19 +1133,6 @@ enum {
         NVME_SC_UNWRITTEN_BLOCK         = 0x287,
 
         NVME_SC_DNR                     = 0x4000,
-
-
-        /*
-         * FC Transport-specific error status values for NVME commands
-         *
-         * Transport-specific status code values must be in the range 0xB0..0xBF
-         */
-
-        /* Generic FC failure - catchall */
-        NVME_SC_FC_TRANSPORT_ERROR      = 0x00B0,
-
-        /* I/O failure due to FC ABTS'd */
-        NVME_SC_FC_TRANSPORT_ABORTED    = 0x00B1,
 };
 
 struct nvme_completion {
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index e0d1946270f3..fb908e598348 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -57,7 +57,14 @@ extern const struct of_device_id of_default_bus_match_table[];
 extern struct platform_device *of_device_alloc(struct device_node *np,
                                          const char *bus_id,
                                          struct device *parent);
+#ifdef CONFIG_OF
 extern struct platform_device *of_find_device_by_node(struct device_node *np);
+#else
+static inline struct platform_device *of_find_device_by_node(struct device_node *np)
+{
+        return NULL;
+}
+#endif
 
 /* Platform devices and busses creation */
 extern struct platform_device *of_platform_device_create(struct device_node *np,
diff --git a/include/linux/pci.h b/include/linux/pci.h
index f68c58a93dd0..f4f8ee5a7362 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1685,6 +1685,8 @@ static inline int pci_get_new_domain_nr(void) { return -ENOSYS; }
 
 #define dev_is_pci(d) (false)
 #define dev_is_pf(d) (false)
+static inline bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags)
+{ return false; }
 #endif /* CONFIG_PCI */
 
 /* Include architecture-dependent settings and functions */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 92fb8dd5a9e4..26a7df4e558c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -65,25 +65,23 @@ struct task_group;
  */
 
 /* Used in tsk->state: */
-#define TASK_RUNNING                    0
-#define TASK_INTERRUPTIBLE              1
-#define TASK_UNINTERRUPTIBLE            2
-#define __TASK_STOPPED                  4
-#define __TASK_TRACED                   8
+#define TASK_RUNNING                    0x0000
+#define TASK_INTERRUPTIBLE              0x0001
+#define TASK_UNINTERRUPTIBLE            0x0002
+#define __TASK_STOPPED                  0x0004
+#define __TASK_TRACED                   0x0008
 /* Used in tsk->exit_state: */
-#define EXIT_DEAD                       16
-#define EXIT_ZOMBIE                     32
+#define EXIT_DEAD                       0x0010
+#define EXIT_ZOMBIE                     0x0020
 #define EXIT_TRACE                      (EXIT_ZOMBIE | EXIT_DEAD)
 /* Used in tsk->state again: */
-#define TASK_DEAD                       64
-#define TASK_WAKEKILL                   128
-#define TASK_WAKING                     256
-#define TASK_PARKED                     512
-#define TASK_NOLOAD                     1024
-#define TASK_NEW                        2048
-#define TASK_STATE_MAX                  4096
-
-#define TASK_STATE_TO_CHAR_STR          "RSDTtXZxKWPNn"
+#define TASK_PARKED                     0x0040
+#define TASK_DEAD                       0x0080
+#define TASK_WAKEKILL                   0x0100
+#define TASK_WAKING                     0x0200
+#define TASK_NOLOAD                     0x0400
+#define TASK_NEW                        0x0800
+#define TASK_STATE_MAX                  0x1000
 
 /* Convenience macros for the sake of set_current_state: */
 #define TASK_KILLABLE                   (TASK_WAKEKILL | TASK_UNINTERRUPTIBLE)
@@ -99,7 +97,8 @@ struct task_group;
 /* get_task_state(): */
 #define TASK_REPORT                     (TASK_RUNNING | TASK_INTERRUPTIBLE | \
                                          TASK_UNINTERRUPTIBLE | __TASK_STOPPED | \
-                                         __TASK_TRACED | EXIT_ZOMBIE | EXIT_DEAD)
+                                         __TASK_TRACED | EXIT_DEAD | EXIT_ZOMBIE | \
+                                         TASK_PARKED)
 
 #define task_is_traced(task)            ((task->state & __TASK_TRACED) != 0)
 
@@ -1243,17 +1242,34 @@ static inline pid_t task_pgrp_nr(struct task_struct *tsk)
         return task_pgrp_nr_ns(tsk, &init_pid_ns);
 }
 
-static inline char task_state_to_char(struct task_struct *task)
+#define TASK_REPORT_IDLE        (TASK_REPORT + 1)
+#define TASK_REPORT_MAX         (TASK_REPORT_IDLE << 1)
+
+static inline unsigned int __get_task_state(struct task_struct *tsk)
+{
+        unsigned int tsk_state = READ_ONCE(tsk->state);
+        unsigned int state = (tsk_state | tsk->exit_state) & TASK_REPORT;
+
+        BUILD_BUG_ON_NOT_POWER_OF_2(TASK_REPORT_MAX);
+
+        if (tsk_state == TASK_IDLE)
+                state = TASK_REPORT_IDLE;
+
+        return fls(state);
+}
+
+static inline char __task_state_to_char(unsigned int state)
 {
-        const char stat_nam[] = TASK_STATE_TO_CHAR_STR;
-        unsigned long state = task->state;
+        static const char state_char[] = "RSDTtXZPI";
 
-        state = state ? __ffs(state) + 1 : 0;
+        BUILD_BUG_ON(1 + ilog2(TASK_REPORT_MAX) != sizeof(state_char) - 1);
 
-        /* Make sure the string lines up properly with the number of task states: */
-        BUILD_BUG_ON(sizeof(TASK_STATE_TO_CHAR_STR)-1 != ilog2(TASK_STATE_MAX)+1);
+        return state_char[state];
+}
 
-        return state < sizeof(stat_nam) - 1 ? stat_nam[state] : '?';
+static inline char task_state_to_char(struct task_struct *tsk)
+{
+        return __task_state_to_char(__get_task_state(tsk));
 }
 
 /**
diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index 3a19c253bdb1..ae53e413fb13 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -84,6 +84,12 @@ static inline bool mmget_not_zero(struct mm_struct *mm)
 
 /* mmput gets rid of the mappings and all user-space */
 extern void mmput(struct mm_struct *);
+#ifdef CONFIG_MMU
+/* same as above but performs the slow path from the async context. Can
+ * be called from the atomic context as well
+ */
+void mmput_async(struct mm_struct *);
+#endif
 
 /* Grab a reference to a task's mm, if it is not already going away */
 extern struct mm_struct *get_task_mm(struct task_struct *task);
diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
index ecc296c137cd..c8bef436b61d 100644
--- a/include/linux/seccomp.h
+++ b/include/linux/seccomp.h
@@ -3,7 +3,8 @@
 
 #include <uapi/linux/seccomp.h>
 
-#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC)
+#define SECCOMP_FILTER_FLAG_MASK        (SECCOMP_FILTER_FLAG_TSYNC | \
+                                         SECCOMP_FILTER_FLAG_LOG)
 
 #ifdef CONFIG_SECCOMP
 
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
index 12910cf19869..c149aa7bedf3 100644
--- a/include/linux/smpboot.h
+++ b/include/linux/smpboot.h
@@ -55,7 +55,7 @@ smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
 }
 
 void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread);
-int smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
-                                         const struct cpumask *);
+void smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
+                                          const struct cpumask *);
 
 #endif
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 95606a2d556f..a78186d826d7 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -221,21 +221,25 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event)
         }                                                               \
         static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))
 
-#ifdef TIF_FSCHECK
 /*
  * Called before coming back to user-mode. Returning to user-mode with an
  * address limit different than USER_DS can allow to overwrite kernel memory.
  */
 static inline void addr_limit_user_check(void)
 {
-
+#ifdef TIF_FSCHECK
         if (!test_thread_flag(TIF_FSCHECK))
                 return;
+#endif
 
-        BUG_ON(!segment_eq(get_fs(), USER_DS));
+        if (CHECK_DATA_CORRUPTION(!segment_eq(get_fs(), USER_DS),
+                                  "Invalid address limit on user-mode return"))
+                force_sig(SIGKILL, current);
+
+#ifdef TIF_FSCHECK
         clear_thread_flag(TIF_FSCHECK);
-}
 #endif
+}
 
 asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,
                                qid_t id, void __user *addr);
diff --git a/include/linux/timer.h b/include/linux/timer.h
index e6789b8757d5..6383c528b148 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -168,6 +168,20 @@ static inline void init_timer_on_stack_key(struct timer_list *timer,
 #define setup_pinned_deferrable_timer_on_stack(timer, fn, data)         \
         __setup_timer_on_stack((timer), (fn), (data), TIMER_DEFERRABLE | TIMER_PINNED)
 
+#define TIMER_DATA_TYPE         unsigned long
+#define TIMER_FUNC_TYPE         void (*)(TIMER_DATA_TYPE)
+
+static inline void timer_setup(struct timer_list *timer,
+                               void (*callback)(struct timer_list *),
+                               unsigned int flags)
+{
+        __setup_timer(timer, (TIMER_FUNC_TYPE)callback,
+                      (TIMER_DATA_TYPE)timer, flags);
+}
+
+#define from_timer(var, callback_timer, timer_fieldname) \
+        container_of(callback_timer, typeof(*var), timer_fieldname)
+
 /**
  * timer_pending - is a timer pending?
  * @timer: the timer in question
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 7f11050746ae..2e0f22298fe9 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -272,6 +272,7 @@ struct trace_event_call {
         int                             perf_refcount;
         struct hlist_head __percpu      *perf_events;
         struct bpf_prog                 *prog;
+        struct perf_event               *bpf_prog_owner;
 
         int     (*perf_perm)(struct trace_event_call *,
                              struct perf_event *);
diff --git a/include/net/dst.h b/include/net/dst.h
index 93568bd0a352..06a6765da074 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -271,7 +271,7 @@ static inline void dst_use_noref(struct dst_entry *dst, unsigned long time)
 static inline struct dst_entry *dst_clone(struct dst_entry *dst)
 {
         if (dst)
-                atomic_inc(&dst->__refcnt);
+                dst_hold(dst);
         return dst;
 }
 
@@ -312,21 +312,6 @@ static inline void skb_dst_copy(struct sk_buff *nskb, const struct sk_buff *oskb
 }
 
 /**
- * skb_dst_force - makes sure skb dst is refcounted
- * @skb: buffer
- *
- * If dst is not yet refcounted, let's do it
- */
-static inline void skb_dst_force(struct sk_buff *skb)
-{
-        if (skb_dst_is_noref(skb)) {
-                WARN_ON(!rcu_read_lock_held());
-                skb->_skb_refdst &= ~SKB_DST_NOREF;
-                dst_clone(skb_dst(skb));
-        }
-}
-
-/**
  * dst_hold_safe - Take a reference on a dst if possible
  * @dst: pointer to dst entry
  *
@@ -339,16 +324,17 @@ static inline bool dst_hold_safe(struct dst_entry *dst)
 }
 
 /**
- * skb_dst_force_safe - makes sure skb dst is refcounted
+ * skb_dst_force - makes sure skb dst is refcounted
  * @skb: buffer
  *
  * If dst is not yet refcounted and not destroyed, grab a ref on it.
  */
-static inline void skb_dst_force_safe(struct sk_buff *skb)
+static inline void skb_dst_force(struct sk_buff *skb)
 {
         if (skb_dst_is_noref(skb)) {
                 struct dst_entry *dst = skb_dst(skb);
 
+                WARN_ON(!rcu_read_lock_held());
                 if (!dst_hold_safe(dst))
                         dst = NULL;
 
diff --git a/include/net/netlink.h b/include/net/netlink.h
index e51cf5f81597..14c289393071 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -773,7 +773,10 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype,
  */
 static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
 {
-        return nla_put(skb, attrtype, sizeof(u8), &value);
+        /* temporary variables to work around GCC PR81715 with asan-stack=1 */
+        u8 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(u8), &tmp);
 }
 
 /**
@@ -784,7 +787,9 @@ static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
  */
 static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value)
 {
-        return nla_put(skb, attrtype, sizeof(u16), &value);
+        u16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(u16), &tmp);
 }
 
 /**
@@ -795,7 +800,9 @@ static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value)
  */
 static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value)
 {
-        return nla_put(skb, attrtype, sizeof(__be16), &value);
+        __be16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__be16), &tmp);
 }
 
 /**
@@ -806,7 +813,9 @@ static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value)
  */
 static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value)
 {
-        return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+        __be16 tmp = value;
+
+        return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -817,7 +826,9 @@ static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value)
  */
 static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value)
 {
-        return nla_put(skb, attrtype, sizeof(__le16), &value);
+        __le16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__le16), &tmp);
 }
 
 /**
@@ -828,7 +839,9 @@ static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value)
  */
 static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value)
 {
-        return nla_put(skb, attrtype, sizeof(u32), &value);
+        u32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(u32), &tmp);
 }
 
 /**
@@ -839,7 +852,9 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value)
  */
 static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value)
 {
-        return nla_put(skb, attrtype, sizeof(__be32), &value);
+        __be32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__be32), &tmp);
 }
 
 /**
@@ -850,7 +865,9 @@ static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value)
  */
 static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value)
 {
-        return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+        __be32 tmp = value;
+
+        return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -861,7 +878,9 @@ static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value)
  */
 static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value)
 {
-        return nla_put(skb, attrtype, sizeof(__le32), &value);
+        __le32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(__le32), &tmp);
 }
 
 /**
@@ -874,7 +893,9 @@ static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value)
 static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype,
                                     u64 value, int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(u64), &value, padattr);
+        u64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(u64), &tmp, padattr);
 }
 
 /**
@@ -887,7 +908,9 @@ static inline int nla_put_u64_64bit(struct sk_buff *skb, int attrtype,
 static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value,
                                int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(__be64), &value, padattr);
+        __be64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(__be64), &tmp, padattr);
 }
 
 /**
@@ -900,7 +923,9 @@ static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value,
 static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value,
                                 int padattr)
 {
-        return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, value,
+        __be64 tmp = value;
+
+        return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, tmp,
                             padattr);
 }
 
@@ -914,7 +939,9 @@ static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value,
 static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value,
                                int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(__le64), &value, padattr);
+        __le64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(__le64), &tmp, padattr);
 }
 
 /**
@@ -925,7 +952,9 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value,
  */
 static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
 {
-        return nla_put(skb, attrtype, sizeof(s8), &value);
+        s8 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(s8), &tmp);
 }
 
 /**
@@ -936,7 +965,9 @@ static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
  */
 static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
 {
-        return nla_put(skb, attrtype, sizeof(s16), &value);
+        s16 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(s16), &tmp);
 }
 
 /**
@@ -947,7 +978,9 @@ static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
  */
 static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
 {
-        return nla_put(skb, attrtype, sizeof(s32), &value);
+        s32 tmp = value;
+
+        return nla_put(skb, attrtype, sizeof(s32), &tmp);
 }
 
 /**
@@ -960,7 +993,9 @@ static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
 static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value,
                               int padattr)
 {
-        return nla_put_64bit(skb, attrtype, sizeof(s64), &value, padattr);
+        s64 tmp = value;
+
+        return nla_put_64bit(skb, attrtype, sizeof(s64), &tmp, padattr);
 }
 
 /**
@@ -1010,7 +1045,9 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype,
 static inline int nla_put_in_addr(struct sk_buff *skb, int attrtype,
                                   __be32 addr)
 {
-        return nla_put_be32(skb, attrtype, addr);
+        __be32 tmp = addr;
+
+        return nla_put_be32(skb, attrtype, tmp);
 }
 
 /**
diff --git a/include/net/protocol.h b/include/net/protocol.h
index 65ba335b0e7e..4fc75f7ae23b 100644
--- a/include/net/protocol.h
+++ b/include/net/protocol.h
@@ -39,8 +39,8 @@
 
 /* This is used to register protocols. */
 struct net_protocol {
-        void                    (*early_demux)(struct sk_buff *skb);
-        void                    (*early_demux_handler)(struct sk_buff *skb);
+        int                     (*early_demux)(struct sk_buff *skb);
+        int                     (*early_demux_handler)(struct sk_buff *skb);
         int                     (*handler)(struct sk_buff *skb);
         void                    (*err_handler)(struct sk_buff *skb, u32 info);
         unsigned int            no_policy:1,
diff --git a/include/net/route.h b/include/net/route.h
index 1b09a9368c68..d538e6db1afe 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -175,7 +175,9 @@ static inline struct rtable *ip_route_output_gre(struct net *net, struct flowi4
         fl4->fl4_gre_key = gre_key;
         return ip_route_output_key(net, fl4);
 }
-
+int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                          u8 tos, struct net_device *dev,
+                          struct in_device *in_dev, u32 *itag);
 int ip_route_input_noref(struct sk_buff *skb, __be32 dst, __be32 src,
                          u8 tos, struct net_device *devin);
 int ip_route_input_rcu(struct sk_buff *skb, __be32 dst, __be32 src,
@@ -190,7 +192,7 @@ static inline int ip_route_input(struct sk_buff *skb, __be32 dst, __be32 src,
         rcu_read_lock();
         err = ip_route_input_noref(skb, dst, src, tos, devin);
         if (!err) {
-                skb_dst_force_safe(skb);
+                skb_dst_force(skb);
                 if (!skb_dst(skb))
                         err = -EINVAL;
         }
diff --git a/include/net/sock.h b/include/net/sock.h
index 03a362568357..a6b9a8d1a6df 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -856,7 +856,7 @@ void sk_stream_write_space(struct sock *sk);
 static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         /* dont let skb dst not refcounted, we are going to leave rcu lock */
-        skb_dst_force_safe(skb);
+        skb_dst_force(skb);
 
         if (!sk->sk_backlog.tail)
                 sk->sk_backlog.head = skb;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index b510f284427a..89974c5286d8 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -345,7 +345,7 @@ void tcp_v4_err(struct sk_buff *skb, u32);
 
 void tcp_shutdown(struct sock *sk, int how);
 
-void tcp_v4_early_demux(struct sk_buff *skb);
+int tcp_v4_early_demux(struct sk_buff *skb);
 int tcp_v4_rcv(struct sk_buff *skb);
 
 int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw);
@@ -544,7 +544,6 @@ u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now,
                      int min_tso_segs);
 void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
                                int nonagle);
-bool tcp_may_send_now(struct sock *sk);
 int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs);
 int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs);
 void tcp_retransmit_timer(struct sock *sk);
diff --git a/include/net/udp.h b/include/net/udp.h
index 12dfbfe2e2d7..6c759c8594e2 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -259,7 +259,7 @@ static inline struct sk_buff *skb_recv_udp(struct sock *sk, unsigned int flags,
         return __skb_recv_udp(sk, flags, noblock, &peeked, &off, err);
 }
 
-void udp_v4_early_demux(struct sk_buff *skb);
+int udp_v4_early_demux(struct sk_buff *skb);
 bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst);
 int udp_get_port(struct sock *sk, unsigned short snum,
                  int (*saddr_cmp)(const struct sock *,
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index bdb1279a415b..e8608b2dc844 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -285,7 +285,7 @@ enum ib_tm_cap_flags {
         IB_TM_CAP_RC                = 1 << 0,
 };
 
-struct ib_xrq_caps {
+struct ib_tm_caps {
         /* Max size of RNDV header */
         u32 max_rndv_hdr_size;
         /* Max number of entries in tag matching list */
@@ -358,7 +358,7 @@ struct ib_device_attr {
         struct ib_rss_caps      rss_caps;
         u32                     max_wq_type_rq;
         u32                     raw_packet_caps; /* Use ib_raw_packet_caps enum */
-        struct ib_xrq_caps      xrq_caps;
+        struct ib_tm_caps       tm_caps;
 };
 
 enum ib_mtu {
@@ -1739,7 +1739,7 @@ struct ib_mr {
         u32                lkey;
         u32                rkey;
         u64                iova;
-        u32                length;
+        u64                length;
         unsigned int       page_size;
         bool               need_inval;
         union {
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 82e93ee94708..67c5a9f223f7 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -192,6 +192,7 @@ struct scsi_device {
         unsigned no_dif:1;      /* T10 PI (DIF) should be disabled */
         unsigned broken_fua:1;          /* Don't set FUA bit */
         unsigned lun_in_cdb:1;          /* Store LUN bits in CDB[1] */
+        unsigned unmap_limit_for_ws:1;  /* Use the UNMAP limit for WRITE SAME */
 
         atomic_t disk_events_disable_depth; /* disable depth for disk events */
 
diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
index 9592570e092a..36b03013d629 100644
--- a/include/scsi/scsi_devinfo.h
+++ b/include/scsi/scsi_devinfo.h
@@ -29,5 +29,6 @@
 #define BLIST_TRY_VPD_PAGES     0x10000000 /* Attempt to read VPD pages */
 #define BLIST_NO_RSOC           0x20000000 /* don't try to issue RSOC */
 #define BLIST_MAX_1024          0x40000000 /* maximum 1024 sector cdb length */
+#define BLIST_UNMAP_LIMIT_WS    0x80000000 /* Use UNMAP limit for WRITE SAME */
 
 #endif
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 6183d20a01fb..b266d2a3bcb1 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -434,7 +434,6 @@ extern struct iscsi_cls_session *iscsi_create_session(struct Scsi_Host *shost,
                                                 unsigned int target_id);
 extern void iscsi_remove_session(struct iscsi_cls_session *session);
 extern void iscsi_free_session(struct iscsi_cls_session *session);
-extern int iscsi_destroy_session(struct iscsi_cls_session *session);
 extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess,
                                                 int dd_size, uint32_t cid);
 extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn);
diff --git a/include/sound/hda_verbs.h b/include/sound/hda_verbs.h
index d0509db6d0ec..f89cd5ee1c7a 100644
--- a/include/sound/hda_verbs.h
+++ b/include/sound/hda_verbs.h
@@ -95,6 +95,7 @@ enum {
 #define AC_VERB_SET_EAPD_BTLENABLE              0x70c
 #define AC_VERB_SET_DIGI_CONVERT_1              0x70d
 #define AC_VERB_SET_DIGI_CONVERT_2              0x70e
+#define AC_VERB_SET_DIGI_CONVERT_3              0x73e
 #define AC_VERB_SET_VOLUME_KNOB_CONTROL         0x70f
 #define AC_VERB_SET_GPIO_DATA                   0x715
 #define AC_VERB_SET_GPIO_MASK                   0x716
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index ae1409ffe99a..3c8b7f625670 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -114,7 +114,10 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct *
          * Preemption ignores task state, therefore preempted tasks are always
          * RUNNING (we will not have dequeued if state != RUNNING).
          */
-        return preempt ? TASK_RUNNING | TASK_STATE_MAX : p->state;
+        if (preempt)
+                return TASK_STATE_MAX;
+
+        return __get_task_state(p);
 }
 #endif /* CREATE_TRACE_POINTS */
 
@@ -152,12 +155,14 @@ TRACE_EVENT(sched_switch,
 
         TP_printk("prev_comm=%s prev_pid=%d prev_prio=%d prev_state=%s%s ==> next_comm=%s next_pid=%d next_prio=%d",
                 __entry->prev_comm, __entry->prev_pid, __entry->prev_prio,
-                __entry->prev_state & (TASK_STATE_MAX-1) ?
-                  __print_flags(__entry->prev_state & (TASK_STATE_MAX-1), "|",
-                                { 1, "S"} , { 2, "D" }, { 4, "T" }, { 8, "t" },
-                                { 16, "Z" }, { 32, "X" }, { 64, "x" },
-                                { 128, "K" }, { 256, "W" }, { 512, "P" },
-                                { 1024, "N" }) : "R",
+
+                (__entry->prev_state & (TASK_REPORT_MAX - 1)) ?
+                  __print_flags(__entry->prev_state & (TASK_REPORT_MAX - 1), "|",
+                                { 0x01, "S" }, { 0x02, "D" }, { 0x04, "T" },
+                                { 0x08, "t" }, { 0x10, "X" }, { 0x20, "Z" },
+                                { 0x40, "P" }, { 0x80, "I" }) :
+                  "R",
+
                 __entry->prev_state & TASK_STATE_MAX ? "+" : "",
                 __entry->next_comm, __entry->next_pid, __entry->next_prio)
 );
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 43ab5c402f98..f90860d1f897 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -312,7 +312,7 @@ union bpf_attr {
  *     jump into another BPF program
  *     @ctx: context pointer passed to next program
  *     @prog_array_map: pointer to map which type is BPF_MAP_TYPE_PROG_ARRAY
- *     @index: index inside array that selects specific program to run
+ *     @index: 32-bit index inside array that selects specific program to run
  *     Return: 0 on success or negative error
  *
  * int bpf_clone_redirect(skb, ifindex, flags)
diff --git a/include/uapi/linux/dm-ioctl.h b/include/uapi/linux/dm-ioctl.h
index 412c06a624c8..ccaea525340b 100644
--- a/include/uapi/linux/dm-ioctl.h
+++ b/include/uapi/linux/dm-ioctl.h
@@ -269,9 +269,9 @@ enum {
 #define DM_DEV_SET_GEOMETRY     _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)
 
 #define DM_VERSION_MAJOR        4
-#define DM_VERSION_MINOR        36
+#define DM_VERSION_MINOR        37
 #define DM_VERSION_PATCHLEVEL   0
-#define DM_VERSION_EXTRA        "-ioctl (2017-06-09)"
+#define DM_VERSION_EXTRA        "-ioctl (2017-09-20)"
 
 /* Status bits */
 #define DM_READONLY_FLAG        (1 << 0) /* In/Out */
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 9c041dae8e2c..5bd1b1de4ea0 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1753,6 +1753,8 @@ enum ethtool_reset_flags {
  *      %ethtool_link_mode_bit_indices for the link modes, and other
  *      link features that the link partner advertised through
  *      autonegotiation; 0 if unknown or not applicable.  Read-only.
+ * @transceiver: Used to distinguish different possible PHY types,
+ *      reported consistently by PHYLIB.  Read-only.
  *
  * If autonegotiation is disabled, the speed and @duplex represent the
  * fixed link mode and are writable if the driver supports multiple
@@ -1804,7 +1806,9 @@ struct ethtool_link_settings {
         __u8    eth_tp_mdix;
         __u8    eth_tp_mdix_ctrl;
         __s8    link_mode_masks_nwords;
-        __u32   reserved[8];
+        __u8    transceiver;
+        __u8    reserved1[3];
+        __u32   reserved[7];
         __u32   link_mode_masks[0];
         /* layout of link_mode_masks fields:
          * __u32 map_supported[link_mode_masks_nwords];
diff --git a/include/uapi/linux/kfd_ioctl.h b/include/uapi/linux/kfd_ioctl.h
index 7b4567bacfc2..26283fefdf5f 100644
--- a/include/uapi/linux/kfd_ioctl.h
+++ b/include/uapi/linux/kfd_ioctl.h
@@ -23,15 +23,15 @@
 #ifndef KFD_IOCTL_H_INCLUDED
 #define KFD_IOCTL_H_INCLUDED
 
-#include <linux/types.h>
+#include <drm/drm.h>
 #include <linux/ioctl.h>
 
 #define KFD_IOCTL_MAJOR_VERSION 1
 #define KFD_IOCTL_MINOR_VERSION 1
 
 struct kfd_ioctl_get_version_args {
-        uint32_t major_version; /* from KFD */
-        uint32_t minor_version; /* from KFD */
+        __u32 major_version;    /* from KFD */
+        __u32 minor_version;    /* from KFD */
 };
 
 /* For kfd_ioctl_create_queue_args.queue_type. */
@@ -43,36 +43,36 @@ struct kfd_ioctl_get_version_args {
 #define KFD_MAX_QUEUE_PRIORITY          15
 
 struct kfd_ioctl_create_queue_args {
-        uint64_t ring_base_address;     /* to KFD */
-        uint64_t write_pointer_address; /* from KFD */
-        uint64_t read_pointer_address;  /* from KFD */
-        uint64_t doorbell_offset;       /* from KFD */
-
-        uint32_t ring_size;             /* to KFD */
-        uint32_t gpu_id;                /* to KFD */
-        uint32_t queue_type;            /* to KFD */
-        uint32_t queue_percentage;      /* to KFD */
-        uint32_t queue_priority;        /* to KFD */
-        uint32_t queue_id;              /* from KFD */
-
-        uint64_t eop_buffer_address;    /* to KFD */
-        uint64_t eop_buffer_size;       /* to KFD */
-        uint64_t ctx_save_restore_address; /* to KFD */
-        uint64_t ctx_save_restore_size; /* to KFD */
+        __u64 ring_base_address;        /* to KFD */
+        __u64 write_pointer_address;    /* from KFD */
+        __u64 read_pointer_address;     /* from KFD */
+        __u64 doorbell_offset;  /* from KFD */
+
+        __u32 ring_size;                /* to KFD */
+        __u32 gpu_id;           /* to KFD */
+        __u32 queue_type;               /* to KFD */
+        __u32 queue_percentage; /* to KFD */
+        __u32 queue_priority;   /* to KFD */
+        __u32 queue_id;         /* from KFD */
+
+        __u64 eop_buffer_address;       /* to KFD */
+        __u64 eop_buffer_size;  /* to KFD */
+        __u64 ctx_save_restore_address; /* to KFD */
+        __u64 ctx_save_restore_size;    /* to KFD */
 };
 
 struct kfd_ioctl_destroy_queue_args {
-        uint32_t queue_id;              /* to KFD */
-        uint32_t pad;
+        __u32 queue_id;         /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_update_queue_args {
-        uint64_t ring_base_address;     /* to KFD */
+        __u64 ring_base_address;        /* to KFD */
 
-        uint32_t queue_id;              /* to KFD */
-        uint32_t ring_size;             /* to KFD */
-        uint32_t queue_percentage;      /* to KFD */
-        uint32_t queue_priority;        /* to KFD */
+        __u32 queue_id;         /* to KFD */
+        __u32 ring_size;                /* to KFD */
+        __u32 queue_percentage; /* to KFD */
+        __u32 queue_priority;   /* to KFD */
 };
 
 /* For kfd_ioctl_set_memory_policy_args.default_policy and alternate_policy */
@@ -80,13 +80,13 @@ struct kfd_ioctl_update_queue_args {
 #define KFD_IOC_CACHE_POLICY_NONCOHERENT 1
 
 struct kfd_ioctl_set_memory_policy_args {
-        uint64_t alternate_aperture_base;       /* to KFD */
-        uint64_t alternate_aperture_size;       /* to KFD */
+        __u64 alternate_aperture_base;  /* to KFD */
+        __u64 alternate_aperture_size;  /* to KFD */
 
-        uint32_t gpu_id;                        /* to KFD */
-        uint32_t default_policy;                /* to KFD */
-        uint32_t alternate_policy;              /* to KFD */
-        uint32_t pad;
+        __u32 gpu_id;                   /* to KFD */
+        __u32 default_policy;           /* to KFD */
+        __u32 alternate_policy;         /* to KFD */
+        __u32 pad;
 };
 
 /*
@@ -97,26 +97,26 @@ struct kfd_ioctl_set_memory_policy_args {
  */
 
 struct kfd_ioctl_get_clock_counters_args {
-        uint64_t gpu_clock_counter;     /* from KFD */
-        uint64_t cpu_clock_counter;     /* from KFD */
-        uint64_t system_clock_counter;  /* from KFD */
-        uint64_t system_clock_freq;     /* from KFD */
+        __u64 gpu_clock_counter;        /* from KFD */
+        __u64 cpu_clock_counter;        /* from KFD */
+        __u64 system_clock_counter;     /* from KFD */
+        __u64 system_clock_freq;        /* from KFD */
 
-        uint32_t gpu_id;                /* to KFD */
-        uint32_t pad;
+        __u32 gpu_id;           /* to KFD */
+        __u32 pad;
 };
 
 #define NUM_OF_SUPPORTED_GPUS 7
 
 struct kfd_process_device_apertures {
-        uint64_t lds_base;              /* from KFD */
-        uint64_t lds_limit;             /* from KFD */
-        uint64_t scratch_base;          /* from KFD */
-        uint64_t scratch_limit;         /* from KFD */
-        uint64_t gpuvm_base;            /* from KFD */
-        uint64_t gpuvm_limit;           /* from KFD */
-        uint32_t gpu_id;                /* from KFD */
-        uint32_t pad;
+        __u64 lds_base;         /* from KFD */
+        __u64 lds_limit;                /* from KFD */
+        __u64 scratch_base;             /* from KFD */
+        __u64 scratch_limit;            /* from KFD */
+        __u64 gpuvm_base;               /* from KFD */
+        __u64 gpuvm_limit;              /* from KFD */
+        __u32 gpu_id;           /* from KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_get_process_apertures_args {
@@ -124,8 +124,8 @@ struct kfd_ioctl_get_process_apertures_args {
                         process_apertures[NUM_OF_SUPPORTED_GPUS];/* from KFD */
 
         /* from KFD, should be in the range [1 - NUM_OF_SUPPORTED_GPUS] */
-        uint32_t num_of_nodes;
-        uint32_t pad;
+        __u32 num_of_nodes;
+        __u32 pad;
 };
 
 #define MAX_ALLOWED_NUM_POINTS    100
@@ -133,25 +133,25 @@ struct kfd_ioctl_get_process_apertures_args {
 #define MAX_ALLOWED_WAC_BUFF_SIZE  128
 
 struct kfd_ioctl_dbg_register_args {
-        uint32_t gpu_id;                /* to KFD */
-        uint32_t pad;
+        __u32 gpu_id;           /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_dbg_unregister_args {
-        uint32_t gpu_id;                /* to KFD */
-        uint32_t pad;
+        __u32 gpu_id;           /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_dbg_address_watch_args {
-        uint64_t content_ptr;           /* a pointer to the actual content */
-        uint32_t gpu_id;                /* to KFD */
-        uint32_t buf_size_in_bytes;     /*including gpu_id and buf_size */
+        __u64 content_ptr;              /* a pointer to the actual content */
+        __u32 gpu_id;           /* to KFD */
+        __u32 buf_size_in_bytes;        /*including gpu_id and buf_size */
 };
 
 struct kfd_ioctl_dbg_wave_control_args {
-        uint64_t content_ptr;           /* a pointer to the actual content */
-        uint32_t gpu_id;                /* to KFD */
-        uint32_t buf_size_in_bytes;     /*including gpu_id and buf_size */
+        __u64 content_ptr;              /* a pointer to the actual content */
+        __u32 gpu_id;           /* to KFD */
+        __u32 buf_size_in_bytes;        /*including gpu_id and buf_size */
 };
 
 /* Matching HSA_EVENTTYPE */
@@ -172,44 +172,44 @@ struct kfd_ioctl_dbg_wave_control_args {
 #define KFD_SIGNAL_EVENT_LIMIT                  256
 
 struct kfd_ioctl_create_event_args {
-        uint64_t event_page_offset;     /* from KFD */
-        uint32_t event_trigger_data;    /* from KFD - signal events only */
-        uint32_t event_type;            /* to KFD */
-        uint32_t auto_reset;            /* to KFD */
-        uint32_t node_id;               /* to KFD - only valid for certain
+        __u64 event_page_offset;        /* from KFD */
+        __u32 event_trigger_data;       /* from KFD - signal events only */
+        __u32 event_type;               /* to KFD */
+        __u32 auto_reset;               /* to KFD */
+        __u32 node_id;          /* to KFD - only valid for certain
                                                         event types */
-        uint32_t event_id;              /* from KFD */
-        uint32_t event_slot_index;      /* from KFD */
+        __u32 event_id;         /* from KFD */
+        __u32 event_slot_index; /* from KFD */
 };
 
 struct kfd_ioctl_destroy_event_args {
-        uint32_t event_id;              /* to KFD */
-        uint32_t pad;
+        __u32 event_id;         /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_set_event_args {
-        uint32_t event_id;              /* to KFD */
-        uint32_t pad;
+        __u32 event_id;         /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_reset_event_args {
-        uint32_t event_id;              /* to KFD */
-        uint32_t pad;
+        __u32 event_id;         /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_memory_exception_failure {
-        uint32_t NotPresent;    /* Page not present or supervisor privilege */
-        uint32_t ReadOnly;      /* Write access to a read-only page */
-        uint32_t NoExecute;     /* Execute access to a page marked NX */
-        uint32_t pad;
+        __u32 NotPresent;       /* Page not present or supervisor privilege */
+        __u32 ReadOnly; /* Write access to a read-only page */
+        __u32 NoExecute;        /* Execute access to a page marked NX */
+        __u32 pad;
 };
 
 /* memory exception data*/
 struct kfd_hsa_memory_exception_data {
         struct kfd_memory_exception_failure failure;
-        uint64_t va;
-        uint32_t gpu_id;
-        uint32_t pad;
+        __u64 va;
+        __u32 gpu_id;
+        __u32 pad;
 };
 
 /* Event data*/
@@ -217,19 +217,19 @@ struct kfd_event_data {
         union {
                 struct kfd_hsa_memory_exception_data memory_exception_data;
         };                              /* From KFD */
-        uint64_t kfd_event_data_ext;    /* pointer to an extension structure
+        __u64 kfd_event_data_ext;       /* pointer to an extension structure
                                            for future exception types */
-        uint32_t event_id;              /* to KFD */
-        uint32_t pad;
+        __u32 event_id;         /* to KFD */
+        __u32 pad;
 };
 
 struct kfd_ioctl_wait_events_args {
-        uint64_t events_ptr;            /* pointed to struct
+        __u64 events_ptr;               /* pointed to struct
                                            kfd_event_data array, to KFD */
-        uint32_t num_events;            /* to KFD */
-        uint32_t wait_for_all;          /* to KFD */
-        uint32_t timeout;               /* to KFD */
-        uint32_t wait_result;           /* from KFD */
+        __u32 num_events;               /* to KFD */
+        __u32 wait_for_all;             /* to KFD */
+        __u32 timeout;          /* to KFD */
+        __u32 wait_result;              /* from KFD */
 };
 
 struct kfd_ioctl_set_scratch_backing_va_args {
diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h
index 0f238a43ff1e..f6bc1dea3247 100644
--- a/include/uapi/linux/seccomp.h
+++ b/include/uapi/linux/seccomp.h
@@ -11,27 +11,34 @@
 #define SECCOMP_MODE_FILTER     2 /* uses user-supplied filter. */
 
 /* Valid operations for seccomp syscall. */
-#define SECCOMP_SET_MODE_STRICT 0
-#define SECCOMP_SET_MODE_FILTER 1
+#define SECCOMP_SET_MODE_STRICT         0
+#define SECCOMP_SET_MODE_FILTER         1
+#define SECCOMP_GET_ACTION_AVAIL        2
 
 /* Valid flags for SECCOMP_SET_MODE_FILTER */
 #define SECCOMP_FILTER_FLAG_TSYNC       1
+#define SECCOMP_FILTER_FLAG_LOG         2
 
 /*
  * All BPF programs must return a 32-bit value.
  * The bottom 16-bits are for optional return data.
- * The upper 16-bits are ordered from least permissive values to most.
+ * The upper 16-bits are ordered from least permissive values to most,
+ * as a signed value (so 0x8000000 is negative).
  *
  * The ordering ensures that a min_t() over composed return values always
  * selects the least permissive choice.
  */
-#define SECCOMP_RET_KILL        0x00000000U /* kill the task immediately */
-#define SECCOMP_RET_TRAP        0x00030000U /* disallow and force a SIGSYS */
-#define SECCOMP_RET_ERRNO       0x00050000U /* returns an errno */
-#define SECCOMP_RET_TRACE       0x7ff00000U /* pass to a tracer or disallow */
-#define SECCOMP_RET_ALLOW       0x7fff0000U /* allow */
+#define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
+#define SECCOMP_RET_KILL_THREAD  0x00000000U /* kill the thread */
+#define SECCOMP_RET_KILL         SECCOMP_RET_KILL_THREAD
+#define SECCOMP_RET_TRAP         0x00030000U /* disallow and force a SIGSYS */
+#define SECCOMP_RET_ERRNO        0x00050000U /* returns an errno */
+#define SECCOMP_RET_TRACE        0x7ff00000U /* pass to a tracer or disallow */
+#define SECCOMP_RET_LOG          0x7ffc0000U /* allow after logging */
+#define SECCOMP_RET_ALLOW        0x7fff0000U /* allow */
 
 /* Masks for the return value sections. */
+#define SECCOMP_RET_ACTION_FULL 0xffff0000U
 #define SECCOMP_RET_ACTION      0x7fff0000U
 #define SECCOMP_RET_DATA        0x0000ffffU
 
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index ce1169af39d7..2a5d63040a0b 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor {
         __u8  iFunction;
 } __attribute__ ((packed));
 
+#define USB_DT_INTERFACE_ASSOCIATION_SIZE       8
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index 9a0b6479fe0c..d4e0b53bfc75 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -261,7 +261,7 @@ struct ib_uverbs_ex_query_device_resp {
         struct ib_uverbs_rss_caps rss_caps;
         __u32  max_wq_type_rq;
         __u32 raw_packet_caps;
-        struct ib_uverbs_tm_caps xrq_caps;
+        struct ib_uverbs_tm_caps tm_caps;
 };
 
 struct ib_uverbs_query_port {
diff --git a/include/xen/arm/page.h b/include/xen/arm/page.h
index 415dbc6e43fd..6adc2a955340 100644
--- a/include/xen/arm/page.h
+++ b/include/xen/arm/page.h
@@ -84,16 +84,6 @@ static inline xmaddr_t arbitrary_virt_to_machine(void *vaddr)
         BUG();
 }
 
-/* TODO: this shouldn't be here but it is because the frontend drivers
- * are using it (its rolled in headers) even though we won't hit the code path.
- * So for right now just punt with this.
- */
-static inline pte_t *lookup_address(unsigned long address, unsigned int *level)
-{
-        BUG();
-        return NULL;
-}
-
 extern int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
                                    struct gnttab_map_grant_ref *kmap_ops,
                                    struct page **pages, unsigned int count);
diff --git a/ipc/shm.c b/ipc/shm.c
index 1b3adfe3c60e..badac463e2c8 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1154,7 +1154,7 @@ static int put_compat_shm_info(struct shm_info *ip,
         info.shm_swp = ip->shm_swp;
         info.swap_attempts = ip->swap_attempts;
         info.swap_successes = ip->swap_successes;
-        return copy_to_user(up, &info, sizeof(info));
+        return copy_to_user(uip, &info, sizeof(info));
 }
 
 static int copy_compat_shmid_to_user(void __user *buf, struct shmid64_ds *in,
@@ -1237,7 +1237,7 @@ COMPAT_SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, void __user *, uptr)
                 err = shmctl_stat(ns, shmid, cmd, &sem64);
                 if (err < 0)
                         return err;
-                if (copy_compat_shmid_to_user(&sem64, uptr, version))
+                if (copy_compat_shmid_to_user(uptr, &sem64, version))
                         err = -EFAULT;
                 return err;
 
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 917cc04a0a94..7b62df86be1d 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1022,7 +1022,7 @@ select_insn:
                 struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2;
                 struct bpf_array *array = container_of(map, struct bpf_array, map);
                 struct bpf_prog *prog;
-                u64 index = BPF_R3;
+                u32 index = BPF_R3;
 
                 if (unlikely(index >= array->map.max_entries))
                         goto out;
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 959c9a07f318..e093d9a2c4dd 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -75,8 +75,8 @@ static u64 dev_map_bitmap_size(const union bpf_attr *attr)
 static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
 {
         struct bpf_dtab *dtab;
+        int err = -EINVAL;
         u64 cost;
-        int err;
 
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
@@ -108,6 +108,8 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
         if (err)
                 goto free_dtab;
 
+        err = -ENOMEM;
+
         /* A per cpu bitfield with a bit per possible net device */
         dtab->flush_needed = __alloc_percpu(dev_map_bitmap_size(attr),
                                             __alignof__(unsigned long));
@@ -128,7 +130,7 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
 free_dtab:
         free_percpu(dtab->flush_needed);
         kfree(dtab);
-        return ERR_PTR(-ENOMEM);
+        return ERR_PTR(err);
 }
 
 static void dev_map_free(struct bpf_map *map)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index cb17e1cd1d43..25d074920a00 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -186,15 +186,17 @@ static int bpf_map_alloc_id(struct bpf_map *map)
 
 static void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock)
 {
+        unsigned long flags;
+
         if (do_idr_lock)
-                spin_lock_bh(&map_idr_lock);
+                spin_lock_irqsave(&map_idr_lock, flags);
         else
                 __acquire(&map_idr_lock);
 
         idr_remove(&map_idr, map->id);
 
         if (do_idr_lock)
-                spin_unlock_bh(&map_idr_lock);
+                spin_unlock_irqrestore(&map_idr_lock, flags);
         else
                 __release(&map_idr_lock);
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 799b2451ef2d..b914fbe1383e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4205,7 +4205,12 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                 }
 
                 if (insn->imm == BPF_FUNC_redirect_map) {
-                        u64 addr = (unsigned long)prog;
+                        /* Note, we cannot use prog directly as imm as subsequent
+                         * rewrites would still change the prog pointer. The only
+                         * stable address we can use is aux, which also works with
+                         * prog clones during blinding.
+                         */
+                        u64 addr = (unsigned long)prog->aux;
                         struct bpf_insn r4_ld[] = {
                                 BPF_LD_IMM64(BPF_REG_4, addr),
                                 *insn,
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index d6551cd45238..44857278eb8a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2311,6 +2311,14 @@ out_release_tset:
                 list_del_init(&cset->mg_node);
         }
         spin_unlock_irq(&css_set_lock);
+
+        /*
+         * Re-initialize the cgroup_taskset structure in case it is reused
+         * again in another cgroup_migrate_add_task()/cgroup_migrate_execute()
+         * iteration.
+         */
+        tset->nr_tasks = 0;
+        tset->csets    = &tset->src_csets;
         return ret;
 }
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index acf5308fad51..d851df22f5c5 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -24,6 +24,7 @@
 #include <linux/lockdep.h>
 #include <linux/tick.h>
 #include <linux/irq.h>
+#include <linux/nmi.h>
 #include <linux/smpboot.h>
 #include <linux/relay.h>
 #include <linux/slab.h>
@@ -46,11 +47,13 @@
  * @bringup:    Single callback bringup or teardown selector
  * @cb_state:   The state for a single callback (install/uninstall)
  * @result:     Result of the operation
- * @done:       Signal completion to the issuer of the task
+ * @done_up:    Signal completion to the issuer of the task for cpu-up
+ * @done_down:  Signal completion to the issuer of the task for cpu-down
  */
 struct cpuhp_cpu_state {
         enum cpuhp_state        state;
         enum cpuhp_state        target;
+        enum cpuhp_state        fail;
 #ifdef CONFIG_SMP
         struct task_struct      *thread;
         bool                    should_run;
@@ -58,18 +61,39 @@ struct cpuhp_cpu_state {
         bool                    single;
         bool                    bringup;
         struct hlist_node       *node;
+        struct hlist_node       *last;
         enum cpuhp_state        cb_state;
         int                     result;
-        struct completion       done;
+        struct completion       done_up;
+        struct completion       done_down;
 #endif
 };
 
-static DEFINE_PER_CPU(struct cpuhp_cpu_state, cpuhp_state);
+static DEFINE_PER_CPU(struct cpuhp_cpu_state, cpuhp_state) = {
+        .fail = CPUHP_INVALID,
+};
 
 #if defined(CONFIG_LOCKDEP) && defined(CONFIG_SMP)
-static struct lock_class_key cpuhp_state_key;
-static struct lockdep_map cpuhp_state_lock_map =
-        STATIC_LOCKDEP_MAP_INIT("cpuhp_state", &cpuhp_state_key);
+static struct lockdep_map cpuhp_state_up_map =
+        STATIC_LOCKDEP_MAP_INIT("cpuhp_state-up", &cpuhp_state_up_map);
+static struct lockdep_map cpuhp_state_down_map =
+        STATIC_LOCKDEP_MAP_INIT("cpuhp_state-down", &cpuhp_state_down_map);
+
+
+static void inline cpuhp_lock_acquire(bool bringup)
+{
+        lock_map_acquire(bringup ? &cpuhp_state_up_map : &cpuhp_state_down_map);
+}
+
+static void inline cpuhp_lock_release(bool bringup)
+{
+        lock_map_release(bringup ? &cpuhp_state_up_map : &cpuhp_state_down_map);
+}
+#else
+
+static void inline cpuhp_lock_acquire(bool bringup) { }
+static void inline cpuhp_lock_release(bool bringup) { }
+
 #endif
 
 /**
@@ -123,13 +147,16 @@ static struct cpuhp_step *cpuhp_get_step(enum cpuhp_state state)
 /**
  * cpuhp_invoke_callback _ Invoke the callbacks for a given state
  * @cpu:        The cpu for which the callback should be invoked
- * @step:       The step in the state machine
+ * @state:      The state to do callbacks for
  * @bringup:    True if the bringup callback should be invoked
+ * @node:       For multi-instance, do a single entry callback for install/remove
+ * @lastp:      For multi-instance rollback, remember how far we got
  *
  * Called from cpu hotplug and from the state register machinery.
  */
 static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
-                                 bool bringup, struct hlist_node *node)
+                                 bool bringup, struct hlist_node *node,
+                                 struct hlist_node **lastp)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
         struct cpuhp_step *step = cpuhp_get_step(state);
@@ -137,7 +164,17 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
         int (*cb)(unsigned int cpu);
         int ret, cnt;
 
+        if (st->fail == state) {
+                st->fail = CPUHP_INVALID;
+
+                if (!(bringup ? step->startup.single : step->teardown.single))
+                        return 0;
+
+                return -EAGAIN;
+        }
+
         if (!step->multi_instance) {
+                WARN_ON_ONCE(lastp && *lastp);
                 cb = bringup ? step->startup.single : step->teardown.single;
                 if (!cb)
                         return 0;
@@ -152,6 +189,7 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
 
         /* Single invocation for instance add/remove */
         if (node) {
+                WARN_ON_ONCE(lastp && *lastp);
                 trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
                 ret = cbm(cpu, node);
                 trace_cpuhp_exit(cpu, st->state, state, ret);
@@ -161,13 +199,23 @@ static int cpuhp_invoke_callback(unsigned int cpu, enum cpuhp_state state,
         /* State transition. Invoke on all instances */
         cnt = 0;
         hlist_for_each(node, &step->list) {
+                if (lastp && node == *lastp)
+                        break;
+
                 trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
                 ret = cbm(cpu, node);
                 trace_cpuhp_exit(cpu, st->state, state, ret);
-                if (ret)
-                        goto err;
+                if (ret) {
+                        if (!lastp)
+                                goto err;
+
+                        *lastp = node;
+                        return ret;
+                }
                 cnt++;
         }
+        if (lastp)
+                *lastp = NULL;
         return 0;
 err:
         /* Rollback the instances if one failed */
@@ -178,12 +226,39 @@ err:
         hlist_for_each(node, &step->list) {
                 if (!cnt--)
                         break;
-                cbm(cpu, node);
+
+                trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
+                ret = cbm(cpu, node);
+                trace_cpuhp_exit(cpu, st->state, state, ret);
+                /*
+                 * Rollback must not fail,
+                 */
+                WARN_ON_ONCE(ret);
         }
         return ret;
 }
 
 #ifdef CONFIG_SMP
+static inline void wait_for_ap_thread(struct cpuhp_cpu_state *st, bool bringup)
+{
+        struct completion *done = bringup ? &st->done_up : &st->done_down;
+        wait_for_completion(done);
+}
+
+static inline void complete_ap_thread(struct cpuhp_cpu_state *st, bool bringup)
+{
+        struct completion *done = bringup ? &st->done_up : &st->done_down;
+        complete(done);
+}
+
+/*
+ * The former STARTING/DYING states, ran with IRQs disabled and must not fail.
+ */
+static bool cpuhp_is_atomic_state(enum cpuhp_state state)
+{
+        return CPUHP_AP_IDLE_DEAD <= state && state < CPUHP_AP_ONLINE;
+}
+
 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
 static DEFINE_MUTEX(cpu_add_remove_lock);
 bool cpuhp_tasks_frozen;
@@ -271,14 +346,79 @@ void cpu_hotplug_enable(void)
 EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
 #endif  /* CONFIG_HOTPLUG_CPU */
 
-static void __cpuhp_kick_ap_work(struct cpuhp_cpu_state *st);
+static inline enum cpuhp_state
+cpuhp_set_state(struct cpuhp_cpu_state *st, enum cpuhp_state target)
+{
+        enum cpuhp_state prev_state = st->state;
+
+        st->rollback = false;
+        st->last = NULL;
+
+        st->target = target;
+        st->single = false;
+        st->bringup = st->state < target;
+
+        return prev_state;
+}
+
+static inline void
+cpuhp_reset_state(struct cpuhp_cpu_state *st, enum cpuhp_state prev_state)
+{
+        st->rollback = true;
+
+        /*
+         * If we have st->last we need to undo partial multi_instance of this
+         * state first. Otherwise start undo at the previous state.
+         */
+        if (!st->last) {
+                if (st->bringup)
+                        st->state--;
+                else
+                        st->state++;
+        }
+
+        st->target = prev_state;
+        st->bringup = !st->bringup;
+}
+
+/* Regular hotplug invocation of the AP hotplug thread */
+static void __cpuhp_kick_ap(struct cpuhp_cpu_state *st)
+{
+        if (!st->single && st->state == st->target)
+                return;
+
+        st->result = 0;
+        /*
+         * Make sure the above stores are visible before should_run becomes
+         * true. Paired with the mb() above in cpuhp_thread_fun()
+         */
+        smp_mb();
+        st->should_run = true;
+        wake_up_process(st->thread);
+        wait_for_ap_thread(st, st->bringup);
+}
+
+static int cpuhp_kick_ap(struct cpuhp_cpu_state *st, enum cpuhp_state target)
+{
+        enum cpuhp_state prev_state;
+        int ret;
+
+        prev_state = cpuhp_set_state(st, target);
+        __cpuhp_kick_ap(st);
+        if ((ret = st->result)) {
+                cpuhp_reset_state(st, prev_state);
+                __cpuhp_kick_ap(st);
+        }
+
+        return ret;
+}
 
 static int bringup_wait_for_ap(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
 
         /* Wait for the CPU to reach CPUHP_AP_ONLINE_IDLE */
-        wait_for_completion(&st->done);
+        wait_for_ap_thread(st, true);
         if (WARN_ON_ONCE((!cpu_online(cpu))))
                 return -ECANCELED;
 
@@ -286,12 +426,10 @@ static int bringup_wait_for_ap(unsigned int cpu)
         stop_machine_unpark(cpu);
         kthread_unpark(st->thread);
 
-        /* Should we go further up ? */
-        if (st->target > CPUHP_AP_ONLINE_IDLE) {
-                __cpuhp_kick_ap_work(st);
-                wait_for_completion(&st->done);
-        }
-        return st->result;
+        if (st->target <= CPUHP_AP_ONLINE_IDLE)
+                return 0;
+
+        return cpuhp_kick_ap(st, st->target);
 }
 
 static int bringup_cpu(unsigned int cpu)
@@ -317,32 +455,6 @@ static int bringup_cpu(unsigned int cpu)
 /*
  * Hotplug state machine related functions
  */
-static void undo_cpu_down(unsigned int cpu, struct cpuhp_cpu_state *st)
-{
-        for (st->state++; st->state < st->target; st->state++) {
-                struct cpuhp_step *step = cpuhp_get_step(st->state);
-
-                if (!step->skip_onerr)
-                        cpuhp_invoke_callback(cpu, st->state, true, NULL);
-        }
-}
-
-static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
-                                enum cpuhp_state target)
-{
-        enum cpuhp_state prev_state = st->state;
-        int ret = 0;
-
-        for (; st->state > target; st->state--) {
-                ret = cpuhp_invoke_callback(cpu, st->state, false, NULL);
-                if (ret) {
-                        st->target = prev_state;
-                        undo_cpu_down(cpu, st);
-                        break;
-                }
-        }
-        return ret;
-}
 
 static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
 {
@@ -350,7 +462,7 @@ static void undo_cpu_up(unsigned int cpu, struct cpuhp_cpu_state *st)
                 struct cpuhp_step *step = cpuhp_get_step(st->state);
 
                 if (!step->skip_onerr)
-                        cpuhp_invoke_callback(cpu, st->state, false, NULL);
+                        cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
         }
 }
 
@@ -362,7 +474,7 @@ static int cpuhp_up_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
 
         while (st->state < target) {
                 st->state++;
-                ret = cpuhp_invoke_callback(cpu, st->state, true, NULL);
+                ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
                 if (ret) {
                         st->target = prev_state;
                         undo_cpu_up(cpu, st);
@@ -379,7 +491,8 @@ static void cpuhp_create(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
 
-        init_completion(&st->done);
+        init_completion(&st->done_up);
+        init_completion(&st->done_down);
 }
 
 static int cpuhp_should_run(unsigned int cpu)
@@ -389,69 +502,90 @@ static int cpuhp_should_run(unsigned int cpu)
         return st->should_run;
 }
 
-/* Execute the teardown callbacks. Used to be CPU_DOWN_PREPARE */
-static int cpuhp_ap_offline(unsigned int cpu, struct cpuhp_cpu_state *st)
-{
-        enum cpuhp_state target = max((int)st->target, CPUHP_TEARDOWN_CPU);
-
-        return cpuhp_down_callbacks(cpu, st, target);
-}
-
-/* Execute the online startup callbacks. Used to be CPU_ONLINE */
-static int cpuhp_ap_online(unsigned int cpu, struct cpuhp_cpu_state *st)
-{
-        return cpuhp_up_callbacks(cpu, st, st->target);
-}
-
 /*
  * Execute teardown/startup callbacks on the plugged cpu. Also used to invoke
  * callbacks when a state gets [un]installed at runtime.
+ *
+ * Each invocation of this function by the smpboot thread does a single AP
+ * state callback.
+ *
+ * It has 3 modes of operation:
+ *  - single: runs st->cb_state
+ *  - up:     runs ++st->state, while st->state < st->target
+ *  - down:   runs st->state--, while st->state > st->target
+ *
+ * When complete or on error, should_run is cleared and the completion is fired.
  */
 static void cpuhp_thread_fun(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = this_cpu_ptr(&cpuhp_state);
-        int ret = 0;
+        bool bringup = st->bringup;
+        enum cpuhp_state state;
 
         /*
-         * Paired with the mb() in cpuhp_kick_ap_work and
-         * cpuhp_invoke_ap_callback, so the work set is consistent visible.
+         * ACQUIRE for the cpuhp_should_run() load of ->should_run. Ensures
+         * that if we see ->should_run we also see the rest of the state.
          */
         smp_mb();
-        if (!st->should_run)
+
+        if (WARN_ON_ONCE(!st->should_run))
                 return;
 
-        st->should_run = false;
+        cpuhp_lock_acquire(bringup);
 
-        lock_map_acquire(&cpuhp_state_lock_map);
-        /* Single callback invocation for [un]install ? */
         if (st->single) {
-                if (st->cb_state < CPUHP_AP_ONLINE) {
-                        local_irq_disable();
-                        ret = cpuhp_invoke_callback(cpu, st->cb_state,
-                                                    st->bringup, st->node);
-                        local_irq_enable();
+                state = st->cb_state;
+                st->should_run = false;
+        } else {
+                if (bringup) {
+                        st->state++;
+                        state = st->state;
+                        st->should_run = (st->state < st->target);
+                        WARN_ON_ONCE(st->state > st->target);
                 } else {
-                        ret = cpuhp_invoke_callback(cpu, st->cb_state,
-                                                    st->bringup, st->node);
+                        state = st->state;
+                        st->state--;
+                        st->should_run = (st->state > st->target);
+                        WARN_ON_ONCE(st->state < st->target);
                 }
-        } else if (st->rollback) {
-                BUG_ON(st->state < CPUHP_AP_ONLINE_IDLE);
+        }
+
+        WARN_ON_ONCE(!cpuhp_is_ap_state(state));
+
+        if (st->rollback) {
+                struct cpuhp_step *step = cpuhp_get_step(state);
+                if (step->skip_onerr)
+                        goto next;
+        }
+
+        if (cpuhp_is_atomic_state(state)) {
+                local_irq_disable();
+                st->result = cpuhp_invoke_callback(cpu, state, bringup, st->node, &st->last);
+                local_irq_enable();
 
-                undo_cpu_down(cpu, st);
-                st->rollback = false;
+                /*
+                 * STARTING/DYING must not fail!
+                 */
+                WARN_ON_ONCE(st->result);
         } else {
-                /* Cannot happen .... */
-                BUG_ON(st->state < CPUHP_AP_ONLINE_IDLE);
-
-                /* Regular hotplug work */
-                if (st->state < st->target)
-                        ret = cpuhp_ap_online(cpu, st);
-                else if (st->state > st->target)
-                        ret = cpuhp_ap_offline(cpu, st);
+                st->result = cpuhp_invoke_callback(cpu, state, bringup, st->node, &st->last);
+        }
+
+        if (st->result) {
+                /*
+                 * If we fail on a rollback, we're up a creek without no
+                 * paddle, no way forward, no way back. We loose, thanks for
+                 * playing.
+                 */
+                WARN_ON_ONCE(st->rollback);
+                st->should_run = false;
         }
-        lock_map_release(&cpuhp_state_lock_map);
-        st->result = ret;
-        complete(&st->done);
+
+next:
+        cpuhp_lock_release(bringup);
+
+        if (!st->should_run)
+                complete_ap_thread(st, bringup);
 }
 
 /* Invoke a single callback on a remote cpu */
@@ -460,62 +594,64 @@ cpuhp_invoke_ap_callback(int cpu, enum cpuhp_state state, bool bringup,
                          struct hlist_node *node)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
+        int ret;
 
         if (!cpu_online(cpu))
                 return 0;
 
-        lock_map_acquire(&cpuhp_state_lock_map);
-        lock_map_release(&cpuhp_state_lock_map);
+        cpuhp_lock_acquire(false);
+        cpuhp_lock_release(false);
+
+        cpuhp_lock_acquire(true);
+        cpuhp_lock_release(true);
 
         /*
          * If we are up and running, use the hotplug thread. For early calls
          * we invoke the thread function directly.
          */
         if (!st->thread)
-                return cpuhp_invoke_callback(cpu, state, bringup, node);
+                return cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
+
+        st->rollback = false;
+        st->last = NULL;
 
+        st->node = node;
+        st->bringup = bringup;
         st->cb_state = state;
         st->single = true;
-        st->bringup = bringup;
-        st->node = node;
 
-        /*
-         * Make sure the above stores are visible before should_run becomes
-         * true. Paired with the mb() above in cpuhp_thread_fun()
-         */
-        smp_mb();
-        st->should_run = true;
-        wake_up_process(st->thread);
-        wait_for_completion(&st->done);
-        return st->result;
-}
+        __cpuhp_kick_ap(st);
 
-/* Regular hotplug invocation of the AP hotplug thread */
-static void __cpuhp_kick_ap_work(struct cpuhp_cpu_state *st)
-{
-        st->result = 0;
-        st->single = false;
         /*
-         * Make sure the above stores are visible before should_run becomes
-         * true. Paired with the mb() above in cpuhp_thread_fun()
+         * If we failed and did a partial, do a rollback.
          */
-        smp_mb();
-        st->should_run = true;
-        wake_up_process(st->thread);
+        if ((ret = st->result) && st->last) {
+                st->rollback = true;
+                st->bringup = !bringup;
+
+                __cpuhp_kick_ap(st);
+        }
+
+        return ret;
 }
 
 static int cpuhp_kick_ap_work(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
-        enum cpuhp_state state = st->state;
+        enum cpuhp_state prev_state = st->state;
+        int ret;
+
+        cpuhp_lock_acquire(false);
+        cpuhp_lock_release(false);
 
-        trace_cpuhp_enter(cpu, st->target, state, cpuhp_kick_ap_work);
-        lock_map_acquire(&cpuhp_state_lock_map);
-        lock_map_release(&cpuhp_state_lock_map);
-        __cpuhp_kick_ap_work(st);
-        wait_for_completion(&st->done);
-        trace_cpuhp_exit(cpu, st->state, state, st->result);
-        return st->result;
+        cpuhp_lock_acquire(true);
+        cpuhp_lock_release(true);
+
+        trace_cpuhp_enter(cpu, st->target, prev_state, cpuhp_kick_ap_work);
+        ret = cpuhp_kick_ap(st, st->target);
+        trace_cpuhp_exit(cpu, st->state, prev_state, ret);
+
+        return ret;
 }
 
 static struct smp_hotplug_thread cpuhp_threads = {
@@ -581,6 +717,7 @@ static int take_cpu_down(void *_param)
         struct cpuhp_cpu_state *st = this_cpu_ptr(&cpuhp_state);
         enum cpuhp_state target = max((int)st->target, CPUHP_AP_OFFLINE);
         int err, cpu = smp_processor_id();
+        int ret;
 
         /* Ensure this CPU doesn't handle any more interrupts. */
         err = __cpu_disable();
@@ -594,8 +731,13 @@ static int take_cpu_down(void *_param)
         WARN_ON(st->state != CPUHP_TEARDOWN_CPU);
         st->state--;
         /* Invoke the former CPU_DYING callbacks */
-        for (; st->state > target; st->state--)
-                cpuhp_invoke_callback(cpu, st->state, false, NULL);
+        for (; st->state > target; st->state--) {
+                ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
+                /*
+                 * DYING must not fail!
+                 */
+                WARN_ON_ONCE(ret);
+        }
 
         /* Give up timekeeping duties */
         tick_handover_do_timer();
@@ -639,7 +781,7 @@ static int takedown_cpu(unsigned int cpu)
          *
          * Wait for the stop thread to go away.
          */
-        wait_for_completion(&st->done);
+        wait_for_ap_thread(st, false);
         BUG_ON(st->state != CPUHP_AP_IDLE_DEAD);
 
         /* Interrupts are moved away from the dying cpu, reenable alloc/free */
@@ -658,7 +800,7 @@ static void cpuhp_complete_idle_dead(void *arg)
 {
         struct cpuhp_cpu_state *st = arg;
 
-        complete(&st->done);
+        complete_ap_thread(st, false);
 }
 
 void cpuhp_report_idle_dead(void)
@@ -676,11 +818,32 @@ void cpuhp_report_idle_dead(void)
                                  cpuhp_complete_idle_dead, st, 0);
 }
 
-#else
-#define takedown_cpu            NULL
-#endif
+static void undo_cpu_down(unsigned int cpu, struct cpuhp_cpu_state *st)
+{
+        for (st->state++; st->state < st->target; st->state++) {
+                struct cpuhp_step *step = cpuhp_get_step(st->state);
 
-#ifdef CONFIG_HOTPLUG_CPU
+                if (!step->skip_onerr)
+                        cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
+        }
+}
+
+static int cpuhp_down_callbacks(unsigned int cpu, struct cpuhp_cpu_state *st,
+                                enum cpuhp_state target)
+{
+        enum cpuhp_state prev_state = st->state;
+        int ret = 0;
+
+        for (; st->state > target; st->state--) {
+                ret = cpuhp_invoke_callback(cpu, st->state, false, NULL, NULL);
+                if (ret) {
+                        st->target = prev_state;
+                        undo_cpu_down(cpu, st);
+                        break;
+                }
+        }
+        return ret;
+}
 
 /* Requires cpu_add_remove_lock to be held */
 static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
@@ -699,13 +862,13 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
 
         cpuhp_tasks_frozen = tasks_frozen;
 
-        prev_state = st->state;
-        st->target = target;
+        prev_state = cpuhp_set_state(st, target);
         /*
          * If the current CPU state is in the range of the AP hotplug thread,
          * then we need to kick the thread.
          */
         if (st->state > CPUHP_TEARDOWN_CPU) {
+                st->target = max((int)target, CPUHP_TEARDOWN_CPU);
                 ret = cpuhp_kick_ap_work(cpu);
                 /*
                  * The AP side has done the error rollback already. Just
@@ -720,6 +883,8 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
                  */
                 if (st->state > CPUHP_TEARDOWN_CPU)
                         goto out;
+
+                st->target = target;
         }
         /*
          * The AP brought itself down to CPUHP_TEARDOWN_CPU. So we need
@@ -727,13 +892,17 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen,
          */
         ret = cpuhp_down_callbacks(cpu, st, target);
         if (ret && st->state > CPUHP_TEARDOWN_CPU && st->state < prev_state) {
-                st->target = prev_state;
-                st->rollback = true;
-                cpuhp_kick_ap_work(cpu);
+                cpuhp_reset_state(st, prev_state);
+                __cpuhp_kick_ap(st);
         }
 
 out:
         cpus_write_unlock();
+        /*
+         * Do post unplug cleanup. This is still protected against
+         * concurrent CPU hotplug via cpu_add_remove_lock.
+         */
+        lockup_detector_cleanup();
         return ret;
 }
 
@@ -754,11 +923,15 @@ out:
         cpu_maps_update_done();
         return err;
 }
+
 int cpu_down(unsigned int cpu)
 {
         return do_cpu_down(cpu, CPUHP_OFFLINE);
 }
 EXPORT_SYMBOL(cpu_down);
+
+#else
+#define takedown_cpu            NULL
 #endif /*CONFIG_HOTPLUG_CPU*/
 
 /**
@@ -772,11 +945,16 @@ void notify_cpu_starting(unsigned int cpu)
 {
         struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, cpu);
         enum cpuhp_state target = min((int)st->target, CPUHP_AP_ONLINE);
+        int ret;
 
         rcu_cpu_starting(cpu);  /* Enables RCU usage on this CPU. */
         while (st->state < target) {
                 st->state++;
-                cpuhp_invoke_callback(cpu, st->state, true, NULL);
+                ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL);
+                /*
+                 * STARTING must not fail!
+                 */
+                WARN_ON_ONCE(ret);
         }
 }
 
@@ -794,7 +972,7 @@ void cpuhp_online_idle(enum cpuhp_state state)
                 return;
 
         st->state = CPUHP_AP_ONLINE_IDLE;
-        complete(&st->done);
+        complete_ap_thread(st, true);
 }
 
 /* Requires cpu_add_remove_lock to be held */
@@ -829,7 +1007,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen, enum cpuhp_state target)
 
         cpuhp_tasks_frozen = tasks_frozen;
 
-        st->target = target;
+        cpuhp_set_state(st, target);
         /*
          * If the current CPU state is in the range of the AP hotplug thread,
          * then we need to kick the thread once more.
@@ -1296,6 +1474,10 @@ static int cpuhp_issue_call(int cpu, enum cpuhp_state state, bool bringup,
         struct cpuhp_step *sp = cpuhp_get_step(state);
         int ret;
 
+        /*
+         * If there's nothing to do, we done.
+         * Relies on the union for multi_instance.
+         */
         if ((bringup && !sp->startup.single) ||
             (!bringup && !sp->teardown.single))
                 return 0;
@@ -1307,9 +1489,9 @@ static int cpuhp_issue_call(int cpu, enum cpuhp_state state, bool bringup,
         if (cpuhp_is_ap_state(state))
                 ret = cpuhp_invoke_ap_callback(cpu, state, bringup, node);
         else
-                ret = cpuhp_invoke_callback(cpu, state, bringup, node);
+                ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
 #else
-        ret = cpuhp_invoke_callback(cpu, state, bringup, node);
+        ret = cpuhp_invoke_callback(cpu, state, bringup, node, NULL);
 #endif
         BUG_ON(ret && !bringup);
         return ret;
@@ -1641,9 +1823,55 @@ static ssize_t show_cpuhp_target(struct device *dev,
 }
 static DEVICE_ATTR(target, 0644, show_cpuhp_target, write_cpuhp_target);
 
+
+static ssize_t write_cpuhp_fail(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, dev->id);
+        struct cpuhp_step *sp;
+        int fail, ret;
+
+        ret = kstrtoint(buf, 10, &fail);
+        if (ret)
+                return ret;
+
+        /*
+         * Cannot fail STARTING/DYING callbacks.
+         */
+        if (cpuhp_is_atomic_state(fail))
+                return -EINVAL;
+
+        /*
+         * Cannot fail anything that doesn't have callbacks.
+         */
+        mutex_lock(&cpuhp_state_mutex);
+        sp = cpuhp_get_step(fail);
+        if (!sp->startup.single && !sp->teardown.single)
+                ret = -EINVAL;
+        mutex_unlock(&cpuhp_state_mutex);
+        if (ret)
+                return ret;
+
+        st->fail = fail;
+
+        return count;
+}
+
+static ssize_t show_cpuhp_fail(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct cpuhp_cpu_state *st = per_cpu_ptr(&cpuhp_state, dev->id);
+
+        return sprintf(buf, "%d\n", st->fail);
+}
+
+static DEVICE_ATTR(fail, 0644, show_cpuhp_fail, write_cpuhp_fail);
+
 static struct attribute *cpuhp_cpu_attrs[] = {
         &dev_attr_state.attr,
         &dev_attr_target.attr,
+        &dev_attr_fail.attr,
         NULL
 };
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3e691b75b2db..6bc21e202ae4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8171,6 +8171,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd)
                 }
         }
         event->tp_event->prog = prog;
+        event->tp_event->bpf_prog_owner = event;
 
         return 0;
 }
@@ -8185,7 +8186,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
                 return;
 
         prog = event->tp_event->prog;
-        if (prog) {
+        if (prog && event->tp_event->bpf_prog_owner == event) {
                 event->tp_event->prog = NULL;
                 bpf_prog_put(prog);
         }
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index af71a84e12ee..f684d8e5fa2b 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -412,6 +412,19 @@ err:
         return NULL;
 }
 
+static bool __always_inline rb_need_aux_wakeup(struct ring_buffer *rb)
+{
+        if (rb->aux_overwrite)
+                return false;
+
+        if (rb->aux_head - rb->aux_wakeup >= rb->aux_watermark) {
+                rb->aux_wakeup = rounddown(rb->aux_head, rb->aux_watermark);
+                return true;
+        }
+
+        return false;
+}
+
 /*
  * Commit the data written by hardware into the ring buffer by adjusting
  * aux_head and posting a PERF_RECORD_AUX into the perf buffer. It is the
@@ -451,10 +464,8 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
         }
 
         rb->user_page->aux_head = rb->aux_head;
-        if (rb->aux_head - rb->aux_wakeup >= rb->aux_watermark) {
+        if (rb_need_aux_wakeup(rb))
                 wakeup = true;
-                rb->aux_wakeup = rounddown(rb->aux_head, rb->aux_watermark);
-        }
 
         if (wakeup) {
                 if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED)
@@ -484,9 +495,8 @@ int perf_aux_output_skip(struct perf_output_handle *handle, unsigned long size)
         rb->aux_head += size;
 
         rb->user_page->aux_head = rb->aux_head;
-        if (rb->aux_head - rb->aux_wakeup >= rb->aux_watermark) {
+        if (rb_need_aux_wakeup(rb)) {
                 perf_output_wakeup(handle);
-                rb->aux_wakeup = rounddown(rb->aux_head, rb->aux_watermark);
                 handle->wakeup = rb->aux_wakeup + rb->aux_watermark;
         }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 3481ababd06a..f2cd53e92147 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1600,12 +1600,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
         struct waitid_info info = {.status = 0};
         long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
         int signo = 0;
+
         if (err > 0) {
                 signo = SIGCHLD;
                 err = 0;
-        }
-
-        if (!err) {
                 if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
                         return -EFAULT;
         }
@@ -1723,16 +1721,15 @@ COMPAT_SYSCALL_DEFINE5(waitid,
         if (err > 0) {
                 signo = SIGCHLD;
                 err = 0;
-        }
-
-        if (!err && uru) {
-                /* kernel_waitid() overwrites everything in ru */
-                if (COMPAT_USE_64BIT_TIME)
-                        err = copy_to_user(uru, &ru, sizeof(ru));
-                else
-                        err = put_compat_rusage(&ru, uru);
-                if (err)
-                        return -EFAULT;
+                if (uru) {
+                        /* kernel_waitid() overwrites everything in ru */
+                        if (COMPAT_USE_64BIT_TIME)
+                                err = copy_to_user(uru, &ru, sizeof(ru));
+                        else
+                                err = put_compat_rusage(&ru, uru);
+                        if (err)
+                                return -EFAULT;
+                }
         }
 
         if (!infop)
diff --git a/kernel/extable.c b/kernel/extable.c
index 38c2412401a1..9aa1cc41ecf7 100644
--- a/kernel/extable.c
+++ b/kernel/extable.c
@@ -102,15 +102,7 @@ int core_kernel_data(unsigned long addr)
 
 int __kernel_text_address(unsigned long addr)
 {
-        if (core_kernel_text(addr))
-                return 1;
-        if (is_module_text_address(addr))
-                return 1;
-        if (is_ftrace_trampoline(addr))
-                return 1;
-        if (is_kprobe_optinsn_slot(addr) || is_kprobe_insn_slot(addr))
-                return 1;
-        if (is_bpf_text_address(addr))
+        if (kernel_text_address(addr))
                 return 1;
         /*
          * There might be init symbols in saved stacktraces.
@@ -127,17 +119,42 @@ int __kernel_text_address(unsigned long addr)
 
 int kernel_text_address(unsigned long addr)
 {
+        bool no_rcu;
+        int ret = 1;
+
         if (core_kernel_text(addr))
                 return 1;
+
+        /*
+         * If a stack dump happens while RCU is not watching, then
+         * RCU needs to be notified that it requires to start
+         * watching again. This can happen either by tracing that
+         * triggers a stack trace, or a WARN() that happens during
+         * coming back from idle, or cpu on or offlining.
+         *
+         * is_module_text_address() as well as the kprobe slots
+         * and is_bpf_text_address() require RCU to be watching.
+         */
+        no_rcu = !rcu_is_watching();
+
+        /* Treat this like an NMI as it can happen anywhere */
+        if (no_rcu)
+                rcu_nmi_enter();
+
         if (is_module_text_address(addr))
-                return 1;
+                goto out;
         if (is_ftrace_trampoline(addr))
-                return 1;
+                goto out;
         if (is_kprobe_optinsn_slot(addr) || is_kprobe_insn_slot(addr))
-                return 1;
+                goto out;
         if (is_bpf_text_address(addr))
-                return 1;
-        return 0;
+                goto out;
+        ret = 0;
+out:
+        if (no_rcu)
+                rcu_nmi_exit();
+
+        return ret;
 }
 
 /*
diff --git a/kernel/fork.c b/kernel/fork.c
index 10646182440f..e702cb9ffbd8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -946,6 +946,24 @@ void mmput(struct mm_struct *mm)
 }
 EXPORT_SYMBOL_GPL(mmput);
 
+#ifdef CONFIG_MMU
+static void mmput_async_fn(struct work_struct *work)
+{
+        struct mm_struct *mm = container_of(work, struct mm_struct,
+                                            async_put_work);
+
+        __mmput(mm);
+}
+
+void mmput_async(struct mm_struct *mm)
+{
+        if (atomic_dec_and_test(&mm->mm_users)) {
+                INIT_WORK(&mm->async_put_work, mmput_async_fn);
+                schedule_work(&mm->async_put_work);
+        }
+}
+#endif
+
 /**
  * set_mm_exe_file - change a reference to the mm's executable file
  *
diff --git a/kernel/futex.c b/kernel/futex.c
index 3d38eaf05492..0518a0bfc746 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -821,8 +821,6 @@ static void get_pi_state(struct futex_pi_state *pi_state)
 /*
  * Drops a reference to the pi_state object and frees or caches it
  * when the last reference is gone.
- *
- * Must be called with the hb lock held.
  */
 static void put_pi_state(struct futex_pi_state *pi_state)
 {
@@ -837,16 +835,22 @@ static void put_pi_state(struct futex_pi_state *pi_state)
          * and has cleaned up the pi_state already
          */
         if (pi_state->owner) {
-                raw_spin_lock_irq(&pi_state->owner->pi_lock);
-                list_del_init(&pi_state->list);
-                raw_spin_unlock_irq(&pi_state->owner->pi_lock);
+                struct task_struct *owner;
 
-                rt_mutex_proxy_unlock(&pi_state->pi_mutex, pi_state->owner);
+                raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+                owner = pi_state->owner;
+                if (owner) {
+                        raw_spin_lock(&owner->pi_lock);
+                        list_del_init(&pi_state->list);
+                        raw_spin_unlock(&owner->pi_lock);
+                }
+                rt_mutex_proxy_unlock(&pi_state->pi_mutex, owner);
+                raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
         }
 
-        if (current->pi_state_cache)
+        if (current->pi_state_cache) {
                 kfree(pi_state);
-        else {
+        } else {
                 /*
                  * pi_state->list is already empty.
                  * clear pi_state->owner.
@@ -907,13 +911,14 @@ void exit_pi_state_list(struct task_struct *curr)
                 raw_spin_unlock_irq(&curr->pi_lock);
 
                 spin_lock(&hb->lock);
-
-                raw_spin_lock_irq(&curr->pi_lock);
+                raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+                raw_spin_lock(&curr->pi_lock);
                 /*
                  * We dropped the pi-lock, so re-check whether this
                  * task still owns the PI-state:
                  */
                 if (head->next != next) {
+                        raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
                         spin_unlock(&hb->lock);
                         continue;
                 }
@@ -922,9 +927,10 @@ void exit_pi_state_list(struct task_struct *curr)
                 WARN_ON(list_empty(&pi_state->list));
                 list_del_init(&pi_state->list);
                 pi_state->owner = NULL;
-                raw_spin_unlock_irq(&curr->pi_lock);
+                raw_spin_unlock(&curr->pi_lock);
 
                 get_pi_state(pi_state);
+                raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
                 spin_unlock(&hb->lock);
 
                 rt_mutex_futex_unlock(&pi_state->pi_mutex);
@@ -1208,6 +1214,10 @@ static int attach_to_pi_owner(u32 uval, union futex_key *key,
 
         WARN_ON(!list_empty(&pi_state->list));
         list_add(&pi_state->list, &p->pi_state_list);
+        /*
+         * Assignment without holding pi_state->pi_mutex.wait_lock is safe
+         * because there is no concurrency as the object is not published yet.
+         */
         pi_state->owner = p;
         raw_spin_unlock_irq(&p->pi_lock);
 
@@ -2878,6 +2888,7 @@ retry:
                 raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
                 spin_unlock(&hb->lock);
 
+                /* drops pi_state->pi_mutex.wait_lock */
                 ret = wake_futex_pi(uaddr, uval, pi_state);
 
                 put_pi_state(pi_state);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index f51b7b6d2451..6fc89fd93824 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -202,7 +202,7 @@ __irq_startup_managed(struct irq_desc *desc, struct cpumask *aff, bool force)
 
         irqd_clr_managed_shutdown(d);
 
-        if (cpumask_any_and(aff, cpu_online_mask) > nr_cpu_ids) {
+        if (cpumask_any_and(aff, cpu_online_mask) >= nr_cpu_ids) {
                 /*
                  * Catch code which fiddles with enable_irq() on a managed
                  * and potentially shutdown IRQ. Chained interrupt
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index f7086b78ad6e..5270a54b9fa4 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -322,7 +322,6 @@ int __irq_alloc_domain_generic_chips(struct irq_domain *d, int irqs_per_chip,
                 /* Calc pointer to the next generic chip */
                 tmp += sizeof(*gc) + num_ct * sizeof(struct irq_chip_type);
         }
-        d->name = name;
         return 0;
 }
 EXPORT_SYMBOL_GPL(__irq_alloc_domain_generic_chips);
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e84b7056bb08..ac4644e92b49 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -945,7 +945,7 @@ static int virq_debug_show(struct seq_file *m, void *private)
         struct irq_desc *desc;
         struct irq_domain *domain;
         struct radix_tree_iter iter;
-        void **slot;
+        void __rcu **slot;
         int i;
 
         seq_printf(m, " %-16s  %-6s  %-10s  %-10s  %s\n",
@@ -1453,7 +1453,7 @@ out_free_desc:
 /* The irq_data was moved, fix the revmap to refer to the new location */
 static void irq_domain_fix_revmap(struct irq_data *d)
 {
-        void **slot;
+        void __rcu **slot;
 
         if (d->hwirq < d->domain->revmap_size)
                 return; /* Not using radix tree. */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 573dc52b0806..d00132b5c325 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1643,6 +1643,10 @@ const void *free_irq(unsigned int irq, void *dev_id)
 #endif
 
         action = __free_irq(irq, dev_id);
+
+        if (!action)
+                return NULL;
+
         devname = action->name;
         kfree(action);
         return devname;
diff --git a/kernel/kcmp.c b/kernel/kcmp.c
index ea34ed8bb952..055bb2962a0b 100644
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -131,7 +131,7 @@ static int kcmp_epoll_target(struct task_struct *task1,
         if (filp_epoll) {
                 filp_tgt = get_epoll_tfile_raw_ptr(filp_epoll, slot.tfd, slot.toff);
                 fput(filp_epoll);
-        } else
+        }
 
         if (IS_ERR(filp_tgt))
                 return PTR_ERR(filp_tgt);
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
index 02f660666ab8..1fefe6dcafd7 100644
--- a/kernel/locking/rwsem-xadd.c
+++ b/kernel/locking/rwsem-xadd.c
@@ -613,6 +613,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem)
         DEFINE_WAKE_Q(wake_q);
 
         /*
+        * __rwsem_down_write_failed_common(sem)
+        *   rwsem_optimistic_spin(sem)
+        *     osq_unlock(sem->osq)
+        *   ...
+        *   atomic_long_add_return(&sem->count)
+        *
+        *      - VS -
+        *
+        *              __up_write()
+        *                if (atomic_long_sub_return_release(&sem->count) < 0)
+        *                  rwsem_wake(sem)
+        *                    osq_is_locked(&sem->osq)
+        *
+        * And __up_write() must observe !osq_is_locked() when it observes the
+        * atomic_long_add_return() in order to not miss a wakeup.
+        *
+        * This boils down to:
+        *
+        * [S.rel] X = 1                [RmW] r0 = (Y += 0)
+        *         MB                         RMB
+        * [RmW]   Y += 1               [L]   r1 = X
+        *
+        * exists (r0=1 /\ r1=0)
+        */
+        smp_rmb();
+
+        /*
          * If a spinner is present, it is not necessary to do the wakeup.
          * Try to do wakeup only if the trylock succeeds to minimize
          * spinlock contention which may introduce too much delay in the
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 6bcbfbf1a8fd..403ab9cdb949 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -350,7 +350,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         pgprot_t pgprot = PAGE_KERNEL;
         struct dev_pagemap *pgmap;
         struct page_map *page_map;
-        int error, nid, is_ram;
+        int error, nid, is_ram, i = 0;
 
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(res->start + resource_size(res), SECTION_SIZE)
@@ -448,6 +448,8 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
                 list_del(&page->lru);
                 page->pgmap = pgmap;
                 percpu_ref_get(ref);
+                if (!(++i % 1024))
+                        cond_resched();
         }
         devres_add(dev, page_map);
         return __va(res->start);
diff --git a/kernel/params.c b/kernel/params.c
index 60b2d8101355..cc9108c2a1fd 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -224,7 +224,7 @@ char *parse_args(const char *doing,
         }                                                               \
         int param_get_##name(char *buffer, const struct kernel_param *kp) \
         {                                                               \
-                return scnprintf(buffer, PAGE_SIZE, format,             \
+                return scnprintf(buffer, PAGE_SIZE, format "\n",        \
                                 *((type *)kp->arg));                    \
         }                                                               \
         const struct kernel_param_ops param_ops_##name = {                      \
@@ -236,14 +236,14 @@ char *parse_args(const char *doing,
         EXPORT_SYMBOL(param_ops_##name)
 
 
-STANDARD_PARAM_DEF(byte, unsigned char, "%hhu", kstrtou8);
-STANDARD_PARAM_DEF(short, short, "%hi", kstrtos16);
-STANDARD_PARAM_DEF(ushort, unsigned short, "%hu", kstrtou16);
-STANDARD_PARAM_DEF(int, int, "%i", kstrtoint);
-STANDARD_PARAM_DEF(uint, unsigned int, "%u", kstrtouint);
-STANDARD_PARAM_DEF(long, long, "%li", kstrtol);
-STANDARD_PARAM_DEF(ulong, unsigned long, "%lu", kstrtoul);
-STANDARD_PARAM_DEF(ullong, unsigned long long, "%llu", kstrtoull);
+STANDARD_PARAM_DEF(byte,        unsigned char,          "%hhu", kstrtou8);
+STANDARD_PARAM_DEF(short,       short,                  "%hi",  kstrtos16);
+STANDARD_PARAM_DEF(ushort,      unsigned short,         "%hu",  kstrtou16);
+STANDARD_PARAM_DEF(int,         int,                    "%i",   kstrtoint);
+STANDARD_PARAM_DEF(uint,        unsigned int,           "%u",   kstrtouint);
+STANDARD_PARAM_DEF(long,        long,                   "%li",  kstrtol);
+STANDARD_PARAM_DEF(ulong,       unsigned long,          "%lu",  kstrtoul);
+STANDARD_PARAM_DEF(ullong,      unsigned long long,     "%llu", kstrtoull);
 
 int param_set_charp(const char *val, const struct kernel_param *kp)
 {
@@ -270,7 +270,7 @@ EXPORT_SYMBOL(param_set_charp);
 
 int param_get_charp(char *buffer, const struct kernel_param *kp)
 {
-        return scnprintf(buffer, PAGE_SIZE, "%s", *((char **)kp->arg));
+        return scnprintf(buffer, PAGE_SIZE, "%s\n", *((char **)kp->arg));
 }
 EXPORT_SYMBOL(param_get_charp);
 
@@ -301,7 +301,7 @@ EXPORT_SYMBOL(param_set_bool);
 int param_get_bool(char *buffer, const struct kernel_param *kp)
 {
         /* Y and N chosen as being relatively non-coder friendly */
-        return sprintf(buffer, "%c", *(bool *)kp->arg ? 'Y' : 'N');
+        return sprintf(buffer, "%c\n", *(bool *)kp->arg ? 'Y' : 'N');
 }
 EXPORT_SYMBOL(param_get_bool);
 
@@ -360,7 +360,7 @@ EXPORT_SYMBOL(param_set_invbool);
 
 int param_get_invbool(char *buffer, const struct kernel_param *kp)
 {
-        return sprintf(buffer, "%c", (*(bool *)kp->arg) ? 'N' : 'Y');
+        return sprintf(buffer, "%c\n", (*(bool *)kp->arg) ? 'N' : 'Y');
 }
 EXPORT_SYMBOL(param_get_invbool);
 
@@ -460,8 +460,9 @@ static int param_array_get(char *buffer, const struct kernel_param *kp)
         struct kernel_param p = *kp;
 
         for (i = off = 0; i < (arr->num ? *arr->num : arr->max); i++) {
+                /* Replace \n with comma */
                 if (i)
-                        buffer[off++] = ',';
+                        buffer[off - 1] = ',';
                 p.arg = arr->elem + arr->elemsize * i;
                 check_kparam_locked(p.mod);
                 ret = arr->ops->get(buffer + off, &p);
@@ -507,7 +508,7 @@ EXPORT_SYMBOL(param_set_copystring);
 int param_get_string(char *buffer, const struct kernel_param *kp)
 {
         const struct kparam_string *kps = kp->str;
-        return strlcpy(buffer, kps->string, kps->maxlen);
+        return scnprintf(buffer, PAGE_SIZE, "%s\n", kps->string);
 }
 EXPORT_SYMBOL(param_get_string);
 
@@ -549,10 +550,6 @@ static ssize_t param_attr_show(struct module_attribute *mattr,
         kernel_param_lock(mk->mod);
         count = attribute->param->ops->get(buf, attribute->param);
         kernel_param_unlock(mk->mod);
-        if (count > 0) {
-                strcat(buf, "\n");
-                ++count;
-        }
         return count;
 }
 
@@ -600,7 +597,7 @@ EXPORT_SYMBOL(kernel_param_unlock);
 /*
  * add_sysfs_param - add a parameter to sysfs
  * @mk: struct module_kobject
- * @kparam: the actual parameter definition to add to sysfs
+ * @kp: the actual parameter definition to add to sysfs
  * @name: name of parameter
  *
  * Create a kobject if for a (per-module) parameter if mp NULL, and
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 3e2b4f519009..ccd2d20e6b06 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -120,22 +120,26 @@ static void s2idle_loop(void)
                  * frozen processes + suspended devices + idle processors.
                  * Thus s2idle_enter() should be called right after
                  * all devices have been suspended.
+                 *
+                 * Wakeups during the noirq suspend of devices may be spurious,
+                 * so prevent them from terminating the loop right away.
                  */
                 error = dpm_noirq_suspend_devices(PMSG_SUSPEND);
                 if (!error)
                         s2idle_enter();
+                else if (error == -EBUSY && pm_wakeup_pending())
+                        error = 0;
 
-                dpm_noirq_resume_devices(PMSG_RESUME);
-                if (error && (error != -EBUSY || !pm_wakeup_pending())) {
-                        dpm_noirq_end();
-                        break;
-                }
-
-                if (s2idle_ops && s2idle_ops->wake)
+                if (!error && s2idle_ops && s2idle_ops->wake)
                         s2idle_ops->wake();
 
+                dpm_noirq_resume_devices(PMSG_RESUME);
+
                 dpm_noirq_end();
 
+                if (error)
+                        break;
+
                 if (s2idle_ops && s2idle_ops->sync)
                         s2idle_ops->sync();
 
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 1250e4bd4b85..b0ad62b0e7b8 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -882,6 +882,11 @@ void rcu_irq_exit(void)
 
         RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_exit() invoked with irqs enabled!!!");
         rdtp = this_cpu_ptr(&rcu_dynticks);
+
+        /* Page faults can happen in NMI handlers, so check... */
+        if (rdtp->dynticks_nmi_nesting)
+                return;
+
         WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) &&
                      rdtp->dynticks_nesting < 1);
         if (rdtp->dynticks_nesting <= 1) {
@@ -1015,6 +1020,11 @@ void rcu_irq_enter(void)
 
         RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_enter() invoked with irqs enabled!!!");
         rdtp = this_cpu_ptr(&rcu_dynticks);
+
+        /* Page faults can happen in NMI handlers, so check... */
+        if (rdtp->dynticks_nmi_nesting)
+                return;
+
         oldval = rdtp->dynticks_nesting;
         rdtp->dynticks_nesting++;
         WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) &&
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 18a6966567da..d17c5da523a0 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5166,6 +5166,28 @@ void sched_show_task(struct task_struct *p)
         put_task_stack(p);
 }
 
+static inline bool
+state_filter_match(unsigned long state_filter, struct task_struct *p)
+{
+        /* no filter, everything matches */
+        if (!state_filter)
+                return true;
+
+        /* filter, but doesn't match */
+        if (!(p->state & state_filter))
+                return false;
+
+        /*
+         * When looking for TASK_UNINTERRUPTIBLE skip TASK_IDLE (allows
+         * TASK_KILLABLE).
+         */
+        if (state_filter == TASK_UNINTERRUPTIBLE && p->state == TASK_IDLE)
+                return false;
+
+        return true;
+}
+
+
 void show_state_filter(unsigned long state_filter)
 {
         struct task_struct *g, *p;
@@ -5188,7 +5210,7 @@ void show_state_filter(unsigned long state_filter)
                  */
                 touch_nmi_watchdog();
                 touch_all_softlockup_watchdogs();
-                if (!state_filter || (p->state & state_filter))
+                if (state_filter_match(state_filter, p))
                         sched_show_task(p);
         }
 
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 01217fb5a5de..2f93e4a2d9f6 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -466,8 +466,6 @@ static char *task_group_path(struct task_group *tg)
 }
 #endif
 
-static const char stat_nam[] = TASK_STATE_TO_CHAR_STR;
-
 static void
 print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
 {
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 98b59b5db90b..bb3a38005b9c 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -17,11 +17,13 @@
 #include <linux/audit.h>
 #include <linux/compat.h>
 #include <linux/coredump.h>
+#include <linux/kmemleak.h>
 #include <linux/sched.h>
 #include <linux/sched/task_stack.h>
 #include <linux/seccomp.h>
 #include <linux/slab.h>
 #include <linux/syscalls.h>
+#include <linux/sysctl.h>
 
 #ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
 #include <asm/syscall.h>
@@ -42,6 +44,7 @@
  *         get/put helpers should be used when accessing an instance
  *         outside of a lifetime-guarded section.  In general, this
  *         is only needed for handling filters shared across tasks.
+ * @log: true if all actions except for SECCOMP_RET_ALLOW should be logged
  * @prev: points to a previously installed, or inherited, filter
  * @prog: the BPF program to evaluate
  *
@@ -57,6 +60,7 @@
  */
 struct seccomp_filter {
         refcount_t usage;
+        bool log;
         struct seccomp_filter *prev;
         struct bpf_prog *prog;
 };
@@ -171,10 +175,15 @@ static int seccomp_check_filter(struct sock_filter *filter, unsigned int flen)
 /**
  * seccomp_run_filters - evaluates all seccomp filters against @sd
  * @sd: optional seccomp data to be passed to filters
+ * @match: stores struct seccomp_filter that resulted in the return value,
+ *         unless filter returned SECCOMP_RET_ALLOW, in which case it will
+ *         be unchanged.
  *
  * Returns valid seccomp BPF response codes.
  */
-static u32 seccomp_run_filters(const struct seccomp_data *sd)
+#define ACTION_ONLY(ret) ((s32)((ret) & (SECCOMP_RET_ACTION_FULL)))
+static u32 seccomp_run_filters(const struct seccomp_data *sd,
+                               struct seccomp_filter **match)
 {
         struct seccomp_data sd_local;
         u32 ret = SECCOMP_RET_ALLOW;
@@ -184,7 +193,7 @@ static u32 seccomp_run_filters(const struct seccomp_data *sd)
 
         /* Ensure unexpected behavior doesn't result in failing open. */
         if (unlikely(WARN_ON(f == NULL)))
-                return SECCOMP_RET_KILL;
+                return SECCOMP_RET_KILL_PROCESS;
 
         if (!sd) {
                 populate_seccomp_data(&sd_local);
@@ -198,8 +207,10 @@ static u32 seccomp_run_filters(const struct seccomp_data *sd)
         for (; f; f = f->prev) {
                 u32 cur_ret = BPF_PROG_RUN(f->prog, sd);
 
-                if ((cur_ret & SECCOMP_RET_ACTION) < (ret & SECCOMP_RET_ACTION))
+                if (ACTION_ONLY(cur_ret) < ACTION_ONLY(ret)) {
                         ret = cur_ret;
+                        *match = f;
+                }
         }
         return ret;
 }
@@ -444,6 +455,10 @@ static long seccomp_attach_filter(unsigned int flags,
                         return ret;
         }
 
+        /* Set log flag, if present. */
+        if (flags & SECCOMP_FILTER_FLAG_LOG)
+                filter->log = true;
+
         /*
          * If there is an existing filter, make it the prev and don't drop its
          * task reference.
@@ -458,14 +473,19 @@ static long seccomp_attach_filter(unsigned int flags,
         return 0;
 }
 
+void __get_seccomp_filter(struct seccomp_filter *filter)
+{
+        /* Reference count is bounded by the number of total processes. */
+        refcount_inc(&filter->usage);
+}
+
 /* get_seccomp_filter - increments the reference count of the filter on @tsk */
 void get_seccomp_filter(struct task_struct *tsk)
 {
         struct seccomp_filter *orig = tsk->seccomp.filter;
         if (!orig)
                 return;
-        /* Reference count is bounded by the number of total processes. */
-        refcount_inc(&orig->usage);
+        __get_seccomp_filter(orig);
 }
 
 static inline void seccomp_filter_free(struct seccomp_filter *filter)
@@ -476,10 +496,8 @@ static inline void seccomp_filter_free(struct seccomp_filter *filter)
         }
 }
 
-/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
-void put_seccomp_filter(struct task_struct *tsk)
+static void __put_seccomp_filter(struct seccomp_filter *orig)
 {
-        struct seccomp_filter *orig = tsk->seccomp.filter;
         /* Clean up single-reference branches iteratively. */
         while (orig && refcount_dec_and_test(&orig->usage)) {
                 struct seccomp_filter *freeme = orig;
@@ -488,6 +506,12 @@ void put_seccomp_filter(struct task_struct *tsk)
         }
 }
 
+/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */
+void put_seccomp_filter(struct task_struct *tsk)
+{
+        __put_seccomp_filter(tsk->seccomp.filter);
+}
+
 static void seccomp_init_siginfo(siginfo_t *info, int syscall, int reason)
 {
         memset(info, 0, sizeof(*info));
@@ -514,6 +538,65 @@ static void seccomp_send_sigsys(int syscall, int reason)
 }
 #endif  /* CONFIG_SECCOMP_FILTER */
 
+/* For use with seccomp_actions_logged */
+#define SECCOMP_LOG_KILL_PROCESS        (1 << 0)
+#define SECCOMP_LOG_KILL_THREAD         (1 << 1)
+#define SECCOMP_LOG_TRAP                (1 << 2)
+#define SECCOMP_LOG_ERRNO               (1 << 3)
+#define SECCOMP_LOG_TRACE               (1 << 4)
+#define SECCOMP_LOG_LOG                 (1 << 5)
+#define SECCOMP_LOG_ALLOW               (1 << 6)
+
+static u32 seccomp_actions_logged = SECCOMP_LOG_KILL_PROCESS |
+                                    SECCOMP_LOG_KILL_THREAD  |
+                                    SECCOMP_LOG_TRAP  |
+                                    SECCOMP_LOG_ERRNO |
+                                    SECCOMP_LOG_TRACE |
+                                    SECCOMP_LOG_LOG;
+
+static inline void seccomp_log(unsigned long syscall, long signr, u32 action,
+                               bool requested)
+{
+        bool log = false;
+
+        switch (action) {
+        case SECCOMP_RET_ALLOW:
+                break;
+        case SECCOMP_RET_TRAP:
+                log = requested && seccomp_actions_logged & SECCOMP_LOG_TRAP;
+                break;
+        case SECCOMP_RET_ERRNO:
+                log = requested && seccomp_actions_logged & SECCOMP_LOG_ERRNO;
+                break;
+        case SECCOMP_RET_TRACE:
+                log = requested && seccomp_actions_logged & SECCOMP_LOG_TRACE;
+                break;
+        case SECCOMP_RET_LOG:
+                log = seccomp_actions_logged & SECCOMP_LOG_LOG;
+                break;
+        case SECCOMP_RET_KILL_THREAD:
+                log = seccomp_actions_logged & SECCOMP_LOG_KILL_THREAD;
+                break;
+        case SECCOMP_RET_KILL_PROCESS:
+        default:
+                log = seccomp_actions_logged & SECCOMP_LOG_KILL_PROCESS;
+        }
+
+        /*
+         * Force an audit message to be emitted when the action is RET_KILL_*,
+         * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is
+         * allowed to be logged by the admin.
+         */
+        if (log)
+                return __audit_seccomp(syscall, signr, action);
+
+        /*
+         * Let the audit subsystem decide if the action should be audited based
+         * on whether the current task itself is being audited.
+         */
+        return audit_seccomp(syscall, signr, action);
+}
+
 /*
  * Secure computing mode 1 allows only read/write/exit/sigreturn.
  * To be fully secure this must be combined with rlimit
@@ -539,7 +622,7 @@ static void __secure_computing_strict(int this_syscall)
 #ifdef SECCOMP_DEBUG
         dump_stack();
 #endif
-        audit_seccomp(this_syscall, SIGKILL, SECCOMP_RET_KILL);
+        seccomp_log(this_syscall, SIGKILL, SECCOMP_RET_KILL_THREAD, true);
         do_exit(SIGKILL);
 }
 
@@ -566,6 +649,7 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
                             const bool recheck_after_trace)
 {
         u32 filter_ret, action;
+        struct seccomp_filter *match = NULL;
         int data;
 
         /*
@@ -574,9 +658,9 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
          */
         rmb();
 
-        filter_ret = seccomp_run_filters(sd);
+        filter_ret = seccomp_run_filters(sd, &match);
         data = filter_ret & SECCOMP_RET_DATA;
-        action = filter_ret & SECCOMP_RET_ACTION;
+        action = filter_ret & SECCOMP_RET_ACTION_FULL;
 
         switch (action) {
         case SECCOMP_RET_ERRNO:
@@ -637,14 +721,25 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
 
                 return 0;
 
+        case SECCOMP_RET_LOG:
+                seccomp_log(this_syscall, 0, action, true);
+                return 0;
+
         case SECCOMP_RET_ALLOW:
+                /*
+                 * Note that the "match" filter will always be NULL for
+                 * this action since SECCOMP_RET_ALLOW is the starting
+                 * state in seccomp_run_filters().
+                 */
                 return 0;
 
-        case SECCOMP_RET_KILL:
+        case SECCOMP_RET_KILL_THREAD:
+        case SECCOMP_RET_KILL_PROCESS:
         default:
-                audit_seccomp(this_syscall, SIGSYS, action);
+                seccomp_log(this_syscall, SIGSYS, action, true);
                 /* Dump core only if this is the last remaining thread. */
-                if (get_nr_threads(current) == 1) {
+                if (action == SECCOMP_RET_KILL_PROCESS ||
+                    get_nr_threads(current) == 1) {
                         siginfo_t info;
 
                         /* Show the original registers in the dump. */
@@ -653,13 +748,16 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
                         seccomp_init_siginfo(&info, this_syscall, data);
                         do_coredump(&info);
                 }
-                do_exit(SIGSYS);
+                if (action == SECCOMP_RET_KILL_PROCESS)
+                        do_group_exit(SIGSYS);
+                else
+                        do_exit(SIGSYS);
         }
 
         unreachable();
 
 skip:
-        audit_seccomp(this_syscall, 0, action);
+        seccomp_log(this_syscall, 0, action, match ? match->log : false);
         return -1;
 }
 #else
@@ -794,6 +892,29 @@ static inline long seccomp_set_mode_filter(unsigned int flags,
 }
 #endif
 
+static long seccomp_get_action_avail(const char __user *uaction)
+{
+        u32 action;
+
+        if (copy_from_user(&action, uaction, sizeof(action)))
+                return -EFAULT;
+
+        switch (action) {
+        case SECCOMP_RET_KILL_PROCESS:
+        case SECCOMP_RET_KILL_THREAD:
+        case SECCOMP_RET_TRAP:
+        case SECCOMP_RET_ERRNO:
+        case SECCOMP_RET_TRACE:
+        case SECCOMP_RET_LOG:
+        case SECCOMP_RET_ALLOW:
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        return 0;
+}
+
 /* Common entry point for both prctl and syscall. */
 static long do_seccomp(unsigned int op, unsigned int flags,
                        const char __user *uargs)
@@ -805,6 +926,11 @@ static long do_seccomp(unsigned int op, unsigned int flags,
                 return seccomp_set_mode_strict();
         case SECCOMP_SET_MODE_FILTER:
                 return seccomp_set_mode_filter(flags, uargs);
+        case SECCOMP_GET_ACTION_AVAIL:
+                if (flags != 0)
+                        return -EINVAL;
+
+                return seccomp_get_action_avail(uargs);
         default:
                 return -EINVAL;
         }
@@ -908,13 +1034,13 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
         if (!data)
                 goto out;
 
-        get_seccomp_filter(task);
+        __get_seccomp_filter(filter);
         spin_unlock_irq(&task->sighand->siglock);
 
         if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog)))
                 ret = -EFAULT;
 
-        put_seccomp_filter(task);
+        __put_seccomp_filter(filter);
         return ret;
 
 out:
@@ -922,3 +1048,185 @@ out:
         return ret;
 }
 #endif
+
+#ifdef CONFIG_SYSCTL
+
+/* Human readable action names for friendly sysctl interaction */
+#define SECCOMP_RET_KILL_PROCESS_NAME   "kill_process"
+#define SECCOMP_RET_KILL_THREAD_NAME    "kill_thread"
+#define SECCOMP_RET_TRAP_NAME           "trap"
+#define SECCOMP_RET_ERRNO_NAME          "errno"
+#define SECCOMP_RET_TRACE_NAME          "trace"
+#define SECCOMP_RET_LOG_NAME            "log"
+#define SECCOMP_RET_ALLOW_NAME          "allow"
+
+static const char seccomp_actions_avail[] =
+                                SECCOMP_RET_KILL_PROCESS_NAME   " "
+                                SECCOMP_RET_KILL_THREAD_NAME    " "
+                                SECCOMP_RET_TRAP_NAME           " "
+                                SECCOMP_RET_ERRNO_NAME          " "
+                                SECCOMP_RET_TRACE_NAME          " "
+                                SECCOMP_RET_LOG_NAME            " "
+                                SECCOMP_RET_ALLOW_NAME;
+
+struct seccomp_log_name {
+        u32             log;
+        const char      *name;
+};
+
+static const struct seccomp_log_name seccomp_log_names[] = {
+        { SECCOMP_LOG_KILL_PROCESS, SECCOMP_RET_KILL_PROCESS_NAME },
+        { SECCOMP_LOG_KILL_THREAD, SECCOMP_RET_KILL_THREAD_NAME },
+        { SECCOMP_LOG_TRAP, SECCOMP_RET_TRAP_NAME },
+        { SECCOMP_LOG_ERRNO, SECCOMP_RET_ERRNO_NAME },
+        { SECCOMP_LOG_TRACE, SECCOMP_RET_TRACE_NAME },
+        { SECCOMP_LOG_LOG, SECCOMP_RET_LOG_NAME },
+        { SECCOMP_LOG_ALLOW, SECCOMP_RET_ALLOW_NAME },
+        { }
+};
+
+static bool seccomp_names_from_actions_logged(char *names, size_t size,
+                                              u32 actions_logged)
+{
+        const struct seccomp_log_name *cur;
+        bool append_space = false;
+
+        for (cur = seccomp_log_names; cur->name && size; cur++) {
+                ssize_t ret;
+
+                if (!(actions_logged & cur->log))
+                        continue;
+
+                if (append_space) {
+                        ret = strscpy(names, " ", size);
+                        if (ret < 0)
+                                return false;
+
+                        names += ret;
+                        size -= ret;
+                } else
+                        append_space = true;
+
+                ret = strscpy(names, cur->name, size);
+                if (ret < 0)
+                        return false;
+
+                names += ret;
+                size -= ret;
+        }
+
+        return true;
+}
+
+static bool seccomp_action_logged_from_name(u32 *action_logged,
+                                            const char *name)
+{
+        const struct seccomp_log_name *cur;
+
+        for (cur = seccomp_log_names; cur->name; cur++) {
+                if (!strcmp(cur->name, name)) {
+                        *action_logged = cur->log;
+                        return true;
+                }
+        }
+
+        return false;
+}
+
+static bool seccomp_actions_logged_from_names(u32 *actions_logged, char *names)
+{
+        char *name;
+
+        *actions_logged = 0;
+        while ((name = strsep(&names, " ")) && *name) {
+                u32 action_logged = 0;
+
+                if (!seccomp_action_logged_from_name(&action_logged, name))
+                        return false;
+
+                *actions_logged |= action_logged;
+        }
+
+        return true;
+}
+
+static int seccomp_actions_logged_handler(struct ctl_table *ro_table, int write,
+                                          void __user *buffer, size_t *lenp,
+                                          loff_t *ppos)
+{
+        char names[sizeof(seccomp_actions_avail)];
+        struct ctl_table table;
+        int ret;
+
+        if (write && !capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        memset(names, 0, sizeof(names));
+
+        if (!write) {
+                if (!seccomp_names_from_actions_logged(names, sizeof(names),
+                                                       seccomp_actions_logged))
+                        return -EINVAL;
+        }
+
+        table = *ro_table;
+        table.data = names;
+        table.maxlen = sizeof(names);
+        ret = proc_dostring(&table, write, buffer, lenp, ppos);
+        if (ret)
+                return ret;
+
+        if (write) {
+                u32 actions_logged;
+
+                if (!seccomp_actions_logged_from_names(&actions_logged,
+                                                       table.data))
+                        return -EINVAL;
+
+                if (actions_logged & SECCOMP_LOG_ALLOW)
+                        return -EINVAL;
+
+                seccomp_actions_logged = actions_logged;
+        }
+
+        return 0;
+}
+
+static struct ctl_path seccomp_sysctl_path[] = {
+        { .procname = "kernel", },
+        { .procname = "seccomp", },
+        { }
+};
+
+static struct ctl_table seccomp_sysctl_table[] = {
+        {
+                .procname       = "actions_avail",
+                .data           = (void *) &seccomp_actions_avail,
+                .maxlen         = sizeof(seccomp_actions_avail),
+                .mode           = 0444,
+                .proc_handler   = proc_dostring,
+        },
+        {
+                .procname       = "actions_logged",
+                .mode           = 0644,
+                .proc_handler   = seccomp_actions_logged_handler,
+        },
+        { }
+};
+
+static int __init seccomp_sysctl_init(void)
+{
+        struct ctl_table_header *hdr;
+
+        hdr = register_sysctl_paths(seccomp_sysctl_path, seccomp_sysctl_table);
+        if (!hdr)
+                pr_warn("seccomp: sysctl registration failed\n");
+        else
+                kmemleak_not_leak(hdr);
+
+        return 0;
+}
+
+device_initcall(seccomp_sysctl_init)
+
+#endif /* CONFIG_SYSCTL */
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index 1d71c051a951..5043e7433f4b 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -344,39 +344,30 @@ EXPORT_SYMBOL_GPL(smpboot_unregister_percpu_thread);
  * by the client, but only by calling this function.
  * This function can only be called on a registered smp_hotplug_thread.
  */
-int smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
-                                         const struct cpumask *new)
+void smpboot_update_cpumask_percpu_thread(struct smp_hotplug_thread *plug_thread,
+                                          const struct cpumask *new)
 {
         struct cpumask *old = plug_thread->cpumask;
-        cpumask_var_t tmp;
+        static struct cpumask tmp;
         unsigned int cpu;
 
-        if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
-                return -ENOMEM;
-
-        get_online_cpus();
+        lockdep_assert_cpus_held();
         mutex_lock(&smpboot_threads_lock);
 
         /* Park threads that were exclusively enabled on the old mask. */
-        cpumask_andnot(tmp, old, new);
-        for_each_cpu_and(cpu, tmp, cpu_online_mask)
+        cpumask_andnot(&tmp, old, new);
+        for_each_cpu_and(cpu, &tmp, cpu_online_mask)
                 smpboot_park_thread(plug_thread, cpu);
 
         /* Unpark threads that are exclusively enabled on the new mask. */
-        cpumask_andnot(tmp, new, old);
-        for_each_cpu_and(cpu, tmp, cpu_online_mask)
+        cpumask_andnot(&tmp, new, old);
+        for_each_cpu_and(cpu, &tmp, cpu_online_mask)
                 smpboot_unpark_thread(plug_thread, cpu);
 
         cpumask_copy(old, new);
 
         mutex_unlock(&smpboot_threads_lock);
-        put_online_cpus();
-
-        free_cpumask_var(tmp);
-
-        return 0;
 }
-EXPORT_SYMBOL_GPL(smpboot_update_cpumask_percpu_thread);
 
 static DEFINE_PER_CPU(atomic_t, cpu_hotplug_state) = ATOMIC_INIT(CPU_POST_DEAD);
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 6648fbbb8157..d9c31bc2eaea 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -367,7 +367,8 @@ static struct ctl_table kern_table[] = {
                 .data           = &sysctl_sched_time_avg,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
         },
 #ifdef CONFIG_SCHEDSTATS
         {
@@ -871,9 +872,9 @@ static struct ctl_table kern_table[] = {
 #if defined(CONFIG_LOCKUP_DETECTOR)
         {
                 .procname       = "watchdog",
-                .data           = &watchdog_user_enabled,
-                .maxlen         = sizeof (int),
-                .mode           = 0644,
+                .data           = &watchdog_user_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
                 .proc_handler   = proc_watchdog,
                 .extra1         = &zero,
                 .extra2         = &one,
@@ -889,16 +890,12 @@ static struct ctl_table kern_table[] = {
         },
         {
                 .procname       = "nmi_watchdog",
-                .data           = &nmi_watchdog_enabled,
-                .maxlen         = sizeof (int),
-                .mode           = 0644,
+                .data           = &nmi_watchdog_user_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = NMI_WATCHDOG_SYSCTL_PERM,
                 .proc_handler   = proc_nmi_watchdog,
                 .extra1         = &zero,
-#if defined(CONFIG_HAVE_NMI_WATCHDOG) || defined(CONFIG_HARDLOCKUP_DETECTOR)
                 .extra2         = &one,
-#else
-                .extra2         = &zero,
-#endif
         },
         {
                 .procname       = "watchdog_cpumask",
@@ -910,9 +907,9 @@ static struct ctl_table kern_table[] = {
 #ifdef CONFIG_SOFTLOCKUP_DETECTOR
         {
                 .procname       = "soft_watchdog",
-                .data           = &soft_watchdog_enabled,
-                .maxlen         = sizeof (int),
-                .mode           = 0644,
+                .data           = &soft_watchdog_user_enabled,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
                 .proc_handler   = proc_soft_watchdog,
                 .extra1         = &zero,
                 .extra2         = &one,
@@ -2187,8 +2184,6 @@ static int do_proc_douintvec_conv(unsigned long *lvalp,
         if (write) {
                 if (*lvalp > UINT_MAX)
                         return -EINVAL;
-                if (*lvalp > UINT_MAX)
-                        return -EINVAL;
                 *valp = *lvalp;
         } else {
                 unsigned int val = *valp;
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 2a685b45b73b..45a3928544ce 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -648,6 +648,12 @@ int blk_trace_startstop(struct request_queue *q, int start)
 }
 EXPORT_SYMBOL_GPL(blk_trace_startstop);
 
+/*
+ * When reading or writing the blktrace sysfs files, the references to the
+ * opened sysfs or device files should prevent the underlying block device
+ * from being removed. So no further delete protection is really needed.
+ */
+
 /**
  * blk_trace_ioctl: - handle the ioctls associated with tracing
  * @bdev:       the block device
@@ -665,7 +671,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
         if (!q)
                 return -ENXIO;
 
-        mutex_lock(&bdev->bd_mutex);
+        mutex_lock(&q->blk_trace_mutex);
 
         switch (cmd) {
         case BLKTRACESETUP:
@@ -691,7 +697,7 @@ int blk_trace_ioctl(struct block_device *bdev, unsigned cmd, char __user *arg)
                 break;
         }
 
-        mutex_unlock(&bdev->bd_mutex);
+        mutex_unlock(&q->blk_trace_mutex);
         return ret;
 }
 
@@ -1727,7 +1733,7 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
         if (q == NULL)
                 goto out_bdput;
 
-        mutex_lock(&bdev->bd_mutex);
+        mutex_lock(&q->blk_trace_mutex);
 
         if (attr == &dev_attr_enable) {
                 ret = sprintf(buf, "%u\n", !!q->blk_trace);
@@ -1746,7 +1752,7 @@ static ssize_t sysfs_blk_trace_attr_show(struct device *dev,
                 ret = sprintf(buf, "%llu\n", q->blk_trace->end_lba);
 
 out_unlock_bdev:
-        mutex_unlock(&bdev->bd_mutex);
+        mutex_unlock(&q->blk_trace_mutex);
 out_bdput:
         bdput(bdev);
 out:
@@ -1788,7 +1794,7 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
         if (q == NULL)
                 goto out_bdput;
 
-        mutex_lock(&bdev->bd_mutex);
+        mutex_lock(&q->blk_trace_mutex);
 
         if (attr == &dev_attr_enable) {
                 if (value)
@@ -1814,7 +1820,7 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
         }
 
 out_unlock_bdev:
-        mutex_unlock(&bdev->bd_mutex);
+        mutex_unlock(&q->blk_trace_mutex);
 out_bdput:
         bdput(bdev);
 out:
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 6abfafd7f173..8319e09e15b9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4954,9 +4954,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata;
 static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata;
 static int ftrace_graph_set_hash(struct ftrace_hash *hash, char *buffer);
 
-static unsigned long save_global_trampoline;
-static unsigned long save_global_flags;
-
 static int __init set_graph_function(char *str)
 {
         strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE);
@@ -6808,17 +6805,6 @@ void unregister_ftrace_graph(void)
         unregister_pm_notifier(&ftrace_suspend_notifier);
         unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
 
-#ifdef CONFIG_DYNAMIC_FTRACE
-        /*
-         * Function graph does not allocate the trampoline, but
-         * other global_ops do. We need to reset the ALLOC_TRAMP flag
-         * if one was used.
-         */
-        global_ops.trampoline = save_global_trampoline;
-        if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP)
-                global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
-#endif
-
  out:
         mutex_unlock(&ftrace_lock);
 }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 5360b7aec57a..752e5daf0896 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4020,11 +4020,17 @@ static int tracing_open(struct inode *inode, struct file *file)
         /* If this file was open for write, then erase contents */
         if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) {
                 int cpu = tracing_get_cpu(inode);
+                struct trace_buffer *trace_buf = &tr->trace_buffer;
+
+#ifdef CONFIG_TRACER_MAX_TRACE
+                if (tr->current_trace->print_max)
+                        trace_buf = &tr->max_buffer;
+#endif
 
                 if (cpu == RING_BUFFER_ALL_CPUS)
-                        tracing_reset_online_cpus(&tr->trace_buffer);
+                        tracing_reset_online_cpus(trace_buf);
                 else
-                        tracing_reset(&tr->trace_buffer, cpu);
+                        tracing_reset(trace_buf, cpu);
         }
 
         if (file->f_mode & FMODE_READ) {
@@ -5358,6 +5364,13 @@ static int tracing_set_tracer(struct trace_array *tr, const char *buf)
         if (t == tr->current_trace)
                 goto out;
 
+        /* Some tracers won't work on kernel command line */
+        if (system_state < SYSTEM_RUNNING && t->noboot) {
+                pr_warn("Tracer '%s' is not allowed on command line, ignored\n",
+                        t->name);
+                goto out;
+        }
+
         /* Some tracers are only allowed for the top level buffer */
         if (!trace_ok_for_array(t, tr)) {
                 ret = -EINVAL;
@@ -5667,7 +5680,7 @@ static int tracing_wait_pipe(struct file *filp)
                  *
                  * iter->pos will be 0 if we haven't read anything.
                  */
-                if (!tracing_is_on() && iter->pos)
+                if (!tracer_tracing_is_on(iter->tr) && iter->pos)
                         break;
 
                 mutex_unlock(&iter->mutex);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index fb5d54d0d1b3..652c682707cd 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -444,6 +444,8 @@ struct tracer {
 #ifdef CONFIG_TRACER_MAX_TRACE
         bool                    use_max_tr;
 #endif
+        /* True if tracer cannot be enabled in kernel param */
+        bool                    noboot;
 };
 
 
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index cd7480d0a201..dca78fc48439 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -282,6 +282,7 @@ static struct tracer mmio_tracer __read_mostly =
         .close          = mmio_close,
         .read           = mmio_read,
         .print_line     = mmio_print_line,
+        .noboot         = true,
 };
 
 __init static int init_mmio_trace(void)
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index bac629af2285..c738e764e2a5 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -656,15 +656,6 @@ int trace_print_lat_context(struct trace_iterator *iter)
         return !trace_seq_has_overflowed(s);
 }
 
-static const char state_to_char[] = TASK_STATE_TO_CHAR_STR;
-
-static int task_state_char(unsigned long state)
-{
-        int bit = state ? __ffs(state) + 1 : 0;
-
-        return bit < sizeof(state_to_char) - 1 ? state_to_char[bit] : '?';
-}
-
 /**
  * ftrace_find_event - find a registered event
  * @type: the type of event to look for
@@ -930,8 +921,8 @@ static enum print_line_t trace_ctxwake_print(struct trace_iterator *iter,
 
         trace_assign_type(field, iter->ent);
 
-        T = task_state_char(field->next_state);
-        S = task_state_char(field->prev_state);
+        T = __task_state_to_char(field->next_state);
+        S = __task_state_to_char(field->prev_state);
         trace_find_cmdline(field->next_pid, comm);
         trace_seq_printf(&iter->seq,
                          " %5d:%3d:%c %s [%03d] %5d:%3d:%c %s\n",
@@ -966,8 +957,8 @@ static int trace_ctxwake_raw(struct trace_iterator *iter, char S)
         trace_assign_type(field, iter->ent);
 
         if (!S)
-                S = task_state_char(field->prev_state);
-        T = task_state_char(field->next_state);
+                S = __task_state_to_char(field->prev_state);
+        T = __task_state_to_char(field->next_state);
         trace_seq_printf(&iter->seq, "%d %d %c %d %d %d %c\n",
                          field->prev_pid,
                          field->prev_prio,
@@ -1002,8 +993,8 @@ static int trace_ctxwake_hex(struct trace_iterator *iter, char S)
         trace_assign_type(field, iter->ent);
 
         if (!S)
-                S = task_state_char(field->prev_state);
-        T = task_state_char(field->next_state);
+                S = __task_state_to_char(field->prev_state);
+        T = __task_state_to_char(field->next_state);
 
         SEQ_PUT_HEX_FIELD(s, field->prev_pid);
         SEQ_PUT_HEX_FIELD(s, field->prev_prio);
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index ddec53b67646..0c331978b1a6 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -397,10 +397,10 @@ tracing_sched_switch_trace(struct trace_array *tr,
         entry   = ring_buffer_event_data(event);
         entry->prev_pid                 = prev->pid;
         entry->prev_prio                = prev->prio;
-        entry->prev_state               = prev->state;
+        entry->prev_state               = __get_task_state(prev);
         entry->next_pid                 = next->pid;
         entry->next_prio                = next->prio;
-        entry->next_state               = next->state;
+        entry->next_state               = __get_task_state(next);
         entry->next_cpu = task_cpu(next);
 
         if (!call_filter_check_discard(call, entry, buffer, event))
@@ -425,10 +425,10 @@ tracing_sched_wakeup_trace(struct trace_array *tr,
         entry   = ring_buffer_event_data(event);
         entry->prev_pid                 = curr->pid;
         entry->prev_prio                = curr->prio;
-        entry->prev_state               = curr->state;
+        entry->prev_state               = __get_task_state(curr);
         entry->next_pid                 = wakee->pid;
         entry->next_prio                = wakee->prio;
-        entry->next_state               = wakee->state;
+        entry->next_state               = __get_task_state(wakee);
         entry->next_cpu                 = task_cpu(wakee);
 
         if (!call_filter_check_discard(call, entry, buffer, event))
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index a4df67cbc711..49cb41412eec 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -96,23 +96,9 @@ check_stack(unsigned long ip, unsigned long *stack)
         if (in_nmi())
                 return;
 
-        /*
-         * There's a slight chance that we are tracing inside the
-         * RCU infrastructure, and rcu_irq_enter() will not work
-         * as expected.
-         */
-        if (unlikely(rcu_irq_enter_disabled()))
-                return;
-
         local_irq_save(flags);
         arch_spin_lock(&stack_trace_max_lock);
 
-        /*
-         * RCU may not be watching, make it see us.
-         * The stack trace code uses rcu_sched.
-         */
-        rcu_irq_enter();
-
         /* In case another CPU set the tracer_frame on us */
         if (unlikely(!frame_size))
                 this_size -= tracer_frame;
@@ -205,7 +191,6 @@ check_stack(unsigned long ip, unsigned long *stack)
         }
 
  out:
-        rcu_irq_exit();
         arch_spin_unlock(&stack_trace_max_lock);
         local_irq_restore(flags);
 }
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index f5d52024f6b7..6bcb854909c0 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -29,20 +29,29 @@
 #include <linux/kvm_para.h>
 #include <linux/kthread.h>
 
-/* Watchdog configuration */
-static DEFINE_MUTEX(watchdog_proc_mutex);
-
-int __read_mostly nmi_watchdog_enabled;
+static DEFINE_MUTEX(watchdog_mutex);
 
 #if defined(CONFIG_HARDLOCKUP_DETECTOR) || defined(CONFIG_HAVE_NMI_WATCHDOG)
-unsigned long __read_mostly watchdog_enabled = SOFT_WATCHDOG_ENABLED |
-                                                NMI_WATCHDOG_ENABLED;
+# define WATCHDOG_DEFAULT       (SOFT_WATCHDOG_ENABLED | NMI_WATCHDOG_ENABLED)
+# define NMI_WATCHDOG_DEFAULT   1
 #else
-unsigned long __read_mostly watchdog_enabled = SOFT_WATCHDOG_ENABLED;
+# define WATCHDOG_DEFAULT       (SOFT_WATCHDOG_ENABLED)
+# define NMI_WATCHDOG_DEFAULT   0
 #endif
 
+unsigned long __read_mostly watchdog_enabled;
+int __read_mostly watchdog_user_enabled = 1;
+int __read_mostly nmi_watchdog_user_enabled = NMI_WATCHDOG_DEFAULT;
+int __read_mostly soft_watchdog_user_enabled = 1;
+int __read_mostly watchdog_thresh = 10;
+int __read_mostly nmi_watchdog_available;
+
+struct cpumask watchdog_allowed_mask __read_mostly;
+
+struct cpumask watchdog_cpumask __read_mostly;
+unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask);
+
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
-/* boot commands */
 /*
  * Should we panic when a soft-lockup or hard-lockup occurs:
  */
@@ -56,9 +65,9 @@ unsigned int __read_mostly hardlockup_panic =
  * kernel command line parameters are parsed, because otherwise it is not
  * possible to override this in hardlockup_panic_setup().
  */
-void hardlockup_detector_disable(void)
+void __init hardlockup_detector_disable(void)
 {
-        watchdog_enabled &= ~NMI_WATCHDOG_ENABLED;
+        nmi_watchdog_user_enabled = 0;
 }
 
 static int __init hardlockup_panic_setup(char *str)
@@ -68,48 +77,24 @@ static int __init hardlockup_panic_setup(char *str)
         else if (!strncmp(str, "nopanic", 7))
                 hardlockup_panic = 0;
         else if (!strncmp(str, "0", 1))
-                watchdog_enabled &= ~NMI_WATCHDOG_ENABLED;
+                nmi_watchdog_user_enabled = 0;
         else if (!strncmp(str, "1", 1))
-                watchdog_enabled |= NMI_WATCHDOG_ENABLED;
+                nmi_watchdog_user_enabled = 1;
         return 1;
 }
 __setup("nmi_watchdog=", hardlockup_panic_setup);
 
-#endif
-
-#ifdef CONFIG_SOFTLOCKUP_DETECTOR
-int __read_mostly soft_watchdog_enabled;
-#endif
-
-int __read_mostly watchdog_user_enabled;
-int __read_mostly watchdog_thresh = 10;
-
-#ifdef CONFIG_SMP
-int __read_mostly sysctl_softlockup_all_cpu_backtrace;
+# ifdef CONFIG_SMP
 int __read_mostly sysctl_hardlockup_all_cpu_backtrace;
-#endif
-struct cpumask watchdog_cpumask __read_mostly;
-unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask);
 
-/*
- * The 'watchdog_running' variable is set to 1 when the watchdog threads
- * are registered/started and is set to 0 when the watchdog threads are
- * unregistered/stopped, so it is an indicator whether the threads exist.
- */
-static int __read_mostly watchdog_running;
-/*
- * If a subsystem has a need to deactivate the watchdog temporarily, it
- * can use the suspend/resume interface to achieve this. The content of
- * the 'watchdog_suspended' variable reflects this state. Existing threads
- * are parked/unparked by the lockup_detector_{suspend|resume} functions
- * (see comment blocks pertaining to those functions for further details).
- *
- * 'watchdog_suspended' also prevents threads from being registered/started
- * or unregistered/stopped via parameters in /proc/sys/kernel, so the state
- * of 'watchdog_running' cannot change while the watchdog is deactivated
- * temporarily (see related code in 'proc' handlers).
- */
-int __read_mostly watchdog_suspended;
+static int __init hardlockup_all_cpu_backtrace_setup(char *str)
+{
+        sysctl_hardlockup_all_cpu_backtrace = !!simple_strtol(str, NULL, 0);
+        return 1;
+}
+__setup("hardlockup_all_cpu_backtrace=", hardlockup_all_cpu_backtrace_setup);
+# endif /* CONFIG_SMP */
+#endif /* CONFIG_HARDLOCKUP_DETECTOR */
 
 /*
  * These functions can be overridden if an architecture implements its
@@ -121,36 +106,68 @@ int __read_mostly watchdog_suspended;
  */
 int __weak watchdog_nmi_enable(unsigned int cpu)
 {
+        hardlockup_detector_perf_enable();
         return 0;
 }
+
 void __weak watchdog_nmi_disable(unsigned int cpu)
 {
+        hardlockup_detector_perf_disable();
 }
 
-/*
- * watchdog_nmi_reconfigure can be implemented to be notified after any
- * watchdog configuration change. The arch hardlockup watchdog should
- * respond to the following variables:
- * - nmi_watchdog_enabled
+/* Return 0, if a NMI watchdog is available. Error code otherwise */
+int __weak __init watchdog_nmi_probe(void)
+{
+        return hardlockup_detector_perf_init();
+}
+
+/**
+ * watchdog_nmi_stop - Stop the watchdog for reconfiguration
+ *
+ * The reconfiguration steps are:
+ * watchdog_nmi_stop();
+ * update_variables();
+ * watchdog_nmi_start();
+ */
+void __weak watchdog_nmi_stop(void) { }
+
+/**
+ * watchdog_nmi_start - Start the watchdog after reconfiguration
+ *
+ * Counterpart to watchdog_nmi_stop().
+ *
+ * The following variables have been updated in update_variables() and
+ * contain the currently valid configuration:
+ * - watchdog_enabled
  * - watchdog_thresh
  * - watchdog_cpumask
- * - sysctl_hardlockup_all_cpu_backtrace
- * - hardlockup_panic
- * - watchdog_suspended
  */
-void __weak watchdog_nmi_reconfigure(void)
+void __weak watchdog_nmi_start(void) { }
+
+/**
+ * lockup_detector_update_enable - Update the sysctl enable bit
+ *
+ * Caller needs to make sure that the NMI/perf watchdogs are off, so this
+ * can't race with watchdog_nmi_disable().
+ */
+static void lockup_detector_update_enable(void)
 {
+        watchdog_enabled = 0;
+        if (!watchdog_user_enabled)
+                return;
+        if (nmi_watchdog_available && nmi_watchdog_user_enabled)
+                watchdog_enabled |= NMI_WATCHDOG_ENABLED;
+        if (soft_watchdog_user_enabled)
+                watchdog_enabled |= SOFT_WATCHDOG_ENABLED;
 }
 
-
 #ifdef CONFIG_SOFTLOCKUP_DETECTOR
 
-/* Helper for online, unparked cpus. */
-#define for_each_watchdog_cpu(cpu) \
-        for_each_cpu_and((cpu), cpu_online_mask, &watchdog_cpumask)
-
-atomic_t watchdog_park_in_progress = ATOMIC_INIT(0);
+/* Global variables, exported for sysctl */
+unsigned int __read_mostly softlockup_panic =
+                        CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
 
+static bool softlockup_threads_initialized __read_mostly;
 static u64 __read_mostly sample_period;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
@@ -164,50 +181,40 @@ static DEFINE_PER_CPU(struct task_struct *, softlockup_task_ptr_saved);
 static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static unsigned long soft_lockup_nmi_warn;
 
-unsigned int __read_mostly softlockup_panic =
-                        CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
-
 static int __init softlockup_panic_setup(char *str)
 {
         softlockup_panic = simple_strtoul(str, NULL, 0);
-
         return 1;
 }
 __setup("softlockup_panic=", softlockup_panic_setup);
 
 static int __init nowatchdog_setup(char *str)
 {
-        watchdog_enabled = 0;
+        watchdog_user_enabled = 0;
         return 1;
 }
 __setup("nowatchdog", nowatchdog_setup);
 
 static int __init nosoftlockup_setup(char *str)
 {
-        watchdog_enabled &= ~SOFT_WATCHDOG_ENABLED;
+        soft_watchdog_user_enabled = 0;
         return 1;
 }
 __setup("nosoftlockup", nosoftlockup_setup);
 
 #ifdef CONFIG_SMP
+int __read_mostly sysctl_softlockup_all_cpu_backtrace;
+
 static int __init softlockup_all_cpu_backtrace_setup(char *str)
 {
-        sysctl_softlockup_all_cpu_backtrace =
-                !!simple_strtol(str, NULL, 0);
+        sysctl_softlockup_all_cpu_backtrace = !!simple_strtol(str, NULL, 0);
         return 1;
 }
 __setup("softlockup_all_cpu_backtrace=", softlockup_all_cpu_backtrace_setup);
-#ifdef CONFIG_HARDLOCKUP_DETECTOR
-static int __init hardlockup_all_cpu_backtrace_setup(char *str)
-{
-        sysctl_hardlockup_all_cpu_backtrace =
-                !!simple_strtol(str, NULL, 0);
-        return 1;
-}
-__setup("hardlockup_all_cpu_backtrace=", hardlockup_all_cpu_backtrace_setup);
-#endif
 #endif
 
+static void __lockup_detector_cleanup(void);
+
 /*
  * Hard-lockup warnings should be triggered after just a few seconds. Soft-
  * lockups can have false positives under extreme conditions. So we generally
@@ -278,11 +285,15 @@ void touch_all_softlockup_watchdogs(void)
         int cpu;
 
         /*
-         * this is done lockless
-         * do we care if a 0 races with a timestamp?
-         * all it means is the softlock check starts one cycle later
+         * watchdog_mutex cannpt be taken here, as this might be called
+         * from (soft)interrupt context, so the access to
+         * watchdog_allowed_cpumask might race with a concurrent update.
+         *
+         * The watchdog time stamp can race against a concurrent real
+         * update as well, the only side effect might be a cycle delay for
+         * the softlockup check.
          */
-        for_each_watchdog_cpu(cpu)
+        for_each_cpu(cpu, &watchdog_allowed_mask)
                 per_cpu(watchdog_touch_ts, cpu) = 0;
         wq_watchdog_touch(-1);
 }
@@ -322,9 +333,6 @@ static void watchdog_interrupt_count(void)
         __this_cpu_inc(hrtimer_interrupts);
 }
 
-static int watchdog_enable_all_cpus(void);
-static void watchdog_disable_all_cpus(void);
-
 /* watchdog kicker functions */
 static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
 {
@@ -333,7 +341,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
         int duration;
         int softlockup_all_cpu_backtrace = sysctl_softlockup_all_cpu_backtrace;
 
-        if (atomic_read(&watchdog_park_in_progress) != 0)
+        if (!watchdog_enabled)
                 return HRTIMER_NORESTART;
 
         /* kick the hardlockup detector */
@@ -447,32 +455,38 @@ static void watchdog_set_prio(unsigned int policy, unsigned int prio)
 
 static void watchdog_enable(unsigned int cpu)
 {
-        struct hrtimer *hrtimer = raw_cpu_ptr(&watchdog_hrtimer);
+        struct hrtimer *hrtimer = this_cpu_ptr(&watchdog_hrtimer);
 
-        /* kick off the timer for the hardlockup detector */
+        /*
+         * Start the timer first to prevent the NMI watchdog triggering
+         * before the timer has a chance to fire.
+         */
         hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         hrtimer->function = watchdog_timer_fn;
-
-        /* Enable the perf event */
-        watchdog_nmi_enable(cpu);
-
-        /* done here because hrtimer_start can only pin to smp_processor_id() */
         hrtimer_start(hrtimer, ns_to_ktime(sample_period),
                       HRTIMER_MODE_REL_PINNED);
 
-        /* initialize timestamp */
-        watchdog_set_prio(SCHED_FIFO, MAX_RT_PRIO - 1);
+        /* Initialize timestamp */
         __touch_watchdog();
+        /* Enable the perf event */
+        if (watchdog_enabled & NMI_WATCHDOG_ENABLED)
+                watchdog_nmi_enable(cpu);
+
+        watchdog_set_prio(SCHED_FIFO, MAX_RT_PRIO - 1);
 }
 
 static void watchdog_disable(unsigned int cpu)
 {
-        struct hrtimer *hrtimer = raw_cpu_ptr(&watchdog_hrtimer);
+        struct hrtimer *hrtimer = this_cpu_ptr(&watchdog_hrtimer);
 
         watchdog_set_prio(SCHED_NORMAL, 0);
-        hrtimer_cancel(hrtimer);
-        /* disable the perf event */
+        /*
+         * Disable the perf event first. That prevents that a large delay
+         * between disabling the timer and disabling the perf event causes
+         * the perf NMI to detect a false positive.
+         */
         watchdog_nmi_disable(cpu);
+        hrtimer_cancel(hrtimer);
 }
 
 static void watchdog_cleanup(unsigned int cpu, bool online)
@@ -499,21 +513,6 @@ static void watchdog(unsigned int cpu)
         __this_cpu_write(soft_lockup_hrtimer_cnt,
                          __this_cpu_read(hrtimer_interrupts));
         __touch_watchdog();
-
-        /*
-         * watchdog_nmi_enable() clears the NMI_WATCHDOG_ENABLED bit in the
-         * failure path. Check for failures that can occur asynchronously -
-         * for example, when CPUs are on-lined - and shut down the hardware
-         * perf event on each CPU accordingly.
-         *
-         * The only non-obvious place this bit can be cleared is through
-         * watchdog_nmi_enable(), so a pr_info() is placed there.  Placing a
-         * pr_info here would be too noisy as it would result in a message
-         * every few seconds if the hardlockup was disabled but the softlockup
-         * enabled.
-         */
-        if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
-                watchdog_nmi_disable(cpu);
 }
 
 static struct smp_hotplug_thread watchdog_threads = {
@@ -527,295 +526,174 @@ static struct smp_hotplug_thread watchdog_threads = {
         .unpark                 = watchdog_enable,
 };
 
-/*
- * park all watchdog threads that are specified in 'watchdog_cpumask'
- *
- * This function returns an error if kthread_park() of a watchdog thread
- * fails. In this situation, the watchdog threads of some CPUs can already
- * be parked and the watchdog threads of other CPUs can still be runnable.
- * Callers are expected to handle this special condition as appropriate in
- * their context.
- *
- * This function may only be called in a context that is protected against
- * races with CPU hotplug - for example, via get_online_cpus().
- */
-static int watchdog_park_threads(void)
+static void softlockup_update_smpboot_threads(void)
 {
-        int cpu, ret = 0;
+        lockdep_assert_held(&watchdog_mutex);
 
-        atomic_set(&watchdog_park_in_progress, 1);
+        if (!softlockup_threads_initialized)
+                return;
 
-        for_each_watchdog_cpu(cpu) {
-                ret = kthread_park(per_cpu(softlockup_watchdog, cpu));
-                if (ret)
-                        break;
-        }
-
-        atomic_set(&watchdog_park_in_progress, 0);
-
-        return ret;
+        smpboot_update_cpumask_percpu_thread(&watchdog_threads,
+                                             &watchdog_allowed_mask);
 }
 
-/*
- * unpark all watchdog threads that are specified in 'watchdog_cpumask'
- *
- * This function may only be called in a context that is protected against
- * races with CPU hotplug - for example, via get_online_cpus().
- */
-static void watchdog_unpark_threads(void)
+/* Temporarily park all watchdog threads */
+static void softlockup_park_all_threads(void)
 {
-        int cpu;
-
-        for_each_watchdog_cpu(cpu)
-                kthread_unpark(per_cpu(softlockup_watchdog, cpu));
+        cpumask_clear(&watchdog_allowed_mask);
+        softlockup_update_smpboot_threads();
 }
 
-static int update_watchdog_all_cpus(void)
+/* Unpark enabled threads */
+static void softlockup_unpark_threads(void)
 {
-        int ret;
-
-        ret = watchdog_park_threads();
-        if (ret)
-                return ret;
-
-        watchdog_unpark_threads();
-
-        return 0;
+        cpumask_copy(&watchdog_allowed_mask, &watchdog_cpumask);
+        softlockup_update_smpboot_threads();
 }
 
-static int watchdog_enable_all_cpus(void)
+static void lockup_detector_reconfigure(void)
 {
-        int err = 0;
-
-        if (!watchdog_running) {
-                err = smpboot_register_percpu_thread_cpumask(&watchdog_threads,
-                                                             &watchdog_cpumask);
-                if (err)
-                        pr_err("Failed to create watchdog threads, disabled\n");
-                else
-                        watchdog_running = 1;
-        } else {
-                /*
-                 * Enable/disable the lockup detectors or
-                 * change the sample period 'on the fly'.
-                 */
-                err = update_watchdog_all_cpus();
-
-                if (err) {
-                        watchdog_disable_all_cpus();
-                        pr_err("Failed to update lockup detectors, disabled\n");
-                }
-        }
-
-        if (err)
-                watchdog_enabled = 0;
-
-        return err;
+        cpus_read_lock();
+        watchdog_nmi_stop();
+        softlockup_park_all_threads();
+        set_sample_period();
+        lockup_detector_update_enable();
+        if (watchdog_enabled && watchdog_thresh)
+                softlockup_unpark_threads();
+        watchdog_nmi_start();
+        cpus_read_unlock();
+        /*
+         * Must be called outside the cpus locked section to prevent
+         * recursive locking in the perf code.
+         */
+        __lockup_detector_cleanup();
 }
 
-static void watchdog_disable_all_cpus(void)
+/*
+ * Create the watchdog thread infrastructure and configure the detector(s).
+ *
+ * The threads are not unparked as watchdog_allowed_mask is empty.  When
+ * the threads are sucessfully initialized, take the proper locks and
+ * unpark the threads in the watchdog_cpumask if the watchdog is enabled.
+ */
+static __init void lockup_detector_setup(void)
 {
-        if (watchdog_running) {
-                watchdog_running = 0;
-                smpboot_unregister_percpu_thread(&watchdog_threads);
-        }
-}
+        int ret;
 
-#ifdef CONFIG_SYSCTL
-static int watchdog_update_cpus(void)
-{
-        return smpboot_update_cpumask_percpu_thread(
-                    &watchdog_threads, &watchdog_cpumask);
-}
-#endif
+        /*
+         * If sysctl is off and watchdog got disabled on the command line,
+         * nothing to do here.
+         */
+        lockup_detector_update_enable();
 
-#else /* SOFTLOCKUP */
-static int watchdog_park_threads(void)
-{
-        return 0;
-}
+        if (!IS_ENABLED(CONFIG_SYSCTL) &&
+            !(watchdog_enabled && watchdog_thresh))
+                return;
 
-static void watchdog_unpark_threads(void)
-{
-}
+        ret = smpboot_register_percpu_thread_cpumask(&watchdog_threads,
+                                                     &watchdog_allowed_mask);
+        if (ret) {
+                pr_err("Failed to initialize soft lockup detector threads\n");
+                return;
+        }
 
-static int watchdog_enable_all_cpus(void)
-{
-        return 0;
+        mutex_lock(&watchdog_mutex);
+        softlockup_threads_initialized = true;
+        lockup_detector_reconfigure();
+        mutex_unlock(&watchdog_mutex);
 }
 
-static void watchdog_disable_all_cpus(void)
+#else /* CONFIG_SOFTLOCKUP_DETECTOR */
+static inline int watchdog_park_threads(void) { return 0; }
+static inline void watchdog_unpark_threads(void) { }
+static inline int watchdog_enable_all_cpus(void) { return 0; }
+static inline void watchdog_disable_all_cpus(void) { }
+static void lockup_detector_reconfigure(void)
 {
+        cpus_read_lock();
+        watchdog_nmi_stop();
+        lockup_detector_update_enable();
+        watchdog_nmi_start();
+        cpus_read_unlock();
 }
-
-#ifdef CONFIG_SYSCTL
-static int watchdog_update_cpus(void)
+static inline void lockup_detector_setup(void)
 {
-        return 0;
+        lockup_detector_reconfigure();
 }
-#endif
+#endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
 
-static void set_sample_period(void)
+static void __lockup_detector_cleanup(void)
 {
+        lockdep_assert_held(&watchdog_mutex);
+        hardlockup_detector_perf_cleanup();
 }
-#endif /* SOFTLOCKUP */
 
-/*
- * Suspend the hard and soft lockup detector by parking the watchdog threads.
+/**
+ * lockup_detector_cleanup - Cleanup after cpu hotplug or sysctl changes
+ *
+ * Caller must not hold the cpu hotplug rwsem.
  */
-int lockup_detector_suspend(void)
+void lockup_detector_cleanup(void)
 {
-        int ret = 0;
-
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
-        /*
-         * Multiple suspend requests can be active in parallel (counted by
-         * the 'watchdog_suspended' variable). If the watchdog threads are
-         * running, the first caller takes care that they will be parked.
-         * The state of 'watchdog_running' cannot change while a suspend
-         * request is active (see related code in 'proc' handlers).
-         */
-        if (watchdog_running && !watchdog_suspended)
-                ret = watchdog_park_threads();
-
-        if (ret == 0)
-                watchdog_suspended++;
-        else {
-                watchdog_disable_all_cpus();
-                pr_err("Failed to suspend lockup detectors, disabled\n");
-                watchdog_enabled = 0;
-        }
-
-        watchdog_nmi_reconfigure();
-
-        mutex_unlock(&watchdog_proc_mutex);
-
-        return ret;
+        mutex_lock(&watchdog_mutex);
+        __lockup_detector_cleanup();
+        mutex_unlock(&watchdog_mutex);
 }
 
-/*
- * Resume the hard and soft lockup detector by unparking the watchdog threads.
+/**
+ * lockup_detector_soft_poweroff - Interface to stop lockup detector(s)
+ *
+ * Special interface for parisc. It prevents lockup detector warnings from
+ * the default pm_poweroff() function which busy loops forever.
  */
-void lockup_detector_resume(void)
+void lockup_detector_soft_poweroff(void)
 {
-        mutex_lock(&watchdog_proc_mutex);
-
-        watchdog_suspended--;
-        /*
-         * The watchdog threads are unparked if they were previously running
-         * and if there is no more active suspend request.
-         */
-        if (watchdog_running && !watchdog_suspended)
-                watchdog_unpark_threads();
-
-        watchdog_nmi_reconfigure();
-
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        watchdog_enabled = 0;
 }
 
 #ifdef CONFIG_SYSCTL
 
-/*
- * Update the run state of the lockup detectors.
- */
-static int proc_watchdog_update(void)
+/* Propagate any changes to the watchdog threads */
+static void proc_watchdog_update(void)
 {
-        int err = 0;
-
-        /*
-         * Watchdog threads won't be started if they are already active.
-         * The 'watchdog_running' variable in watchdog_*_all_cpus() takes
-         * care of this. If those threads are already active, the sample
-         * period will be updated and the lockup detectors will be enabled
-         * or disabled 'on the fly'.
-         */
-        if (watchdog_enabled && watchdog_thresh)
-                err = watchdog_enable_all_cpus();
-        else
-                watchdog_disable_all_cpus();
-
-        watchdog_nmi_reconfigure();
-
-        return err;
-
+        /* Remove impossible cpus to keep sysctl output clean. */
+        cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask);
+        lockup_detector_reconfigure();
 }
 
 /*
  * common function for watchdog, nmi_watchdog and soft_watchdog parameter
  *
- * caller             | table->data points to | 'which' contains the flag(s)
- * -------------------|-----------------------|-----------------------------
- * proc_watchdog      | watchdog_user_enabled | NMI_WATCHDOG_ENABLED or'ed
- *                    |                       | with SOFT_WATCHDOG_ENABLED
- * -------------------|-----------------------|-----------------------------
- * proc_nmi_watchdog  | nmi_watchdog_enabled  | NMI_WATCHDOG_ENABLED
- * -------------------|-----------------------|-----------------------------
- * proc_soft_watchdog | soft_watchdog_enabled | SOFT_WATCHDOG_ENABLED
+ * caller             | table->data points to      | 'which'
+ * -------------------|----------------------------|--------------------------
+ * proc_watchdog      | watchdog_user_enabled      | NMI_WATCHDOG_ENABLED |
+ *                    |                            | SOFT_WATCHDOG_ENABLED
+ * -------------------|----------------------------|--------------------------
+ * proc_nmi_watchdog  | nmi_watchdog_user_enabled  | NMI_WATCHDOG_ENABLED
+ * -------------------|----------------------------|--------------------------
+ * proc_soft_watchdog | soft_watchdog_user_enabled | SOFT_WATCHDOG_ENABLED
  */
 static int proc_watchdog_common(int which, struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        int err, old, new;
-        int *watchdog_param = (int *)table->data;
+        int err, old, *param = table->data;
 
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
+        mutex_lock(&watchdog_mutex);
 
-        if (watchdog_suspended) {
-                /* no parameter changes allowed while watchdog is suspended */
-                err = -EAGAIN;
-                goto out;
-        }
-
-        /*
-         * If the parameter is being read return the state of the corresponding
-         * bit(s) in 'watchdog_enabled', else update 'watchdog_enabled' and the
-         * run state of the lockup detectors.
-         */
         if (!write) {
-                *watchdog_param = (watchdog_enabled & which) != 0;
+                /*
+                 * On read synchronize the userspace interface. This is a
+                 * racy snapshot.
+                 */
+                *param = (watchdog_enabled & which) != 0;
                 err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
         } else {
+                old = READ_ONCE(*param);
                 err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
-                if (err)
-                        goto out;
-
-                /*
-                 * There is a race window between fetching the current value
-                 * from 'watchdog_enabled' and storing the new value. During
-                 * this race window, watchdog_nmi_enable() can sneak in and
-                 * clear the NMI_WATCHDOG_ENABLED bit in 'watchdog_enabled'.
-                 * The 'cmpxchg' detects this race and the loop retries.
-                 */
-                do {
-                        old = watchdog_enabled;
-                        /*
-                         * If the parameter value is not zero set the
-                         * corresponding bit(s), else clear it(them).
-                         */
-                        if (*watchdog_param)
-                                new = old | which;
-                        else
-                                new = old & ~which;
-                } while (cmpxchg(&watchdog_enabled, old, new) != old);
-
-                /*
-                 * Update the run state of the lockup detectors. There is _no_
-                 * need to check the value returned by proc_watchdog_update()
-                 * and to restore the previous value of 'watchdog_enabled' as
-                 * both lockup detectors are disabled if proc_watchdog_update()
-                 * returns an error.
-                 */
-                if (old == new)
-                        goto out;
-
-                err = proc_watchdog_update();
+                if (!err && old != READ_ONCE(*param))
+                        proc_watchdog_update();
         }
-out:
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        mutex_unlock(&watchdog_mutex);
         return err;
 }
 
@@ -835,6 +713,8 @@ int proc_watchdog(struct ctl_table *table, int write,
 int proc_nmi_watchdog(struct ctl_table *table, int write,
                       void __user *buffer, size_t *lenp, loff_t *ppos)
 {
+        if (!nmi_watchdog_available && write)
+                return -ENOTSUPP;
         return proc_watchdog_common(NMI_WATCHDOG_ENABLED,
                                     table, write, buffer, lenp, ppos);
 }
@@ -855,39 +735,17 @@ int proc_soft_watchdog(struct ctl_table *table, int write,
 int proc_watchdog_thresh(struct ctl_table *table, int write,
                          void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        int err, old, new;
-
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
+        int err, old;
 
-        if (watchdog_suspended) {
-                /* no parameter changes allowed while watchdog is suspended */
-                err = -EAGAIN;
-                goto out;
-        }
+        mutex_lock(&watchdog_mutex);
 
-        old = ACCESS_ONCE(watchdog_thresh);
+        old = READ_ONCE(watchdog_thresh);
         err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 
-        if (err || !write)
-                goto out;
-
-        /*
-         * Update the sample period. Restore on failure.
-         */
-        new = ACCESS_ONCE(watchdog_thresh);
-        if (old == new)
-                goto out;
+        if (!err && write && old != READ_ONCE(watchdog_thresh))
+                proc_watchdog_update();
 
-        set_sample_period();
-        err = proc_watchdog_update();
-        if (err) {
-                watchdog_thresh = old;
-                set_sample_period();
-        }
-out:
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        mutex_unlock(&watchdog_mutex);
         return err;
 }
 
@@ -902,45 +760,19 @@ int proc_watchdog_cpumask(struct ctl_table *table, int write,
 {
         int err;
 
-        get_online_cpus();
-        mutex_lock(&watchdog_proc_mutex);
-
-        if (watchdog_suspended) {
-                /* no parameter changes allowed while watchdog is suspended */
-                err = -EAGAIN;
-                goto out;
-        }
+        mutex_lock(&watchdog_mutex);
 
         err = proc_do_large_bitmap(table, write, buffer, lenp, ppos);
-        if (!err && write) {
-                /* Remove impossible cpus to keep sysctl output cleaner. */
-                cpumask_and(&watchdog_cpumask, &watchdog_cpumask,
-                            cpu_possible_mask);
-
-                if (watchdog_running) {
-                        /*
-                         * Failure would be due to being unable to allocate
-                         * a temporary cpumask, so we are likely not in a
-                         * position to do much else to make things better.
-                         */
-                        if (watchdog_update_cpus() != 0)
-                                pr_err("cpumask update failed\n");
-                }
+        if (!err && write)
+                proc_watchdog_update();
 
-                watchdog_nmi_reconfigure();
-        }
-out:
-        mutex_unlock(&watchdog_proc_mutex);
-        put_online_cpus();
+        mutex_unlock(&watchdog_mutex);
         return err;
 }
-
 #endif /* CONFIG_SYSCTL */
 
 void __init lockup_detector_init(void)
 {
-        set_sample_period();
-
 #ifdef CONFIG_NO_HZ_FULL
         if (tick_nohz_full_enabled()) {
                 pr_info("Disabling watchdog on nohz_full cores by default\n");
@@ -951,6 +783,7 @@ void __init lockup_detector_init(void)
         cpumask_copy(&watchdog_cpumask, cpu_possible_mask);
 #endif
 
-        if (watchdog_enabled)
-                watchdog_enable_all_cpus();
+        if (!watchdog_nmi_probe())
+                nmi_watchdog_available = true;
+        lockup_detector_setup();
 }
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 3a09ea1b1d3d..71a62ceacdc8 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -21,8 +21,10 @@
 static DEFINE_PER_CPU(bool, hard_watchdog_warn);
 static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
+static struct cpumask dead_events_mask;
 
 static unsigned long hardlockup_allcpu_dumped;
+static unsigned int watchdog_cpus;
 
 void arch_touch_nmi_watchdog(void)
 {
@@ -103,15 +105,12 @@ static struct perf_event_attr wd_hw_attr = {
 
 /* Callback function for perf event subsystem */
 static void watchdog_overflow_callback(struct perf_event *event,
-                 struct perf_sample_data *data,
-                 struct pt_regs *regs)
+                                       struct perf_sample_data *data,
+                                       struct pt_regs *regs)
 {
         /* Ensure the watchdog never gets throttled */
         event->hw.interrupts = 0;
 
-        if (atomic_read(&watchdog_park_in_progress) != 0)
-                return;
-
         if (__this_cpu_read(watchdog_nmi_touch) == true) {
                 __this_cpu_write(watchdog_nmi_touch, false);
                 return;
@@ -160,104 +159,131 @@ static void watchdog_overflow_callback(struct perf_event *event,
         return;
 }
 
-/*
- * People like the simple clean cpu node info on boot.
- * Reduce the watchdog noise by only printing messages
- * that are different from what cpu0 displayed.
- */
-static unsigned long firstcpu_err;
-static atomic_t watchdog_cpus;
-
-int watchdog_nmi_enable(unsigned int cpu)
+static int hardlockup_detector_event_create(void)
 {
+        unsigned int cpu = smp_processor_id();
         struct perf_event_attr *wd_attr;
-        struct perf_event *event = per_cpu(watchdog_ev, cpu);
-        int firstcpu = 0;
-
-        /* nothing to do if the hard lockup detector is disabled */
-        if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
-                goto out;
-
-        /* is it already setup and enabled? */
-        if (event && event->state > PERF_EVENT_STATE_OFF)
-                goto out;
-
-        /* it is setup but not enabled */
-        if (event != NULL)
-                goto out_enable;
-
-        if (atomic_inc_return(&watchdog_cpus) == 1)
-                firstcpu = 1;
+        struct perf_event *evt;
 
         wd_attr = &wd_hw_attr;
         wd_attr->sample_period = hw_nmi_get_sample_period(watchdog_thresh);
 
         /* Try to register using hardware perf events */
-        event = perf_event_create_kernel_counter(wd_attr, cpu, NULL, watchdog_overflow_callback, NULL);
+        evt = perf_event_create_kernel_counter(wd_attr, cpu, NULL,
+                                               watchdog_overflow_callback, NULL);
+        if (IS_ERR(evt)) {
+                pr_info("Perf event create on CPU %d failed with %ld\n", cpu,
+                        PTR_ERR(evt));
+                return PTR_ERR(evt);
+        }
+        this_cpu_write(watchdog_ev, evt);
+        return 0;
+}
 
-        /* save the first cpu's error for future comparision */
-        if (firstcpu && IS_ERR(event))
-                firstcpu_err = PTR_ERR(event);
+/**
+ * hardlockup_detector_perf_enable - Enable the local event
+ */
+void hardlockup_detector_perf_enable(void)
+{
+        if (hardlockup_detector_event_create())
+                return;
 
-        if (!IS_ERR(event)) {
-                /* only print for the first cpu initialized */
-                if (firstcpu || firstcpu_err)
-                        pr_info("enabled on all CPUs, permanently consumes one hw-PMU counter.\n");
-                goto out_save;
-        }
+        if (!watchdog_cpus++)
+                pr_info("Enabled. Permanently consumes one hw-PMU counter.\n");
 
-        /*
-         * Disable the hard lockup detector if _any_ CPU fails to set up
-         * set up the hardware perf event. The watchdog() function checks
-         * the NMI_WATCHDOG_ENABLED bit periodically.
-         *
-         * The barriers are for syncing up watchdog_enabled across all the
-         * cpus, as clear_bit() does not use barriers.
-         */
-        smp_mb__before_atomic();
-        clear_bit(NMI_WATCHDOG_ENABLED_BIT, &watchdog_enabled);
-        smp_mb__after_atomic();
-
-        /* skip displaying the same error again */
-        if (!firstcpu && (PTR_ERR(event) == firstcpu_err))
-                return PTR_ERR(event);
-
-        /* vary the KERN level based on the returned errno */
-        if (PTR_ERR(event) == -EOPNOTSUPP)
-                pr_info("disabled (cpu%i): not supported (no LAPIC?)\n", cpu);
-        else if (PTR_ERR(event) == -ENOENT)
-                pr_warn("disabled (cpu%i): hardware events not enabled\n",
-                         cpu);
-        else
-                pr_err("disabled (cpu%i): unable to create perf event: %ld\n",
-                        cpu, PTR_ERR(event));
-
-        pr_info("Shutting down hard lockup detector on all cpus\n");
-
-        return PTR_ERR(event);
-
-        /* success path */
-out_save:
-        per_cpu(watchdog_ev, cpu) = event;
-out_enable:
-        perf_event_enable(per_cpu(watchdog_ev, cpu));
-out:
-        return 0;
+        perf_event_enable(this_cpu_read(watchdog_ev));
 }
 
-void watchdog_nmi_disable(unsigned int cpu)
+/**
+ * hardlockup_detector_perf_disable - Disable the local event
+ */
+void hardlockup_detector_perf_disable(void)
 {
-        struct perf_event *event = per_cpu(watchdog_ev, cpu);
+        struct perf_event *event = this_cpu_read(watchdog_ev);
 
         if (event) {
                 perf_event_disable(event);
+                cpumask_set_cpu(smp_processor_id(), &dead_events_mask);
+                watchdog_cpus--;
+        }
+}
+
+/**
+ * hardlockup_detector_perf_cleanup - Cleanup disabled events and destroy them
+ *
+ * Called from lockup_detector_cleanup(). Serialized by the caller.
+ */
+void hardlockup_detector_perf_cleanup(void)
+{
+        int cpu;
+
+        for_each_cpu(cpu, &dead_events_mask) {
+                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+
+                /*
+                 * Required because for_each_cpu() reports  unconditionally
+                 * CPU0 as set on UP kernels. Sigh.
+                 */
+                if (event)
+                        perf_event_release_kernel(event);
                 per_cpu(watchdog_ev, cpu) = NULL;
+        }
+        cpumask_clear(&dead_events_mask);
+}
+
+/**
+ * hardlockup_detector_perf_stop - Globally stop watchdog events
+ *
+ * Special interface for x86 to handle the perf HT bug.
+ */
+void __init hardlockup_detector_perf_stop(void)
+{
+        int cpu;
+
+        lockdep_assert_cpus_held();
+
+        for_each_online_cpu(cpu) {
+                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+
+                if (event)
+                        perf_event_disable(event);
+        }
+}
 
-                /* should be in cleanup, but blocks oprofile */
-                perf_event_release_kernel(event);
+/**
+ * hardlockup_detector_perf_restart - Globally restart watchdog events
+ *
+ * Special interface for x86 to handle the perf HT bug.
+ */
+void __init hardlockup_detector_perf_restart(void)
+{
+        int cpu;
+
+        lockdep_assert_cpus_held();
+
+        if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
+                return;
+
+        for_each_online_cpu(cpu) {
+                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+
+                if (event)
+                        perf_event_enable(event);
+        }
+}
+
+/**
+ * hardlockup_detector_perf_init - Probe whether NMI event is available at all
+ */
+int __init hardlockup_detector_perf_init(void)
+{
+        int ret = hardlockup_detector_event_create();
 
-                /* watchdog_nmi_enable() expects this to be zero initially. */
-                if (atomic_dec_and_test(&watchdog_cpus))
-                        firstcpu_err = 0;
+        if (ret) {
+                pr_info("Perf NMI watchdog permanently disabled\n");
+        } else {
+                perf_event_release_kernel(this_cpu_read(watchdog_ev));
+                this_cpu_write(watchdog_ev, NULL);
         }
+        return ret;
 }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index b19c491cbc4e..2689b7c50c52 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -219,7 +219,8 @@ config FRAME_WARN
         range 0 8192
         default 0 if KASAN
         default 2048 if GCC_PLUGIN_LATENT_ENTROPY
-        default 1024 if !64BIT
+        default 1280 if (!64BIT && PARISC)
+        default 1024 if (!64BIT && !PARISC)
         default 2048 if 64BIT
         help
           Tell gcc to warn at build time for stack frames larger than this.
diff --git a/lib/idr.c b/lib/idr.c
index f9adf4805fd7..edd9b2be1651 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -146,8 +146,8 @@ EXPORT_SYMBOL(idr_get_next_ext);
  * idr_alloc() and idr_remove() (as long as the ID being removed is not
  * the one being replaced!).
  *
- * Returns: 0 on success.  %-ENOENT indicates that @id was not found.
- * %-EINVAL indicates that @id or @ptr were not valid.
+ * Returns: the old value on success.  %-ENOENT indicates that @id was not
+ * found.  %-EINVAL indicates that @id or @ptr were not valid.
  */
 void *idr_replace(struct idr *idr, void *ptr, int id)
 {
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 52c8dd6d8e82..1c1c06ddc20a 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache);
 
 static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
 {
-        size_t v = n + offset;
-        if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page))))
+        struct page *head = compound_head(page);
+        size_t v = n + offset + page_address(page) - page_address(head);
+
+        if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head))))
                 return true;
         WARN_ON(1);
         return false;
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index e590523ea476..f237a09a5862 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -294,6 +294,26 @@ static void cleanup_uevent_env(struct subprocess_info *info)
 }
 #endif
 
+static void zap_modalias_env(struct kobj_uevent_env *env)
+{
+        static const char modalias_prefix[] = "MODALIAS=";
+        int i;
+
+        for (i = 0; i < env->envp_idx;) {
+                if (strncmp(env->envp[i], modalias_prefix,
+                            sizeof(modalias_prefix) - 1)) {
+                        i++;
+                        continue;
+                }
+
+                if (i != env->envp_idx - 1)
+                        memmove(&env->envp[i], &env->envp[i + 1],
+                                sizeof(env->envp[i]) * env->envp_idx - 1);
+
+                env->envp_idx--;
+        }
+}
+
 /**
  * kobject_uevent_env - send an uevent with environmental data
  *
@@ -409,16 +429,29 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
                 }
         }
 
-        /*
-         * Mark "add" and "remove" events in the object to ensure proper
-         * events to userspace during automatic cleanup. If the object did
-         * send an "add" event, "remove" will automatically generated by
-         * the core, if not already done by the caller.
-         */
-        if (action == KOBJ_ADD)
+        switch (action) {
+        case KOBJ_ADD:
+                /*
+                 * Mark "add" event so we can make sure we deliver "remove"
+                 * event to userspace during automatic cleanup. If
+                 * the object did send an "add" event, "remove" will
+                 * automatically generated by the core, if not already done
+                 * by the caller.
+                 */
                 kobj->state_add_uevent_sent = 1;
-        else if (action == KOBJ_REMOVE)
+                break;
+
+        case KOBJ_REMOVE:
                 kobj->state_remove_uevent_sent = 1;
+                break;
+
+        case KOBJ_UNBIND:
+                zap_modalias_env(env);
+                break;
+
+        default:
+                break;
+        }
 
         mutex_lock(&uevent_sock_mutex);
         /* we will send an event, so request a new sequence number */
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index bd3574312b82..141734d255e4 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -85,8 +85,8 @@ static FORCE_INLINE int LZ4_decompress_generic(
         const BYTE * const lowLimit = lowPrefix - dictSize;
 
         const BYTE * const dictEnd = (const BYTE *)dictStart + dictSize;
-        const unsigned int dec32table[] = { 0, 1, 2, 1, 4, 4, 4, 4 };
-        const int dec64table[] = { 0, 0, 0, -1, 0, 1, 2, 3 };
+        static const unsigned int dec32table[] = { 0, 1, 2, 1, 4, 4, 4, 4 };
+        static const int dec64table[] = { 0, 0, 0, -1, 0, 1, 2, 3 };
 
         const int safeDecode = (endOnInput == endOnInputSize);
         const int checkOffset = ((safeDecode) && (dictSize < (int)(64 * KB)));
diff --git a/lib/ratelimit.c b/lib/ratelimit.c
index 08f8043cac61..d01f47135239 100644
--- a/lib/ratelimit.c
+++ b/lib/ratelimit.c
@@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
         if (time_is_before_jiffies(rs->begin + rs->interval)) {
                 if (rs->missed) {
                         if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) {
-                                pr_warn("%s: %d callbacks suppressed\n", func, rs->missed);
+                                printk_deferred(KERN_WARNING
+                                                "%s: %d callbacks suppressed\n",
+                                                func, rs->missed);
                                 rs->missed = 0;
                         }
                 }
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 707ca5d677c6..ddd7dde87c3c 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -735,9 +735,9 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
  * rhashtable_walk_start - Start a hash table walk
  * @iter:       Hash table iterator
  *
- * Start a hash table walk.  Note that we take the RCU lock in all
- * cases including when we return an error.  So you must always call
- * rhashtable_walk_stop to clean up.
+ * Start a hash table walk at the current iterator position.  Note that we take
+ * the RCU lock in all cases including when we return an error.  So you must
+ * always call rhashtable_walk_stop to clean up.
  *
  * Returns zero if successful.
  *
@@ -846,7 +846,8 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_next);
  * rhashtable_walk_stop - Finish a hash table walk
  * @iter:       Hash table iterator
  *
- * Finish a hash table walk.
+ * Finish a hash table walk.  Does not reset the iterator to the start of the
+ * hash table.
  */
 void rhashtable_walk_stop(struct rhashtable_iter *iter)
         __releases(RCU)
diff --git a/mm/compaction.c b/mm/compaction.c
index fb548e4c7bd4..03d31a875341 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1999,17 +1999,14 @@ void wakeup_kcompactd(pg_data_t *pgdat, int order, int classzone_idx)
         if (pgdat->kcompactd_max_order < order)
                 pgdat->kcompactd_max_order = order;
 
-        /*
-         * Pairs with implicit barrier in wait_event_freezable()
-         * such that wakeups are not missed in the lockless
-         * waitqueue_active() call.
-         */
-        smp_acquire__after_ctrl_dep();
-
         if (pgdat->kcompactd_classzone_idx > classzone_idx)
                 pgdat->kcompactd_classzone_idx = classzone_idx;
 
-        if (!waitqueue_active(&pgdat->kcompactd_wait))
+        /*
+         * Pairs with implicit barrier in wait_event_freezable()
+         * such that wakeups are not missed.
+         */
+        if (!wq_has_sleeper(&pgdat->kcompactd_wait))
                 return;
 
         if (!kcompactd_node_suitable(pgdat))
diff --git a/mm/filemap.c b/mm/filemap.c
index 870971e20967..594d73fef8b4 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -620,6 +620,14 @@ int file_check_and_advance_wb_err(struct file *file)
                 trace_file_check_and_advance_wb_err(file, old);
                 spin_unlock(&file->f_lock);
         }
+
+        /*
+         * We're mostly using this function as a drop in replacement for
+         * filemap_check_errors. Clear AS_EIO/AS_ENOSPC to emulate the effect
+         * that the legacy code would have had on these flags.
+         */
+        clear_bit(AS_EIO, &mapping->flags);
+        clear_bit(AS_ENOSPC, &mapping->flags);
         return err;
 }
 EXPORT_SYMBOL(file_check_and_advance_wb_err);
@@ -2926,9 +2934,15 @@ generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from)
          * we're writing.  Either one is a pretty crazy thing to do,
          * so we don't support it 100%.  If this invalidation
          * fails, tough, the write still worked...
+         *
+         * Most of the time we do not need this since dio_complete() will do
+         * the invalidation for us. However there are some file systems that
+         * do not end up with dio_complete() being called, so let's not break
+         * them by removing it completely
          */
-        invalidate_inode_pages2_range(mapping,
-                                pos >> PAGE_SHIFT, end);
+        if (mapping->nrpages)
+                invalidate_inode_pages2_range(mapping,
+                                        pos >> PAGE_SHIFT, end);
 
         if (written > 0) {
                 pos += written;
diff --git a/mm/ksm.c b/mm/ksm.c
index 15dd7415f7b3..6cb60f46cce5 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1990,6 +1990,7 @@ static void stable_tree_append(struct rmap_item *rmap_item,
  */
 static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
 {
+        struct mm_struct *mm = rmap_item->mm;
         struct rmap_item *tree_rmap_item;
         struct page *tree_page = NULL;
         struct stable_node *stable_node;
@@ -2062,9 +2063,11 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
         if (ksm_use_zero_pages && (checksum == zero_checksum)) {
                 struct vm_area_struct *vma;
 
-                vma = find_mergeable_vma(rmap_item->mm, rmap_item->address);
+                down_read(&mm->mmap_sem);
+                vma = find_mergeable_vma(mm, rmap_item->address);
                 err = try_to_merge_one_page(vma, page,
                                             ZERO_PAGE(rmap_item->address));
+                up_read(&mm->mmap_sem);
                 /*
                  * In case of failure, the page was not really empty, so we
                  * need to continue. Otherwise we're done.
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 7a40fa2be858..f141f0c80ff3 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -325,12 +325,12 @@ static int memcg_init_list_lru_node(struct list_lru_node *nlru)
 {
         int size = memcg_nr_cache_ids;
 
-        nlru->memcg_lrus = kmalloc(size * sizeof(void *), GFP_KERNEL);
+        nlru->memcg_lrus = kvmalloc(size * sizeof(void *), GFP_KERNEL);
         if (!nlru->memcg_lrus)
                 return -ENOMEM;
 
         if (__memcg_init_list_lru_node(nlru->memcg_lrus, 0, size)) {
-                kfree(nlru->memcg_lrus);
+                kvfree(nlru->memcg_lrus);
                 return -ENOMEM;
         }
 
@@ -340,7 +340,7 @@ static int memcg_init_list_lru_node(struct list_lru_node *nlru)
 static void memcg_destroy_list_lru_node(struct list_lru_node *nlru)
 {
         __memcg_destroy_list_lru_node(nlru->memcg_lrus, 0, memcg_nr_cache_ids);
-        kfree(nlru->memcg_lrus);
+        kvfree(nlru->memcg_lrus);
 }
 
 static int memcg_update_list_lru_node(struct list_lru_node *nlru,
@@ -351,12 +351,12 @@ static int memcg_update_list_lru_node(struct list_lru_node *nlru,
         BUG_ON(old_size > new_size);
 
         old = nlru->memcg_lrus;
-        new = kmalloc(new_size * sizeof(void *), GFP_KERNEL);
+        new = kvmalloc(new_size * sizeof(void *), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
         if (__memcg_init_list_lru_node(new, old_size, new_size)) {
-                kfree(new);
+                kvfree(new);
                 return -ENOMEM;
         }
 
@@ -373,7 +373,7 @@ static int memcg_update_list_lru_node(struct list_lru_node *nlru,
         nlru->memcg_lrus = new;
         spin_unlock_irq(&nlru->lock);
 
-        kfree(old);
+        kvfree(old);
         return 0;
 }
 
diff --git a/mm/madvise.c b/mm/madvise.c
index 21261ff0466f..25bade36e9ca 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -625,18 +625,26 @@ static int madvise_inject_error(int behavior,
 {
         struct page *page;
         struct zone *zone;
+        unsigned int order;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        for (; start < end; start += PAGE_SIZE <<
-                                compound_order(compound_head(page))) {
+
+        for (; start < end; start += PAGE_SIZE << order) {
                 int ret;
 
                 ret = get_user_pages_fast(start, 1, 0, &page);
                 if (ret != 1)
                         return ret;
 
+                /*
+                 * When soft offlining hugepages, after migrating the page
+                 * we dissolve it, therefore in the second loop "page" will
+                 * no longer be a compound page, and order will be 0.
+                 */
+                order = compound_order(compound_head(page));
+
                 if (PageHWPoison(page)) {
                         put_page(page);
                         continue;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 15af3da5af02..d5f3a62887cf 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1777,6 +1777,10 @@ static void drain_local_stock(struct work_struct *dummy)
         struct memcg_stock_pcp *stock;
         unsigned long flags;
 
+        /*
+         * The only protection from memory hotplug vs. drain_stock races is
+         * that we always operate on local CPU stock here with IRQ disabled
+         */
         local_irq_save(flags);
 
         stock = this_cpu_ptr(&memcg_stock);
@@ -1821,27 +1825,33 @@ static void drain_all_stock(struct mem_cgroup *root_memcg)
         /* If someone's already draining, avoid adding running more workers. */
         if (!mutex_trylock(&percpu_charge_mutex))
                 return;
-        /* Notify other cpus that system-wide "drain" is running */
-        get_online_cpus();
+        /*
+         * Notify other cpus that system-wide "drain" is running
+         * We do not care about races with the cpu hotplug because cpu down
+         * as well as workers from this path always operate on the local
+         * per-cpu data. CPU up doesn't touch memcg_stock at all.
+         */
         curcpu = get_cpu();
         for_each_online_cpu(cpu) {
                 struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
                 struct mem_cgroup *memcg;
 
                 memcg = stock->cached;
-                if (!memcg || !stock->nr_pages)
+                if (!memcg || !stock->nr_pages || !css_tryget(&memcg->css))
                         continue;
-                if (!mem_cgroup_is_descendant(memcg, root_memcg))
+                if (!mem_cgroup_is_descendant(memcg, root_memcg)) {
+                        css_put(&memcg->css);
                         continue;
+                }
                 if (!test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) {
                         if (cpu == curcpu)
                                 drain_local_stock(&stock->work);
                         else
                                 schedule_work_on(cpu, &stock->work);
                 }
+                css_put(&memcg->css);
         }
         put_cpu();
-        put_online_cpus();
         mutex_unlock(&percpu_charge_mutex);
 }
 
@@ -5648,7 +5658,8 @@ static void uncharge_batch(const struct uncharge_gather *ug)
 static void uncharge_page(struct page *page, struct uncharge_gather *ug)
 {
         VM_BUG_ON_PAGE(PageLRU(page), page);
-        VM_BUG_ON_PAGE(!PageHWPoison(page) && page_count(page), page);
+        VM_BUG_ON_PAGE(page_count(page) && !is_zone_device_page(page) &&
+                        !PageHWPoison(page) , page);
 
         if (!page->mem_cgroup)
                 return;
diff --git a/mm/memory.c b/mm/memory.c
index ec4e15494901..a728bed16c20 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -845,7 +845,7 @@ struct page *_vm_normal_page(struct vm_area_struct *vma, unsigned long addr,
                  * vm_normal_page() so that we do not have to special case all
                  * call site of vm_normal_page().
                  */
-                if (likely(pfn < highest_memmap_pfn)) {
+                if (likely(pfn <= highest_memmap_pfn)) {
                         struct page *page = pfn_to_page(pfn);
 
                         if (is_device_public_page(page)) {
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index e882cb6da994..d4b5f29906b9 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -328,6 +328,7 @@ int __ref __add_pages(int nid, unsigned long phys_start_pfn,
                 if (err && (err != -EEXIST))
                         break;
                 err = 0;
+                cond_resched();
         }
         vmemmap_populate_print_last();
 out:
@@ -337,7 +338,7 @@ EXPORT_SYMBOL_GPL(__add_pages);
 
 #ifdef CONFIG_MEMORY_HOTREMOVE
 /* find the smallest valid pfn in the range [start_pfn, end_pfn) */
-static int find_smallest_section_pfn(int nid, struct zone *zone,
+static unsigned long find_smallest_section_pfn(int nid, struct zone *zone,
                                      unsigned long start_pfn,
                                      unsigned long end_pfn)
 {
@@ -362,7 +363,7 @@ static int find_smallest_section_pfn(int nid, struct zone *zone,
 }
 
 /* find the biggest valid pfn in the range [start_pfn, end_pfn). */
-static int find_biggest_section_pfn(int nid, struct zone *zone,
+static unsigned long find_biggest_section_pfn(int nid, struct zone *zone,
                                     unsigned long start_pfn,
                                     unsigned long end_pfn)
 {
@@ -550,7 +551,7 @@ static int __remove_section(struct zone *zone, struct mem_section *ms,
                 return ret;
 
         scn_nr = __section_nr(ms);
-        start_pfn = section_nr_to_pfn(scn_nr);
+        start_pfn = section_nr_to_pfn((unsigned long)scn_nr);
         __remove_zone(zone, start_pfn);
 
         sparse_remove_one_section(zone, ms, map_offset);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 99736e026712..dee0f75c3013 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -40,6 +40,7 @@
 #include <linux/ratelimit.h>
 #include <linux/kthread.h>
 #include <linux/init.h>
+#include <linux/mmu_notifier.h>
 
 #include <asm/tlb.h>
 #include "internal.h"
@@ -495,6 +496,21 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm)
         }
 
         /*
+         * If the mm has notifiers then we would need to invalidate them around
+         * unmap_page_range and that is risky because notifiers can sleep and
+         * what they do is basically undeterministic.  So let's have a short
+         * sleep to give the oom victim some more time.
+         * TODO: we really want to get rid of this ugly hack and make sure that
+         * notifiers cannot block for unbounded amount of time and add
+         * mmu_notifier_invalidate_range_{start,end} around unmap_page_range
+         */
+        if (mm_has_notifiers(mm)) {
+                up_read(&mm->mmap_sem);
+                schedule_timeout_idle(HZ);
+                goto unlock_oom;
+        }
+
+        /*
          * MMF_OOM_SKIP is set by exit_mmap when the OOM reaper can't
          * work on the mm anymore. The check for MMF_OOM_SKIP must run
          * under mmap_sem for reading because it serializes against the
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c841af88836a..77e4d3c5c57b 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1190,7 +1190,7 @@ static void __meminit __init_single_pfn(unsigned long pfn, unsigned long zone,
 }
 
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
-static void init_reserved_page(unsigned long pfn)
+static void __meminit init_reserved_page(unsigned long pfn)
 {
         pg_data_t *pgdat;
         int nid, zid;
@@ -5367,6 +5367,7 @@ not_early:
 
                         __init_single_page(page, pfn, zone, nid);
                         set_pageblock_migratetype(page, MIGRATE_MOVABLE);
+                        cond_resched();
                 } else {
                         __init_single_pfn(pfn, zone, nid);
                 }
diff --git a/mm/percpu-stats.c b/mm/percpu-stats.c
index 6142484e88f7..7a58460bfd27 100644
--- a/mm/percpu-stats.c
+++ b/mm/percpu-stats.c
@@ -73,7 +73,7 @@ static void chunk_map_stats(struct seq_file *m, struct pcpu_chunk *chunk,
                      last_alloc + 1 : 0;
 
         as_len = 0;
-        start = chunk->start_offset;
+        start = chunk->start_offset / PCPU_MIN_ALLOC_SIZE;
 
         /*
          * If a bit is set in the allocation map, the bound_map identifies
diff --git a/mm/percpu.c b/mm/percpu.c
index 59d44d61f5f1..aa121cef76de 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -353,6 +353,8 @@ static void pcpu_next_md_free_region(struct pcpu_chunk *chunk, int *bit_off,
                                         block->contig_hint_start);
                         return;
                 }
+                /* reset to satisfy the second predicate above */
+                block_off = 0;
 
                 *bits = block->right_free;
                 *bit_off = (i + 1) * PCPU_BITMAP_BLOCK_BITS - block->right_free;
@@ -407,6 +409,8 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits,
                         *bit_off = pcpu_block_off_to_off(i, block->first_free);
                         return;
                 }
+                /* reset to satisfy the second predicate above */
+                block_off = 0;
 
                 *bit_off = ALIGN(PCPU_BITMAP_BLOCK_BITS - block->right_free,
                                  align);
diff --git a/mm/rodata_test.c b/mm/rodata_test.c
index 6bb4deb12e78..d908c8769b48 100644
--- a/mm/rodata_test.c
+++ b/mm/rodata_test.c
@@ -14,7 +14,7 @@
 #include <linux/uaccess.h>
 #include <asm/sections.h>
 
-const int rodata_test_data = 0xC3;
+static const int rodata_test_data = 0xC3;
 
 void rodata_test(void)
 {
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 904a83be82de..80164599ca5d 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -165,9 +165,9 @@ static int init_memcg_params(struct kmem_cache *s,
         if (!memcg_nr_cache_ids)
                 return 0;
 
-        arr = kzalloc(sizeof(struct memcg_cache_array) +
-                      memcg_nr_cache_ids * sizeof(void *),
-                      GFP_KERNEL);
+        arr = kvzalloc(sizeof(struct memcg_cache_array) +
+                       memcg_nr_cache_ids * sizeof(void *),
+                       GFP_KERNEL);
         if (!arr)
                 return -ENOMEM;
 
@@ -178,15 +178,23 @@ static int init_memcg_params(struct kmem_cache *s,
 static void destroy_memcg_params(struct kmem_cache *s)
 {
         if (is_root_cache(s))
-                kfree(rcu_access_pointer(s->memcg_params.memcg_caches));
+                kvfree(rcu_access_pointer(s->memcg_params.memcg_caches));
+}
+
+static void free_memcg_params(struct rcu_head *rcu)
+{
+        struct memcg_cache_array *old;
+
+        old = container_of(rcu, struct memcg_cache_array, rcu);
+        kvfree(old);
 }
 
 static int update_memcg_params(struct kmem_cache *s, int new_array_size)
 {
         struct memcg_cache_array *old, *new;
 
-        new = kzalloc(sizeof(struct memcg_cache_array) +
-                      new_array_size * sizeof(void *), GFP_KERNEL);
+        new = kvzalloc(sizeof(struct memcg_cache_array) +
+                       new_array_size * sizeof(void *), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
@@ -198,7 +206,7 @@ static int update_memcg_params(struct kmem_cache *s, int new_array_size)
 
         rcu_assign_pointer(s->memcg_params.memcg_caches, new);
         if (old)
-                kfree_rcu(old, rcu);
+                call_rcu(&old->rcu, free_memcg_params);
         return 0;
 }
 
diff --git a/mm/swap.c b/mm/swap.c
index 9295ae960d66..a77d68f2c1b6 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -575,7 +575,7 @@ static void lru_lazyfree_fn(struct page *page, struct lruvec *lruvec,
                             void *arg)
 {
         if (PageLRU(page) && PageAnon(page) && PageSwapBacked(page) &&
-            !PageUnevictable(page)) {
+            !PageSwapCache(page) && !PageUnevictable(page)) {
                 bool active = PageActive(page);
 
                 del_page_from_lru_list(page, lruvec,
@@ -665,7 +665,7 @@ void deactivate_file_page(struct page *page)
 void mark_page_lazyfree(struct page *page)
 {
         if (PageLRU(page) && PageAnon(page) && PageSwapBacked(page) &&
-            !PageUnevictable(page)) {
+            !PageSwapCache(page) && !PageUnevictable(page)) {
                 struct pagevec *pvec = &get_cpu_var(lru_lazyfree_pvecs);
 
                 get_page(page);
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 71ce2d1ccbf7..ed91091d1e68 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -242,6 +242,17 @@ int add_to_swap(struct page *page)
                  * clear SWAP_HAS_CACHE flag.
                  */
                 goto fail;
+        /*
+         * Normally the page will be dirtied in unmap because its pte should be
+         * dirty. A special case is MADV_FREE page. The page'e pte could have
+         * dirty bit cleared but the page's SwapBacked bit is still set because
+         * clearing the dirty bit and SwapBacked bit has no lock protected. For
+         * such page, unmap will not set dirty bit for it, so page reclaim will
+         * not write the page out. This can cause data corruption when the page
+         * is swap in later. Always setting the dirty bit for the page solves
+         * the problem.
+         */
+        set_page_dirty(page);
 
         return 1;
 
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 486550df32be..b2ba2ba585f3 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -250,6 +250,7 @@ static void __release_z3fold_page(struct z3fold_header *zhdr, bool locked)
 
         WARN_ON(!list_empty(&zhdr->buddy));
         set_bit(PAGE_STALE, &page->private);
+        clear_bit(NEEDS_COMPACTING, &page->private);
         spin_lock(&pool->lock);
         if (!list_empty(&page->lru))
                 list_del(&page->lru);
@@ -303,7 +304,6 @@ static void free_pages_work(struct work_struct *w)
                 list_del(&zhdr->buddy);
                 if (WARN_ON(!test_bit(PAGE_STALE, &page->private)))
                         continue;
-                clear_bit(NEEDS_COMPACTING, &page->private);
                 spin_unlock(&pool->stale_lock);
                 cancel_work_sync(&zhdr->work);
                 free_z3fold_page(page);
@@ -624,10 +624,8 @@ lookup:
          * stale pages list. cancel_work_sync() can sleep so we must make
          * sure it won't be called in case we're in atomic context.
          */
-        if (zhdr && (can_sleep || !work_pending(&zhdr->work) ||
-            !unlikely(work_busy(&zhdr->work)))) {
+        if (zhdr && (can_sleep || !work_pending(&zhdr->work))) {
                 list_del(&zhdr->buddy);
-                clear_bit(NEEDS_COMPACTING, &page->private);
                 spin_unlock(&pool->stale_lock);
                 if (can_sleep)
                         cancel_work_sync(&zhdr->work);
@@ -875,16 +873,18 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
                                 goto next;
                 }
 next:
+                spin_lock(&pool->lock);
                 if (test_bit(PAGE_HEADLESS, &page->private)) {
                         if (ret == 0) {
+                                spin_unlock(&pool->lock);
                                 free_z3fold_page(page);
                                 return 0;
                         }
                 } else if (kref_put(&zhdr->refcount, release_z3fold_page)) {
                         atomic64_dec(&pool->pages_nr);
+                        spin_unlock(&pool->lock);
                         return 0;
                 }
-                spin_lock(&pool->lock);
 
                 /*
                  * Add to the beginning of LRU.
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e2ed69850489..0bc31de9071a 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -21,6 +21,12 @@ bool vlan_do_receive(struct sk_buff **skbp)
         if (unlikely(!skb))
                 return false;
 
+        if (unlikely(!(vlan_dev->flags & IFF_UP))) {
+                kfree_skb(skb);
+                *skbp = NULL;
+                return false;
+        }
+
         skb->dev = vlan_dev;
         if (unlikely(skb->pkt_type == PACKET_OTHERHOST)) {
                 /* Our lower layer thinks this is not local, let's make sure.
diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index c18115d22f00..db82a40875e8 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -126,14 +126,4 @@ config BT_DEBUGFS
           Provide extensive information about internal Bluetooth states
           in debugfs.
 
-config BT_LEGACY_IOCTL
-        bool "Enable legacy ioctl interfaces"
-        depends on BT && BT_BREDR
-        default y
-        help
-          Enable support for legacy ioctl interfaces.  This is only needed
-          for old and deprecated applications using direct ioctl calls for
-          controller management.  Since Linux 3.4 all configuration and
-          setup is done via mgmt interface and this is no longer needed.
-
 source "drivers/bluetooth/Kconfig"
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 0bad296fe0af..65d734c165bd 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -878,7 +878,6 @@ static int hci_sock_release(struct socket *sock)
         return 0;
 }
 
-#ifdef CONFIG_BT_LEGACY_IOCTL
 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 {
         bdaddr_t bdaddr;
@@ -1050,7 +1049,6 @@ done:
         release_sock(sk);
         return err;
 }
-#endif
 
 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
                          int addr_len)
@@ -1971,11 +1969,7 @@ static const struct proto_ops hci_sock_ops = {
         .getname        = hci_sock_getname,
         .sendmsg        = hci_sock_sendmsg,
         .recvmsg        = hci_sock_recvmsg,
-#ifdef CONFIG_BT_LEGACY_IOCTL
         .ioctl          = hci_sock_ioctl,
-#else
-        .ioctl          = sock_no_ioctl,
-#endif
         .poll           = datagram_poll,
         .listen         = sock_no_listen,
         .shutdown       = sock_no_shutdown,
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index f358d0bfa76b..79d14d70b7ea 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -2445,19 +2445,34 @@ static void apply_upmap(struct ceph_osdmap *osdmap,
 
         pg = lookup_pg_mapping(&osdmap->pg_upmap_items, pgid);
         if (pg) {
-                for (i = 0; i < raw->size; i++) {
-                        for (j = 0; j < pg->pg_upmap_items.len; j++) {
-                                int from = pg->pg_upmap_items.from_to[j][0];
-                                int to = pg->pg_upmap_items.from_to[j][1];
-
-                                if (from == raw->osds[i]) {
-                                        if (!(to != CRUSH_ITEM_NONE &&
-                                              to < osdmap->max_osd &&
-                                              osdmap->osd_weight[to] == 0))
-                                                raw->osds[i] = to;
+                /*
+                 * Note: this approach does not allow a bidirectional swap,
+                 * e.g., [[1,2],[2,1]] applied to [0,1,2] -> [0,2,1].
+                 */
+                for (i = 0; i < pg->pg_upmap_items.len; i++) {
+                        int from = pg->pg_upmap_items.from_to[i][0];
+                        int to = pg->pg_upmap_items.from_to[i][1];
+                        int pos = -1;
+                        bool exists = false;
+
+                        /* make sure replacement doesn't already appear */
+                        for (j = 0; j < raw->size; j++) {
+                                int osd = raw->osds[j];
+
+                                if (osd == to) {
+                                        exists = true;
                                         break;
                                 }
+                                /* ignore mapping if target is marked out */
+                                if (osd == from && pos < 0 &&
+                                    !(to != CRUSH_ITEM_NONE &&
+                                      to < osdmap->max_osd &&
+                                      osdmap->osd_weight[to] == 0)) {
+                                        pos = j;
+                                }
                         }
+                        if (!exists && pos >= 0)
+                                raw->osds[pos] = to;
                 }
         }
 }
diff --git a/net/compat.c b/net/compat.c
index 6ded6c821d7a..22381719718c 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -185,6 +185,13 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
                 ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, ucmlen);
         }
 
+        /*
+         * check the length of messages copied in is the same as the
+         * what we get from the first loop
+         */
+        if ((char *)kcmsg - (char *)kcmsg_base != kcmlen)
+                goto Einval;
+
         /* Ok, looks like we made it.  Hook it up and return success. */
         kmsg->msg_control = kcmsg_base;
         kmsg->msg_controllen = kcmlen;
diff --git a/net/core/dev.c b/net/core/dev.c
index fb766d906148..588b473194a8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1948,8 +1948,12 @@ again:
                 goto again;
         }
 out_unlock:
-        if (pt_prev)
-                pt_prev->func(skb2, skb->dev, pt_prev, skb->dev);
+        if (pt_prev) {
+                if (!skb_orphan_frags_rx(skb2, GFP_ATOMIC))
+                        pt_prev->func(skb2, skb->dev, pt_prev, skb->dev);
+                else
+                        kfree_skb(skb2);
+        }
         rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(dev_queue_xmit_nit);
@@ -3892,6 +3896,7 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
                 __skb_pull(skb, off);
         else if (off < 0)
                 __skb_push(skb, -off);
+        skb->mac_header += off;
 
         switch (act) {
         case XDP_REDIRECT:
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 6a582ae4c5d9..3228411ada0f 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -525,6 +525,8 @@ convert_link_ksettings_to_legacy_settings(
                 = link_ksettings->base.eth_tp_mdix;
         legacy_settings->eth_tp_mdix_ctrl
                 = link_ksettings->base.eth_tp_mdix_ctrl;
+        legacy_settings->transceiver
+                = link_ksettings->base.transceiver;
         return retval;
 }
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 24dd33dd9f04..74b8c91fb5f4 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -989,10 +989,14 @@ static bool __sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 
 bool sk_filter_charge(struct sock *sk, struct sk_filter *fp)
 {
-        bool ret = __sk_filter_charge(sk, fp);
-        if (ret)
-                refcount_inc(&fp->refcnt);
-        return ret;
+        if (!refcount_inc_not_zero(&fp->refcnt))
+                return false;
+
+        if (!__sk_filter_charge(sk, fp)) {
+                sk_filter_release(fp);
+                return false;
+        }
+        return true;
 }
 
 static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp)
@@ -1794,7 +1798,7 @@ struct redirect_info {
         u32 flags;
         struct bpf_map *map;
         struct bpf_map *map_to_flush;
-        const struct bpf_prog *map_owner;
+        unsigned long   map_owner;
 };
 
 static DEFINE_PER_CPU(struct redirect_info, redirect_info);
@@ -2500,11 +2504,17 @@ void xdp_do_flush_map(void)
 }
 EXPORT_SYMBOL_GPL(xdp_do_flush_map);
 
+static inline bool xdp_map_invalid(const struct bpf_prog *xdp_prog,
+                                   unsigned long aux)
+{
+        return (unsigned long)xdp_prog->aux != aux;
+}
+
 static int xdp_do_redirect_map(struct net_device *dev, struct xdp_buff *xdp,
                                struct bpf_prog *xdp_prog)
 {
         struct redirect_info *ri = this_cpu_ptr(&redirect_info);
-        const struct bpf_prog *map_owner = ri->map_owner;
+        unsigned long map_owner = ri->map_owner;
         struct bpf_map *map = ri->map;
         struct net_device *fwd = NULL;
         u32 index = ri->ifindex;
@@ -2512,9 +2522,9 @@ static int xdp_do_redirect_map(struct net_device *dev, struct xdp_buff *xdp,
 
         ri->ifindex = 0;
         ri->map = NULL;
-        ri->map_owner = NULL;
+        ri->map_owner = 0;
 
-        if (unlikely(map_owner != xdp_prog)) {
+        if (unlikely(xdp_map_invalid(xdp_prog, map_owner))) {
                 err = -EFAULT;
                 map = NULL;
                 goto err;
@@ -2574,7 +2584,7 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
                             struct bpf_prog *xdp_prog)
 {
         struct redirect_info *ri = this_cpu_ptr(&redirect_info);
-        const struct bpf_prog *map_owner = ri->map_owner;
+        unsigned long map_owner = ri->map_owner;
         struct bpf_map *map = ri->map;
         struct net_device *fwd = NULL;
         u32 index = ri->ifindex;
@@ -2583,10 +2593,10 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
 
         ri->ifindex = 0;
         ri->map = NULL;
-        ri->map_owner = NULL;
+        ri->map_owner = 0;
 
         if (map) {
-                if (unlikely(map_owner != xdp_prog)) {
+                if (unlikely(xdp_map_invalid(xdp_prog, map_owner))) {
                         err = -EFAULT;
                         map = NULL;
                         goto err;
@@ -2632,7 +2642,7 @@ BPF_CALL_2(bpf_xdp_redirect, u32, ifindex, u64, flags)
         ri->ifindex = ifindex;
         ri->flags = flags;
         ri->map = NULL;
-        ri->map_owner = NULL;
+        ri->map_owner = 0;
 
         return XDP_REDIRECT;
 }
@@ -2646,7 +2656,7 @@ static const struct bpf_func_proto bpf_xdp_redirect_proto = {
 };
 
 BPF_CALL_4(bpf_xdp_redirect_map, struct bpf_map *, map, u32, ifindex, u64, flags,
-           const struct bpf_prog *, map_owner)
+           unsigned long, map_owner)
 {
         struct redirect_info *ri = this_cpu_ptr(&redirect_info);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a78fd61da0ec..d4bcdcc68e92 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3854,6 +3854,9 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev,
                 return -EMSGSIZE;
 
         ifsm = nlmsg_data(nlh);
+        ifsm->family = PF_UNSPEC;
+        ifsm->pad1 = 0;
+        ifsm->pad2 = 0;
         ifsm->ifindex = dev->ifindex;
         ifsm->filter_mask = filter_mask;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 9b7b6bbb2a23..23953b741a41 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1654,6 +1654,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
 
                 sock_copy(newsk, sk);
 
+                newsk->sk_prot_creator = sk->sk_prot;
+
                 /* SANITY */
                 if (likely(newsk->sk_net_refcnt))
                         get_net(sock_net(newsk));
@@ -1682,13 +1684,16 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
 
                 sock_reset_flag(newsk, SOCK_DONE);
 
-                filter = rcu_dereference_protected(newsk->sk_filter, 1);
+                rcu_read_lock();
+                filter = rcu_dereference(sk->sk_filter);
                 if (filter != NULL)
                         /* though it's an empty new sock, the charging may fail
                          * if sysctl_optmem_max was changed between creation of
                          * original socket and cloning
                          */
                         is_charged = sk_filter_charge(newsk, filter);
+                RCU_INIT_POINTER(newsk->sk_filter, filter);
+                rcu_read_unlock();
 
                 if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
                         /* We need to make sure that we don't uncharge the new
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 2afa99506f8b..865e29e62bad 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1301,28 +1301,33 @@ int dsa_slave_create(struct dsa_port *port, const char *name)
         p->old_duplex = -1;
 
         port->netdev = slave_dev;
-        ret = register_netdev(slave_dev);
-        if (ret) {
-                netdev_err(master, "error %d registering interface %s\n",
-                           ret, slave_dev->name);
-                port->netdev = NULL;
-                free_percpu(p->stats64);
-                free_netdev(slave_dev);
-                return ret;
-        }
 
         netif_carrier_off(slave_dev);
 
         ret = dsa_slave_phy_setup(p, slave_dev);
         if (ret) {
                 netdev_err(master, "error %d setting up slave phy\n", ret);
-                unregister_netdev(slave_dev);
-                free_percpu(p->stats64);
-                free_netdev(slave_dev);
-                return ret;
+                goto out_free;
+        }
+
+        ret = register_netdev(slave_dev);
+        if (ret) {
+                netdev_err(master, "error %d registering interface %s\n",
+                           ret, slave_dev->name);
+                goto out_phy;
         }
 
         return 0;
+
+out_phy:
+        phy_disconnect(p->phy);
+        if (of_phy_is_fixed_link(p->dp->dn))
+                of_phy_deregister_fixed_link(p->dp->dn);
+out_free:
+        free_percpu(p->stats64);
+        free_netdev(slave_dev);
+        port->netdev = NULL;
+        return ret;
 }
 
 void dsa_slave_destroy(struct net_device *slave_dev)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index b9c64b40a83a..c039c937ba90 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -266,7 +266,7 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
 #if IS_ENABLED(CONFIG_IPV6)
         if (tb->fast_sk_family == AF_INET6)
                 return ipv6_rcv_saddr_equal(&tb->fast_v6_rcv_saddr,
-                                            &sk->sk_v6_rcv_saddr,
+                                            inet6_rcv_saddr(sk),
                                             tb->fast_rcv_saddr,
                                             sk->sk_rcv_saddr,
                                             tb->fast_ipv6_only,
@@ -321,13 +321,14 @@ tb_found:
                         goto fail_unlock;
         }
 success:
-        if (!hlist_empty(&tb->owners)) {
+        if (hlist_empty(&tb->owners)) {
                 tb->fastreuse = reuse;
                 if (sk->sk_reuseport) {
                         tb->fastreuseport = FASTREUSEPORT_ANY;
                         tb->fastuid = uid;
                         tb->fast_rcv_saddr = sk->sk_rcv_saddr;
                         tb->fast_ipv6_only = ipv6_only_sock(sk);
+                        tb->fast_sk_family = sk->sk_family;
 #if IS_ENABLED(CONFIG_IPV6)
                         tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
 #endif
@@ -354,6 +355,7 @@ success:
                                 tb->fastuid = uid;
                                 tb->fast_rcv_saddr = sk->sk_rcv_saddr;
                                 tb->fast_ipv6_only = ipv6_only_sock(sk);
+                                tb->fast_sk_family = sk->sk_family;
 #if IS_ENABLED(CONFIG_IPV6)
                                 tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
 #endif
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index e7eb590c86ce..b20c8ac64081 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -128,9 +128,9 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,
                         break;
                 }
                 if (cmp == -1)
-                        pp = &(*pp)->rb_left;
+                        pp = &next->rb_left;
                 else
-                        pp = &(*pp)->rb_right;
+                        pp = &next->rb_right;
         }
         *parent_p = parent;
         *pp_p = pp;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 0162fb955b33..467e44d7587d 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,7 +259,6 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         struct ip_tunnel *tunnel;
         struct erspanhdr *ershdr;
         const struct iphdr *iph;
-        __be32 session_id;
         __be32 index;
         int len;
 
@@ -275,8 +274,7 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         /* The original GRE header does not have key field,
          * Use ERSPAN 10-bit session ID as key.
          */
-        session_id = cpu_to_be32(ntohs(ershdr->session_id));
-        tpi->key = session_id;
+        tpi->key = cpu_to_be32(ntohs(ershdr->session_id) & ID_MASK);
         index = ershdr->md.index;
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
                                   tpi->flags | TUNNEL_KEY,
@@ -733,7 +731,7 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
         if (skb_cow_head(skb, dev->needed_headroom))
                 goto free_skb;
 
-        if (skb->len > dev->mtu) {
+        if (skb->len - dev->hard_header_len > dev->mtu) {
                 pskb_trim(skb, dev->mtu);
                 truncate = true;
         }
@@ -1223,6 +1221,7 @@ static int gre_tap_init(struct net_device *dev)
 {
         __gre_tunnel_init(dev);
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+        netif_keep_dst(dev);
 
         return ip_tunnel_init(dev);
 }
@@ -1246,13 +1245,16 @@ static int erspan_tunnel_init(struct net_device *dev)
 
         tunnel->tun_hlen = 8;
         tunnel->parms.iph.protocol = IPPROTO_GRE;
-        t_hlen = tunnel->hlen + sizeof(struct iphdr) + sizeof(struct erspanhdr);
+        tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
+                       sizeof(struct erspanhdr);
+        t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
         dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4;
         dev->mtu = ETH_DATA_LEN - t_hlen - 4;
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
         dev->priv_flags         |= IFF_LIVE_ADDR_CHANGE;
+        netif_keep_dst(dev);
 
         return ip_tunnel_init(dev);
 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index fa2dc8f692c6..57fc13c6ab2b 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -311,9 +311,10 @@ drop:
 static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
-        struct rtable *rt;
+        int (*edemux)(struct sk_buff *skb);
         struct net_device *dev = skb->dev;
-        void (*edemux)(struct sk_buff *skb);
+        struct rtable *rt;
+        int err;
 
         /* if ingress device is enslaved to an L3 master device pass the
          * skb to its handler for processing
@@ -331,7 +332,9 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 
                 ipprot = rcu_dereference(inet_protos[protocol]);
                 if (ipprot && (edemux = READ_ONCE(ipprot->early_demux))) {
-                        edemux(skb);
+                        err = edemux(skb);
+                        if (unlikely(err))
+                                goto drop_error;
                         /* must reload iph, skb->head might have changed */
                         iph = ip_hdr(skb);
                 }
@@ -342,13 +345,10 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
          *      how the packet travels inside Linux networking.
          */
         if (!skb_valid_dst(skb)) {
-                int err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                               iph->tos, dev);
-                if (unlikely(err)) {
-                        if (err == -EXDEV)
-                                __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER);
-                        goto drop;
-                }
+                err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
+                                           iph->tos, dev);
+                if (unlikely(err))
+                        goto drop_error;
         }
 
 #ifdef CONFIG_IP_ROUTE_CLASSID
@@ -399,6 +399,11 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 drop:
         kfree_skb(skb);
         return NET_RX_DROP;
+
+drop_error:
+        if (err == -EXDEV)
+                __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER);
+        goto drop;
 }
 
 /*
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 5ed63d250950..89453cf62158 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
         struct ip_tunnel_parm *parms = &tunnel->parms;
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;        /* Device to other host */
+        int pkt_len = skb->len;
         int err;
         int mtu;
 
@@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
 
         err = dst_output(tunnel->net, skb->sk, skb);
         if (net_xmit_eval(err) == 0)
-                err = skb->len;
+                err = pkt_len;
         iptunnel_xmit_stats(dev, err);
         return NETDEV_TX_OK;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 94d4cd2d5ea4..ac6fde5d45f1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1520,43 +1520,56 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
 EXPORT_SYMBOL(rt_dst_alloc);
 
 /* called in rcu_read_lock() section */
-static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-                                u8 tos, struct net_device *dev, int our)
+int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                          u8 tos, struct net_device *dev,
+                          struct in_device *in_dev, u32 *itag)
 {
-        struct rtable *rth;
-        struct in_device *in_dev = __in_dev_get_rcu(dev);
-        unsigned int flags = RTCF_MULTICAST;
-        u32 itag = 0;
         int err;
 
         /* Primary sanity checks. */
-
         if (!in_dev)
                 return -EINVAL;
 
         if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
             skb->protocol != htons(ETH_P_IP))
-                goto e_inval;
+                return -EINVAL;
 
         if (ipv4_is_loopback(saddr) && !IN_DEV_ROUTE_LOCALNET(in_dev))
-                goto e_inval;
+                return -EINVAL;
 
         if (ipv4_is_zeronet(saddr)) {
                 if (!ipv4_is_local_multicast(daddr))
-                        goto e_inval;
+                        return -EINVAL;
         } else {
                 err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
-                                          in_dev, &itag);
+                                          in_dev, itag);
                 if (err < 0)
-                        goto e_err;
+                        return err;
         }
+        return 0;
+}
+
+/* called in rcu_read_lock() section */
+static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                             u8 tos, struct net_device *dev, int our)
+{
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
+        unsigned int flags = RTCF_MULTICAST;
+        struct rtable *rth;
+        u32 itag = 0;
+        int err;
+
+        err = ip_mc_validate_source(skb, daddr, saddr, tos, dev, in_dev, &itag);
+        if (err)
+                return err;
+
         if (our)
                 flags |= RTCF_LOCAL;
 
         rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
         if (!rth)
-                goto e_nobufs;
+                return -ENOBUFS;
 
 #ifdef CONFIG_IP_ROUTE_CLASSID
         rth->dst.tclassid = itag;
@@ -1572,13 +1585,6 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         skb_dst_set(skb, &rth->dst);
         return 0;
-
-e_nobufs:
-        return -ENOBUFS;
-e_inval:
-        return -EINVAL;
-e_err:
-        return err;
 }
 
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d9416b5162bc..85164d4d3e53 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1503,23 +1503,23 @@ csum_err:
 }
 EXPORT_SYMBOL(tcp_v4_do_rcv);
 
-void tcp_v4_early_demux(struct sk_buff *skb)
+int tcp_v4_early_demux(struct sk_buff *skb)
 {
         const struct iphdr *iph;
         const struct tcphdr *th;
         struct sock *sk;
 
         if (skb->pkt_type != PACKET_HOST)
-                return;
+                return 0;
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
-                return;
+                return 0;
 
         iph = ip_hdr(skb);
         th = tcp_hdr(skb);
 
         if (th->doff < sizeof(struct tcphdr) / 4)
-                return;
+                return 0;
 
         sk = __inet_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
                                        iph->saddr, th->source,
@@ -1538,6 +1538,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
+        return 0;
 }
 
 bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 1c839c99114c..0bc9e46a5369 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1806,40 +1806,6 @@ static bool tcp_snd_wnd_test(const struct tcp_sock *tp,
         return !after(end_seq, tcp_wnd_end(tp));
 }
 
-/* This checks if the data bearing packet SKB (usually tcp_send_head(sk))
- * should be put on the wire right now.  If so, it returns the number of
- * packets allowed by the congestion window.
- */
-static unsigned int tcp_snd_test(const struct sock *sk, struct sk_buff *skb,
-                                 unsigned int cur_mss, int nonagle)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        unsigned int cwnd_quota;
-
-        tcp_init_tso_segs(skb, cur_mss);
-
-        if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
-                return 0;
-
-        cwnd_quota = tcp_cwnd_test(tp, skb);
-        if (cwnd_quota && !tcp_snd_wnd_test(tp, skb, cur_mss))
-                cwnd_quota = 0;
-
-        return cwnd_quota;
-}
-
-/* Test if sending is allowed right now. */
-bool tcp_may_send_now(struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb = tcp_send_head(sk);
-
-        return skb &&
-                tcp_snd_test(sk, skb, tcp_current_mss(sk),
-                             (tcp_skb_is_last(sk, skb) ?
-                              tp->nonagle : TCP_NAGLE_PUSH));
-}
-
 /* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
  * which is put after SKB on the list.  It is very much like
  * tcp_fragment() except that it may make several kinds of assumptions
@@ -3423,6 +3389,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
                 goto done;
         }
 
+        /* data was not sent, this is our new send_head */
+        sk->sk_send_head = syn_data;
+        tp->packets_out -= tcp_skb_pcount(syn_data);
+
 fallback:
         /* Send a regular SYN with Fast Open cookie request option */
         if (fo->cookie.len > 0)
@@ -3475,6 +3445,11 @@ int tcp_connect(struct sock *sk)
          */
         tp->snd_nxt = tp->write_seq;
         tp->pushed_seq = tp->write_seq;
+        buff = tcp_send_head(sk);
+        if (unlikely(buff)) {
+                tp->snd_nxt     = TCP_SKB_CB(buff)->seq;
+                tp->pushed_seq  = TCP_SKB_CB(buff)->seq;
+        }
         TCP_INC_STATS(sock_net(sk), TCP_MIB_ACTIVEOPENS);
 
         /* Timer for repeating the SYN until an answer. */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ef29df8648e4..5676237d2b0f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2221,9 +2221,10 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
         return NULL;
 }
 
-void udp_v4_early_demux(struct sk_buff *skb)
+int udp_v4_early_demux(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb->dev);
+        struct in_device *in_dev = NULL;
         const struct iphdr *iph;
         const struct udphdr *uh;
         struct sock *sk = NULL;
@@ -2234,24 +2235,24 @@ void udp_v4_early_demux(struct sk_buff *skb)
 
         /* validate the packet */
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
-                return;
+                return 0;
 
         iph = ip_hdr(skb);
         uh = udp_hdr(skb);
 
         if (skb->pkt_type == PACKET_BROADCAST ||
             skb->pkt_type == PACKET_MULTICAST) {
-                struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+                in_dev = __in_dev_get_rcu(skb->dev);
 
                 if (!in_dev)
-                        return;
+                        return 0;
 
                 /* we are supposed to accept bcast packets */
                 if (skb->pkt_type == PACKET_MULTICAST) {
                         ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
                                                iph->protocol);
                         if (!ours)
-                                return;
+                                return 0;
                 }
 
                 sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
@@ -2263,7 +2264,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
         }
 
         if (!sk || !refcount_inc_not_zero(&sk->sk_refcnt))
-                return;
+                return 0;
 
         skb->sk = sk;
         skb->destructor = sock_efree;
@@ -2272,12 +2273,23 @@ void udp_v4_early_demux(struct sk_buff *skb)
         if (dst)
                 dst = dst_check(dst, 0);
         if (dst) {
+                u32 itag = 0;
+
                 /* set noref for now.
                  * any place which wants to hold dst has to call
                  * dst_hold_safe()
                  */
                 skb_dst_set_noref(skb, dst);
+
+                /* for unconnected multicast sockets we need to validate
+                 * the source on each packet
+                 */
+                if (!inet_sk(sk)->inet_daddr && in_dev)
+                        return ip_mc_validate_source(skb, iph->daddr,
+                                                     iph->saddr, iph->tos,
+                                                     skb->dev, in_dev, &itag);
         }
+        return 0;
 }
 
 int udp_rcv(struct sk_buff *skb)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c2e2a78787ec..96861c702c06 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1399,10 +1399,18 @@ static inline int ipv6_saddr_preferred(int type)
         return 0;
 }
 
-static inline bool ipv6_use_optimistic_addr(struct inet6_dev *idev)
+static bool ipv6_use_optimistic_addr(struct net *net,
+                                     struct inet6_dev *idev)
 {
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
-        return idev && idev->cnf.optimistic_dad && idev->cnf.use_optimistic;
+        if (!idev)
+                return false;
+        if (!net->ipv6.devconf_all->optimistic_dad && !idev->cnf.optimistic_dad)
+                return false;
+        if (!net->ipv6.devconf_all->use_optimistic && !idev->cnf.use_optimistic)
+                return false;
+
+        return true;
 #else
         return false;
 #endif
@@ -1472,7 +1480,7 @@ static int ipv6_get_saddr_eval(struct net *net,
                 /* Rule 3: Avoid deprecated and optimistic addresses */
                 u8 avoid = IFA_F_DEPRECATED;
 
-                if (!ipv6_use_optimistic_addr(score->ifa->idev))
+                if (!ipv6_use_optimistic_addr(net, score->ifa->idev))
                         avoid |= IFA_F_OPTIMISTIC;
                 ret = ipv6_saddr_preferred(score->addr_type) ||
                       !(score->ifa->flags & avoid);
@@ -2460,7 +2468,8 @@ int addrconf_prefix_rcv_add_addr(struct net *net, struct net_device *dev,
                 int max_addresses = in6_dev->cnf.max_addresses;
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
-                if (in6_dev->cnf.optimistic_dad &&
+                if ((net->ipv6.devconf_all->optimistic_dad ||
+                     in6_dev->cnf.optimistic_dad) &&
                     !net->ipv6.devconf_all->forwarding && sllao)
                         addr_flags |= IFA_F_OPTIMISTIC;
 #endif
@@ -3051,7 +3060,8 @@ void addrconf_add_linklocal(struct inet6_dev *idev,
         u32 addr_flags = flags | IFA_F_PERMANENT;
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
-        if (idev->cnf.optimistic_dad &&
+        if ((dev_net(idev->dev)->ipv6.devconf_all->optimistic_dad ||
+             idev->cnf.optimistic_dad) &&
             !dev_net(idev->dev)->ipv6.devconf_all->forwarding)
                 addr_flags |= IFA_F_OPTIMISTIC;
 #endif
@@ -3810,6 +3820,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
                 goto out;
 
         if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
+            dev_net(dev)->ipv6.devconf_all->accept_dad < 1 ||
             idev->cnf.accept_dad < 1 ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
@@ -3841,7 +3852,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
          */
         if (ifp->flags & IFA_F_OPTIMISTIC) {
                 ip6_ins_rt(ifp->rt);
-                if (ipv6_use_optimistic_addr(idev)) {
+                if (ipv6_use_optimistic_addr(dev_net(dev), idev)) {
                         /* Because optimistic nodes can use this address,
                          * notify listeners. If DAD fails, RTM_DELADDR is sent.
                          */
@@ -3897,7 +3908,9 @@ static void addrconf_dad_work(struct work_struct *w)
                 action = DAD_ABORT;
                 ifp->state = INET6_IFADDR_STATE_POSTDAD;
 
-                if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6 &&
+                if ((dev_net(idev->dev)->ipv6.devconf_all->accept_dad > 1 ||
+                     idev->cnf.accept_dad > 1) &&
+                    !idev->cnf.disable_ipv6 &&
                     !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
                         struct in6_addr addr;
 
@@ -4940,9 +4953,10 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
 
         /* Don't send DELADDR notification for TENTATIVE address,
          * since NEWADDR notification is sent only after removing
-         * TENTATIVE flag.
+         * TENTATIVE flag, if DAD has not failed.
          */
-        if (ifa->flags & IFA_F_TENTATIVE && event == RTM_DELADDR)
+        if (ifa->flags & IFA_F_TENTATIVE && !(ifa->flags & IFA_F_DADFAILED) &&
+            event == RTM_DELADDR)
                 return;
 
         skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b7a72d409334..1602b491b281 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -940,24 +940,25 @@ done:
 }
 
 static int ip6gre_header(struct sk_buff *skb, struct net_device *dev,
-                        unsigned short type,
-                        const void *daddr, const void *saddr, unsigned int len)
+                         unsigned short type, const void *daddr,
+                         const void *saddr, unsigned int len)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        struct ipv6hdr *ipv6h = skb_push(skb, t->hlen);
-        __be16 *p = (__be16 *)(ipv6h+1);
+        struct ipv6hdr *ipv6h;
+        __be16 *p;
 
-        ip6_flow_hdr(ipv6h, 0,
-                     ip6_make_flowlabel(dev_net(dev), skb,
-                                        t->fl.u.ip6.flowlabel, true,
-                                        &t->fl.u.ip6));
+        ipv6h = skb_push(skb, t->hlen + sizeof(*ipv6h));
+        ip6_flow_hdr(ipv6h, 0, ip6_make_flowlabel(dev_net(dev), skb,
+                                                  t->fl.u.ip6.flowlabel,
+                                                  true, &t->fl.u.ip6));
         ipv6h->hop_limit = t->parms.hop_limit;
         ipv6h->nexthdr = NEXTHDR_GRE;
         ipv6h->saddr = t->parms.laddr;
         ipv6h->daddr = t->parms.raddr;
 
-        p[0]            = t->parms.o_flags;
-        p[1]            = htons(type);
+        p = (__be16 *)(ipv6h + 1);
+        p[0] = t->parms.o_flags;
+        p[1] = htons(type);
 
         /*
          *      Set the source hardware address.
@@ -1310,6 +1311,7 @@ static void ip6gre_tap_setup(struct net_device *dev)
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+        netif_keep_dst(dev);
 }
 
 static bool ip6gre_netlink_encap_parms(struct nlattr *data[],
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ae73164559d5..a1c24443cd9e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1043,6 +1043,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
         struct dst_entry *dst = NULL, *ndst = NULL;
         struct net_device *tdev;
         int mtu;
+        unsigned int eth_hlen = t->dev->type == ARPHRD_ETHER ? ETH_HLEN : 0;
         unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen;
         unsigned int max_headroom = psh_hlen;
         bool use_cache = false;
@@ -1124,7 +1125,7 @@ route_lookup:
                                      t->parms.name);
                 goto tx_err_dst_release;
         }
-        mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen;
+        mtu = dst_mtu(dst) - eth_hlen - psh_hlen - t->tun_hlen;
         if (encap_limit >= 0) {
                 max_headroom += 8;
                 mtu -= 8;
@@ -1133,7 +1134,7 @@ route_lookup:
                 mtu = IPV6_MIN_MTU;
         if (skb_dst(skb) && !t->parms.collect_md)
                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-        if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) {
+        if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
                 *pmtu = mtu;
                 err = -EMSGSIZE;
                 goto tx_err_dst_release;
@@ -2259,6 +2260,9 @@ static int __init ip6_tunnel_init(void)
 {
         int  err;
 
+        if (!ipv6_mod_enabled())
+                return -EOPNOTSUPP;
+
         err = register_pernet_device(&ip6_tnl_net_ops);
         if (err < 0)
                 goto out_pernet;
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 79444a4bfd6d..bcdc2d557de1 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;
         struct xfrm_state *x;
+        int pkt_len = skb->len;
         int err = -1;
         int mtu;
 
@@ -502,7 +503,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
 
                 u64_stats_update_begin(&tstats->syncp);
-                tstats->tx_bytes += skb->len;
+                tstats->tx_bytes += pkt_len;
                 tstats->tx_packets++;
                 u64_stats_update_end(&tstats->syncp);
         } else {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e2ecfb137297..40d7234c27b9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1015,6 +1015,7 @@ static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
                  */
                 offset = skb_transport_offset(skb);
                 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
+                csum = skb->csum;
 
                 skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ee485df73ccd..02d61101b108 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1314,6 +1314,9 @@ again:
 
                         hlist_del_init(&session->hlist);
 
+                        if (test_and_set_bit(0, &session->dead))
+                                goto again;
+
                         if (session->ref != NULL)
                                 (*session->ref)(session);
 
@@ -1685,14 +1688,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
 
 /* This function is used by the netlink TUNNEL_DELETE command.
  */
-int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
+void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
-        l2tp_tunnel_inc_refcount(tunnel);
-        if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
-                l2tp_tunnel_dec_refcount(tunnel);
-                return 1;
+        if (!test_and_set_bit(0, &tunnel->dead)) {
+                l2tp_tunnel_inc_refcount(tunnel);
+                queue_work(l2tp_wq, &tunnel->del_work);
         }
-        return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
 
@@ -1750,6 +1751,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
  */
 int l2tp_session_delete(struct l2tp_session *session)
 {
+        if (test_and_set_bit(0, &session->dead))
+                return 0;
+
         if (session->ref)
                 (*session->ref)(session);
         __l2tp_session_unhash(session);
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a305e0c5925a..67c79d9b5c6c 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -76,6 +76,7 @@ struct l2tp_session_cfg {
 struct l2tp_session {
         int                     magic;          /* should be
                                                  * L2TP_SESSION_MAGIC */
+        long                    dead;
 
         struct l2tp_tunnel      *tunnel;        /* back pointer to tunnel
                                                  * context */
@@ -160,6 +161,9 @@ struct l2tp_tunnel_cfg {
 
 struct l2tp_tunnel {
         int                     magic;          /* Should be L2TP_TUNNEL_MAGIC */
+
+        unsigned long           dead;
+
         struct rcu_head rcu;
         rwlock_t                hlist_lock;     /* protect session_hlist */
         bool                    acpt_newsess;   /* Indicates whether this
@@ -254,7 +258,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id,
                        u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg,
                        struct l2tp_tunnel **tunnelp);
 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
-int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel);
+void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel);
 struct l2tp_session *l2tp_session_create(int priv_size,
                                          struct l2tp_tunnel *tunnel,
                                          u32 session_id, u32 peer_session_id,
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 87da9ef61860..014a7bc2a872 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -44,7 +44,6 @@ struct l2tp_eth {
         struct net_device       *dev;
         struct sock             *tunnel_sock;
         struct l2tp_session     *session;
-        struct list_head        list;
         atomic_long_t           tx_bytes;
         atomic_long_t           tx_packets;
         atomic_long_t           tx_dropped;
@@ -58,17 +57,6 @@ struct l2tp_eth_sess {
         struct net_device       *dev;
 };
 
-/* per-net private data for this module */
-static unsigned int l2tp_eth_net_id;
-struct l2tp_eth_net {
-        struct list_head l2tp_eth_dev_list;
-        spinlock_t l2tp_eth_lock;
-};
-
-static inline struct l2tp_eth_net *l2tp_eth_pernet(struct net *net)
-{
-        return net_generic(net, l2tp_eth_net_id);
-}
 
 static int l2tp_eth_dev_init(struct net_device *dev)
 {
@@ -84,12 +72,6 @@ static int l2tp_eth_dev_init(struct net_device *dev)
 
 static void l2tp_eth_dev_uninit(struct net_device *dev)
 {
-        struct l2tp_eth *priv = netdev_priv(dev);
-        struct l2tp_eth_net *pn = l2tp_eth_pernet(dev_net(dev));
-
-        spin_lock(&pn->l2tp_eth_lock);
-        list_del_init(&priv->list);
-        spin_unlock(&pn->l2tp_eth_lock);
         dev_put(dev);
 }
 
@@ -273,7 +255,6 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         struct l2tp_eth *priv;
         struct l2tp_eth_sess *spriv;
         int rc;
-        struct l2tp_eth_net *pn;
 
         if (cfg->ifname) {
                 strlcpy(name, cfg->ifname, IFNAMSIZ);
@@ -305,7 +286,6 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         priv = netdev_priv(dev);
         priv->dev = dev;
         priv->session = session;
-        INIT_LIST_HEAD(&priv->list);
 
         priv->tunnel_sock = tunnel->sock;
         session->recv_skb = l2tp_eth_dev_recv;
@@ -326,10 +306,6 @@ static int l2tp_eth_create(struct net *net, struct l2tp_tunnel *tunnel,
         strlcpy(session->ifname, dev->name, IFNAMSIZ);
 
         dev_hold(dev);
-        pn = l2tp_eth_pernet(dev_net(dev));
-        spin_lock(&pn->l2tp_eth_lock);
-        list_add(&priv->list, &pn->l2tp_eth_dev_list);
-        spin_unlock(&pn->l2tp_eth_lock);
 
         return 0;
 
@@ -342,22 +318,6 @@ out:
         return rc;
 }
 
-static __net_init int l2tp_eth_init_net(struct net *net)
-{
-        struct l2tp_eth_net *pn = net_generic(net, l2tp_eth_net_id);
-
-        INIT_LIST_HEAD(&pn->l2tp_eth_dev_list);
-        spin_lock_init(&pn->l2tp_eth_lock);
-
-        return 0;
-}
-
-static struct pernet_operations l2tp_eth_net_ops = {
-        .init = l2tp_eth_init_net,
-        .id   = &l2tp_eth_net_id,
-        .size = sizeof(struct l2tp_eth_net),
-};
-
 
 static const struct l2tp_nl_cmd_ops l2tp_eth_nl_cmd_ops = {
         .session_create = l2tp_eth_create,
@@ -371,25 +331,18 @@ static int __init l2tp_eth_init(void)
 
         err = l2tp_nl_register_ops(L2TP_PWTYPE_ETH, &l2tp_eth_nl_cmd_ops);
         if (err)
-                goto out;
-
-        err = register_pernet_device(&l2tp_eth_net_ops);
-        if (err)
-                goto out_unreg;
+                goto err;
 
         pr_info("L2TP ethernet pseudowire support (L2TPv3)\n");
 
         return 0;
 
-out_unreg:
-        l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH);
-out:
+err:
         return err;
 }
 
 static void __exit l2tp_eth_exit(void)
 {
-        unregister_pernet_device(&l2tp_eth_net_ops);
         l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH);
 }
 
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 50e3ee9a9d61..bc6e8bfc5be4 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -437,11 +437,11 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-        if (sock) {
+        if (sock)
                 inet_shutdown(sock, SEND_SHUTDOWN);
-                /* Don't let the session go away before our socket does */
-                l2tp_session_inc_refcount(session);
-        }
+
+        /* Don't let the session go away before our socket does */
+        l2tp_session_inc_refcount(session);
 }
 
 /* Really kill the session socket. (Called from sock_put() if
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index f236c0bc7b3f..51063d9ed0f7 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1041,12 +1041,24 @@ out:
 static int
 mtype_head(struct ip_set *set, struct sk_buff *skb)
 {
-        const struct htype *h = set->data;
+        struct htype *h = set->data;
         const struct htable *t;
         struct nlattr *nested;
         size_t memsize;
         u8 htable_bits;
 
+        /* If any members have expired, set->elements will be wrong
+         * mytype_expire function will update it with the right count.
+         * we do not hold set->lock here, so grab it first.
+         * set->elements can still be incorrect in the case of a huge set,
+         * because elements might time out during the listing.
+         */
+        if (SET_WITH_TIMEOUT(set)) {
+                spin_lock_bh(&set->lock);
+                mtype_expire(set, h);
+                spin_unlock_bh(&set->lock);
+        }
+
         rcu_read_lock_bh();
         t = rcu_dereference_bh_nfnl(h->table);
         memsize = mtype_ahash_memsize(h, t) + set->ext_size;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index f393a7086025..af8345fc4fbd 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -429,7 +429,7 @@ nf_nat_setup_info(struct nf_conn *ct,
 
                 srchash = hash_by_src(net,
                                       &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-                lock = &nf_nat_locks[srchash % ARRAY_SIZE(nf_nat_locks)];
+                lock = &nf_nat_locks[srchash % CONNTRACK_LOCKS];
                 spin_lock_bh(lock);
                 hlist_add_head_rcu(&ct->nat_bysource,
                                    &nf_nat_bysource[srchash]);
@@ -532,9 +532,9 @@ static void __nf_nat_cleanup_conntrack(struct nf_conn *ct)
         unsigned int h;
 
         h = hash_by_src(nf_ct_net(ct), &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        spin_lock_bh(&nf_nat_locks[h % ARRAY_SIZE(nf_nat_locks)]);
+        spin_lock_bh(&nf_nat_locks[h % CONNTRACK_LOCKS]);
         hlist_del_rcu(&ct->nat_bysource);
-        spin_unlock_bh(&nf_nat_locks[h % ARRAY_SIZE(nf_nat_locks)]);
+        spin_unlock_bh(&nf_nat_locks[h % CONNTRACK_LOCKS]);
 }
 
 static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
@@ -807,8 +807,8 @@ static int __init nf_nat_init(void)
 
         /* Leave them the same for the moment. */
         nf_nat_htable_size = nf_conntrack_htable_size;
-        if (nf_nat_htable_size < ARRAY_SIZE(nf_nat_locks))
-                nf_nat_htable_size = ARRAY_SIZE(nf_nat_locks);
+        if (nf_nat_htable_size < CONNTRACK_LOCKS)
+                nf_nat_htable_size = CONNTRACK_LOCKS;
 
         nf_nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size, 0);
         if (!nf_nat_bysource)
@@ -821,7 +821,7 @@ static int __init nf_nat_init(void)
                 return ret;
         }
 
-        for (i = 0; i < ARRAY_SIZE(nf_nat_locks); i++)
+        for (i = 0; i < CONNTRACK_LOCKS; i++)
                 spin_lock_init(&nf_nat_locks[i]);
 
         nf_ct_helper_expectfn_register(&follow_master_nat);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 327807731b44..94c11cf0459d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2270,10 +2270,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
         mutex_unlock(nlk->cb_mutex);
 
+        ret = 0;
         if (cb->start)
-                cb->start(cb);
+                ret = cb->start(cb);
+
+        if (!ret)
+                ret = netlink_dump(sk);
 
-        ret = netlink_dump(sk);
         sock_put(sk);
 
         if (ret)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c26172995511..bec01a3daf5b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1684,10 +1684,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 
         mutex_lock(&fanout_mutex);
 
-        err = -EINVAL;
-        if (!po->running)
-                goto out;
-
         err = -EALREADY;
         if (po->fanout)
                 goto out;
@@ -1749,7 +1745,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                 list_add(&match->list, &fanout_list);
         }
         err = -EINVAL;
-        if (match->type == type &&
+
+        spin_lock(&po->bind_lock);
+        if (po->running &&
+            match->type == type &&
             match->prot_hook.type == po->prot_hook.type &&
             match->prot_hook.dev == po->prot_hook.dev) {
                 err = -ENOSPC;
@@ -1761,6 +1760,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                         err = 0;
                 }
         }
+        spin_unlock(&po->bind_lock);
+
+        if (err && !refcount_read(&match->sk_ref)) {
+                list_del(&match->list);
+                kfree(match);
+        }
+
 out:
         if (err && rollover) {
                 kfree(rollover);
@@ -2834,6 +2840,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         struct virtio_net_hdr vnet_hdr = { 0 };
         int offset = 0;
         struct packet_sock *po = pkt_sk(sk);
+        bool has_vnet_hdr = false;
         int hlen, tlen, linear;
         int extra_len = 0;
 
@@ -2877,6 +2884,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 err = packet_snd_vnet_parse(msg, &len, &vnet_hdr);
                 if (err)
                         goto out_unlock;
+                has_vnet_hdr = true;
         }
 
         if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
@@ -2935,7 +2943,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         skb->priority = sk->sk_priority;
         skb->mark = sockc.mark;
 
-        if (po->has_vnet_hdr) {
+        if (has_vnet_hdr) {
                 err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
                 if (err)
                         goto out_free;
@@ -3063,13 +3071,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
         int ret = 0;
         bool unlisted = false;
 
-        if (po->fanout)
-                return -EINVAL;
-
         lock_sock(sk);
         spin_lock(&po->bind_lock);
         rcu_read_lock();
 
+        if (po->fanout) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
+
         if (name) {
                 dev = dev_get_by_name_rcu(sock_net(sk), name);
                 if (!dev) {
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 1a267e77c6de..d230cb4c8094 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -922,28 +922,28 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 
                 if (!tc_flags_valid(fnew->flags)) {
                         err = -EINVAL;
-                        goto errout;
+                        goto errout_idr;
                 }
         }
 
         err = fl_set_parms(net, tp, fnew, &mask, base, tb, tca[TCA_RATE], ovr);
         if (err)
-                goto errout;
+                goto errout_idr;
 
         err = fl_check_assign_mask(head, &mask);
         if (err)
-                goto errout;
+                goto errout_idr;
 
         if (!tc_skip_sw(fnew->flags)) {
                 if (!fold && fl_lookup(head, &fnew->mkey)) {
                         err = -EEXIST;
-                        goto errout;
+                        goto errout_idr;
                 }
 
                 err = rhashtable_insert_fast(&head->ht, &fnew->ht_node,
                                              head->ht_params);
                 if (err)
-                        goto errout;
+                        goto errout_idr;
         }
 
         if (!tc_skip_hw(fnew->flags)) {
@@ -952,7 +952,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                                            &mask.key,
                                            fnew);
                 if (err)
-                        goto errout;
+                        goto errout_idr;
         }
 
         if (!tc_in_hw(fnew->flags))
@@ -981,6 +981,9 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         kfree(tb);
         return 0;
 
+errout_idr:
+        if (fnew->handle)
+                idr_remove_ext(&head->handle_idr, fnew->handle);
 errout:
         tcf_exts_destroy(&fnew->exts);
         kfree(fnew);
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 21cc45caf842..eeac606c95ab 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -32,6 +32,7 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp,
         if (tc_skip_sw(head->flags))
                 return -1;
 
+        *res = head->res;
         return tcf_exts_exec(skb, &head->exts, res);
 }
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 92237e75dbbc..bf8c81e07c70 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -685,6 +685,7 @@ void qdisc_reset(struct Qdisc *qdisc)
                 qdisc->gso_skb = NULL;
         }
         qdisc->q.qlen = 0;
+        qdisc->qstats.backlog = 0;
 }
 EXPORT_SYMBOL(qdisc_reset);
 
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index daaf214e5201..3f88b75488b0 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -958,6 +958,8 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
         }
 
         if (cl != NULL) {
+                int old_flags;
+
                 if (parentid) {
                         if (cl->cl_parent &&
                             cl->cl_parent->cl_common.classid != parentid)
@@ -978,6 +980,8 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                 }
 
                 sch_tree_lock(sch);
+                old_flags = cl->cl_flags;
+
                 if (rsc != NULL)
                         hfsc_change_rsc(cl, rsc, cur_time);
                 if (fsc != NULL)
@@ -986,10 +990,21 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
                         hfsc_change_usc(cl, usc, cur_time);
 
                 if (cl->qdisc->q.qlen != 0) {
-                        if (cl->cl_flags & HFSC_RSC)
-                                update_ed(cl, qdisc_peek_len(cl->qdisc));
-                        if (cl->cl_flags & HFSC_FSC)
-                                update_vf(cl, 0, cur_time);
+                        int len = qdisc_peek_len(cl->qdisc);
+
+                        if (cl->cl_flags & HFSC_RSC) {
+                                if (old_flags & HFSC_RSC)
+                                        update_ed(cl, len);
+                                else
+                                        init_ed(cl, len);
+                        }
+
+                        if (cl->cl_flags & HFSC_FSC) {
+                                if (old_flags & HFSC_FSC)
+                                        update_vf(cl, 0, cur_time);
+                                else
+                                        init_vf(cl, len);
+                        }
                 }
                 sch_tree_unlock(sch);
 
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 22ed01a76b19..a72a7d925d46 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -463,6 +463,7 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
                 .r = r,
                 .net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),
         };
+        int pos = cb->args[2];
 
         /* eps hashtable dumps
          * args:
@@ -493,7 +494,8 @@ skip:
                 goto done;
 
         sctp_for_each_transport(sctp_sock_filter, sctp_sock_dump,
-                                net, (int *)&cb->args[2], &commp);
+                                net, &pos, &commp);
+        cb->args[2] = pos;
 
 done:
         cb->args[1] = cb->args[4];
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 8c6d24b2995d..745f145d4c4d 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -282,6 +282,7 @@ int smc_netinfo_by_tcpsk(struct socket *clcsock,
                          __be32 *subnet, u8 *prefix_len)
 {
         struct dst_entry *dst = sk_dst_get(clcsock->sk);
+        struct in_device *in_dev;
         struct sockaddr_in addr;
         int rc = -ENOENT;
         int len;
@@ -298,14 +299,17 @@ int smc_netinfo_by_tcpsk(struct socket *clcsock,
         /* get address to which the internal TCP socket is bound */
         kernel_getsockname(clcsock, (struct sockaddr *)&addr, &len);
         /* analyze IPv4 specific data of net_device belonging to TCP socket */
-        for_ifa(dst->dev->ip_ptr) {
-                if (ifa->ifa_address != addr.sin_addr.s_addr)
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(dst->dev);
+        for_ifa(in_dev) {
+                if (!inet_ifa_match(addr.sin_addr.s_addr, ifa))
                         continue;
                 *prefix_len = inet_mask_len(ifa->ifa_mask);
                 *subnet = ifa->ifa_address & ifa->ifa_mask;
                 rc = 0;
                 break;
-        } endfor_ifa(dst->dev->ip_ptr);
+        } endfor_ifa(in_dev);
+        rcu_read_unlock();
 
 out_rel:
         dst_release(dst);
@@ -509,7 +513,7 @@ decline_rdma:
         /* RDMA setup failed, switch back to TCP */
         smc->use_fallback = true;
         if (reason_code && (reason_code != SMC_CLC_DECL_REPLY)) {
-                rc = smc_clc_send_decline(smc, reason_code, 0);
+                rc = smc_clc_send_decline(smc, reason_code);
                 if (rc < sizeof(struct smc_clc_msg_decline))
                         goto out_err;
         }
@@ -804,8 +808,6 @@ static void smc_listen_work(struct work_struct *work)
                 rc = local_contact;
                 if (rc == -ENOMEM)
                         reason_code = SMC_CLC_DECL_MEM;/* insufficient memory*/
-                else if (rc == -ENOLINK)
-                        reason_code = SMC_CLC_DECL_SYNCERR; /* synchr. error */
                 goto decline_rdma;
         }
         link = &new_smc->conn.lgr->lnk[SMC_SINGLE_LINK];
@@ -899,7 +901,7 @@ decline_rdma:
         smc_conn_free(&new_smc->conn);
         new_smc->use_fallback = true;
         if (reason_code && (reason_code != SMC_CLC_DECL_REPLY)) {
-                rc = smc_clc_send_decline(new_smc, reason_code, 0);
+                rc = smc_clc_send_decline(new_smc, reason_code);
                 if (rc < sizeof(struct smc_clc_msg_decline))
                         goto out_err;
         }
diff --git a/net/smc/smc.h b/net/smc/smc.h
index 6e44313e4467..0ccd6fa387ad 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -149,7 +149,7 @@ struct smc_connection {
         atomic_t                sndbuf_space;   /* remaining space in sndbuf */
         u16                     tx_cdc_seq;     /* sequence # for CDC send */
         spinlock_t              send_lock;      /* protect wr_sends */
-        struct work_struct      tx_work;        /* retry of smc_cdc_msg_send */
+        struct delayed_work     tx_work;        /* retry of smc_cdc_msg_send */
 
         struct smc_host_cdc_msg local_rx_ctrl;  /* filled during event_handl.
                                                  * .prod cf. TCP rcv_nxt
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 3934913ab835..b7dd2743fb5c 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -95,9 +95,10 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
         }
         if (clcm->type == SMC_CLC_DECLINE) {
                 reason_code = SMC_CLC_DECL_REPLY;
-                if (ntohl(((struct smc_clc_msg_decline *)buf)->peer_diagnosis)
-                        == SMC_CLC_DECL_SYNCERR)
+                if (((struct smc_clc_msg_decline *)buf)->hdr.flag) {
                         smc->conn.lgr->sync_err = true;
+                        smc_lgr_terminate(smc->conn.lgr);
+                }
         }
 
 out:
@@ -105,8 +106,7 @@ out:
 }
 
 /* send CLC DECLINE message across internal TCP socket */
-int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info,
-                         u8 out_of_sync)
+int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info)
 {
         struct smc_clc_msg_decline dclc;
         struct msghdr msg;
@@ -118,7 +118,7 @@ int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info,
         dclc.hdr.type = SMC_CLC_DECLINE;
         dclc.hdr.length = htons(sizeof(struct smc_clc_msg_decline));
         dclc.hdr.version = SMC_CLC_V1;
-        dclc.hdr.flag = out_of_sync ? 1 : 0;
+        dclc.hdr.flag = (peer_diag_info == SMC_CLC_DECL_SYNCERR) ? 1 : 0;
         memcpy(dclc.id_for_peer, local_systemid, sizeof(local_systemid));
         dclc.peer_diagnosis = htonl(peer_diag_info);
         memcpy(dclc.trl.eyecatcher, SMC_EYECATCHER, sizeof(SMC_EYECATCHER));
diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h
index 13db8ce177c9..1c55414041d4 100644
--- a/net/smc/smc_clc.h
+++ b/net/smc/smc_clc.h
@@ -106,8 +106,7 @@ struct smc_ib_device;
 
 int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
                      u8 expected_type);
-int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info,
-                         u8 out_of_sync);
+int smc_clc_send_decline(struct smc_sock *smc, u32 peer_diag_info);
 int smc_clc_send_proposal(struct smc_sock *smc, struct smc_ib_device *smcibdev,
                           u8 ibport);
 int smc_clc_send_confirm(struct smc_sock *smc);
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 3c2e166b5d22..f0d16fb825f7 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -174,15 +174,15 @@ int smc_close_active(struct smc_sock *smc)
 {
         struct smc_cdc_conn_state_flags *txflags =
                 &smc->conn.local_tx_ctrl.conn_state_flags;
-        long timeout = SMC_MAX_STREAM_WAIT_TIMEOUT;
         struct smc_connection *conn = &smc->conn;
         struct sock *sk = &smc->sk;
         int old_state;
+        long timeout;
         int rc = 0;
 
-        if (sock_flag(sk, SOCK_LINGER) &&
-            !(current->flags & PF_EXITING))
-                timeout = sk->sk_lingertime;
+        timeout = current->flags & PF_EXITING ?
+                  0 : sock_flag(sk, SOCK_LINGER) ?
+                      sk->sk_lingertime : SMC_MAX_STREAM_WAIT_TIMEOUT;
 
 again:
         old_state = sk->sk_state;
@@ -208,7 +208,7 @@ again:
         case SMC_ACTIVE:
                 smc_close_stream_wait(smc, timeout);
                 release_sock(sk);
-                cancel_work_sync(&conn->tx_work);
+                cancel_delayed_work_sync(&conn->tx_work);
                 lock_sock(sk);
                 if (sk->sk_state == SMC_ACTIVE) {
                         /* send close request */
@@ -234,7 +234,7 @@ again:
                 if (!smc_cdc_rxed_any_close(conn))
                         smc_close_stream_wait(smc, timeout);
                 release_sock(sk);
-                cancel_work_sync(&conn->tx_work);
+                cancel_delayed_work_sync(&conn->tx_work);
                 lock_sock(sk);
                 if (sk->sk_err != ECONNABORTED) {
                         /* confirm close from peer */
@@ -263,7 +263,9 @@ again:
                 /* peer sending PeerConnectionClosed will cause transition */
                 break;
         case SMC_PROCESSABORT:
-                cancel_work_sync(&conn->tx_work);
+                release_sock(sk);
+                cancel_delayed_work_sync(&conn->tx_work);
+                lock_sock(sk);
                 smc_close_abort(conn);
                 sk->sk_state = SMC_CLOSED;
                 smc_close_wait_tx_pends(smc);
@@ -411,13 +413,14 @@ void smc_close_sock_put_work(struct work_struct *work)
 int smc_close_shutdown_write(struct smc_sock *smc)
 {
         struct smc_connection *conn = &smc->conn;
-        long timeout = SMC_MAX_STREAM_WAIT_TIMEOUT;
         struct sock *sk = &smc->sk;
         int old_state;
+        long timeout;
         int rc = 0;
 
-        if (sock_flag(sk, SOCK_LINGER))
-                timeout = sk->sk_lingertime;
+        timeout = current->flags & PF_EXITING ?
+                  0 : sock_flag(sk, SOCK_LINGER) ?
+                      sk->sk_lingertime : SMC_MAX_STREAM_WAIT_TIMEOUT;
 
 again:
         old_state = sk->sk_state;
@@ -425,7 +428,7 @@ again:
         case SMC_ACTIVE:
                 smc_close_stream_wait(smc, timeout);
                 release_sock(sk);
-                cancel_work_sync(&conn->tx_work);
+                cancel_delayed_work_sync(&conn->tx_work);
                 lock_sock(sk);
                 /* send close wr request */
                 rc = smc_close_wr(conn);
@@ -439,7 +442,7 @@ again:
                 if (!smc_cdc_rxed_any_close(conn))
                         smc_close_stream_wait(smc, timeout);
                 release_sock(sk);
-                cancel_work_sync(&conn->tx_work);
+                cancel_delayed_work_sync(&conn->tx_work);
                 lock_sock(sk);
                 /* confirm close from peer */
                 rc = smc_close_wr(conn);
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 1a16d51e2330..20b66e79c5d6 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -25,8 +25,9 @@
 #include "smc_cdc.h"
 #include "smc_close.h"
 
-#define SMC_LGR_NUM_INCR        256
-#define SMC_LGR_FREE_DELAY      (600 * HZ)
+#define SMC_LGR_NUM_INCR                256
+#define SMC_LGR_FREE_DELAY_SERV         (600 * HZ)
+#define SMC_LGR_FREE_DELAY_CLNT         (SMC_LGR_FREE_DELAY_SERV + 10)
 
 static u32 smc_lgr_num;                 /* unique link group number */
 
@@ -107,8 +108,15 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
                 __smc_lgr_unregister_conn(conn);
         }
         write_unlock_bh(&lgr->conns_lock);
-        if (reduced && !lgr->conns_num)
-                schedule_delayed_work(&lgr->free_work, SMC_LGR_FREE_DELAY);
+        if (!reduced || lgr->conns_num)
+                return;
+        /* client link group creation always follows the server link group
+         * creation. For client use a somewhat higher removal delay time,
+         * otherwise there is a risk of out-of-sync link groups.
+         */
+        mod_delayed_work(system_wq, &lgr->free_work,
+                         lgr->role == SMC_CLNT ? SMC_LGR_FREE_DELAY_CLNT :
+                                                 SMC_LGR_FREE_DELAY_SERV);
 }
 
 static void smc_lgr_free_work(struct work_struct *work)
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index 547e0e113b17..0b5852299158 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -380,6 +380,7 @@ static int smc_ib_fill_gid_and_mac(struct smc_ib_device *smcibdev, u8 ibport)
         ndev = smcibdev->ibdev->get_netdev(smcibdev->ibdev, ibport);
         if (ndev) {
                 memcpy(&smcibdev->mac, ndev->dev_addr, ETH_ALEN);
+                dev_put(ndev);
         } else if (!rc) {
                 memcpy(&smcibdev->mac[ibport - 1][0],
                        &smcibdev->gid[ibport - 1].raw[8], 3);
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 78f7af28ae4f..31f8453c25c5 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -181,8 +181,10 @@ static int smc_pnet_enter(struct smc_pnetentry *new_pnetelem)
                              sizeof(new_pnetelem->ndev->name)) ||
                     smc_pnet_same_ibname(pnetelem,
                                          new_pnetelem->smcibdev->ibdev->name,
-                                         new_pnetelem->ib_port))
+                                         new_pnetelem->ib_port)) {
+                        dev_put(pnetelem->ndev);
                         goto found;
+                }
         }
         list_add_tail(&new_pnetelem->list, &smc_pnettable.pnetlist);
         rc = 0;
diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
index b17a333e9bb0..3e631ae4b6b6 100644
--- a/net/smc/smc_rx.c
+++ b/net/smc/smc_rx.c
@@ -148,6 +148,8 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, size_t len,
                                 read_done = sock_intr_errno(timeo);
                                 break;
                         }
+                        if (!timeo)
+                                return -EAGAIN;
                 }
 
                 if (!atomic_read(&conn->bytes_to_rcv)) {
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 3c656beb8820..3866573288dd 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -24,6 +24,8 @@
 #include "smc_cdc.h"
 #include "smc_tx.h"
 
+#define SMC_TX_WORK_DELAY       HZ
+
 /***************************** sndbuf producer *******************************/
 
 /* callback implementation for sk.sk_write_space()
@@ -406,7 +408,8 @@ int smc_tx_sndbuf_nonempty(struct smc_connection *conn)
                                 goto out_unlock;
                         }
                         rc = 0;
-                        schedule_work(&conn->tx_work);
+                        schedule_delayed_work(&conn->tx_work,
+                                              SMC_TX_WORK_DELAY);
                 }
                 goto out_unlock;
         }
@@ -430,7 +433,7 @@ out_unlock:
  */
 static void smc_tx_work(struct work_struct *work)
 {
-        struct smc_connection *conn = container_of(work,
+        struct smc_connection *conn = container_of(to_delayed_work(work),
                                                    struct smc_connection,
                                                    tx_work);
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
@@ -468,7 +471,8 @@ void smc_tx_consumer_update(struct smc_connection *conn)
                 if (!rc)
                         rc = smc_cdc_msg_send(conn, wr_buf, pend);
                 if (rc < 0) {
-                        schedule_work(&conn->tx_work);
+                        schedule_delayed_work(&conn->tx_work,
+                                              SMC_TX_WORK_DELAY);
                         return;
                 }
                 smc_curs_write(&conn->rx_curs_confirmed,
@@ -487,6 +491,6 @@ void smc_tx_consumer_update(struct smc_connection *conn)
 void smc_tx_init(struct smc_sock *smc)
 {
         smc->sk.sk_write_space = smc_tx_write_space;
-        INIT_WORK(&smc->conn.tx_work, smc_tx_work);
+        INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
         spin_lock_init(&smc->conn.send_lock);
 }
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index ab56bda66783..525d91e0d57e 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -244,7 +244,7 @@ int smc_wr_tx_send(struct smc_link *link, struct smc_wr_tx_pend_priv *priv)
         int rc;
 
         ib_req_notify_cq(link->smcibdev->roce_cq_send,
-                         IB_CQ_SOLICITED_MASK | IB_CQ_REPORT_MISSED_EVENTS);
+                         IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
         pend = container_of(priv, struct smc_wr_tx_pend, priv);
         rc = ib_post_send(link->roce_qp, &link->wr_tx_ibs[pend->idx],
                           &failed_wr);
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index 5a936a6a31a3..df062e086bdb 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -401,7 +401,7 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
         if (unlikely(n != mw->mw_nents))
                 goto out_mapmr_err;
 
-        dprintk("RPC:       %s: Using frmr %p to map %u segments (%u bytes)\n",
+        dprintk("RPC:       %s: Using frmr %p to map %u segments (%llu bytes)\n",
                 __func__, frmr, mw->mw_nents, mr->length);
 
         key = (u8)(mr->rkey & 0x000000FF);
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 6ef379f004ac..121e59a1d0e7 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -551,7 +551,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
                 return false;
         if (msg_errcode(msg))
                 return false;
-        *err = -TIPC_ERR_NO_NAME;
+        *err = TIPC_ERR_NO_NAME;
         if (skb_linearize(skb))
                 return false;
         msg = buf_msg(skb);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0df8023f480b..690874293cfc 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9987,6 +9987,9 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                 if (err)
                         return err;
 
+                if (!setup.chandef.chan)
+                        return -EINVAL;
+
                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
                                               &setup.beacon_rate);
                 if (err)
@@ -10903,6 +10906,9 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 return err;
 
+        if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
+            !tb[NL80211_REKEY_DATA_KCK])
+                return -EINVAL;
         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
                 return -ERANGE;
         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 2e3a10e79ca9..061d0c3a420a 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -265,6 +265,8 @@ objtool_args += --no-fp
 endif
 ifdef CONFIG_GCOV_KERNEL
 objtool_args += --no-unreachable
+else
+objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable)
 endif
 
 # 'OBJECT_FILES_NON_STANDARD := y': skip objtool checking for a directory
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index dd2c262aebbf..8b80bac055e4 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -6390,7 +6390,7 @@ sub process {
                 exit(0);
         }
 
-        if (!$is_patch && $file !~ /cover-letter\.patch$/) {
+        if (!$is_patch && $filename !~ /cover-letter\.patch$/) {
                 ERROR("NOT_UNIFIED_DIFF",
                       "Does not appear to be a unified-diff format patch\n");
         }
diff --git a/scripts/dtc/dtx_diff b/scripts/dtc/dtx_diff
index f9a3d8d23c64..8c4fbad2055e 100755
--- a/scripts/dtc/dtx_diff
+++ b/scripts/dtc/dtx_diff
@@ -86,6 +86,7 @@ eod
 compile_to_dts() {
 
         dtx="$1"
+        dtc_include="$2"
 
         if [ -d "${dtx}" ] ; then
 
@@ -113,7 +114,7 @@ compile_to_dts() {
                 # -----  input is DTS (source)
 
                 if ( cpp ${cpp_flags} -x assembler-with-cpp ${dtx} \
-                        | ${DTC} -I dts ) ; then
+                        | ${DTC} ${dtc_include} -I dts ) ; then
                         return
                 fi
 
@@ -320,18 +321,13 @@ fi
 
 cpp_flags="\
         -nostdinc                                  \
-        -I${srctree}/arch/${ARCH}/boot/dts         \
         -I${srctree}/scripts/dtc/include-prefixes  \
-        -I${srctree}/drivers/of/testcase-data      \
         -undef -D__DTS__"
 
-dtc_flags="\
-        -i ${srctree}/arch/${ARCH}/boot/dts/ \
-        -i ${srctree}/kernel/dts             \
-        ${dtx_path_1_dtc_include}            \
-        ${dtx_path_2_dtc_include}"
-
-DTC="${DTC} ${dtc_flags} -O dts -qq -f ${dtc_sort} -o -"
+DTC="\
+        ${DTC}                                     \
+        -i ${srctree}/scripts/dtc/include-prefixes \
+        -O dts -qq -f ${dtc_sort} -o -"
 
 
 # -----  do the diff or decompile
@@ -339,11 +335,11 @@ DTC="${DTC} ${dtc_flags} -O dts -qq -f ${dtc_sort} -o -"
 if (( ${cmd_diff} )) ; then
 
         diff ${diff_flags} --label "${dtx_file_1}" --label "${dtx_file_2}" \
-                <(compile_to_dts "${dtx_file_1}") \
-                <(compile_to_dts "${dtx_file_2}")
+                <(compile_to_dts "${dtx_file_1}" "${dtx_path_1_dtc_include}") \
+                <(compile_to_dts "${dtx_file_2}" "${dtx_path_2_dtc_include}")
 
 else
 
-        compile_to_dts "${dtx_file_1}"
+        compile_to_dts "${dtx_file_1}" "${dtx_path_1_dtc_include}"
 
 fi
diff --git a/scripts/mkversion b/scripts/mkversion
deleted file mode 100644
index c12addc9c7ef..000000000000
--- a/scripts/mkversion
+++ /dev/null
@@ -1,6 +0,0 @@
-if [ ! -f .version ]
-then
-    echo 1
-else
-    expr 0`cat .version` + 1
-fi
diff --git a/scripts/package/Makefile b/scripts/package/Makefile
index 71b4a8af9d4d..73f9f3192b9f 100644
--- a/scripts/package/Makefile
+++ b/scripts/package/Makefile
@@ -50,8 +50,6 @@ rpm-pkg rpm: FORCE
         $(MAKE) clean
         $(CONFIG_SHELL) $(MKSPEC) >$(objtree)/kernel.spec
         $(call cmd,src_tar,$(KERNELPATH),kernel.spec)
-        $(CONFIG_SHELL) $(srctree)/scripts/mkversion > $(objtree)/.tmp_version
-        mv -f $(objtree)/.tmp_version $(objtree)/.version
         rpmbuild $(RPMOPTS) --target $(UTS_MACHINE) -ta $(KERNELPATH).tar.gz
         rm $(KERNELPATH).tar.gz kernel.spec
 
@@ -60,9 +58,6 @@ rpm-pkg rpm: FORCE
 binrpm-pkg: FORCE
         $(MAKE) KBUILD_SRC=
         $(CONFIG_SHELL) $(MKSPEC) prebuilt > $(objtree)/binkernel.spec
-        $(CONFIG_SHELL) $(srctree)/scripts/mkversion > $(objtree)/.tmp_version
-        mv -f $(objtree)/.tmp_version $(objtree)/.version
-
         rpmbuild $(RPMOPTS) --define "_builddir $(objtree)" --target \
                 $(UTS_MACHINE) -bb $(objtree)/binkernel.spec
         rm binkernel.spec
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index aad67000e4dd..0bc87473f68f 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -92,12 +92,10 @@ else
 fi
 sourcename=$KDEB_SOURCENAME
 tmpdir="$objtree/debian/tmp"
-fwdir="$objtree/debian/fwtmp"
 kernel_headers_dir="$objtree/debian/hdrtmp"
 libc_headers_dir="$objtree/debian/headertmp"
 dbg_dir="$objtree/debian/dbgtmp"
 packagename=linux-image-$version
-fwpackagename=linux-firmware-image-$version
 kernel_headers_packagename=linux-headers-$version
 libc_headers_packagename=linux-libc-dev
 dbg_packagename=$packagename-dbg
@@ -126,10 +124,9 @@ esac
 BUILD_DEBUG="$(grep -s '^CONFIG_DEBUG_INFO=y' $KCONFIG_CONFIG || true)"
 
 # Setup the directory structure
-rm -rf "$tmpdir" "$fwdir" "$kernel_headers_dir" "$libc_headers_dir" "$dbg_dir" $objtree/debian/files
+rm -rf "$tmpdir" "$kernel_headers_dir" "$libc_headers_dir" "$dbg_dir" $objtree/debian/files
 mkdir -m 755 -p "$tmpdir/DEBIAN"
 mkdir -p "$tmpdir/lib" "$tmpdir/boot"
-mkdir -p "$fwdir/lib/firmware/$version/"
 mkdir -p "$kernel_headers_dir/lib/modules/$version/"
 
 # Build and install the kernel
@@ -306,7 +303,6 @@ else
         cat <<EOF >> debian/control
 
 Package: $packagename
-Suggests: $fwpackagename
 Architecture: any
 Description: Linux kernel, version $version
  This package contains the Linux kernel, modules and corresponding other
@@ -345,22 +341,6 @@ Description: Linux kernel headers for $KERNELRELEASE on \${kernel:debarch}
  This is useful for people who need to build external modules
 EOF
 
-# Do we have firmware? Move it out of the way and build it into a package.
-if [ -e "$tmpdir/lib/firmware" ]; then
-        mv "$tmpdir/lib/firmware"/* "$fwdir/lib/firmware/$version/"
-        rmdir "$tmpdir/lib/firmware"
-
-        cat <<EOF >> debian/control
-
-Package: $fwpackagename
-Architecture: all
-Description: Linux kernel firmware, version $version
- This package contains firmware from the Linux kernel, version $version.
-EOF
-
-        create_package "$fwpackagename" "$fwdir"
-fi
-
 cat <<EOF >> debian/control
 
 Package: $libc_headers_packagename
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index bb43f153fd8e..f47f17aae135 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -27,9 +27,7 @@ __KERNELRELEASE=`echo $KERNELRELEASE | sed -e "s/-/_/g"`
 echo "Name: kernel"
 echo "Summary: The Linux Kernel"
 echo "Version: $__KERNELRELEASE"
-# we need to determine the NEXT version number so that uname and
-# rpm -q will agree
-echo "Release: `. $srctree/scripts/mkversion`"
+echo "Release: $(cat .version 2>/dev/null || echo 1)"
 echo "License: GPL"
 echo "Group: System Environment/Kernel"
 echo "Vendor: The Linux Community"
@@ -77,7 +75,7 @@ fi
 echo "%build"
 
 if ! $PREBUILT; then
-echo "make clean && make %{?_smp_mflags}"
+echo "make clean && make %{?_smp_mflags} KBUILD_BUILD_VERSION=%{release}"
 echo ""
 fi
 
@@ -88,11 +86,8 @@ echo 'mkdir -p $RPM_BUILD_ROOT/boot/efi $RPM_BUILD_ROOT/lib/modules'
 echo "%else"
 echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib/modules'
 echo "%endif"
-echo 'mkdir -p $RPM_BUILD_ROOT'"/lib/firmware/$KERNELRELEASE"
 
-echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= mod-fw= modules_install'
-echo 'INSTALL_FW_PATH=$RPM_BUILD_ROOT'"/lib/firmware/$KERNELRELEASE"
-echo 'make INSTALL_FW_PATH=$INSTALL_FW_PATH' firmware_install
+echo 'INSTALL_MOD_PATH=$RPM_BUILD_ROOT make %{?_smp_mflags} KBUILD_SRC= modules_install'
 echo "%ifarch ia64"
 echo 'cp $KBUILD_IMAGE $RPM_BUILD_ROOT'"/boot/efi/vmlinuz-$KERNELRELEASE"
 echo 'ln -s '"efi/vmlinuz-$KERNELRELEASE" '$RPM_BUILD_ROOT'"/boot/"
@@ -119,7 +114,7 @@ if ! $PREBUILT; then
 echo 'rm -f $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE/build"
 echo 'rm -f $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE/source"
 echo "mkdir -p "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE"
-echo "EXCLUDES=\"$RCS_TAR_IGNORE --exclude .tmp_versions --exclude=*vmlinux* --exclude=*.o --exclude=*.ko --exclude=*.cmd --exclude=Documentation --exclude=firmware --exclude .config.old --exclude .missing-syscalls.d\""
+echo "EXCLUDES=\"$RCS_TAR_IGNORE --exclude .tmp_versions --exclude=*vmlinux* --exclude=*.o --exclude=*.ko --exclude=*.cmd --exclude=Documentation --exclude .config.old --exclude .missing-syscalls.d\""
 echo "tar "'$EXCLUDES'" -cf- . | (cd "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE;tar xvf -)"
 echo 'cd $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE"
 echo "ln -sf /usr/src/kernels/$KERNELRELEASE build"
@@ -154,7 +149,6 @@ echo '%defattr (-, root, root)'
 echo "/lib/modules/$KERNELRELEASE"
 echo "%exclude /lib/modules/$KERNELRELEASE/build"
 echo "%exclude /lib/modules/$KERNELRELEASE/source"
-echo "/lib/firmware/$KERNELRELEASE"
 echo "/boot/*"
 echo ""
 echo "%files headers"
diff --git a/scripts/spelling.txt b/scripts/spelling.txt
index 400ef35169c5..aa0cc49ad1ad 100644
--- a/scripts/spelling.txt
+++ b/scripts/spelling.txt
@@ -53,6 +53,7 @@ acumulator||accumulator
 adapater||adapter
 addional||additional
 additionaly||additionally
+additonal||additional
 addres||address
 adddress||address
 addreses||addresses
@@ -67,6 +68,8 @@ adviced||advised
 afecting||affecting
 againt||against
 agaist||against
+aggreataon||aggregation
+aggreation||aggregation
 albumns||albums
 alegorical||allegorical
 algined||aligned
@@ -80,6 +83,8 @@ aligment||alignment
 alignement||alignment
 allign||align
 alligned||aligned
+alllocate||allocate
+alloated||allocated
 allocatote||allocate
 allocatrd||allocated
 allocte||allocate
@@ -171,6 +176,7 @@ availale||available
 availavility||availability
 availble||available
 availiable||available
+availible||available
 avalable||available
 avaliable||available
 aysnc||async
@@ -203,6 +209,7 @@ broadcat||broadcast
 cacluated||calculated
 caculation||calculation
 calender||calendar
+calescing||coalescing
 calle||called
 callibration||calibration
 calucate||calculate
@@ -210,6 +217,7 @@ calulate||calculate
 cancelation||cancellation
 cancle||cancel
 capabilites||capabilities
+capabilty||capability
 capabitilies||capabilities
 capatibilities||capabilities
 capapbilities||capabilities
@@ -302,6 +310,7 @@ containts||contains
 contaisn||contains
 contant||contact
 contence||contents
+continious||continuous
 continous||continuous
 continously||continuously
 continueing||continuing
@@ -393,6 +402,7 @@ differrence||difference
 diffrent||different
 diffrentiate||differentiate
 difinition||definition
+dimesions||dimensions
 diplay||display
 direectly||directly
 disassocation||disassociation
@@ -449,6 +459,7 @@ equiped||equipped
 equivelant||equivalent
 equivilant||equivalent
 eror||error
+errorr||error
 estbalishment||establishment
 etsablishment||establishment
 etsbalishment||establishment
@@ -481,6 +492,7 @@ failied||failed
 faillure||failure
 failue||failure
 failuer||failure
+failng||failing
 faireness||fairness
 falied||failed
 faliure||failure
@@ -493,6 +505,7 @@ fetaure||feature
 fetaures||features
 fileystem||filesystem
 fimware||firmware
+firware||firmware
 finanize||finalize
 findn||find
 finilizes||finalizes
@@ -502,6 +515,7 @@ folloing||following
 followign||following
 followings||following
 follwing||following
+fonud||found
 forseeable||foreseeable
 forse||force
 fortan||fortran
@@ -532,6 +546,7 @@ grabing||grabbing
 grahical||graphical
 grahpical||graphical
 grapic||graphic
+grranted||granted
 guage||gauge
 guarenteed||guaranteed
 guarentee||guarantee
@@ -543,6 +558,7 @@ happend||happened
 harware||hardware
 heirarchically||hierarchically
 helpfull||helpful
+hybernate||hibernate
 hierachy||hierarchy
 hierarchie||hierarchy
 howver||however
@@ -565,16 +581,19 @@ implemenation||implementation
 implementaiton||implementation
 implementated||implemented
 implemention||implementation
+implementd||implemented
 implemetation||implementation
 implemntation||implementation
 implentation||implementation
 implmentation||implementation
 implmenting||implementing
+incative||inactive
 incomming||incoming
 incompatabilities||incompatibilities
 incompatable||incompatible
 inconsistant||inconsistent
 increas||increase
+incremeted||incremented
 incrment||increment
 indendation||indentation
 indended||intended
@@ -619,6 +638,7 @@ interger||integer
 intermittant||intermittent
 internel||internal
 interoprability||interoperability
+interuupt||interrupt
 interrface||interface
 interrrupt||interrupt
 interrup||interrupt
@@ -638,8 +658,10 @@ intrrupt||interrupt
 intterrupt||interrupt
 intuative||intuitive
 invaid||invalid
+invald||invalid
 invalde||invalid
 invalide||invalid
+invalidiate||invalidate
 invalud||invalid
 invididual||individual
 invokation||invocation
@@ -713,6 +735,7 @@ misformed||malformed
 mispelled||misspelled
 mispelt||misspelt
 mising||missing
+mismactch||mismatch
 missmanaged||mismanaged
 missmatch||mismatch
 miximum||maximum
@@ -731,6 +754,7 @@ multidimensionnal||multidimensional
 multple||multiple
 mumber||number
 muticast||multicast
+mutilcast||multicast
 mutiple||multiple
 mutli||multi
 nams||names
@@ -834,6 +858,7 @@ posible||possible
 positon||position
 possibilites||possibilities
 powerfull||powerful
+preample||preamble
 preapre||prepare
 preceeded||preceded
 preceeding||preceding
@@ -1059,6 +1084,7 @@ sturcture||structure
 subdirectoires||subdirectories
 suble||subtle
 substract||subtract
+submition||submission
 succesfully||successfully
 succesful||successful
 successed||succeeded
@@ -1078,6 +1104,7 @@ suppoted||supported
 suppported||supported
 suppport||support
 supress||suppress
+surpressed||suppressed
 surpresses||suppresses
 susbsystem||subsystem
 suspeneded||suspended
@@ -1091,6 +1118,7 @@ swithced||switched
 swithcing||switching
 swithed||switched
 swithing||switching
+swtich||switch
 symetric||symmetric
 synax||syntax
 synchonized||synchronized
@@ -1111,7 +1139,9 @@ therfore||therefore
 thier||their
 threds||threads
 threshhold||threshold
+thresold||threshold
 throught||through
+troughput||throughput
 thses||these
 tiggered||triggered
 tipically||typically
@@ -1120,6 +1150,7 @@ tmis||this
 torerable||tolerable
 tramsmitted||transmitted
 tramsmit||transmit
+tranasction||transaction
 tranfer||transfer
 transciever||transceiver
 transferd||transferred
@@ -1133,6 +1164,7 @@ trasmission||transmission
 treshold||threshold
 trigerring||triggering
 trun||turn
+tunning||tuning
 ture||true
 tyep||type
 udpate||update
@@ -1199,6 +1231,7 @@ visiters||visitors
 vitual||virtual
 wakeus||wakeups
 wating||waiting
+wiat||wait
 wether||whether
 whataver||whatever
 whcih||which
diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore
index 9cdec70d72b8..d5b291e94264 100644
--- a/security/apparmor/.gitignore
+++ b/security/apparmor/.gitignore
@@ -1,5 +1,6 @@
 #
 # Generated include files
 #
+net_names.h
 capability_names.h
 rlim_names.h
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
index a16b195274de..dafdd387d42b 100644
--- a/security/apparmor/Makefile
+++ b/security/apparmor/Makefile
@@ -4,11 +4,44 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
 
 apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
               path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
-              resource.o secid.o file.o policy_ns.o label.o
+              resource.o secid.o file.o policy_ns.o label.o mount.o net.o
 apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o
 
-clean-files := capability_names.h rlim_names.h
+clean-files := capability_names.h rlim_names.h net_names.h
 
+# Build a lower case string table of address family names
+# Transform lines from
+#    #define AF_LOCAL           1       /* POSIX name for AF_UNIX       */
+#    #define AF_INET            2       /* Internet IP Protocol         */
+# to
+#    [1] = "local",
+#    [2] = "inet",
+#
+# and build the securityfs entries for the mapping.
+# Transforms lines from
+#    #define AF_INET            2       /* Internet IP Protocol         */
+# to
+#    #define AA_SFS_AF_MASK "local inet"
+quiet_cmd_make-af = GEN     $@
+cmd_make-af = echo "static const char *address_family_names[] = {" > $@ ;\
+        sed $< >>$@ -r -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "/AF_ROUTE/d" -e \
+         's/^\#define[ \t]+AF_([A-Z0-9_]+)[ \t]+([0-9]+)(.*)/[\2] = "\L\1",/p';\
+        echo "};" >> $@ ;\
+        printf '%s' '\#define AA_SFS_AF_MASK "' >> $@ ;\
+        sed -r -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "/AF_ROUTE/d" -e \
+         's/^\#define[ \t]+AF_([A-Z0-9_]+)[ \t]+([0-9]+)(.*)/\L\1/p'\
+         $< | tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
+
+# Build a lower case string table of sock type names
+# Transform lines from
+#    SOCK_STREAM        = 1,
+# to
+#    [1] = "stream",
+quiet_cmd_make-sock = GEN     $@
+cmd_make-sock = echo "static const char *sock_type_names[] = {" >> $@ ;\
+        sed $^ >>$@ -r -n \
+        -e 's/^\tSOCK_([A-Z0-9_]+)[\t]+=[ \t]+([0-9]+)(.*)/[\2] = "\L\1",/p';\
+        echo "};" >> $@
 
 # Build a lower case string table of capability names
 # Transforms lines from
@@ -61,6 +94,7 @@ cmd_make-rlim = echo "static const char *const rlim_names[RLIM_NLIMITS] = {" \
             tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
 
 $(obj)/capability.o : $(obj)/capability_names.h
+$(obj)/net.o : $(obj)/net_names.h
 $(obj)/resource.o : $(obj)/rlim_names.h
 $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
                             $(src)/Makefile
@@ -68,3 +102,8 @@ $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
 $(obj)/rlim_names.h : $(srctree)/include/uapi/asm-generic/resource.h \
                       $(src)/Makefile
         $(call cmd,make-rlim)
+$(obj)/net_names.h : $(srctree)/include/linux/socket.h \
+                     $(srctree)/include/linux/net.h \
+                     $(src)/Makefile
+        $(call cmd,make-af)
+        $(call cmd,make-sock)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 853c2ec8e0c9..518d5928661b 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -32,6 +32,7 @@
 #include "include/audit.h"
 #include "include/context.h"
 #include "include/crypto.h"
+#include "include/ipc.h"
 #include "include/policy_ns.h"
 #include "include/label.h"
 #include "include/policy.h"
@@ -248,8 +249,10 @@ static struct dentry *aafs_create(const char *name, umode_t mode,
 
         inode_lock(dir);
         dentry = lookup_one_len(name, parent, strlen(name));
-        if (IS_ERR(dentry))
+        if (IS_ERR(dentry)) {
+                error = PTR_ERR(dentry);
                 goto fail_lock;
+        }
 
         if (d_really_is_positive(dentry)) {
                 error = -EEXIST;
@@ -1443,6 +1446,10 @@ void __aafs_profile_migrate_dents(struct aa_profile *old,
 {
         int i;
 
+        AA_BUG(!old);
+        AA_BUG(!new);
+        AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock));
+
         for (i = 0; i < AAFS_PROF_SIZEOF; i++) {
                 new->dents[i] = old->dents[i];
                 if (new->dents[i])
@@ -1506,6 +1513,9 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
         struct dentry *dent = NULL, *dir;
         int error;
 
+        AA_BUG(!profile);
+        AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock));
+
         if (!parent) {
                 struct aa_profile *p;
                 p = aa_deref_parent(profile);
@@ -1731,6 +1741,7 @@ void __aafs_ns_rmdir(struct aa_ns *ns)
 
         if (!ns)
                 return;
+        AA_BUG(!mutex_is_locked(&ns->lock));
 
         list_for_each_entry(child, &ns->base.profiles, base.list)
                 __aafs_profile_rmdir(child);
@@ -1903,6 +1914,10 @@ static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
 {
         struct aa_ns *parent, *next;
 
+        AA_BUG(!root);
+        AA_BUG(!ns);
+        AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock));
+
         /* is next namespace a child */
         if (!list_empty(&ns->sub_ns)) {
                 next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
@@ -1937,6 +1952,9 @@ static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
 static struct aa_profile *__first_profile(struct aa_ns *root,
                                           struct aa_ns *ns)
 {
+        AA_BUG(!root);
+        AA_BUG(ns && !mutex_is_locked(&ns->lock));
+
         for (; ns; ns = __next_ns(root, ns)) {
                 if (!list_empty(&ns->base.profiles))
                         return list_first_entry(&ns->base.profiles,
@@ -1959,6 +1977,8 @@ static struct aa_profile *__next_profile(struct aa_profile *p)
         struct aa_profile *parent;
         struct aa_ns *ns = p->ns;
 
+        AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock));
+
         /* is next profile a child */
         if (!list_empty(&p->base.profiles))
                 return list_first_entry(&p->base.profiles, typeof(*p),
@@ -2127,6 +2147,11 @@ static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
         { }
 };
 
+static struct aa_sfs_entry aa_sfs_entry_signal[] = {
+        AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK),
+        { }
+};
+
 static struct aa_sfs_entry aa_sfs_entry_domain[] = {
         AA_SFS_FILE_BOOLEAN("change_hat",       1),
         AA_SFS_FILE_BOOLEAN("change_hatv",      1),
@@ -2151,9 +2176,14 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = {
         { }
 };
 
+static struct aa_sfs_entry aa_sfs_entry_mount[] = {
+        AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
+        { }
+};
+
 static struct aa_sfs_entry aa_sfs_entry_ns[] = {
         AA_SFS_FILE_BOOLEAN("profile",          1),
-        AA_SFS_FILE_BOOLEAN("pivot_root",       1),
+        AA_SFS_FILE_BOOLEAN("pivot_root",       0),
         { }
 };
 
@@ -2172,22 +2202,25 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
         AA_SFS_DIR("policy",                    aa_sfs_entry_policy),
         AA_SFS_DIR("domain",                    aa_sfs_entry_domain),
         AA_SFS_DIR("file",                      aa_sfs_entry_file),
+        AA_SFS_DIR("network",                   aa_sfs_entry_network),
+        AA_SFS_DIR("mount",                     aa_sfs_entry_mount),
         AA_SFS_DIR("namespaces",                aa_sfs_entry_ns),
         AA_SFS_FILE_U64("capability",           VFS_CAP_FLAGS_MASK),
         AA_SFS_DIR("rlimit",                    aa_sfs_entry_rlimit),
         AA_SFS_DIR("caps",                      aa_sfs_entry_caps),
         AA_SFS_DIR("ptrace",                    aa_sfs_entry_ptrace),
+        AA_SFS_DIR("signal",                    aa_sfs_entry_signal),
         AA_SFS_DIR("query",                     aa_sfs_entry_query),
         { }
 };
 
 static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
-        AA_SFS_FILE_FOPS(".access", 0640, &aa_sfs_access),
+        AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
         AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
         AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
-        AA_SFS_FILE_FOPS(".ns_level", 0666, &seq_ns_level_fops),
-        AA_SFS_FILE_FOPS(".ns_name", 0640, &seq_ns_name_fops),
-        AA_SFS_FILE_FOPS("profiles", 0440, &aa_sfs_profiles_fops),
+        AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
+        AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
+        AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
         AA_SFS_DIR("features", aa_sfs_entry_features),
         { }
 };
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 17a601c67b62..dd754b7850a8 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -374,8 +374,8 @@ static const char *next_name(int xtype, const char *name)
  *
  * Returns: refcounted label, or NULL on failure (MAYBE NULL)
  */
-static struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
-                                       const char **name)
+struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
+                                const char **name)
 {
         struct aa_label *label = NULL;
         u32 xtype = xindex & AA_X_TYPE_MASK;
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 3382518b87fa..db80221891c6 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -21,6 +21,7 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/match.h"
+#include "include/net.h"
 #include "include/path.h"
 #include "include/policy.h"
 #include "include/label.h"
@@ -566,6 +567,32 @@ static int __file_path_perm(const char *op, struct aa_label *label,
         return error;
 }
 
+static int __file_sock_perm(const char *op, struct aa_label *label,
+                            struct aa_label *flabel, struct file *file,
+                            u32 request, u32 denied)
+{
+        struct socket *sock = (struct socket *) file->private_data;
+        int error;
+
+        AA_BUG(!sock);
+
+        /* revalidation due to label out of date. No revocation at this time */
+        if (!denied && aa_label_is_subset(flabel, label))
+                return 0;
+
+        /* TODO: improve to skip profiles cached in flabel */
+        error = aa_sock_file_perm(label, op, request, sock);
+        if (denied) {
+                /* TODO: improve to skip profiles checked above */
+                /* check every profile in file label to is cached */
+                last_error(error, aa_sock_file_perm(flabel, op, request, sock));
+        }
+        if (!error)
+                update_file_ctx(file_ctx(file), label, request);
+
+        return error;
+}
+
 /**
  * aa_file_perm - do permission revalidation check & audit for @file
  * @op: operation being checked
@@ -610,6 +637,9 @@ int aa_file_perm(const char *op, struct aa_label *label, struct file *file,
                 error = __file_path_perm(op, label, flabel, file, request,
                                          denied);
 
+        else if (S_ISSOCK(file_inode(file)->i_mode))
+                error = __file_sock_perm(op, label, flabel, file, request,
+                                         denied);
 done:
         rcu_read_unlock();
 
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
index aaf893f4e4f5..829082c35faa 100644
--- a/security/apparmor/include/apparmor.h
+++ b/security/apparmor/include/apparmor.h
@@ -27,7 +27,9 @@
 #define AA_CLASS_NET            4
 #define AA_CLASS_RLIMITS        5
 #define AA_CLASS_DOMAIN         6
+#define AA_CLASS_MOUNT          7
 #define AA_CLASS_PTRACE         9
+#define AA_CLASS_SIGNAL         10
 #define AA_CLASS_LABEL          16
 
 #define AA_CLASS_LAST           AA_CLASS_LABEL
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index c68839a44351..ff4316e1068d 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -71,6 +71,10 @@ enum audit_type {
 #define OP_FMPROT "file_mprotect"
 #define OP_INHERIT "file_inherit"
 
+#define OP_PIVOTROOT "pivotroot"
+#define OP_MOUNT "mount"
+#define OP_UMOUNT "umount"
+
 #define OP_CREATE "create"
 #define OP_POST_CREATE "post_create"
 #define OP_BIND "bind"
@@ -86,6 +90,7 @@ enum audit_type {
 #define OP_SHUTDOWN "socket_shutdown"
 
 #define OP_PTRACE "ptrace"
+#define OP_SIGNAL "signal"
 
 #define OP_EXEC "exec"
 
@@ -116,20 +121,36 @@ struct apparmor_audit_data {
                 /* these entries require a custom callback fn */
                 struct {
                         struct aa_label *peer;
-                        struct {
-                                const char *target;
-                                kuid_t ouid;
-                        } fs;
+                        union {
+                                struct {
+                                        kuid_t ouid;
+                                        const char *target;
+                                } fs;
+                                struct {
+                                        int type, protocol;
+                                        struct sock *peer_sk;
+                                        void *addr;
+                                        int addrlen;
+                                } net;
+                                int signal;
+                                struct {
+                                        int rlim;
+                                        unsigned long max;
+                                } rlim;
+                        };
                 };
                 struct {
-                        const char *name;
-                        long pos;
+                        struct aa_profile *profile;
                         const char *ns;
+                        long pos;
                 } iface;
                 struct {
-                        int rlim;
-                        unsigned long max;
-                } rlim;
+                        const char *src_name;
+                        const char *type;
+                        const char *trans;
+                        const char *data;
+                        unsigned long flags;
+                } mnt;
         };
 };
 
diff --git a/security/apparmor/include/domain.h b/security/apparmor/include/domain.h
index 24c5976d6143..ac9862ff7cdf 100644
--- a/security/apparmor/include/domain.h
+++ b/security/apparmor/include/domain.h
@@ -15,6 +15,8 @@
 #include <linux/binfmts.h>
 #include <linux/types.h>
 
+#include "label.h"
+
 #ifndef __AA_DOMAIN_H
 #define __AA_DOMAIN_H
 
@@ -29,6 +31,9 @@ struct aa_domain {
 #define AA_CHANGE_ONEXEC  4
 #define AA_CHANGE_STACK 8
 
+struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
+                                const char **name);
+
 int apparmor_bprm_set_creds(struct linux_binprm *bprm);
 
 void aa_free_domain_entries(struct aa_domain *domain);
diff --git a/security/apparmor/include/ipc.h b/security/apparmor/include/ipc.h
index 656fdb81c8a0..5ffc218d1e74 100644
--- a/security/apparmor/include/ipc.h
+++ b/security/apparmor/include/ipc.h
@@ -27,8 +27,14 @@ struct aa_profile;
 
 #define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
                              AA_MAY_BE_READ | AA_MAY_BE_TRACED)
+#define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE)
+
+#define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \
+        "segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \
+        "xcpu xfsz vtalrm prof winch io pwr sys emt lost"
 
 int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
                   u32 request);
+int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig);
 
 #endif /* __AA_IPC_H */
diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index 9a283b722755..af22dcbbcb8a 100644
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -310,6 +310,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp);
 #define FLAG_SHOW_MODE 1
 #define FLAG_VIEW_SUBNS 2
 #define FLAG_HIDDEN_UNCONFINED 4
+#define FLAG_ABS_ROOT 8
 int aa_label_snxprint(char *str, size_t size, struct aa_ns *view,
                       struct aa_label *label, int flags);
 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
diff --git a/security/apparmor/include/mount.h b/security/apparmor/include/mount.h
new file mode 100644
index 000000000000..25d6067fa6ef
--- /dev/null
+++ b/security/apparmor/include/mount.h
@@ -0,0 +1,54 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor file mediation function definitions.
+ *
+ * Copyright 2017 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_MOUNT_H
+#define __AA_MOUNT_H
+
+#include <linux/fs.h>
+#include <linux/path.h>
+
+#include "domain.h"
+#include "policy.h"
+
+/* mount perms */
+#define AA_MAY_PIVOTROOT        0x01
+#define AA_MAY_MOUNT            0x02
+#define AA_MAY_UMOUNT           0x04
+#define AA_AUDIT_DATA           0x40
+#define AA_MNT_CONT_MATCH       0x40
+
+#define AA_MS_IGNORE_MASK (MS_KERNMOUNT | MS_NOSEC | MS_ACTIVE | MS_BORN)
+
+int aa_remount(struct aa_label *label, const struct path *path,
+               unsigned long flags, void *data);
+
+int aa_bind_mount(struct aa_label *label, const struct path *path,
+                  const char *old_name, unsigned long flags);
+
+
+int aa_mount_change_type(struct aa_label *label, const struct path *path,
+                         unsigned long flags);
+
+int aa_move_mount(struct aa_label *label, const struct path *path,
+                  const char *old_name);
+
+int aa_new_mount(struct aa_label *label, const char *dev_name,
+                 const struct path *path, const char *type, unsigned long flags,
+                 void *data);
+
+int aa_umount(struct aa_label *label, struct vfsmount *mnt, int flags);
+
+int aa_pivotroot(struct aa_label *label, const struct path *old_path,
+                 const struct path *new_path);
+
+#endif /* __AA_MOUNT_H */
diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h
new file mode 100644
index 000000000000..140c8efcf364
--- /dev/null
+++ b/security/apparmor/include/net.h
@@ -0,0 +1,114 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor network mediation definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2017 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_NET_H
+#define __AA_NET_H
+
+#include <net/sock.h>
+#include <linux/path.h>
+
+#include "apparmorfs.h"
+#include "label.h"
+#include "perms.h"
+#include "policy.h"
+
+#define AA_MAY_SEND             AA_MAY_WRITE
+#define AA_MAY_RECEIVE          AA_MAY_READ
+
+#define AA_MAY_SHUTDOWN         AA_MAY_DELETE
+
+#define AA_MAY_CONNECT          AA_MAY_OPEN
+#define AA_MAY_ACCEPT           0x00100000
+
+#define AA_MAY_BIND             0x00200000
+#define AA_MAY_LISTEN           0x00400000
+
+#define AA_MAY_SETOPT           0x01000000
+#define AA_MAY_GETOPT           0x02000000
+
+#define NET_PERMS_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE |    \
+                        AA_MAY_SHUTDOWN | AA_MAY_BIND | AA_MAY_LISTEN |   \
+                        AA_MAY_CONNECT | AA_MAY_ACCEPT | AA_MAY_SETATTR | \
+                        AA_MAY_GETATTR | AA_MAY_SETOPT | AA_MAY_GETOPT)
+
+#define NET_FS_PERMS (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE |    \
+                      AA_MAY_SHUTDOWN | AA_MAY_CONNECT | AA_MAY_RENAME |\
+                      AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_CHMOD |  \
+                      AA_MAY_CHOWN | AA_MAY_CHGRP | AA_MAY_LOCK |       \
+                      AA_MAY_MPROT)
+
+#define NET_PEER_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CONNECT |  \
+                       AA_MAY_ACCEPT)
+struct aa_sk_ctx {
+        struct aa_label *label;
+        struct aa_label *peer;
+        struct path path;
+};
+
+#define SK_CTX(X) ((X)->sk_security)
+#define SOCK_ctx(X) SOCK_INODE(X)->i_security
+#define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P)                           \
+        struct lsm_network_audit NAME ## _net = { .sk = (SK),             \
+                                                  .family = (F)};         \
+        DEFINE_AUDIT_DATA(NAME,                                           \
+                          ((SK) && (F) != AF_UNIX) ? LSM_AUDIT_DATA_NET : \
+                                                     LSM_AUDIT_DATA_NONE, \
+                          OP);                                            \
+        NAME.u.net = &(NAME ## _net);                                     \
+        aad(&NAME)->net.type = (T);                                       \
+        aad(&NAME)->net.protocol = (P)
+
+#define DEFINE_AUDIT_SK(NAME, OP, SK)                                   \
+        DEFINE_AUDIT_NET(NAME, OP, SK, (SK)->sk_family, (SK)->sk_type,  \
+                         (SK)->sk_protocol)
+
+/* struct aa_net - network confinement data
+ * @allow: basic network families permissions
+ * @audit: which network permissions to force audit
+ * @quiet: which network permissions to quiet rejects
+ */
+struct aa_net {
+        u16 allow[AF_MAX];
+        u16 audit[AF_MAX];
+        u16 quiet[AF_MAX];
+};
+
+
+extern struct aa_sfs_entry aa_sfs_entry_network[];
+
+void audit_net_cb(struct audit_buffer *ab, void *va);
+int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
+                       u32 request, u16 family, int type);
+int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
+               int type, int protocol);
+static inline int aa_profile_af_sk_perm(struct aa_profile *profile,
+                                        struct common_audit_data *sa,
+                                        u32 request,
+                                        struct sock *sk)
+{
+        return aa_profile_af_perm(profile, sa, request, sk->sk_family,
+                                  sk->sk_type);
+}
+int aa_sk_perm(const char *op, u32 request, struct sock *sk);
+
+int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
+                      struct socket *sock);
+
+
+static inline void aa_free_net_rules(struct aa_net *new)
+{
+        /* NOP */
+}
+
+#endif /* __AA_NET_H */
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 2b27bb79aec4..af04d5a7d73d 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -135,9 +135,10 @@ extern struct aa_perms allperms;
 
 
 void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask);
-void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask);
+void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
+                         u32 mask);
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
-                        u32 chrsmask, const char **names, u32 namesmask);
+                        u32 chrsmask, const char * const *names, u32 namesmask);
 void aa_apply_modes_to_perms(struct aa_profile *profile,
                              struct aa_perms *perms);
 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 17fe41a9cac3..4364088a0b9e 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -30,6 +30,7 @@
 #include "file.h"
 #include "lib.h"
 #include "label.h"
+#include "net.h"
 #include "perms.h"
 #include "resource.h"
 
@@ -111,6 +112,7 @@ struct aa_data {
  * @policy: general match rules governing policy
  * @file: The set of rules governing basic file access and domain transitions
  * @caps: capabilities for the profile
+ * @net: network controls for the profile
  * @rlimits: rlimits for the profile
  *
  * @dents: dentries for the profiles file entries in apparmorfs
@@ -148,6 +150,7 @@ struct aa_profile {
         struct aa_policydb policy;
         struct aa_file_rules file;
         struct aa_caps caps;
+        struct aa_net net;
         struct aa_rlimit rlimits;
 
         struct aa_loaddata *rawdata;
@@ -220,6 +223,16 @@ static inline unsigned int PROFILE_MEDIATES_SAFE(struct aa_profile *profile,
         return 0;
 }
 
+static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile,
+                                               u16 AF) {
+        unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
+        u16 be_af = cpu_to_be16(AF);
+
+        if (!state)
+                return 0;
+        return aa_dfa_match_len(profile->policy.dfa, state, (char *) &be_af, 2);
+}
+
 /**
  * aa_get_profile - increment refcount on profile @p
  * @p: profile  (MAYBE NULL)
diff --git a/security/apparmor/include/sig_names.h b/security/apparmor/include/sig_names.h
new file mode 100644
index 000000000000..92e62fe95292
--- /dev/null
+++ b/security/apparmor/include/sig_names.h
@@ -0,0 +1,98 @@
+#include <linux/signal.h>
+
+#define SIGUNKNOWN 0
+#define MAXMAPPED_SIG 35
+/* provide a mapping of arch signal to internal signal # for mediation
+ * those that are always an alias SIGCLD for SIGCLHD and SIGPOLL for SIGIO
+ * map to the same entry those that may/or may not get a separate entry
+ */
+static const int sig_map[MAXMAPPED_SIG] = {
+        [0] = MAXMAPPED_SIG,    /* existence test */
+        [SIGHUP] = 1,
+        [SIGINT] = 2,
+        [SIGQUIT] = 3,
+        [SIGILL] = 4,
+        [SIGTRAP] = 5,          /* -, 5, - */
+        [SIGABRT] = 6,          /*  SIGIOT: -, 6, - */
+        [SIGBUS] = 7,           /* 10, 7, 10 */
+        [SIGFPE] = 8,
+        [SIGKILL] = 9,
+        [SIGUSR1] = 10,         /* 30, 10, 16 */
+        [SIGSEGV] = 11,
+        [SIGUSR2] = 12,         /* 31, 12, 17 */
+        [SIGPIPE] = 13,
+        [SIGALRM] = 14,
+        [SIGTERM] = 15,
+#ifdef SIGSTKFLT
+        [SIGSTKFLT] = 16,       /* -, 16, - */
+#endif
+        [SIGCHLD] = 17,         /* 20, 17, 18.  SIGCHLD -, -, 18 */
+        [SIGCONT] = 18,         /* 19, 18, 25 */
+        [SIGSTOP] = 19,         /* 17, 19, 23 */
+        [SIGTSTP] = 20,         /* 18, 20, 24 */
+        [SIGTTIN] = 21,         /* 21, 21, 26 */
+        [SIGTTOU] = 22,         /* 22, 22, 27 */
+        [SIGURG] = 23,          /* 16, 23, 21 */
+        [SIGXCPU] = 24,         /* 24, 24, 30 */
+        [SIGXFSZ] = 25,         /* 25, 25, 31 */
+        [SIGVTALRM] = 26,       /* 26, 26, 28 */
+        [SIGPROF] = 27,         /* 27, 27, 29 */
+        [SIGWINCH] = 28,        /* 28, 28, 20 */
+        [SIGIO] = 29,           /* SIGPOLL: 23, 29, 22 */
+        [SIGPWR] = 30,          /* 29, 30, 19.  SIGINFO 29, -, - */
+#ifdef SIGSYS
+        [SIGSYS] = 31,          /* 12, 31, 12. often SIG LOST/UNUSED */
+#endif
+#ifdef SIGEMT
+        [SIGEMT] = 32,          /* 7, - , 7 */
+#endif
+#if defined(SIGLOST) && SIGPWR != SIGLOST               /* sparc */
+        [SIGLOST] = 33,         /* unused on Linux */
+#endif
+#if defined(SIGUNUSED) && \
+    defined(SIGLOST) && defined(SIGSYS) && SIGLOST != SIGSYS
+        [SIGUNUSED] = 34,       /* -, 31, - */
+#endif
+};
+
+/* this table is ordered post sig_map[sig] mapping */
+static const char *const sig_names[MAXMAPPED_SIG + 1] = {
+        "unknown",
+        "hup",
+        "int",
+        "quit",
+        "ill",
+        "trap",
+        "abrt",
+        "bus",
+        "fpe",
+        "kill",
+        "usr1",
+        "segv",
+        "usr2",
+        "pipe",
+        "alrm",
+        "term",
+        "stkflt",
+        "chld",
+        "cont",
+        "stop",
+        "stp",
+        "ttin",
+        "ttou",
+        "urg",
+        "xcpu",
+        "xfsz",
+        "vtalrm",
+        "prof",
+        "winch",
+        "io",
+        "pwr",
+        "sys",
+        "emt",
+        "lost",
+        "unused",
+
+        "exists",       /* always last existence test mapped to MAXMAPPED_SIG */
+};
+
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index 11e66b5bbc42..66fb9ede9447 100644
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -20,6 +20,7 @@
 #include "include/context.h"
 #include "include/policy.h"
 #include "include/ipc.h"
+#include "include/sig_names.h"
 
 /**
  * audit_ptrace_mask - convert mask to permission string
@@ -121,3 +122,101 @@ int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
 }
 
 
+static inline int map_signal_num(int sig)
+{
+        if (sig > SIGRTMAX)
+                return SIGUNKNOWN;
+        else if (sig >= SIGRTMIN)
+                return sig - SIGRTMIN + 128;    /* rt sigs mapped to 128 */
+        else if (sig <= MAXMAPPED_SIG)
+                return sig_map[sig];
+        return SIGUNKNOWN;
+}
+
+/**
+ * audit_file_mask - convert mask to permission string
+ * @buffer: buffer to write string to (NOT NULL)
+ * @mask: permission mask to convert
+ */
+static void audit_signal_mask(struct audit_buffer *ab, u32 mask)
+{
+        if (mask & MAY_READ)
+                audit_log_string(ab, "receive");
+        if (mask & MAY_WRITE)
+                audit_log_string(ab, "send");
+}
+
+/**
+ * audit_cb - call back for signal specific audit fields
+ * @ab: audit_buffer  (NOT NULL)
+ * @va: audit struct to audit values of  (NOT NULL)
+ */
+static void audit_signal_cb(struct audit_buffer *ab, void *va)
+{
+        struct common_audit_data *sa = va;
+
+        if (aad(sa)->request & AA_SIGNAL_PERM_MASK) {
+                audit_log_format(ab, " requested_mask=");
+                audit_signal_mask(ab, aad(sa)->request);
+                if (aad(sa)->denied & AA_SIGNAL_PERM_MASK) {
+                        audit_log_format(ab, " denied_mask=");
+                        audit_signal_mask(ab, aad(sa)->denied);
+                }
+        }
+        if (aad(sa)->signal <= MAXMAPPED_SIG)
+                audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]);
+        else
+                audit_log_format(ab, " signal=rtmin+%d",
+                                 aad(sa)->signal - 128);
+        audit_log_format(ab, " peer=");
+        aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
+                        FLAGS_NONE, GFP_ATOMIC);
+}
+
+/* TODO: update to handle compound name&name2, conditionals */
+static void profile_match_signal(struct aa_profile *profile, const char *label,
+                                 int signal, struct aa_perms *perms)
+{
+        unsigned int state;
+
+        /* TODO: secondary cache check <profile, profile, perm> */
+        state = aa_dfa_next(profile->policy.dfa,
+                            profile->policy.start[AA_CLASS_SIGNAL],
+                            signal);
+        state = aa_dfa_match(profile->policy.dfa, state, label);
+        aa_compute_perms(profile->policy.dfa, state, perms);
+}
+
+static int profile_signal_perm(struct aa_profile *profile,
+                               struct aa_profile *peer, u32 request,
+                               struct common_audit_data *sa)
+{
+        struct aa_perms perms;
+
+        if (profile_unconfined(profile) ||
+            !PROFILE_MEDIATES(profile, AA_CLASS_SIGNAL))
+                return 0;
+
+        aad(sa)->peer = &peer->label;
+        profile_match_signal(profile, peer->base.hname, aad(sa)->signal,
+                             &perms);
+        aa_apply_modes_to_perms(profile, &perms);
+        return aa_check_perms(profile, &perms, request, sa, audit_signal_cb);
+}
+
+static int aa_signal_cross_perm(struct aa_profile *sender,
+                                struct aa_profile *target,
+                                struct common_audit_data *sa)
+{
+        return xcheck(profile_signal_perm(sender, target, MAY_WRITE, sa),
+                      profile_signal_perm(target, sender, MAY_READ, sa));
+}
+
+int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig)
+{
+        DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SIGNAL);
+
+        aad(&sa)->signal = map_signal_num(sig);
+        return xcheck_labels_profiles(sender, target, aa_signal_cross_perm,
+                                      &sa);
+}
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index e052eaba1cf6..c5b99b954580 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -49,7 +49,7 @@ static void free_proxy(struct aa_proxy *proxy)
                 /* p->label will not updated any more as p is dead */
                 aa_put_label(rcu_dereference_protected(proxy->label, true));
                 memset(proxy, 0, sizeof(*proxy));
-                proxy->label = (struct aa_label *) PROXY_POISON;
+                RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
                 kfree(proxy);
         }
 }
@@ -1450,9 +1450,11 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
  * cached label name is present and visible
  * @label->hname only exists if label is namespace hierachical
  */
-static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label)
+static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
+                                   int flags)
 {
-        if (label->hname && labels_ns(label) == ns)
+        if (label->hname && (!ns || labels_ns(label) == ns) &&
+            !(flags & ~FLAG_SHOW_MODE))
                 return true;
 
         return false;
@@ -1495,7 +1497,7 @@ static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
                 view = profiles_ns(profile);
 
         if (view != profile->ns &&
-            (!prev_ns || (prev_ns && *prev_ns != profile->ns))) {
+            (!prev_ns || (*prev_ns != profile->ns))) {
                 if (prev_ns)
                         *prev_ns = profile->ns;
                 ns_name = aa_ns_name(view, profile->ns,
@@ -1605,8 +1607,13 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
         AA_BUG(!str && size != 0);
         AA_BUG(!label);
 
-        if (!ns)
+        if (flags & FLAG_ABS_ROOT) {
+                ns = root_ns;
+                len = snprintf(str, size, "=");
+                update_for_len(total, len, size, str);
+        } else if (!ns) {
                 ns = labels_ns(label);
+        }
 
         label_for_each(i, label, profile) {
                 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
@@ -1710,10 +1717,8 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
         AA_BUG(!ab);
         AA_BUG(!label);
 
-        if (!ns)
-                ns = labels_ns(label);
-
-        if (!use_label_hname(ns, label) || display_mode(ns, label, flags)) {
+        if (!use_label_hname(ns, label, flags) ||
+            display_mode(ns, label, flags)) {
                 len  = aa_label_asxprint(&name, ns, label, flags, gfp);
                 if (len == -1) {
                         AA_DEBUG("label print error");
@@ -1738,10 +1743,7 @@ void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
         AA_BUG(!f);
         AA_BUG(!label);
 
-        if (!ns)
-                ns = labels_ns(label);
-
-        if (!use_label_hname(ns, label)) {
+        if (!use_label_hname(ns, label, flags)) {
                 char *str;
                 int len;
 
@@ -1764,10 +1766,7 @@ void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
 {
         AA_BUG(!label);
 
-        if (!ns)
-                ns = labels_ns(label);
-
-        if (!use_label_hname(ns, label)) {
+        if (!use_label_hname(ns, label, flags)) {
                 char *str;
                 int len;
 
@@ -1874,6 +1873,9 @@ struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
                 if (*str == '&')
                         str++;
         }
+        if (*str == '=')
+                base = &root_ns->unconfined->label;
+
         error = vec_setup(profile, vec, len, gfp);
         if (error)
                 return ERR_PTR(error);
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 08ca26bcca77..8818621b5d95 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -211,7 +211,8 @@ void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask)
         *str = '\0';
 }
 
-void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask)
+void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
+                         u32 mask)
 {
         const char *fmt = "%s";
         unsigned int i, perm = 1;
@@ -229,7 +230,7 @@ void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask)
 }
 
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
-                        u32 chrsmask, const char **names, u32 namesmask)
+                        u32 chrsmask, const char * const *names, u32 namesmask)
 {
         char str[33];
 
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 7a82c0f61452..72b915dfcaf7 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -33,11 +33,13 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/ipc.h"
+#include "include/net.h"
 #include "include/path.h"
 #include "include/label.h"
 #include "include/policy.h"
 #include "include/policy_ns.h"
 #include "include/procattr.h"
+#include "include/mount.h"
 
 /* Flag indicating whether initialization completed */
 int apparmor_initialized;
@@ -511,6 +513,65 @@ static int apparmor_file_mprotect(struct vm_area_struct *vma,
                            !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
 }
 
+static int apparmor_sb_mount(const char *dev_name, const struct path *path,
+                             const char *type, unsigned long flags, void *data)
+{
+        struct aa_label *label;
+        int error = 0;
+
+        /* Discard magic */
+        if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
+                flags &= ~MS_MGC_MSK;
+
+        flags &= ~AA_MS_IGNORE_MASK;
+
+        label = __begin_current_label_crit_section();
+        if (!unconfined(label)) {
+                if (flags & MS_REMOUNT)
+                        error = aa_remount(label, path, flags, data);
+                else if (flags & MS_BIND)
+                        error = aa_bind_mount(label, path, dev_name, flags);
+                else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE |
+                                  MS_UNBINDABLE))
+                        error = aa_mount_change_type(label, path, flags);
+                else if (flags & MS_MOVE)
+                        error = aa_move_mount(label, path, dev_name);
+                else
+                        error = aa_new_mount(label, dev_name, path, type,
+                                             flags, data);
+        }
+        __end_current_label_crit_section(label);
+
+        return error;
+}
+
+static int apparmor_sb_umount(struct vfsmount *mnt, int flags)
+{
+        struct aa_label *label;
+        int error = 0;
+
+        label = __begin_current_label_crit_section();
+        if (!unconfined(label))
+                error = aa_umount(label, mnt, flags);
+        __end_current_label_crit_section(label);
+
+        return error;
+}
+
+static int apparmor_sb_pivotroot(const struct path *old_path,
+                                 const struct path *new_path)
+{
+        struct aa_label *label;
+        int error = 0;
+
+        label = aa_get_current_label();
+        if (!unconfined(label))
+                error = aa_pivotroot(label, old_path, new_path);
+        aa_put_label(label);
+
+        return error;
+}
+
 static int apparmor_getprocattr(struct task_struct *task, char *name,
                                 char **value)
 {
@@ -656,12 +717,398 @@ static int apparmor_task_setrlimit(struct task_struct *task,
         return error;
 }
 
+static int apparmor_task_kill(struct task_struct *target, struct siginfo *info,
+                              int sig, u32 secid)
+{
+        struct aa_label *cl, *tl;
+        int error;
+
+        if (secid)
+                /* TODO: after secid to label mapping is done.
+                 *  Dealing with USB IO specific behavior
+                 */
+                return 0;
+        cl = __begin_current_label_crit_section();
+        tl = aa_get_task_label(target);
+        error = aa_may_signal(cl, tl, sig);
+        aa_put_label(tl);
+        __end_current_label_crit_section(cl);
+
+        return error;
+}
+
+/**
+ * apparmor_sk_alloc_security - allocate and attach the sk_security field
+ */
+static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags)
+{
+        struct aa_sk_ctx *ctx;
+
+        ctx = kzalloc(sizeof(*ctx), flags);
+        if (!ctx)
+                return -ENOMEM;
+
+        SK_CTX(sk) = ctx;
+
+        return 0;
+}
+
+/**
+ * apparmor_sk_free_security - free the sk_security field
+ */
+static void apparmor_sk_free_security(struct sock *sk)
+{
+        struct aa_sk_ctx *ctx = SK_CTX(sk);
+
+        SK_CTX(sk) = NULL;
+        aa_put_label(ctx->label);
+        aa_put_label(ctx->peer);
+        path_put(&ctx->path);
+        kfree(ctx);
+}
+
+/**
+ * apparmor_clone_security - clone the sk_security field
+ */
+static void apparmor_sk_clone_security(const struct sock *sk,
+                                       struct sock *newsk)
+{
+        struct aa_sk_ctx *ctx = SK_CTX(sk);
+        struct aa_sk_ctx *new = SK_CTX(newsk);
+
+        new->label = aa_get_label(ctx->label);
+        new->peer = aa_get_label(ctx->peer);
+        new->path = ctx->path;
+        path_get(&new->path);
+}
+
+static int aa_sock_create_perm(struct aa_label *label, int family, int type,
+                               int protocol)
+{
+        AA_BUG(!label);
+        AA_BUG(in_interrupt());
+
+        return aa_af_perm(label, OP_CREATE, AA_MAY_CREATE, family, type,
+                          protocol);
+}
+
+
+/**
+ * apparmor_socket_create - check perms before creating a new socket
+ */
+static int apparmor_socket_create(int family, int type, int protocol, int kern)
+{
+        struct aa_label *label;
+        int error = 0;
+
+        label = begin_current_label_crit_section();
+        if (!(kern || unconfined(label)))
+                error = aa_sock_create_perm(label, family, type, protocol);
+        end_current_label_crit_section(label);
+
+        return error;
+}
+
+/**
+ * apparmor_socket_post_create - setup the per-socket security struct
+ *
+ * Note:
+ * -   kernel sockets currently labeled unconfined but we may want to
+ *     move to a special kernel label
+ * -   socket may not have sk here if created with sock_create_lite or
+ *     sock_alloc. These should be accept cases which will be handled in
+ *     sock_graft.
+ */
+static int apparmor_socket_post_create(struct socket *sock, int family,
+                                       int type, int protocol, int kern)
+{
+        struct aa_label *label;
+
+        if (kern) {
+                struct aa_ns *ns = aa_get_current_ns();
+
+                label = aa_get_label(ns_unconfined(ns));
+                aa_put_ns(ns);
+        } else
+                label = aa_get_current_label();
+
+        if (sock->sk) {
+                struct aa_sk_ctx *ctx = SK_CTX(sock->sk);
+
+                aa_put_label(ctx->label);
+                ctx->label = aa_get_label(label);
+        }
+        aa_put_label(label);
+
+        return 0;
+}
+
+/**
+ * apparmor_socket_bind - check perms before bind addr to socket
+ */
+static int apparmor_socket_bind(struct socket *sock,
+                                struct sockaddr *address, int addrlen)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(!address);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk);
+}
+
+/**
+ * apparmor_socket_connect - check perms before connecting @sock to @address
+ */
+static int apparmor_socket_connect(struct socket *sock,
+                                   struct sockaddr *address, int addrlen)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(!address);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
+}
+
+/**
+ * apparmor_socket_list - check perms before allowing listen
+ */
+static int apparmor_socket_listen(struct socket *sock, int backlog)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk);
+}
+
+/**
+ * apparmor_socket_accept - check perms before accepting a new connection.
+ *
+ * Note: while @newsock is created and has some information, the accept
+ *       has not been done.
+ */
+static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(!newsock);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk);
+}
+
+static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock,
+                            struct msghdr *msg, int size)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(!msg);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(op, request, sock->sk);
+}
+
+/**
+ * apparmor_socket_sendmsg - check perms before sending msg to another socket
+ */
+static int apparmor_socket_sendmsg(struct socket *sock,
+                                   struct msghdr *msg, int size)
+{
+        return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
+}
+
+/**
+ * apparmor_socket_recvmsg - check perms before receiving a message
+ */
+static int apparmor_socket_recvmsg(struct socket *sock,
+                                   struct msghdr *msg, int size, int flags)
+{
+        return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size);
+}
+
+/* revaliation, get/set attr, shutdown */
+static int aa_sock_perm(const char *op, u32 request, struct socket *sock)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(op, request, sock->sk);
+}
+
+/**
+ * apparmor_socket_getsockname - check perms before getting the local address
+ */
+static int apparmor_socket_getsockname(struct socket *sock)
+{
+        return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock);
+}
+
+/**
+ * apparmor_socket_getpeername - check perms before getting remote address
+ */
+static int apparmor_socket_getpeername(struct socket *sock)
+{
+        return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock);
+}
+
+/* revaliation, get/set attr, opt */
+static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock,
+                            int level, int optname)
+{
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+        AA_BUG(in_interrupt());
+
+        return aa_sk_perm(op, request, sock->sk);
+}
+
+/**
+ * apparmor_getsockopt - check perms before getting socket options
+ */
+static int apparmor_socket_getsockopt(struct socket *sock, int level,
+                                      int optname)
+{
+        return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock,
+                                level, optname);
+}
+
+/**
+ * apparmor_setsockopt - check perms before setting socket options
+ */
+static int apparmor_socket_setsockopt(struct socket *sock, int level,
+                                      int optname)
+{
+        return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock,
+                                level, optname);
+}
+
+/**
+ * apparmor_socket_shutdown - check perms before shutting down @sock conn
+ */
+static int apparmor_socket_shutdown(struct socket *sock, int how)
+{
+        return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock);
+}
+
+/**
+ * apparmor_socket_sock_recv_skb - check perms before associating skb to sk
+ *
+ * Note: can not sleep may be called with locks held
+ *
+ * dont want protocol specific in __skb_recv_datagram()
+ * to deny an incoming connection  socket_sock_rcv_skb()
+ */
+static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        return 0;
+}
+
+
+static struct aa_label *sk_peer_label(struct sock *sk)
+{
+        struct aa_sk_ctx *ctx = SK_CTX(sk);
+
+        if (ctx->peer)
+                return ctx->peer;
+
+        return ERR_PTR(-ENOPROTOOPT);
+}
+
+/**
+ * apparmor_socket_getpeersec_stream - get security context of peer
+ *
+ * Note: for tcp only valid if using ipsec or cipso on lan
+ */
+static int apparmor_socket_getpeersec_stream(struct socket *sock,
+                                             char __user *optval,
+                                             int __user *optlen,
+                                             unsigned int len)
+{
+        char *name;
+        int slen, error = 0;
+        struct aa_label *label;
+        struct aa_label *peer;
+
+        label = begin_current_label_crit_section();
+        peer = sk_peer_label(sock->sk);
+        if (IS_ERR(peer)) {
+                error = PTR_ERR(peer);
+                goto done;
+        }
+        slen = aa_label_asxprint(&name, labels_ns(label), peer,
+                                 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
+                                 FLAG_HIDDEN_UNCONFINED, GFP_KERNEL);
+        /* don't include terminating \0 in slen, it breaks some apps */
+        if (slen < 0) {
+                error = -ENOMEM;
+        } else {
+                if (slen > len) {
+                        error = -ERANGE;
+                } else if (copy_to_user(optval, name, slen)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                if (put_user(slen, optlen))
+                        error = -EFAULT;
+out:
+                kfree(name);
+
+        }
+
+done:
+        end_current_label_crit_section(label);
+
+        return error;
+}
+
+/**
+ * apparmor_socket_getpeersec_dgram - get security label of packet
+ * @sock: the peer socket
+ * @skb: packet data
+ * @secid: pointer to where to put the secid of the packet
+ *
+ * Sets the netlabel socket state on sk from parent
+ */
+static int apparmor_socket_getpeersec_dgram(struct socket *sock,
+                                            struct sk_buff *skb, u32 *secid)
+
+{
+        /* TODO: requires secid support */
+        return -ENOPROTOOPT;
+}
+
+/**
+ * apparmor_sock_graft - Initialize newly created socket
+ * @sk: child sock
+ * @parent: parent socket
+ *
+ * Note: could set off of SOCK_CTX(parent) but need to track inode and we can
+ *       just set sk security information off of current creating process label
+ *       Labeling of sk for accept case - probably should be sock based
+ *       instead of task, because of the case where an implicitly labeled
+ *       socket is shared by different tasks.
+ */
+static void apparmor_sock_graft(struct sock *sk, struct socket *parent)
+{
+        struct aa_sk_ctx *ctx = SK_CTX(sk);
+
+        if (!ctx->label)
+                ctx->label = aa_get_current_label();
+}
+
 static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
         LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
         LSM_HOOK_INIT(capget, apparmor_capget),
         LSM_HOOK_INIT(capable, apparmor_capable),
 
+        LSM_HOOK_INIT(sb_mount, apparmor_sb_mount),
+        LSM_HOOK_INIT(sb_umount, apparmor_sb_umount),
+        LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot),
+
         LSM_HOOK_INIT(path_link, apparmor_path_link),
         LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
         LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
@@ -686,6 +1133,30 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
         LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
 
+        LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security),
+        LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security),
+        LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
+
+        LSM_HOOK_INIT(socket_create, apparmor_socket_create),
+        LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create),
+        LSM_HOOK_INIT(socket_bind, apparmor_socket_bind),
+        LSM_HOOK_INIT(socket_connect, apparmor_socket_connect),
+        LSM_HOOK_INIT(socket_listen, apparmor_socket_listen),
+        LSM_HOOK_INIT(socket_accept, apparmor_socket_accept),
+        LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg),
+        LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg),
+        LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname),
+        LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername),
+        LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
+        LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
+        LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
+        LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
+        LSM_HOOK_INIT(socket_getpeersec_stream,
+                      apparmor_socket_getpeersec_stream),
+        LSM_HOOK_INIT(socket_getpeersec_dgram,
+                      apparmor_socket_getpeersec_dgram),
+        LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
+
         LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
         LSM_HOOK_INIT(cred_free, apparmor_cred_free),
         LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
@@ -696,6 +1167,7 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
 
         LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
+        LSM_HOOK_INIT(task_kill, apparmor_task_kill),
 };
 
 /*
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
new file mode 100644
index 000000000000..82a64b58041d
--- /dev/null
+++ b/security/apparmor/mount.c
@@ -0,0 +1,696 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor mediation of files
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2017 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/fs.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/domain.h"
+#include "include/file.h"
+#include "include/match.h"
+#include "include/mount.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+
+static void audit_mnt_flags(struct audit_buffer *ab, unsigned long flags)
+{
+        if (flags & MS_RDONLY)
+                audit_log_format(ab, "ro");
+        else
+                audit_log_format(ab, "rw");
+        if (flags & MS_NOSUID)
+                audit_log_format(ab, ", nosuid");
+        if (flags & MS_NODEV)
+                audit_log_format(ab, ", nodev");
+        if (flags & MS_NOEXEC)
+                audit_log_format(ab, ", noexec");
+        if (flags & MS_SYNCHRONOUS)
+                audit_log_format(ab, ", sync");
+        if (flags & MS_REMOUNT)
+                audit_log_format(ab, ", remount");
+        if (flags & MS_MANDLOCK)
+                audit_log_format(ab, ", mand");
+        if (flags & MS_DIRSYNC)
+                audit_log_format(ab, ", dirsync");
+        if (flags & MS_NOATIME)
+                audit_log_format(ab, ", noatime");
+        if (flags & MS_NODIRATIME)
+                audit_log_format(ab, ", nodiratime");
+        if (flags & MS_BIND)
+                audit_log_format(ab, flags & MS_REC ? ", rbind" : ", bind");
+        if (flags & MS_MOVE)
+                audit_log_format(ab, ", move");
+        if (flags & MS_SILENT)
+                audit_log_format(ab, ", silent");
+        if (flags & MS_POSIXACL)
+                audit_log_format(ab, ", acl");
+        if (flags & MS_UNBINDABLE)
+                audit_log_format(ab, flags & MS_REC ? ", runbindable" :
+                                 ", unbindable");
+        if (flags & MS_PRIVATE)
+                audit_log_format(ab, flags & MS_REC ? ", rprivate" :
+                                 ", private");
+        if (flags & MS_SLAVE)
+                audit_log_format(ab, flags & MS_REC ? ", rslave" :
+                                 ", slave");
+        if (flags & MS_SHARED)
+                audit_log_format(ab, flags & MS_REC ? ", rshared" :
+                                 ", shared");
+        if (flags & MS_RELATIME)
+                audit_log_format(ab, ", relatime");
+        if (flags & MS_I_VERSION)
+                audit_log_format(ab, ", iversion");
+        if (flags & MS_STRICTATIME)
+                audit_log_format(ab, ", strictatime");
+        if (flags & MS_NOUSER)
+                audit_log_format(ab, ", nouser");
+}
+
+/**
+ * audit_cb - call back for mount specific audit fields
+ * @ab: audit_buffer  (NOT NULL)
+ * @va: audit struct to audit values of  (NOT NULL)
+ */
+static void audit_cb(struct audit_buffer *ab, void *va)
+{
+        struct common_audit_data *sa = va;
+
+        if (aad(sa)->mnt.type) {
+                audit_log_format(ab, " fstype=");
+                audit_log_untrustedstring(ab, aad(sa)->mnt.type);
+        }
+        if (aad(sa)->mnt.src_name) {
+                audit_log_format(ab, " srcname=");
+                audit_log_untrustedstring(ab, aad(sa)->mnt.src_name);
+        }
+        if (aad(sa)->mnt.trans) {
+                audit_log_format(ab, " trans=");
+                audit_log_untrustedstring(ab, aad(sa)->mnt.trans);
+        }
+        if (aad(sa)->mnt.flags) {
+                audit_log_format(ab, " flags=\"");
+                audit_mnt_flags(ab, aad(sa)->mnt.flags);
+                audit_log_format(ab, "\"");
+        }
+        if (aad(sa)->mnt.data) {
+                audit_log_format(ab, " options=");
+                audit_log_untrustedstring(ab, aad(sa)->mnt.data);
+        }
+}
+
+/**
+ * audit_mount - handle the auditing of mount operations
+ * @profile: the profile being enforced  (NOT NULL)
+ * @op: operation being mediated (NOT NULL)
+ * @name: name of object being mediated (MAYBE NULL)
+ * @src_name: src_name of object being mediated (MAYBE_NULL)
+ * @type: type of filesystem (MAYBE_NULL)
+ * @trans: name of trans (MAYBE NULL)
+ * @flags: filesystem idependent mount flags
+ * @data: filesystem mount flags
+ * @request: permissions requested
+ * @perms: the permissions computed for the request (NOT NULL)
+ * @info: extra information message (MAYBE NULL)
+ * @error: 0 if operation allowed else failure error code
+ *
+ * Returns: %0 or error on failure
+ */
+static int audit_mount(struct aa_profile *profile, const char *op,
+                       const char *name, const char *src_name,
+                       const char *type, const char *trans,
+                       unsigned long flags, const void *data, u32 request,
+                       struct aa_perms *perms, const char *info, int error)
+{
+        int audit_type = AUDIT_APPARMOR_AUTO;
+        DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, op);
+
+        if (likely(!error)) {
+                u32 mask = perms->audit;
+
+                if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
+                        mask = 0xffff;
+
+                /* mask off perms that are not being force audited */
+                request &= mask;
+
+                if (likely(!request))
+                        return 0;
+                audit_type = AUDIT_APPARMOR_AUDIT;
+        } else {
+                /* only report permissions that were denied */
+                request = request & ~perms->allow;
+
+                if (request & perms->kill)
+                        audit_type = AUDIT_APPARMOR_KILL;
+
+                /* quiet known rejects, assumes quiet and kill do not overlap */
+                if ((request & perms->quiet) &&
+                    AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+                    AUDIT_MODE(profile) != AUDIT_ALL)
+                        request &= ~perms->quiet;
+
+                if (!request)
+                        return error;
+        }
+
+        aad(&sa)->name = name;
+        aad(&sa)->mnt.src_name = src_name;
+        aad(&sa)->mnt.type = type;
+        aad(&sa)->mnt.trans = trans;
+        aad(&sa)->mnt.flags = flags;
+        if (data && (perms->audit & AA_AUDIT_DATA))
+                aad(&sa)->mnt.data = data;
+        aad(&sa)->info = info;
+        aad(&sa)->error = error;
+
+        return aa_audit(audit_type, profile, &sa, audit_cb);
+}
+
+/**
+ * match_mnt_flags - Do an ordered match on mount flags
+ * @dfa: dfa to match against
+ * @state: state to start in
+ * @flags: mount flags to match against
+ *
+ * Mount flags are encoded as an ordered match. This is done instead of
+ * checking against a simple bitmask, to allow for logical operations
+ * on the flags.
+ *
+ * Returns: next state after flags match
+ */
+static unsigned int match_mnt_flags(struct aa_dfa *dfa, unsigned int state,
+                                    unsigned long flags)
+{
+        unsigned int i;
+
+        for (i = 0; i <= 31 ; ++i) {
+                if ((1 << i) & flags)
+                        state = aa_dfa_next(dfa, state, i + 1);
+        }
+
+        return state;
+}
+
+/**
+ * compute_mnt_perms - compute mount permission associated with @state
+ * @dfa: dfa to match against (NOT NULL)
+ * @state: state match finished in
+ *
+ * Returns: mount permissions
+ */
+static struct aa_perms compute_mnt_perms(struct aa_dfa *dfa,
+                                           unsigned int state)
+{
+        struct aa_perms perms;
+
+        perms.kill = 0;
+        perms.allow = dfa_user_allow(dfa, state);
+        perms.audit = dfa_user_audit(dfa, state);
+        perms.quiet = dfa_user_quiet(dfa, state);
+        perms.xindex = dfa_user_xindex(dfa, state);
+
+        return perms;
+}
+
+static const char * const mnt_info_table[] = {
+        "match succeeded",
+        "failed mntpnt match",
+        "failed srcname match",
+        "failed type match",
+        "failed flags match",
+        "failed data match"
+};
+
+/*
+ * Returns 0 on success else element that match failed in, this is the
+ * index into the mnt_info_table above
+ */
+static int do_match_mnt(struct aa_dfa *dfa, unsigned int start,
+                        const char *mntpnt, const char *devname,
+                        const char *type, unsigned long flags,
+                        void *data, bool binary, struct aa_perms *perms)
+{
+        unsigned int state;
+
+        AA_BUG(!dfa);
+        AA_BUG(!perms);
+
+        state = aa_dfa_match(dfa, start, mntpnt);
+        state = aa_dfa_null_transition(dfa, state);
+        if (!state)
+                return 1;
+
+        if (devname)
+                state = aa_dfa_match(dfa, state, devname);
+        state = aa_dfa_null_transition(dfa, state);
+        if (!state)
+                return 2;
+
+        if (type)
+                state = aa_dfa_match(dfa, state, type);
+        state = aa_dfa_null_transition(dfa, state);
+        if (!state)
+                return 3;
+
+        state = match_mnt_flags(dfa, state, flags);
+        if (!state)
+                return 4;
+        *perms = compute_mnt_perms(dfa, state);
+        if (perms->allow & AA_MAY_MOUNT)
+                return 0;
+
+        /* only match data if not binary and the DFA flags data is expected */
+        if (data && !binary && (perms->allow & AA_MNT_CONT_MATCH)) {
+                state = aa_dfa_null_transition(dfa, state);
+                if (!state)
+                        return 4;
+
+                state = aa_dfa_match(dfa, state, data);
+                if (!state)
+                        return 5;
+                *perms = compute_mnt_perms(dfa, state);
+                if (perms->allow & AA_MAY_MOUNT)
+                        return 0;
+        }
+
+        /* failed at end of flags match */
+        return 4;
+}
+
+
+static int path_flags(struct aa_profile *profile, const struct path *path)
+{
+        AA_BUG(!profile);
+        AA_BUG(!path);
+
+        return profile->path_flags |
+                (S_ISDIR(path->dentry->d_inode->i_mode) ? PATH_IS_DIR : 0);
+}
+
+/**
+ * match_mnt_path_str - handle path matching for mount
+ * @profile: the confining profile
+ * @mntpath: for the mntpnt (NOT NULL)
+ * @buffer: buffer to be used to lookup mntpath
+ * @devnme: string for the devname/src_name (MAY BE NULL OR ERRPTR)
+ * @type: string for the dev type (MAYBE NULL)
+ * @flags: mount flags to match
+ * @data: fs mount data (MAYBE NULL)
+ * @binary: whether @data is binary
+ * @devinfo: error str if (IS_ERR(@devname))
+ *
+ * Returns: 0 on success else error
+ */
+static int match_mnt_path_str(struct aa_profile *profile,
+                              const struct path *mntpath, char *buffer,
+                              const char *devname, const char *type,
+                              unsigned long flags, void *data, bool binary,
+                              const char *devinfo)
+{
+        struct aa_perms perms = { };
+        const char *mntpnt = NULL, *info = NULL;
+        int pos, error;
+
+        AA_BUG(!profile);
+        AA_BUG(!mntpath);
+        AA_BUG(!buffer);
+
+        error = aa_path_name(mntpath, path_flags(profile, mntpath), buffer,
+                             &mntpnt, &info, profile->disconnected);
+        if (error)
+                goto audit;
+        if (IS_ERR(devname)) {
+                error = PTR_ERR(devname);
+                devname = NULL;
+                info = devinfo;
+                goto audit;
+        }
+
+        error = -EACCES;
+        pos = do_match_mnt(profile->policy.dfa,
+                           profile->policy.start[AA_CLASS_MOUNT],
+                           mntpnt, devname, type, flags, data, binary, &perms);
+        if (pos) {
+                info = mnt_info_table[pos];
+                goto audit;
+        }
+        error = 0;
+
+audit:
+        return audit_mount(profile, OP_MOUNT, mntpnt, devname, type, NULL,
+                           flags, data, AA_MAY_MOUNT, &perms, info, error);
+}
+
+/**
+ * match_mnt - handle path matching for mount
+ * @profile: the confining profile
+ * @mntpath: for the mntpnt (NOT NULL)
+ * @buffer: buffer to be used to lookup mntpath
+ * @devpath: path devname/src_name (MAYBE NULL)
+ * @devbuffer: buffer to be used to lookup devname/src_name
+ * @type: string for the dev type (MAYBE NULL)
+ * @flags: mount flags to match
+ * @data: fs mount data (MAYBE NULL)
+ * @binary: whether @data is binary
+ *
+ * Returns: 0 on success else error
+ */
+static int match_mnt(struct aa_profile *profile, const struct path *path,
+                     char *buffer, struct path *devpath, char *devbuffer,
+                     const char *type, unsigned long flags, void *data,
+                     bool binary)
+{
+        const char *devname = NULL, *info = NULL;
+        int error = -EACCES;
+
+        AA_BUG(!profile);
+        AA_BUG(devpath && !devbuffer);
+
+        if (devpath) {
+                error = aa_path_name(devpath, path_flags(profile, devpath),
+                                     devbuffer, &devname, &info,
+                                     profile->disconnected);
+                if (error)
+                        devname = ERR_PTR(error);
+        }
+
+        return match_mnt_path_str(profile, path, buffer, devname, type, flags,
+                                  data, binary, info);
+}
+
+int aa_remount(struct aa_label *label, const struct path *path,
+               unsigned long flags, void *data)
+{
+        struct aa_profile *profile;
+        char *buffer = NULL;
+        bool binary;
+        int error;
+
+        AA_BUG(!label);
+        AA_BUG(!path);
+
+        binary = path->dentry->d_sb->s_type->fs_flags & FS_BINARY_MOUNTDATA;
+
+        get_buffers(buffer);
+        error = fn_for_each_confined(label, profile,
+                        match_mnt(profile, path, buffer, NULL, NULL, NULL,
+                                  flags, data, binary));
+        put_buffers(buffer);
+
+        return error;
+}
+
+int aa_bind_mount(struct aa_label *label, const struct path *path,
+                  const char *dev_name, unsigned long flags)
+{
+        struct aa_profile *profile;
+        char *buffer = NULL, *old_buffer = NULL;
+        struct path old_path;
+        int error;
+
+        AA_BUG(!label);
+        AA_BUG(!path);
+
+        if (!dev_name || !*dev_name)
+                return -EINVAL;
+
+        flags &= MS_REC | MS_BIND;
+
+        error = kern_path(dev_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
+        if (error)
+                return error;
+
+        get_buffers(buffer, old_buffer);
+        error = fn_for_each_confined(label, profile,
+                        match_mnt(profile, path, buffer, &old_path, old_buffer,
+                                  NULL, flags, NULL, false));
+        put_buffers(buffer, old_buffer);
+        path_put(&old_path);
+
+        return error;
+}
+
+int aa_mount_change_type(struct aa_label *label, const struct path *path,
+                         unsigned long flags)
+{
+        struct aa_profile *profile;
+        char *buffer = NULL;
+        int error;
+
+        AA_BUG(!label);
+        AA_BUG(!path);
+
+        /* These are the flags allowed by do_change_type() */
+        flags &= (MS_REC | MS_SILENT | MS_SHARED | MS_PRIVATE | MS_SLAVE |
+                  MS_UNBINDABLE);
+
+        get_buffers(buffer);
+        error = fn_for_each_confined(label, profile,
+                        match_mnt(profile, path, buffer, NULL, NULL, NULL,
+                                  flags, NULL, false));
+        put_buffers(buffer);
+
+        return error;
+}
+
+int aa_move_mount(struct aa_label *label, const struct path *path,
+                  const char *orig_name)
+{
+        struct aa_profile *profile;
+        char *buffer = NULL, *old_buffer = NULL;
+        struct path old_path;
+        int error;
+
+        AA_BUG(!label);
+        AA_BUG(!path);
+
+        if (!orig_name || !*orig_name)
+                return -EINVAL;
+
+        error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path);
+        if (error)
+                return error;
+
+        get_buffers(buffer, old_buffer);
+        error = fn_for_each_confined(label, profile,
+                        match_mnt(profile, path, buffer, &old_path, old_buffer,
+                                  NULL, MS_MOVE, NULL, false));
+        put_buffers(buffer, old_buffer);
+        path_put(&old_path);
+
+        return error;
+}
+
+int aa_new_mount(struct aa_label *label, const char *dev_name,
+                 const struct path *path, const char *type, unsigned long flags,
+                 void *data)
+{
+        struct aa_profile *profile;
+        char *buffer = NULL, *dev_buffer = NULL;
+        bool binary = true;
+        int error;
+        int requires_dev = 0;
+        struct path tmp_path, *dev_path = NULL;
+
+        AA_BUG(!label);
+        AA_BUG(!path);
+
+        if (type) {
+                struct file_system_type *fstype;
+
+                fstype = get_fs_type(type);
+                if (!fstype)
+                        return -ENODEV;
+                binary = fstype->fs_flags & FS_BINARY_MOUNTDATA;
+                requires_dev = fstype->fs_flags & FS_REQUIRES_DEV;
+                put_filesystem(fstype);
+
+                if (requires_dev) {
+                        if (!dev_name || !*dev_name)
+                                return -ENOENT;
+
+                        error = kern_path(dev_name, LOOKUP_FOLLOW, &tmp_path);
+                        if (error)
+                                return error;
+                        dev_path = &tmp_path;
+                }
+        }
+
+        get_buffers(buffer, dev_buffer);
+        if (dev_path) {
+                error = fn_for_each_confined(label, profile,
+                        match_mnt(profile, path, buffer, dev_path, dev_buffer,
+                                  type, flags, data, binary));
+        } else {
+                error = fn_for_each_confined(label, profile,
+                        match_mnt_path_str(profile, path, buffer, dev_name,
+                                           type, flags, data, binary, NULL));
+        }
+        put_buffers(buffer, dev_buffer);
+        if (dev_path)
+                path_put(dev_path);
+
+        return error;
+}
+
+static int profile_umount(struct aa_profile *profile, struct path *path,
+                          char *buffer)
+{
+        struct aa_perms perms = { };
+        const char *name = NULL, *info = NULL;
+        unsigned int state;
+        int error;
+
+        AA_BUG(!profile);
+        AA_BUG(!path);
+
+        error = aa_path_name(path, path_flags(profile, path), buffer, &name,
+                             &info, profile->disconnected);
+        if (error)
+                goto audit;
+
+        state = aa_dfa_match(profile->policy.dfa,
+                             profile->policy.start[AA_CLASS_MOUNT],
+                             name);
+        perms = compute_mnt_perms(profile->policy.dfa, state);
+        if (AA_MAY_UMOUNT & ~perms.allow)
+                error = -EACCES;
+
+audit:
+        return audit_mount(profile, OP_UMOUNT, name, NULL, NULL, NULL, 0, NULL,
+                           AA_MAY_UMOUNT, &perms, info, error);
+}
+
+int aa_umount(struct aa_label *label, struct vfsmount *mnt, int flags)
+{
+        struct aa_profile *profile;
+        char *buffer = NULL;
+        int error;
+        struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
+
+        AA_BUG(!label);
+        AA_BUG(!mnt);
+
+        get_buffers(buffer);
+        error = fn_for_each_confined(label, profile,
+                        profile_umount(profile, &path, buffer));
+        put_buffers(buffer);
+
+        return error;
+}
+
+/* helper fn for transition on pivotroot
+ *
+ * Returns: label for transition or ERR_PTR. Does not return NULL
+ */
+static struct aa_label *build_pivotroot(struct aa_profile *profile,
+                                        const struct path *new_path,
+                                        char *new_buffer,
+                                        const struct path *old_path,
+                                        char *old_buffer)
+{
+        const char *old_name, *new_name = NULL, *info = NULL;
+        const char *trans_name = NULL;
+        struct aa_perms perms = { };
+        unsigned int state;
+        int error;
+
+        AA_BUG(!profile);
+        AA_BUG(!new_path);
+        AA_BUG(!old_path);
+
+        if (profile_unconfined(profile))
+                return aa_get_newest_label(&profile->label);
+
+        error = aa_path_name(old_path, path_flags(profile, old_path),
+                             old_buffer, &old_name, &info,
+                             profile->disconnected);
+        if (error)
+                goto audit;
+        error = aa_path_name(new_path, path_flags(profile, new_path),
+                             new_buffer, &new_name, &info,
+                             profile->disconnected);
+        if (error)
+                goto audit;
+
+        error = -EACCES;
+        state = aa_dfa_match(profile->policy.dfa,
+                             profile->policy.start[AA_CLASS_MOUNT],
+                             new_name);
+        state = aa_dfa_null_transition(profile->policy.dfa, state);
+        state = aa_dfa_match(profile->policy.dfa, state, old_name);
+        perms = compute_mnt_perms(profile->policy.dfa, state);
+
+        if (AA_MAY_PIVOTROOT & perms.allow)
+                error = 0;
+
+audit:
+        error = audit_mount(profile, OP_PIVOTROOT, new_name, old_name,
+                            NULL, trans_name, 0, NULL, AA_MAY_PIVOTROOT,
+                            &perms, info, error);
+        if (error)
+                return ERR_PTR(error);
+
+        return aa_get_newest_label(&profile->label);
+}
+
+int aa_pivotroot(struct aa_label *label, const struct path *old_path,
+                 const struct path *new_path)
+{
+        struct aa_profile *profile;
+        struct aa_label *target = NULL;
+        char *old_buffer = NULL, *new_buffer = NULL, *info = NULL;
+        int error;
+
+        AA_BUG(!label);
+        AA_BUG(!old_path);
+        AA_BUG(!new_path);
+
+        get_buffers(old_buffer, new_buffer);
+        target = fn_label_build(label, profile, GFP_ATOMIC,
+                        build_pivotroot(profile, new_path, new_buffer,
+                                        old_path, old_buffer));
+        if (!target) {
+                info = "label build failed";
+                error = -ENOMEM;
+                goto fail;
+        } else if (!IS_ERR(target)) {
+                error = aa_replace_current_label(target);
+                if (error) {
+                        /* TODO: audit target */
+                        aa_put_label(target);
+                        goto out;
+                }
+        } else
+                /* already audited error */
+                error = PTR_ERR(target);
+out:
+        put_buffers(old_buffer, new_buffer);
+
+        return error;
+
+fail:
+        /* TODO: add back in auditing of new_name and old_name */
+        error = fn_for_each(label, profile,
+                        audit_mount(profile, OP_PIVOTROOT, NULL /*new_name */,
+                                    NULL /* old_name */,
+                                    NULL, NULL,
+                                    0, NULL, AA_MAY_PIVOTROOT, &nullperms, info,
+                                    error));
+        goto out;
+}
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
new file mode 100644
index 000000000000..33d54435f8d6
--- /dev/null
+++ b/security/apparmor/net.c
@@ -0,0 +1,184 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor network mediation
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2017 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/label.h"
+#include "include/net.h"
+#include "include/policy.h"
+
+#include "net_names.h"
+
+
+struct aa_sfs_entry aa_sfs_entry_network[] = {
+        AA_SFS_FILE_STRING("af_mask",   AA_SFS_AF_MASK),
+        { }
+};
+
+static const char * const net_mask_names[] = {
+        "unknown",
+        "send",
+        "receive",
+        "unknown",
+
+        "create",
+        "shutdown",
+        "connect",
+        "unknown",
+
+        "setattr",
+        "getattr",
+        "setcred",
+        "getcred",
+
+        "chmod",
+        "chown",
+        "chgrp",
+        "lock",
+
+        "mmap",
+        "mprot",
+        "unknown",
+        "unknown",
+
+        "accept",
+        "bind",
+        "listen",
+        "unknown",
+
+        "setopt",
+        "getopt",
+        "unknown",
+        "unknown",
+
+        "unknown",
+        "unknown",
+        "unknown",
+        "unknown",
+};
+
+
+/* audit callback for net specific fields */
+void audit_net_cb(struct audit_buffer *ab, void *va)
+{
+        struct common_audit_data *sa = va;
+
+        audit_log_format(ab, " family=");
+        if (address_family_names[sa->u.net->family])
+                audit_log_string(ab, address_family_names[sa->u.net->family]);
+        else
+                audit_log_format(ab, "\"unknown(%d)\"", sa->u.net->family);
+        audit_log_format(ab, " sock_type=");
+        if (sock_type_names[aad(sa)->net.type])
+                audit_log_string(ab, sock_type_names[aad(sa)->net.type]);
+        else
+                audit_log_format(ab, "\"unknown(%d)\"", aad(sa)->net.type);
+        audit_log_format(ab, " protocol=%d", aad(sa)->net.protocol);
+
+        if (aad(sa)->request & NET_PERMS_MASK) {
+                audit_log_format(ab, " requested_mask=");
+                aa_audit_perm_mask(ab, aad(sa)->request, NULL, 0,
+                                   net_mask_names, NET_PERMS_MASK);
+
+                if (aad(sa)->denied & NET_PERMS_MASK) {
+                        audit_log_format(ab, " denied_mask=");
+                        aa_audit_perm_mask(ab, aad(sa)->denied, NULL, 0,
+                                           net_mask_names, NET_PERMS_MASK);
+                }
+        }
+        if (aad(sa)->peer) {
+                audit_log_format(ab, " peer=");
+                aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
+                                FLAGS_NONE, GFP_ATOMIC);
+        }
+}
+
+
+/* Generic af perm */
+int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
+                       u32 request, u16 family, int type)
+{
+        struct aa_perms perms = { };
+
+        AA_BUG(family >= AF_MAX);
+        AA_BUG(type < 0 || type >= SOCK_MAX);
+
+        if (profile_unconfined(profile))
+                return 0;
+
+        perms.allow = (profile->net.allow[family] & (1 << type)) ?
+                ALL_PERMS_MASK : 0;
+        perms.audit = (profile->net.audit[family] & (1 << type)) ?
+                ALL_PERMS_MASK : 0;
+        perms.quiet = (profile->net.quiet[family] & (1 << type)) ?
+                ALL_PERMS_MASK : 0;
+        aa_apply_modes_to_perms(profile, &perms);
+
+        return aa_check_perms(profile, &perms, request, sa, audit_net_cb);
+}
+
+int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
+               int type, int protocol)
+{
+        struct aa_profile *profile;
+        DEFINE_AUDIT_NET(sa, op, NULL, family, type, protocol);
+
+        return fn_for_each_confined(label, profile,
+                        aa_profile_af_perm(profile, &sa, request, family,
+                                           type));
+}
+
+static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
+                            struct sock *sk)
+{
+        struct aa_profile *profile;
+        DEFINE_AUDIT_SK(sa, op, sk);
+
+        AA_BUG(!label);
+        AA_BUG(!sk);
+
+        if (unconfined(label))
+                return 0;
+
+        return fn_for_each_confined(label, profile,
+                        aa_profile_af_sk_perm(profile, &sa, request, sk));
+}
+
+int aa_sk_perm(const char *op, u32 request, struct sock *sk)
+{
+        struct aa_label *label;
+        int error;
+
+        AA_BUG(!sk);
+        AA_BUG(in_interrupt());
+
+        /* TODO: switch to begin_current_label ???? */
+        label = begin_current_label_crit_section();
+        error = aa_label_sk_perm(label, op, request, sk);
+        end_current_label_crit_section(label);
+
+        return error;
+}
+
+
+int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
+                      struct socket *sock)
+{
+        AA_BUG(!label);
+        AA_BUG(!sock);
+        AA_BUG(!sock->sk);
+
+        return aa_label_sk_perm(label, op, request, sock->sk);
+}
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 244ea4a4a8f0..4243b0c3f0e4 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -289,85 +289,6 @@ fail:
         return NULL;
 }
 
-/**
- * aa_new_null_profile - create or find a null-X learning profile
- * @parent: profile that caused this profile to be created (NOT NULL)
- * @hat: true if the null- learning profile is a hat
- * @base: name to base the null profile off of
- * @gfp: type of allocation
- *
- * Find/Create a null- complain mode profile used in learning mode.  The
- * name of the profile is unique and follows the format of parent//null-XXX.
- * where XXX is based on the @name or if that fails or is not supplied
- * a unique number
- *
- * null profiles are added to the profile list but the list does not
- * hold a count on them so that they are automatically released when
- * not in use.
- *
- * Returns: new refcounted profile else NULL on failure
- */
-struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
-                                       const char *base, gfp_t gfp)
-{
-        struct aa_profile *profile;
-        char *name;
-
-        AA_BUG(!parent);
-
-        if (base) {
-                name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
-                               gfp);
-                if (name) {
-                        sprintf(name, "%s//null-%s", parent->base.hname, base);
-                        goto name;
-                }
-                /* fall through to try shorter uniq */
-        }
-
-        name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);
-        if (!name)
-                return NULL;
-        sprintf(name, "%s//null-%x", parent->base.hname,
-                atomic_inc_return(&parent->ns->uniq_null));
-
-name:
-        /* lookup to see if this is a dup creation */
-        profile = aa_find_child(parent, basename(name));
-        if (profile)
-                goto out;
-
-        profile = aa_alloc_profile(name, NULL, gfp);
-        if (!profile)
-                goto fail;
-
-        profile->mode = APPARMOR_COMPLAIN;
-        profile->label.flags |= FLAG_NULL;
-        if (hat)
-                profile->label.flags |= FLAG_HAT;
-        profile->path_flags = parent->path_flags;
-
-        /* released on free_profile */
-        rcu_assign_pointer(profile->parent, aa_get_profile(parent));
-        profile->ns = aa_get_ns(parent->ns);
-        profile->file.dfa = aa_get_dfa(nulldfa);
-        profile->policy.dfa = aa_get_dfa(nulldfa);
-
-        mutex_lock(&profile->ns->lock);
-        __add_profile(&parent->base.profiles, profile);
-        mutex_unlock(&profile->ns->lock);
-
-        /* refcount released by caller */
-out:
-        kfree(name);
-
-        return profile;
-
-fail:
-        aa_free_profile(profile);
-        return NULL;
-}
-
 /* TODO: profile accounting - setup in remove */
 
 /**
@@ -559,6 +480,93 @@ struct aa_profile *aa_fqlookupn_profile(struct aa_label *base,
 }
 
 /**
+ * aa_new_null_profile - create or find a null-X learning profile
+ * @parent: profile that caused this profile to be created (NOT NULL)
+ * @hat: true if the null- learning profile is a hat
+ * @base: name to base the null profile off of
+ * @gfp: type of allocation
+ *
+ * Find/Create a null- complain mode profile used in learning mode.  The
+ * name of the profile is unique and follows the format of parent//null-XXX.
+ * where XXX is based on the @name or if that fails or is not supplied
+ * a unique number
+ *
+ * null profiles are added to the profile list but the list does not
+ * hold a count on them so that they are automatically released when
+ * not in use.
+ *
+ * Returns: new refcounted profile else NULL on failure
+ */
+struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
+                                       const char *base, gfp_t gfp)
+{
+        struct aa_profile *p, *profile;
+        const char *bname;
+        char *name;
+
+        AA_BUG(!parent);
+
+        if (base) {
+                name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
+                               gfp);
+                if (name) {
+                        sprintf(name, "%s//null-%s", parent->base.hname, base);
+                        goto name;
+                }
+                /* fall through to try shorter uniq */
+        }
+
+        name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);
+        if (!name)
+                return NULL;
+        sprintf(name, "%s//null-%x", parent->base.hname,
+                atomic_inc_return(&parent->ns->uniq_null));
+
+name:
+        /* lookup to see if this is a dup creation */
+        bname = basename(name);
+        profile = aa_find_child(parent, bname);
+        if (profile)
+                goto out;
+
+        profile = aa_alloc_profile(name, NULL, gfp);
+        if (!profile)
+                goto fail;
+
+        profile->mode = APPARMOR_COMPLAIN;
+        profile->label.flags |= FLAG_NULL;
+        if (hat)
+                profile->label.flags |= FLAG_HAT;
+        profile->path_flags = parent->path_flags;
+
+        /* released on free_profile */
+        rcu_assign_pointer(profile->parent, aa_get_profile(parent));
+        profile->ns = aa_get_ns(parent->ns);
+        profile->file.dfa = aa_get_dfa(nulldfa);
+        profile->policy.dfa = aa_get_dfa(nulldfa);
+
+        mutex_lock(&profile->ns->lock);
+        p = __find_child(&parent->base.profiles, bname);
+        if (p) {
+                aa_free_profile(profile);
+                profile = aa_get_profile(p);
+        } else {
+                __add_profile(&parent->base.profiles, profile);
+        }
+        mutex_unlock(&profile->ns->lock);
+
+        /* refcount released by caller */
+out:
+        kfree(name);
+
+        return profile;
+
+fail:
+        aa_free_profile(profile);
+        return NULL;
+}
+
+/**
  * replacement_allowed - test to see if replacement is allowed
  * @profile: profile to test if it can be replaced  (MAYBE NULL)
  * @noreplace: true if replacement shouldn't be allowed but addition is okay
diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index 351d3bab3a3d..62a3589c62ab 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -112,6 +112,8 @@ static struct aa_ns *alloc_ns(const char *prefix, const char *name)
         ns->unconfined->label.flags |= FLAG_IX_ON_NAME_ERROR |
                 FLAG_IMMUTIBLE | FLAG_NS_COUNT | FLAG_UNCONFINED;
         ns->unconfined->mode = APPARMOR_UNCONFINED;
+        ns->unconfined->file.dfa = aa_get_dfa(nulldfa);
+        ns->unconfined->policy.dfa = aa_get_dfa(nulldfa);
 
         /* ns and ns->unconfined share ns->unconfined refcount */
         ns->unconfined->ns = ns;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index c600f4dd1783..5a2aec358322 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -85,9 +85,9 @@ static void audit_cb(struct audit_buffer *ab, void *va)
                 audit_log_format(ab, " ns=");
                 audit_log_untrustedstring(ab, aad(sa)->iface.ns);
         }
-        if (aad(sa)->iface.name) {
+        if (aad(sa)->name) {
                 audit_log_format(ab, " name=");
-                audit_log_untrustedstring(ab, aad(sa)->iface.name);
+                audit_log_untrustedstring(ab, aad(sa)->name);
         }
         if (aad(sa)->iface.pos)
                 audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
@@ -114,9 +114,9 @@ static int audit_iface(struct aa_profile *new, const char *ns_name,
                 aad(&sa)->iface.pos = e->pos - e->start;
         aad(&sa)->iface.ns = ns_name;
         if (new)
-                aad(&sa)->iface.name = new->base.hname;
+                aad(&sa)->name = new->base.hname;
         else
-                aad(&sa)->iface.name = name;
+                aad(&sa)->name = name;
         aad(&sa)->info = info;
         aad(&sa)->error = error;
 
@@ -275,6 +275,19 @@ fail:
         return 0;
 }
 
+static bool unpack_u16(struct aa_ext *e, u16 *data, const char *name)
+{
+        if (unpack_nameX(e, AA_U16, name)) {
+                if (!inbounds(e, sizeof(u16)))
+                        return 0;
+                if (data)
+                        *data = le16_to_cpu(get_unaligned((__le16 *) e->pos));
+                e->pos += sizeof(u16);
+                return 1;
+        }
+        return 0;
+}
+
 static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 {
         if (unpack_nameX(e, AA_U32, name)) {
@@ -448,7 +461,7 @@ fail:
  */
 static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
 {
-        void *pos = e->pos;
+        void *saved_pos = e->pos;
 
         /* exec table is optional */
         if (unpack_nameX(e, AA_STRUCT, "xtable")) {
@@ -511,7 +524,7 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
 
 fail:
         aa_free_domain_entries(&profile->file.trans);
-        e->pos = pos;
+        e->pos = saved_pos;
         return 0;
 }
 
@@ -583,7 +596,8 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 {
         struct aa_profile *profile = NULL;
         const char *tmpname, *tmpns = NULL, *name = NULL;
-        size_t ns_len;
+        const char *info = "failed to unpack profile";
+        size_t size = 0, ns_len;
         struct rhashtable_params params = { 0 };
         char *key = NULL;
         struct aa_data *data;
@@ -604,8 +618,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
         if (tmpns) {
                 *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
-                if (!*ns_name)
+                if (!*ns_name) {
+                        info = "out of memory";
                         goto fail;
+                }
                 name = tmpname;
         }
 
@@ -624,12 +640,15 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         if (IS_ERR(profile->xmatch)) {
                 error = PTR_ERR(profile->xmatch);
                 profile->xmatch = NULL;
+                info = "bad xmatch";
                 goto fail;
         }
         /* xmatch_len is not optional if xmatch is set */
         if (profile->xmatch) {
-                if (!unpack_u32(e, &tmp, NULL))
+                if (!unpack_u32(e, &tmp, NULL)) {
+                        info = "missing xmatch len";
                         goto fail;
+                }
                 profile->xmatch_len = tmp;
         }
 
@@ -637,8 +656,11 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         (void) unpack_str(e, &profile->disconnected, "disconnected");
 
         /* per profile debug flags (complain, audit) */
-        if (!unpack_nameX(e, AA_STRUCT, "flags"))
+        if (!unpack_nameX(e, AA_STRUCT, "flags")) {
+                info = "profile missing flags";
                 goto fail;
+        }
+        info = "failed to unpack profile flags";
         if (!unpack_u32(e, &tmp, NULL))
                 goto fail;
         if (tmp & PACKED_FLAG_HAT)
@@ -667,6 +689,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                 /* set a default value if path_flags field is not present */
                 profile->path_flags = PATH_MEDIATE_DELETED;
 
+        info = "failed to unpack profile capabilities";
         if (!unpack_u32(e, &(profile->caps.allow.cap[0]), NULL))
                 goto fail;
         if (!unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
@@ -676,6 +699,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         if (!unpack_u32(e, &tmpcap.cap[0], NULL))
                 goto fail;
 
+        info = "failed to unpack upper profile capabilities";
         if (unpack_nameX(e, AA_STRUCT, "caps64")) {
                 /* optional upper half of 64 bit caps */
                 if (!unpack_u32(e, &(profile->caps.allow.cap[1]), NULL))
@@ -690,6 +714,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                         goto fail;
         }
 
+        info = "failed to unpack extended profile capabilities";
         if (unpack_nameX(e, AA_STRUCT, "capsx")) {
                 /* optional extended caps mediation mask */
                 if (!unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
@@ -700,11 +725,46 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                         goto fail;
         }
 
-        if (!unpack_rlimits(e, profile))
+        if (!unpack_rlimits(e, profile)) {
+                info = "failed to unpack profile rlimits";
                 goto fail;
+        }
+
+        size = unpack_array(e, "net_allowed_af");
+        if (size) {
+
+                for (i = 0; i < size; i++) {
+                        /* discard extraneous rules that this kernel will
+                         * never request
+                         */
+                        if (i >= AF_MAX) {
+                                u16 tmp;
+
+                                if (!unpack_u16(e, &tmp, NULL) ||
+                                    !unpack_u16(e, &tmp, NULL) ||
+                                    !unpack_u16(e, &tmp, NULL))
+                                        goto fail;
+                                continue;
+                        }
+                        if (!unpack_u16(e, &profile->net.allow[i], NULL))
+                                goto fail;
+                        if (!unpack_u16(e, &profile->net.audit[i], NULL))
+                                goto fail;
+                        if (!unpack_u16(e, &profile->net.quiet[i], NULL))
+                                goto fail;
+                }
+                if (!unpack_nameX(e, AA_ARRAYEND, NULL))
+                        goto fail;
+        }
+        if (VERSION_LT(e->version, v7)) {
+                /* pre v7 policy always allowed these */
+                profile->net.allow[AF_UNIX] = 0xffff;
+                profile->net.allow[AF_NETLINK] = 0xffff;
+        }
 
         if (unpack_nameX(e, AA_STRUCT, "policydb")) {
                 /* generic policy dfa - optional and may be NULL */
+                info = "failed to unpack policydb";
                 profile->policy.dfa = unpack_dfa(e);
                 if (IS_ERR(profile->policy.dfa)) {
                         error = PTR_ERR(profile->policy.dfa);
@@ -734,6 +794,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         if (IS_ERR(profile->file.dfa)) {
                 error = PTR_ERR(profile->file.dfa);
                 profile->file.dfa = NULL;
+                info = "failed to unpack profile file rules";
                 goto fail;
         } else if (profile->file.dfa) {
                 if (!unpack_u32(e, &profile->file.start, "dfa_start"))
@@ -746,10 +807,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
         } else
                 profile->file.dfa = aa_get_dfa(nulldfa);
 
-        if (!unpack_trans_table(e, profile))
+        if (!unpack_trans_table(e, profile)) {
+                info = "failed to unpack profile transition table";
                 goto fail;
+        }
 
         if (unpack_nameX(e, AA_STRUCT, "data")) {
+                info = "out of memory";
                 profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
                 if (!profile->data)
                         goto fail;
@@ -761,8 +825,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                 params.hashfn = strhash;
                 params.obj_cmpfn = datacmp;
 
-                if (rhashtable_init(profile->data, &params))
+                if (rhashtable_init(profile->data, &params)) {
+                        info = "failed to init key, value hash table";
                         goto fail;
+                }
 
                 while (unpack_strdup(e, &key, NULL)) {
                         data = kzalloc(sizeof(*data), GFP_KERNEL);
@@ -784,12 +850,16 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                                                profile->data->p);
                 }
 
-                if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+                if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
+                        info = "failed to unpack end of key, value data table";
                         goto fail;
+                }
         }
 
-        if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+        if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
+                info = "failed to unpack end of profile";
                 goto fail;
+        }
 
         return profile;
 
@@ -798,8 +868,7 @@ fail:
                 name = NULL;
         else if (!name)
                 name = "unknown";
-        audit_iface(profile, NULL, name, "failed to unpack profile", e,
-                    error);
+        audit_iface(profile, NULL, name, info, e, error);
         aa_free_profile(profile);
 
         return ERR_PTR(error);
@@ -832,7 +901,7 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
          * if not specified use previous version
          * Mask off everything that is not kernel abi version
          */
-        if (VERSION_LT(e->version, v5) && VERSION_GT(e->version, v7)) {
+        if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v7)) {
                 audit_iface(NULL, NULL, NULL, "unsupported interface version",
                             e, error);
                 return error;
diff --git a/security/commoncap.c b/security/commoncap.c
index 6bf72b175b49..c25e0d27537f 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -294,10 +294,10 @@ int cap_capset(struct cred *new,
  *
  * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
  * affects the security markings on that inode, and if it is, should
- * inode_killpriv() be invoked or the change rejected?
+ * inode_killpriv() be invoked or the change rejected.
  *
- * Returns 0 if granted; +ve if granted, but inode_killpriv() is required; and
- * -ve to deny the change.
+ * Returns 1 if security.capability has a value, meaning inode_killpriv()
+ * is required, 0 otherwise, meaning inode_killpriv() is not required.
  */
 int cap_inode_need_killpriv(struct dentry *dentry)
 {
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index a7a23b5541f8..91eafada3164 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -45,10 +45,8 @@ config BIG_KEYS
         bool "Large payload keys"
         depends on KEYS
         depends on TMPFS
-        depends on (CRYPTO_ANSI_CPRNG = y || CRYPTO_DRBG = y)
         select CRYPTO_AES
-        select CRYPTO_ECB
-        select CRYPTO_RNG
+        select CRYPTO_GCM
         help
           This option provides support for holding large keys within the kernel
           (for example Kerberos ticket caches).  The data may be stored out to
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 6acb00f6f22c..e607830b6154 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -1,5 +1,6 @@
 /* Large capacity key type
  *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  *
@@ -16,10 +17,10 @@
 #include <linux/shmem_fs.h>
 #include <linux/err.h>
 #include <linux/scatterlist.h>
+#include <linux/random.h>
 #include <keys/user-type.h>
 #include <keys/big_key-type.h>
-#include <crypto/rng.h>
-#include <crypto/skcipher.h>
+#include <crypto/aead.h>
 
 /*
  * Layout of key payload words.
@@ -49,7 +50,12 @@ enum big_key_op {
 /*
  * Key size for big_key data encryption
  */
-#define ENC_KEY_SIZE    16
+#define ENC_KEY_SIZE 32
+
+/*
+ * Authentication tag length
+ */
+#define ENC_AUTHTAG_SIZE 16
 
 /*
  * big_key defined keys take an arbitrary string as the description and an
@@ -64,57 +70,62 @@ struct key_type key_type_big_key = {
         .destroy                = big_key_destroy,
         .describe               = big_key_describe,
         .read                   = big_key_read,
+        /* no ->update(); don't add it without changing big_key_crypt() nonce */
 };
 
 /*
- * Crypto names for big_key data encryption
+ * Crypto names for big_key data authenticated encryption
  */
-static const char big_key_rng_name[] = "stdrng";
-static const char big_key_alg_name[] = "ecb(aes)";
+static const char big_key_alg_name[] = "gcm(aes)";
 
 /*
- * Crypto algorithms for big_key data encryption
+ * Crypto algorithms for big_key data authenticated encryption
  */
-static struct crypto_rng *big_key_rng;
-static struct crypto_skcipher *big_key_skcipher;
+static struct crypto_aead *big_key_aead;
 
 /*
- * Generate random key to encrypt big_key data
+ * Since changing the key affects the entire object, we need a mutex.
  */
-static inline int big_key_gen_enckey(u8 *key)
-{
-        return crypto_rng_get_bytes(big_key_rng, key, ENC_KEY_SIZE);
-}
+static DEFINE_MUTEX(big_key_aead_lock);
 
 /*
  * Encrypt/decrypt big_key data
  */
 static int big_key_crypt(enum big_key_op op, u8 *data, size_t datalen, u8 *key)
 {
-        int ret = -EINVAL;
+        int ret;
         struct scatterlist sgio;
-        SKCIPHER_REQUEST_ON_STACK(req, big_key_skcipher);
-
-        if (crypto_skcipher_setkey(big_key_skcipher, key, ENC_KEY_SIZE)) {
+        struct aead_request *aead_req;
+        /* We always use a zero nonce. The reason we can get away with this is
+         * because we're using a different randomly generated key for every
+         * different encryption. Notably, too, key_type_big_key doesn't define
+         * an .update function, so there's no chance we'll wind up reusing the
+         * key to encrypt updated data. Simply put: one key, one encryption.
+         */
+        u8 zero_nonce[crypto_aead_ivsize(big_key_aead)];
+
+        aead_req = aead_request_alloc(big_key_aead, GFP_KERNEL);
+        if (!aead_req)
+                return -ENOMEM;
+
+        memset(zero_nonce, 0, sizeof(zero_nonce));
+        sg_init_one(&sgio, data, datalen + (op == BIG_KEY_ENC ? ENC_AUTHTAG_SIZE : 0));
+        aead_request_set_crypt(aead_req, &sgio, &sgio, datalen, zero_nonce);
+        aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
+        aead_request_set_ad(aead_req, 0);
+
+        mutex_lock(&big_key_aead_lock);
+        if (crypto_aead_setkey(big_key_aead, key, ENC_KEY_SIZE)) {
                 ret = -EAGAIN;
                 goto error;
         }
-
-        skcipher_request_set_tfm(req, big_key_skcipher);
-        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
-                                      NULL, NULL);
-
-        sg_init_one(&sgio, data, datalen);
-        skcipher_request_set_crypt(req, &sgio, &sgio, datalen, NULL);
-
         if (op == BIG_KEY_ENC)
-                ret = crypto_skcipher_encrypt(req);
+                ret = crypto_aead_encrypt(aead_req);
         else
-                ret = crypto_skcipher_decrypt(req);
-
-        skcipher_request_zero(req);
-
+                ret = crypto_aead_decrypt(aead_req);
 error:
+        mutex_unlock(&big_key_aead_lock);
+        aead_request_free(aead_req);
         return ret;
 }
 
@@ -146,16 +157,13 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                  *
                  * File content is stored encrypted with randomly generated key.
                  */
-                size_t enclen = ALIGN(datalen, crypto_skcipher_blocksize(big_key_skcipher));
+                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                 loff_t pos = 0;
 
-                /* prepare aligned data to encrypt */
                 data = kmalloc(enclen, GFP_KERNEL);
                 if (!data)
                         return -ENOMEM;
-
                 memcpy(data, prep->data, datalen);
-                memset(data + datalen, 0x00, enclen - datalen);
 
                 /* generate random key */
                 enckey = kmalloc(ENC_KEY_SIZE, GFP_KERNEL);
@@ -163,13 +171,12 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                         ret = -ENOMEM;
                         goto error;
                 }
-
-                ret = big_key_gen_enckey(enckey);
-                if (ret)
+                ret = get_random_bytes_wait(enckey, ENC_KEY_SIZE);
+                if (unlikely(ret))
                         goto err_enckey;
 
                 /* encrypt aligned data */
-                ret = big_key_crypt(BIG_KEY_ENC, data, enclen, enckey);
+                ret = big_key_crypt(BIG_KEY_ENC, data, datalen, enckey);
                 if (ret)
                         goto err_enckey;
 
@@ -195,7 +202,7 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                 *path = file->f_path;
                 path_get(path);
                 fput(file);
-                kfree(data);
+                kzfree(data);
         } else {
                 /* Just store the data in a buffer */
                 void *data = kmalloc(datalen, GFP_KERNEL);
@@ -211,9 +218,9 @@ int big_key_preparse(struct key_preparsed_payload *prep)
 err_fput:
         fput(file);
 err_enckey:
-        kfree(enckey);
+        kzfree(enckey);
 error:
-        kfree(data);
+        kzfree(data);
         return ret;
 }
 
@@ -227,7 +234,7 @@ void big_key_free_preparse(struct key_preparsed_payload *prep)
 
                 path_put(path);
         }
-        kfree(prep->payload.data[big_key_data]);
+        kzfree(prep->payload.data[big_key_data]);
 }
 
 /*
@@ -259,7 +266,7 @@ void big_key_destroy(struct key *key)
                 path->mnt = NULL;
                 path->dentry = NULL;
         }
-        kfree(key->payload.data[big_key_data]);
+        kzfree(key->payload.data[big_key_data]);
         key->payload.data[big_key_data] = NULL;
 }
 
@@ -295,7 +302,7 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
                 struct file *file;
                 u8 *data;
                 u8 *enckey = (u8 *)key->payload.data[big_key_data];
-                size_t enclen = ALIGN(datalen, crypto_skcipher_blocksize(big_key_skcipher));
+                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                 loff_t pos = 0;
 
                 data = kmalloc(enclen, GFP_KERNEL);
@@ -328,7 +335,7 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
 err_fput:
                 fput(file);
 error:
-                kfree(data);
+                kzfree(data);
         } else {
                 ret = datalen;
                 if (copy_to_user(buffer, key->payload.data[big_key_data],
@@ -344,47 +351,31 @@ error:
  */
 static int __init big_key_init(void)
 {
-        struct crypto_skcipher *cipher;
-        struct crypto_rng *rng;
         int ret;
 
-        rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
-        if (IS_ERR(rng)) {
-                pr_err("Can't alloc rng: %ld\n", PTR_ERR(rng));
-                return PTR_ERR(rng);
-        }
-
-        big_key_rng = rng;
-
-        /* seed RNG */
-        ret = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
-        if (ret) {
-                pr_err("Can't reset rng: %d\n", ret);
-                goto error_rng;
-        }
-
         /* init block cipher */
-        cipher = crypto_alloc_skcipher(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(cipher)) {
-                ret = PTR_ERR(cipher);
+        big_key_aead = crypto_alloc_aead(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(big_key_aead)) {
+                ret = PTR_ERR(big_key_aead);
                 pr_err("Can't alloc crypto: %d\n", ret);
-                goto error_rng;
+                return ret;
+        }
+        ret = crypto_aead_setauthsize(big_key_aead, ENC_AUTHTAG_SIZE);
+        if (ret < 0) {
+                pr_err("Can't set crypto auth tag len: %d\n", ret);
+                goto free_aead;
         }
-
-        big_key_skcipher = cipher;
 
         ret = register_key_type(&key_type_big_key);
         if (ret < 0) {
                 pr_err("Can't register type: %d\n", ret);
-                goto error_cipher;
+                goto free_aead;
         }
 
         return 0;
 
-error_cipher:
-        crypto_free_skcipher(big_key_skcipher);
-error_rng:
-        crypto_free_rng(big_key_rng);
+free_aead:
+        crypto_free_aead(big_key_aead);
         return ret;
 }
 
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 1c02c6547038..503adbae7b0d 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -141,7 +141,7 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 extern key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx);
 extern key_ref_t search_process_keyrings(struct keyring_search_context *ctx);
 
-extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
+extern struct key *find_keyring_by_name(const char *name, bool uid_keyring);
 
 extern int install_user_keyrings(void);
 extern int install_thread_keyring_to_cred(struct cred *);
diff --git a/security/keys/key.c b/security/keys/key.c
index 83da68d98b40..eb914a838840 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -54,10 +54,10 @@ void __key_check(const struct key *key)
 struct key_user *key_user_lookup(kuid_t uid)
 {
         struct key_user *candidate = NULL, *user;
-        struct rb_node *parent = NULL;
-        struct rb_node **p;
+        struct rb_node *parent, **p;
 
 try_again:
+        parent = NULL;
         p = &key_user_tree.rb_node;
         spin_lock(&key_user_lock);
 
@@ -302,6 +302,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
         if (flags & KEY_ALLOC_BUILT_IN)
                 key->flags |= 1 << KEY_FLAG_BUILTIN;
+        if (flags & KEY_ALLOC_UID_KEYRING)
+                key->flags |= 1 << KEY_FLAG_UID_KEYRING;
 
 #ifdef KEY_DEBUGGING
         key->magic = KEY_DEBUG_MAGIC;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index ab0b337c84b4..365ff85d7e27 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -766,12 +766,17 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 
         key = key_ref_to_ptr(key_ref);
 
+        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+                ret = -ENOKEY;
+                goto error2;
+        }
+
         /* see if we can read it directly */
         ret = key_permission(key_ref, KEY_NEED_READ);
         if (ret == 0)
                 goto can_read_key;
         if (ret != -EACCES)
-                goto error;
+                goto error2;
 
         /* we can't; see if it's searchable from this process's keyrings
          * - we automatically take account of the fact that it may be
@@ -1406,11 +1411,9 @@ long keyctl_assume_authority(key_serial_t id)
         }
 
         ret = keyctl_change_reqkey_auth(authkey);
-        if (ret < 0)
-                goto error;
+        if (ret == 0)
+                ret = authkey->serial;
         key_put(authkey);
-
-        ret = authkey->serial;
 error:
         return ret;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index de81793f9920..4fa82a8a9c0e 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -423,7 +423,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
 }
 
 struct keyring_read_iterator_context {
-        size_t                  qty;
+        size_t                  buflen;
         size_t                  count;
         key_serial_t __user     *buffer;
 };
@@ -435,9 +435,9 @@ static int keyring_read_iterator(const void *object, void *data)
         int ret;
 
         kenter("{%s,%d},,{%zu/%zu}",
-               key->type->name, key->serial, ctx->count, ctx->qty);
+               key->type->name, key->serial, ctx->count, ctx->buflen);
 
-        if (ctx->count >= ctx->qty)
+        if (ctx->count >= ctx->buflen)
                 return 1;
 
         ret = put_user(key->serial, ctx->buffer);
@@ -472,16 +472,12 @@ static long keyring_read(const struct key *keyring,
                 return 0;
 
         /* Calculate how much data we could return */
-        ctx.qty = nr_keys * sizeof(key_serial_t);
-
         if (!buffer || !buflen)
-                return ctx.qty;
-
-        if (buflen > ctx.qty)
-                ctx.qty = buflen;
+                return nr_keys * sizeof(key_serial_t);
 
         /* Copy the IDs of the subscribed keys into the buffer */
         ctx.buffer = (key_serial_t __user *)buffer;
+        ctx.buflen = buflen;
         ctx.count = 0;
         ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
         if (ret < 0) {
@@ -1101,15 +1097,15 @@ found:
 /*
  * Find a keyring with the specified name.
  *
- * All named keyrings in the current user namespace are searched, provided they
- * grant Search permission directly to the caller (unless this check is
- * skipped).  Keyrings whose usage points have reached zero or who have been
- * revoked are skipped.
+ * Only keyrings that have nonzero refcount, are not revoked, and are owned by a
+ * user in the current user namespace are considered.  If @uid_keyring is %true,
+ * the keyring additionally must have been allocated as a user or user session
+ * keyring; otherwise, it must grant Search permission directly to the caller.
  *
  * Returns a pointer to the keyring with the keyring's refcount having being
  * incremented on success.  -ENOKEY is returned if a key could not be found.
  */
-struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
+struct key *find_keyring_by_name(const char *name, bool uid_keyring)
 {
         struct key *keyring;
         int bucket;
@@ -1137,10 +1133,15 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                         if (strcmp(keyring->description, name) != 0)
                                 continue;
 
-                        if (!skip_perm_check &&
-                            key_permission(make_key_ref(keyring, 0),
-                                           KEY_NEED_SEARCH) < 0)
-                                continue;
+                        if (uid_keyring) {
+                                if (!test_bit(KEY_FLAG_UID_KEYRING,
+                                              &keyring->flags))
+                                        continue;
+                        } else {
+                                if (key_permission(make_key_ref(keyring, 0),
+                                                   KEY_NEED_SEARCH) < 0)
+                                        continue;
+                        }
 
                         /* we've got a match but we might end up racing with
                          * key_cleanup() if the keyring is currently 'dead'
diff --git a/security/keys/proc.c b/security/keys/proc.c
index bf08d02b6646..de834309d100 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
         struct keyring_search_context ctx = {
                 .index_key.type         = key->type,
                 .index_key.description  = key->description,
-                .cred                   = current_cred(),
+                .cred                   = m->file->f_cred,
                 .match_data.cmp         = lookup_user_key_possessed,
                 .match_data.raw_data    = key,
                 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
                 }
         }
 
-        /* check whether the current task is allowed to view the key (assuming
-         * non-possession)
-         * - the caller holds a spinlock, and thus the RCU read lock, making our
-         *   access to __current_cred() safe
-         */
+        /* check whether the current task is allowed to view the key */
         rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
         if (rc < 0)
                 return 0;
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 86bced9fdbdf..293d3598153b 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -77,7 +77,8 @@ int install_user_keyrings(void)
                 if (IS_ERR(uid_keyring)) {
                         uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID,
                                                     cred, user_keyring_perm,
-                                                    KEY_ALLOC_IN_QUOTA,
+                                                    KEY_ALLOC_UID_KEYRING |
+                                                        KEY_ALLOC_IN_QUOTA,
                                                     NULL, NULL);
                         if (IS_ERR(uid_keyring)) {
                                 ret = PTR_ERR(uid_keyring);
@@ -94,7 +95,8 @@ int install_user_keyrings(void)
                         session_keyring =
                                 keyring_alloc(buf, user->uid, INVALID_GID,
                                               cred, user_keyring_perm,
-                                              KEY_ALLOC_IN_QUOTA,
+                                              KEY_ALLOC_UID_KEYRING |
+                                                  KEY_ALLOC_IN_QUOTA,
                                               NULL, NULL);
                         if (IS_ERR(session_keyring)) {
                                 ret = PTR_ERR(session_keyring);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index afe9d22ab361..6ebf1af8fce9 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -120,6 +120,18 @@ static void request_key_auth_revoke(struct key *key)
         }
 }
 
+static void free_request_key_auth(struct request_key_auth *rka)
+{
+        if (!rka)
+                return;
+        key_put(rka->target_key);
+        key_put(rka->dest_keyring);
+        if (rka->cred)
+                put_cred(rka->cred);
+        kfree(rka->callout_info);
+        kfree(rka);
+}
+
 /*
  * Destroy an instantiation authorisation token key.
  */
@@ -129,15 +141,7 @@ static void request_key_auth_destroy(struct key *key)
 
         kenter("{%d}", key->serial);
 
-        if (rka->cred) {
-                put_cred(rka->cred);
-                rka->cred = NULL;
-        }
-
-        key_put(rka->target_key);
-        key_put(rka->dest_keyring);
-        kfree(rka->callout_info);
-        kfree(rka);
+        free_request_key_auth(rka);
 }
 
 /*
@@ -151,22 +155,18 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
         const struct cred *cred = current->cred;
         struct key *authkey = NULL;
         char desc[20];
-        int ret;
+        int ret = -ENOMEM;
 
         kenter("%d,", target->serial);
 
         /* allocate a auth record */
-        rka = kmalloc(sizeof(*rka), GFP_KERNEL);
-        if (!rka) {
-                kleave(" = -ENOMEM");
-                return ERR_PTR(-ENOMEM);
-        }
-        rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
-        if (!rka->callout_info) {
-                kleave(" = -ENOMEM");
-                kfree(rka);
-                return ERR_PTR(-ENOMEM);
-        }
+        rka = kzalloc(sizeof(*rka), GFP_KERNEL);
+        if (!rka)
+                goto error;
+        rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
+        if (!rka->callout_info)
+                goto error_free_rka;
+        rka->callout_len = callout_len;
 
         /* see if the calling process is already servicing the key request of
          * another process */
@@ -176,8 +176,12 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
 
                 /* if the auth key has been revoked, then the key we're
                  * servicing is already instantiated */
-                if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
-                        goto auth_key_revoked;
+                if (test_bit(KEY_FLAG_REVOKED,
+                             &cred->request_key_auth->flags)) {
+                        up_read(&cred->request_key_auth->sem);
+                        ret = -EKEYREVOKED;
+                        goto error_free_rka;
+                }
 
                 irka = cred->request_key_auth->payload.data[0];
                 rka->cred = get_cred(irka->cred);
@@ -193,8 +197,6 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
 
         rka->target_key = key_get(target);
         rka->dest_keyring = key_get(dest_keyring);
-        memcpy(rka->callout_info, callout_info, callout_len);
-        rka->callout_len = callout_len;
 
         /* allocate the auth key */
         sprintf(desc, "%x", target->serial);
@@ -205,32 +207,22 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                             KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
         if (IS_ERR(authkey)) {
                 ret = PTR_ERR(authkey);
-                goto error_alloc;
+                goto error_free_rka;
         }
 
         /* construct the auth key */
         ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
         if (ret < 0)
-                goto error_inst;
+                goto error_put_authkey;
 
         kleave(" = {%d,%d}", authkey->serial, refcount_read(&authkey->usage));
         return authkey;
 
-auth_key_revoked:
-        up_read(&cred->request_key_auth->sem);
-        kfree(rka->callout_info);
-        kfree(rka);
-        kleave("= -EKEYREVOKED");
-        return ERR_PTR(-EKEYREVOKED);
-
-error_inst:
-        key_revoke(authkey);
+error_put_authkey:
         key_put(authkey);
-error_alloc:
-        key_put(rka->target_key);
-        key_put(rka->dest_keyring);
-        kfree(rka->callout_info);
-        kfree(rka);
+error_free_rka:
+        free_request_key_auth(rka);
+error:
         kleave("= %d", ret);
         return ERR_PTR(ret);
 }
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 319add31b4a4..286171a16ed2 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1473,7 +1473,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
  * @inode: the object
  * @name: attribute name
  * @buffer: where to put the result
- * @alloc: unused
+ * @alloc: duplicate memory
  *
  * Returns the size of the attribute or an error code
  */
@@ -1486,43 +1486,38 @@ static int smack_inode_getsecurity(struct inode *inode,
         struct super_block *sbp;
         struct inode *ip = (struct inode *)inode;
         struct smack_known *isp;
-        int ilen;
-        int rc = 0;
 
-        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
+        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0)
                 isp = smk_of_inode(inode);
-                ilen = strlen(isp->smk_known);
-                *buffer = isp->smk_known;
-                return ilen;
-        }
+        else {
+                /*
+                 * The rest of the Smack xattrs are only on sockets.
+                 */
+                sbp = ip->i_sb;
+                if (sbp->s_magic != SOCKFS_MAGIC)
+                        return -EOPNOTSUPP;
 
-        /*
-         * The rest of the Smack xattrs are only on sockets.
-         */
-        sbp = ip->i_sb;
-        if (sbp->s_magic != SOCKFS_MAGIC)
-                return -EOPNOTSUPP;
+                sock = SOCKET_I(ip);
+                if (sock == NULL || sock->sk == NULL)
+                        return -EOPNOTSUPP;
 
-        sock = SOCKET_I(ip);
-        if (sock == NULL || sock->sk == NULL)
-                return -EOPNOTSUPP;
-
-        ssp = sock->sk->sk_security;
+                ssp = sock->sk->sk_security;
 
-        if (strcmp(name, XATTR_SMACK_IPIN) == 0)
-                isp = ssp->smk_in;
-        else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
-                isp = ssp->smk_out;
-        else
-                return -EOPNOTSUPP;
+                if (strcmp(name, XATTR_SMACK_IPIN) == 0)
+                        isp = ssp->smk_in;
+                else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
+                        isp = ssp->smk_out;
+                else
+                        return -EOPNOTSUPP;
+        }
 
-        ilen = strlen(isp->smk_known);
-        if (rc == 0) {
-                *buffer = isp->smk_known;
-                rc = ilen;
+        if (alloc) {
+                *buffer = kstrdup(isp->smk_known, GFP_KERNEL);
+                if (*buffer == NULL)
+                        return -ENOMEM;
         }
 
-        return rc;
+        return strlen(isp->smk_known);
 }
 
 
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index fec1dfdb14ad..4490a699030b 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -948,14 +948,13 @@ static const struct file_operations snd_compr_file_ops = {
 static int snd_compress_dev_register(struct snd_device *device)
 {
         int ret = -EINVAL;
-        char str[16];
         struct snd_compr *compr;
 
         if (snd_BUG_ON(!device || !device->device_data))
                 return -EBADFD;
         compr = device->device_data;
 
-        pr_debug("reg %s for device %s, direction %d\n", str, compr->name,
+        pr_debug("reg device %s, direction %d\n", compr->name,
                         compr->direction);
         /* register compressed device */
         ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS,
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 3a1cc7b97e46..b719d0bd833e 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -547,6 +547,7 @@ struct snd_pcm_mmap_status_x32 {
         u32 pad2; /* alignment */
         struct timespec tstamp;
         s32 suspended_state;
+        s32 pad3;
         struct timespec audio_tstamp;
 } __packed;
 
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 7e3aa50b21f9..5badd08e1d69 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -103,6 +103,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         void __user *puhr;
         union hpi_message_buffer_v1 *hm;
         union hpi_response_buffer_v1 *hr;
+        u16 msg_size;
         u16 res_max_size;
         u32 uncopied_bytes;
         int err = 0;
@@ -127,22 +128,25 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         }
 
         /* Now read the message size and data from user space.  */
-        if (get_user(hm->h.size, (u16 __user *)puhm)) {
+        if (get_user(msg_size, (u16 __user *)puhm)) {
                 err = -EFAULT;
                 goto out;
         }
-        if (hm->h.size > sizeof(*hm))
-                hm->h.size = sizeof(*hm);
+        if (msg_size > sizeof(*hm))
+                msg_size = sizeof(*hm);
 
         /* printk(KERN_INFO "message size %d\n", hm->h.wSize); */
 
-        uncopied_bytes = copy_from_user(hm, puhm, hm->h.size);
+        uncopied_bytes = copy_from_user(hm, puhm, msg_size);
         if (uncopied_bytes) {
                 HPI_DEBUG_LOG(ERROR, "uncopied bytes %d\n", uncopied_bytes);
                 err = -EFAULT;
                 goto out;
         }
 
+        /* Override h.size in case it is changed between two userspace fetches */
+        hm->h.size = msg_size;
+
         if (get_user(res_max_size, (u16 __user *)puhr)) {
                 err = -EFAULT;
                 goto out;
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index 7326695bca33..d68f99e076a8 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -1272,11 +1272,11 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol,
 
         chip = snd_kcontrol_chip(kcontrol);
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 1;
         uinfo->value.integer.min = ECHOGAIN_MINOUT;
         uinfo->value.integer.max = ECHOGAIN_MAXOUT;
         uinfo->dimen.d[0] = num_busses_out(chip);
         uinfo->dimen.d[1] = num_busses_in(chip);
-        uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1];
         return 0;
 }
 
@@ -1344,11 +1344,11 @@ static int snd_echo_vmixer_info(struct snd_kcontrol *kcontrol,
 
         chip = snd_kcontrol_chip(kcontrol);
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 1;
         uinfo->value.integer.min = ECHOGAIN_MINOUT;
         uinfo->value.integer.max = ECHOGAIN_MAXOUT;
         uinfo->dimen.d[0] = num_busses_out(chip);
         uinfo->dimen.d[1] = num_pipes_out(chip);
-        uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1];
         return 0;
 }
 
@@ -1728,6 +1728,7 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol,
                                   struct snd_ctl_elem_info *uinfo)
 {
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 96;
         uinfo->value.integer.min = ECHOGAIN_MINOUT;
         uinfo->value.integer.max = 0;
 #ifdef ECHOCARD_HAS_VMIXER
@@ -1737,7 +1738,6 @@ static int snd_echo_vumeters_info(struct snd_kcontrol *kcontrol,
 #endif
         uinfo->dimen.d[1] = 16; /* 16 channels */
         uinfo->dimen.d[2] = 2;  /* 0=level, 1=peak */
-        uinfo->count = uinfo->dimen.d[0] * uinfo->dimen.d[1] * uinfo->dimen.d[2];
         return 0;
 }
 
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 2b64fabd5faa..c19c81d230bd 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -906,6 +906,7 @@ static int hdmi_setup_stream(struct hda_codec *codec, hda_nid_t cvt_nid,
                               hda_nid_t pin_nid, u32 stream_tag, int format)
 {
         struct hdmi_spec *spec = codec->spec;
+        unsigned int param;
         int err;
 
         err = spec->ops.pin_hbr_setup(codec, pin_nid, is_hbr_format(format));
@@ -915,6 +916,26 @@ static int hdmi_setup_stream(struct hda_codec *codec, hda_nid_t cvt_nid,
                 return err;
         }
 
+        if (is_haswell_plus(codec)) {
+
+                /*
+                 * on recent platforms IEC Coding Type is required for HBR
+                 * support, read current Digital Converter settings and set
+                 * ICT bitfield if needed.
+                 */
+                param = snd_hda_codec_read(codec, cvt_nid, 0,
+                                           AC_VERB_GET_DIGI_CONVERT_1, 0);
+
+                param = (param >> 16) & ~(AC_DIG3_ICT);
+
+                /* on recent platforms ICT mode is required for HBR support */
+                if (is_hbr_format(format))
+                        param |= 0x1;
+
+                snd_hda_codec_write(codec, cvt_nid, 0,
+                                    AC_VERB_SET_DIGI_CONVERT_3, param);
+        }
+
         snd_hda_codec_setup_stream(codec, cvt_nid, stream_tag, 0, format);
         return 0;
 }
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 3dc36d913550..23d1d23aefec 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -221,6 +221,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
         struct usb_interface_descriptor *altsd;
         void *control_header;
         int i, protocol;
+        int rest_bytes;
 
         /* find audiocontrol interface */
         host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0];
@@ -235,6 +236,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
                 return -EINVAL;
         }
 
+        rest_bytes = (void *)(host_iface->extra + host_iface->extralen) -
+                control_header;
+
+        /* just to be sure -- this shouldn't hit at all */
+        if (rest_bytes <= 0) {
+                dev_err(&dev->dev, "invalid control header\n");
+                return -EINVAL;
+        }
+
         switch (protocol) {
         default:
                 dev_warn(&dev->dev,
@@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif)
         case UAC_VERSION_1: {
                 struct uac1_ac_header_descriptor *h1 = control_header;
 
+                if (rest_bytes < sizeof(*h1)) {
+                        dev_err(&dev->dev, "too short v1 buffer descriptor\n");
+                        return -EINVAL;
+                }
+
                 if (!h1->bInCollection) {
                         dev_info(&dev->dev, "skipping empty audio interface (v1)\n");
                         return -EINVAL;
                 }
 
+                if (rest_bytes < h1->bLength) {
+                        dev_err(&dev->dev, "invalid buffer length (v1)\n");
+                        return -EINVAL;
+                }
+
                 if (h1->bLength < sizeof(*h1) + h1->bInCollection) {
                         dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n");
                         return -EINVAL;
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 913552078285..b8cb57aeec77 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1137,6 +1137,8 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x047F, 0x02F7): /* Plantronics BT-600 */
         case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
         case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+        case USB_ID(0x047F, 0xC022): /* Plantronics C310 */
+        case USB_ID(0x047F, 0xC036): /* Plantronics C520-M */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
         case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
index 4dab49080700..e229abd21652 100644
--- a/sound/usb/usx2y/usb_stream.c
+++ b/sound/usb/usx2y/usb_stream.c
@@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
         }
 
         pg = get_order(read_size);
-        sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg);
+        sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO|
+                                          __GFP_NOWARN, pg);
         if (!sk->s) {
                 snd_printk(KERN_WARNING "couldn't __get_free_pages()\n");
                 goto out;
@@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
         pg = get_order(write_size);
 
         sk->write_page =
-                (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg);
+                (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO|
+                                         __GFP_NOWARN, pg);
         if (!sk->write_page) {
                 snd_printk(KERN_WARNING "couldn't __get_free_pages()\n");
                 usb_stream_free(sk);
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 69d09c39bbcd..cd7359e23d86 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -88,6 +88,12 @@ struct kvm_s390_io_adapter_req {
 /* kvm attributes for KVM_S390_VM_TOD */
 #define KVM_S390_VM_TOD_LOW             0
 #define KVM_S390_VM_TOD_HIGH            1
+#define KVM_S390_VM_TOD_EXT             2
+
+struct kvm_s390_vm_tod_clock {
+        __u8  epoch_idx;
+        __u64 tod;
+};
 
 /* kvm attributes for KVM_S390_VM_CPU_MODEL */
 /* processor related attributes are r/w */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 8ea315a11fe0..2519c6c801c9 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -196,6 +196,7 @@
 
 #define X86_FEATURE_HW_PSTATE   ( 7*32+ 8) /* AMD HW-PState */
 #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */
+#define X86_FEATURE_SME         ( 7*32+10) /* AMD Secure Memory Encryption */
 
 #define X86_FEATURE_INTEL_PPIN  ( 7*32+14) /* Intel Processor Inventory Number */
 #define X86_FEATURE_INTEL_PT    ( 7*32+15) /* Intel Processor Trace */
@@ -287,6 +288,7 @@
 #define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
 #define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
 #define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
+#define X86_FEATURE_VGIF        (15*32+16) /* Virtual GIF */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
 #define X86_FEATURE_AVX512VBMI  (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index 5dff775af7cd..c10c9128f54e 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -21,11 +21,13 @@
 # define DISABLE_K6_MTRR        (1<<(X86_FEATURE_K6_MTRR & 31))
 # define DISABLE_CYRIX_ARR      (1<<(X86_FEATURE_CYRIX_ARR & 31))
 # define DISABLE_CENTAUR_MCR    (1<<(X86_FEATURE_CENTAUR_MCR & 31))
+# define DISABLE_PCID           0
 #else
 # define DISABLE_VME            0
 # define DISABLE_K6_MTRR        0
 # define DISABLE_CYRIX_ARR      0
 # define DISABLE_CENTAUR_MCR    0
+# define DISABLE_PCID           (1<<(X86_FEATURE_PCID & 31))
 #endif /* CONFIG_X86_64 */
 
 #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
@@ -49,7 +51,7 @@
 #define DISABLED_MASK1  0
 #define DISABLED_MASK2  0
 #define DISABLED_MASK3  (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR)
-#define DISABLED_MASK4  0
+#define DISABLED_MASK4  (DISABLE_PCID)
 #define DISABLED_MASK5  0
 #define DISABLED_MASK6  0
 #define DISABLED_MASK7  0
diff --git a/tools/include/asm-generic/hugetlb_encode.h b/tools/include/asm-generic/hugetlb_encode.h
new file mode 100644
index 000000000000..e4732d3c2998
--- /dev/null
+++ b/tools/include/asm-generic/hugetlb_encode.h
@@ -0,0 +1,34 @@
+#ifndef _ASM_GENERIC_HUGETLB_ENCODE_H_
+#define _ASM_GENERIC_HUGETLB_ENCODE_H_
+
+/*
+ * Several system calls take a flag to request "hugetlb" huge pages.
+ * Without further specification, these system calls will use the
+ * system's default huge page size.  If a system supports multiple
+ * huge page sizes, the desired huge page size can be specified in
+ * bits [26:31] of the flag arguments.  The value in these 6 bits
+ * will encode the log2 of the huge page size.
+ *
+ * The following definitions are associated with this huge page size
+ * encoding in flag arguments.  System call specific header files
+ * that use this encoding should include this file.  They can then
+ * provide definitions based on these with their own specific prefix.
+ * for example:
+ * #define MAP_HUGE_SHIFT HUGETLB_FLAG_ENCODE_SHIFT
+ */
+
+#define HUGETLB_FLAG_ENCODE_SHIFT       26
+#define HUGETLB_FLAG_ENCODE_MASK        0x3f
+
+#define HUGETLB_FLAG_ENCODE_64KB        (16 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_512KB       (19 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_1MB         (20 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_2MB         (21 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_8MB         (23 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_16MB        (24 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_256MB       (28 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_1GB         (30 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_2GB         (31 << HUGETLB_FLAG_ENCODE_SHIFT)
+#define HUGETLB_FLAG_ENCODE_16GB        (34 << HUGETLB_FLAG_ENCODE_SHIFT)
+
+#endif /* _ASM_GENERIC_HUGETLB_ENCODE_H_ */
diff --git a/tools/include/uapi/asm-generic/mman-common.h b/tools/include/uapi/asm-generic/mman-common.h
index 8c27db0c5c08..203268f9231e 100644
--- a/tools/include/uapi/asm-generic/mman-common.h
+++ b/tools/include/uapi/asm-generic/mman-common.h
@@ -58,20 +58,12 @@
                                            overrides the coredump filter bits */
 #define MADV_DODUMP     17              /* Clear the MADV_DONTDUMP flag */
 
+#define MADV_WIPEONFORK 18              /* Zero memory on fork, child only */
+#define MADV_KEEPONFORK 19              /* Undo MADV_WIPEONFORK */
+
 /* compatibility flags */
 #define MAP_FILE        0
 
-/*
- * When MAP_HUGETLB is set bits [26:31] encode the log2 of the huge page size.
- * This gives us 6 bits, which is enough until someone invents 128 bit address
- * spaces.
- *
- * Assume these are all power of twos.
- * When 0 use the default page size.
- */
-#define MAP_HUGE_SHIFT  26
-#define MAP_HUGE_MASK   0x3f
-
 #define PKEY_DISABLE_ACCESS     0x1
 #define PKEY_DISABLE_WRITE      0x2
 #define PKEY_ACCESS_MASK        (PKEY_DISABLE_ACCESS |\
diff --git a/tools/include/uapi/drm/drm.h b/tools/include/uapi/drm/drm.h
index 101593ab10ac..97677cd6964d 100644
--- a/tools/include/uapi/drm/drm.h
+++ b/tools/include/uapi/drm/drm.h
@@ -700,6 +700,7 @@ struct drm_prime_handle {
 
 struct drm_syncobj_create {
         __u32 handle;
+#define DRM_SYNCOBJ_CREATE_SIGNALED (1 << 0)
         __u32 flags;
 };
 
@@ -718,6 +719,24 @@ struct drm_syncobj_handle {
         __u32 pad;
 };
 
+#define DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL (1 << 0)
+#define DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT (1 << 1)
+struct drm_syncobj_wait {
+        __u64 handles;
+        /* absolute timeout */
+        __s64 timeout_nsec;
+        __u32 count_handles;
+        __u32 flags;
+        __u32 first_signaled; /* only valid when not waiting all */
+        __u32 pad;
+};
+
+struct drm_syncobj_array {
+        __u64 handles;
+        __u32 count_handles;
+        __u32 pad;
+};
+
 #if defined(__cplusplus)
 }
 #endif
@@ -840,6 +859,9 @@ extern "C" {
 #define DRM_IOCTL_SYNCOBJ_DESTROY       DRM_IOWR(0xC0, struct drm_syncobj_destroy)
 #define DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD  DRM_IOWR(0xC1, struct drm_syncobj_handle)
 #define DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE  DRM_IOWR(0xC2, struct drm_syncobj_handle)
+#define DRM_IOCTL_SYNCOBJ_WAIT          DRM_IOWR(0xC3, struct drm_syncobj_wait)
+#define DRM_IOCTL_SYNCOBJ_RESET         DRM_IOWR(0xC4, struct drm_syncobj_array)
+#define DRM_IOCTL_SYNCOBJ_SIGNAL        DRM_IOWR(0xC5, struct drm_syncobj_array)
 
 /**
  * Device specific ioctls should only be in their respective headers
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index 7ccbd6a2bbe0..6598fb76d2c2 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -260,6 +260,8 @@ typedef struct _drm_i915_sarea {
 #define DRM_I915_GEM_CONTEXT_GETPARAM   0x34
 #define DRM_I915_GEM_CONTEXT_SETPARAM   0x35
 #define DRM_I915_PERF_OPEN              0x36
+#define DRM_I915_PERF_ADD_CONFIG        0x37
+#define DRM_I915_PERF_REMOVE_CONFIG     0x38
 
 #define DRM_IOCTL_I915_INIT             DRM_IOW( DRM_COMMAND_BASE + DRM_I915_INIT, drm_i915_init_t)
 #define DRM_IOCTL_I915_FLUSH            DRM_IO ( DRM_COMMAND_BASE + DRM_I915_FLUSH)
@@ -315,6 +317,8 @@ typedef struct _drm_i915_sarea {
 #define DRM_IOCTL_I915_GEM_CONTEXT_GETPARAM     DRM_IOWR (DRM_COMMAND_BASE + DRM_I915_GEM_CONTEXT_GETPARAM, struct drm_i915_gem_context_param)
 #define DRM_IOCTL_I915_GEM_CONTEXT_SETPARAM     DRM_IOWR (DRM_COMMAND_BASE + DRM_I915_GEM_CONTEXT_SETPARAM, struct drm_i915_gem_context_param)
 #define DRM_IOCTL_I915_PERF_OPEN        DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_OPEN, struct drm_i915_perf_open_param)
+#define DRM_IOCTL_I915_PERF_ADD_CONFIG  DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_ADD_CONFIG, struct drm_i915_perf_oa_config)
+#define DRM_IOCTL_I915_PERF_REMOVE_CONFIG       DRM_IOW(DRM_COMMAND_BASE + DRM_I915_PERF_REMOVE_CONFIG, __u64)
 
 /* Allow drivers to submit batchbuffers directly to hardware, relying
  * on the security mechanisms provided by hardware.
@@ -431,6 +435,11 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_HAS_EXEC_BATCH_FIRST  48
 
+/* Query whether DRM_I915_GEM_EXECBUFFER2 supports supplying an array of
+ * drm_i915_gem_exec_fence structures.  See I915_EXEC_FENCE_ARRAY.
+ */
+#define I915_PARAM_HAS_EXEC_FENCE_ARRAY  49
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
@@ -812,6 +821,17 @@ struct drm_i915_gem_exec_object2 {
         __u64 rsvd2;
 };
 
+struct drm_i915_gem_exec_fence {
+        /**
+         * User's handle for a drm_syncobj to wait on or signal.
+         */
+        __u32 handle;
+
+#define I915_EXEC_FENCE_WAIT            (1<<0)
+#define I915_EXEC_FENCE_SIGNAL          (1<<1)
+        __u32 flags;
+};
+
 struct drm_i915_gem_execbuffer2 {
         /**
          * List of gem_exec_object2 structs
@@ -826,7 +846,11 @@ struct drm_i915_gem_execbuffer2 {
         __u32 DR1;
         __u32 DR4;
         __u32 num_cliprects;
-        /** This is a struct drm_clip_rect *cliprects */
+        /**
+         * This is a struct drm_clip_rect *cliprects if I915_EXEC_FENCE_ARRAY
+         * is not set.  If I915_EXEC_FENCE_ARRAY is set, then this is a
+         * struct drm_i915_gem_exec_fence *fences.
+         */
         __u64 cliprects_ptr;
 #define I915_EXEC_RING_MASK              (7<<0)
 #define I915_EXEC_DEFAULT                (0<<0)
@@ -927,7 +951,14 @@ struct drm_i915_gem_execbuffer2 {
  * element).
  */
 #define I915_EXEC_BATCH_FIRST           (1<<18)
-#define __I915_EXEC_UNKNOWN_FLAGS (-(I915_EXEC_BATCH_FIRST<<1))
+
+/* Setting I915_FENCE_ARRAY implies that num_cliprects and cliprects_ptr
+ * define an array of i915_gem_exec_fence structures which specify a set of
+ * dma fences to wait upon or signal.
+ */
+#define I915_EXEC_FENCE_ARRAY   (1<<19)
+
+#define __I915_EXEC_UNKNOWN_FLAGS (-(I915_EXEC_FENCE_ARRAY<<1))
 
 #define I915_EXEC_CONTEXT_ID_MASK       (0xffffffff)
 #define i915_execbuffer2_set_context_id(eb2, context) \
@@ -1467,6 +1498,22 @@ enum drm_i915_perf_record_type {
         DRM_I915_PERF_RECORD_MAX /* non-ABI */
 };
 
+/**
+ * Structure to upload perf dynamic configuration into the kernel.
+ */
+struct drm_i915_perf_oa_config {
+        /** String formatted like "%08x-%04x-%04x-%04x-%012x" */
+        char uuid[36];
+
+        __u32 n_mux_regs;
+        __u32 n_boolean_regs;
+        __u32 n_flex_regs;
+
+        __u64 __user mux_regs_ptr;
+        __u64 __user boolean_regs_ptr;
+        __u64 __user flex_regs_ptr;
+};
+
 #if defined(__cplusplus)
 }
 #endif
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 461811e57140..43ab5c402f98 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -143,12 +143,6 @@ enum bpf_attach_type {
 
 #define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE
 
-enum bpf_sockmap_flags {
-        BPF_SOCKMAP_UNSPEC,
-        BPF_SOCKMAP_STRPARSER,
-        __MAX_BPF_SOCKMAP_FLAG
-};
-
 /* If BPF_F_ALLOW_OVERRIDE flag is used in BPF_PROG_ATTACH command
  * to the given target_fd cgroup the descendent cgroup will be able to
  * override effective bpf program that was inherited from this cgroup
@@ -368,9 +362,20 @@ union bpf_attr {
  * int bpf_redirect(ifindex, flags)
  *     redirect to another netdev
  *     @ifindex: ifindex of the net device
- *     @flags: bit 0 - if set, redirect to ingress instead of egress
- *             other bits - reserved
- *     Return: TC_ACT_REDIRECT
+ *     @flags:
+ *        cls_bpf:
+ *          bit 0 - if set, redirect to ingress instead of egress
+ *          other bits - reserved
+ *        xdp_bpf:
+ *          all bits - reserved
+ *     Return: cls_bpf: TC_ACT_REDIRECT on success or TC_ACT_SHOT on error
+ *             xdp_bfp: XDP_REDIRECT on success or XDP_ABORT on error
+ * int bpf_redirect_map(map, key, flags)
+ *     redirect to endpoint in map
+ *     @map: pointer to dev map
+ *     @key: index in map to lookup
+ *     @flags: --
+ *     Return: XDP_REDIRECT on success or XDP_ABORT on error
  *
  * u32 bpf_get_route_realm(skb)
  *     retrieve a dst's tclassid
@@ -632,7 +637,7 @@ union bpf_attr {
         FN(skb_adjust_room),            \
         FN(redirect_map),               \
         FN(sk_redirect_map),            \
-        FN(sock_map_update),
+        FN(sock_map_update),            \
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
@@ -753,20 +758,23 @@ struct bpf_sock {
         __u32 family;
         __u32 type;
         __u32 protocol;
+        __u32 mark;
+        __u32 priority;
 };
 
 #define XDP_PACKET_HEADROOM 256
 
 /* User return codes for XDP prog type.
  * A valid XDP program must return one of these defined values. All other
- * return codes are reserved for future use. Unknown return codes will result
- * in packet drop.
+ * return codes are reserved for future use. Unknown return codes will
+ * result in packet drops and a warning via bpf_warn_invalid_xdp_action().
  */
 enum xdp_action {
         XDP_ABORTED = 0,
         XDP_DROP,
         XDP_PASS,
         XDP_TX,
+        XDP_REDIRECT,
 };
 
 /* user accessible metadata for XDP packet hook
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 6cd63c18708a..838887587411 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -711,7 +711,8 @@ struct kvm_ppc_one_seg_page_size {
 struct kvm_ppc_smmu_info {
         __u64 flags;
         __u32 slb_size;
-        __u32 pad;
+        __u16 data_keys;        /* # storage keys supported for data */
+        __u16 instr_keys;       /* # storage keys supported for instructions */
         struct kvm_ppc_one_seg_page_size sps[KVM_PPC_PAGE_SIZES_MAX_SZ];
 };
 
diff --git a/tools/include/uapi/linux/mman.h b/tools/include/uapi/linux/mman.h
index 81d8edf11789..a937480d7cd3 100644
--- a/tools/include/uapi/linux/mman.h
+++ b/tools/include/uapi/linux/mman.h
@@ -1,7 +1,8 @@
 #ifndef _UAPI_LINUX_MMAN_H
 #define _UAPI_LINUX_MMAN_H
 
-#include <uapi/asm/mman.h>
+#include <asm/mman.h>
+#include <asm-generic/hugetlb_encode.h>
 
 #define MREMAP_MAYMOVE  1
 #define MREMAP_FIXED    2
@@ -10,4 +11,25 @@
 #define OVERCOMMIT_ALWAYS               1
 #define OVERCOMMIT_NEVER                2
 
+/*
+ * Huge page size encoding when MAP_HUGETLB is specified, and a huge page
+ * size other than the default is desired.  See hugetlb_encode.h.
+ * All known huge page size encodings are provided here.  It is the
+ * responsibility of the application to know which sizes are supported on
+ * the running system.  See mmap(2) man page for details.
+ */
+#define MAP_HUGE_SHIFT  HUGETLB_FLAG_ENCODE_SHIFT
+#define MAP_HUGE_MASK   HUGETLB_FLAG_ENCODE_MASK
+
+#define MAP_HUGE_64KB   HUGETLB_FLAG_ENCODE_64KB
+#define MAP_HUGE_512KB  HUGETLB_FLAG_ENCODE_512KB
+#define MAP_HUGE_1MB    HUGETLB_FLAG_ENCODE_1MB
+#define MAP_HUGE_2MB    HUGETLB_FLAG_ENCODE_2MB
+#define MAP_HUGE_8MB    HUGETLB_FLAG_ENCODE_8MB
+#define MAP_HUGE_16MB   HUGETLB_FLAG_ENCODE_16MB
+#define MAP_HUGE_256MB  HUGETLB_FLAG_ENCODE_256MB
+#define MAP_HUGE_1GB    HUGETLB_FLAG_ENCODE_1GB
+#define MAP_HUGE_2GB    HUGETLB_FLAG_ENCODE_2GB
+#define MAP_HUGE_16GB   HUGETLB_FLAG_ENCODE_16GB
+
 #endif /* _UAPI_LINUX_MMAN_H */
diff --git a/tools/objtool/Documentation/stack-validation.txt b/tools/objtool/Documentation/stack-validation.txt
index 6a1af43862df..3995735a878f 100644
--- a/tools/objtool/Documentation/stack-validation.txt
+++ b/tools/objtool/Documentation/stack-validation.txt
@@ -194,10 +194,10 @@ they mean, and suggestions for how to fix them.
    If it's a GCC-compiled .c file, the error may be because the function
    uses an inline asm() statement which has a "call" instruction.  An
    asm() statement with a call instruction must declare the use of the
-   stack pointer in its output operand.  For example, on x86_64:
+   stack pointer in its output operand.  On x86_64, this means adding
+   the ASM_CALL_CONSTRAINT as an output constraint:
 
-     register void *__sp asm("rsp");
-     asm volatile("call func" : "+r" (__sp));
+     asm volatile("call func" : ASM_CALL_CONSTRAINT);
 
    Otherwise the stack frame may not get created before the call.
 
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 0e8c8ec4fd4e..34a579f806e3 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -208,14 +208,14 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
                 break;
 
         case 0x89:
-                if (rex == 0x48 && modrm == 0xe5) {
+                if (rex_w && !rex_r && modrm_mod == 3 && modrm_reg == 4) {
 
-                        /* mov %rsp, %rbp */
+                        /* mov %rsp, reg */
                         *type = INSN_STACK;
                         op->src.type = OP_SRC_REG;
                         op->src.reg = CFI_SP;
                         op->dest.type = OP_DEST_REG;
-                        op->dest.reg = CFI_BP;
+                        op->dest.reg = op_to_cfi_reg[modrm_rm][rex_b];
                         break;
                 }
 
@@ -284,11 +284,16 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
         case 0x8d:
                 if (sib == 0x24 && rex_w && !rex_b && !rex_x) {
 
-                        /* lea disp(%rsp), reg */
                         *type = INSN_STACK;
-                        op->src.type = OP_SRC_ADD;
+                        if (!insn.displacement.value) {
+                                /* lea (%rsp), reg */
+                                op->src.type = OP_SRC_REG;
+                        } else {
+                                /* lea disp(%rsp), reg */
+                                op->src.type = OP_SRC_ADD;
+                                op->src.offset = insn.displacement.value;
+                        }
                         op->src.reg = CFI_SP;
-                        op->src.offset = insn.displacement.value;
                         op->dest.type = OP_DEST_REG;
                         op->dest.reg = op_to_cfi_reg[modrm_reg][rex_r];
 
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index f744617c9946..a0c518ecf085 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1203,24 +1203,39 @@ static int update_insn_state(struct instruction *insn, struct insn_state *state)
                 switch (op->src.type) {
 
                 case OP_SRC_REG:
-                        if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP) {
+                        if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
+                            cfa->base == CFI_SP &&
+                            regs[CFI_BP].base == CFI_CFA &&
+                            regs[CFI_BP].offset == -cfa->offset) {
+
+                                /* mov %rsp, %rbp */
+                                cfa->base = op->dest.reg;
+                                state->bp_scratch = false;
+                        }
 
-                                if (cfa->base == CFI_SP &&
-                                    regs[CFI_BP].base == CFI_CFA &&
-                                    regs[CFI_BP].offset == -cfa->offset) {
+                        else if (op->src.reg == CFI_SP &&
+                                 op->dest.reg == CFI_BP && state->drap) {
 
-                                        /* mov %rsp, %rbp */
-                                        cfa->base = op->dest.reg;
-                                        state->bp_scratch = false;
-                                }
+                                /* drap: mov %rsp, %rbp */
+                                regs[CFI_BP].base = CFI_BP;
+                                regs[CFI_BP].offset = -state->stack_size;
+                                state->bp_scratch = false;
+                        }
 
-                                else if (state->drap) {
+                        else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
 
-                                        /* drap: mov %rsp, %rbp */
-                                        regs[CFI_BP].base = CFI_BP;
-                                        regs[CFI_BP].offset = -state->stack_size;
-                                        state->bp_scratch = false;
-                                }
+                                /*
+                                 * mov %rsp, %reg
+                                 *
+                                 * This is needed for the rare case where GCC
+                                 * does:
+                                 *
+                                 *   mov    %rsp, %rax
+                                 *   ...
+                                 *   mov    %rax, %rsp
+                                 */
+                                state->vals[op->dest.reg].base = CFI_CFA;
+                                state->vals[op->dest.reg].offset = -state->stack_size;
                         }
 
                         else if (op->dest.reg == cfa->base) {
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 6e9f980a7d26..24460155c82c 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -175,19 +175,20 @@ static int read_sections(struct elf *elf)
                         return -1;
                 }
 
-                sec->data = elf_getdata(s, NULL);
-                if (!sec->data) {
-                        WARN_ELF("elf_getdata");
-                        return -1;
-                }
-
-                if (sec->data->d_off != 0 ||
-                    sec->data->d_size != sec->sh.sh_size) {
-                        WARN("unexpected data attributes for %s", sec->name);
-                        return -1;
+                if (sec->sh.sh_size != 0) {
+                        sec->data = elf_getdata(s, NULL);
+                        if (!sec->data) {
+                                WARN_ELF("elf_getdata");
+                                return -1;
+                        }
+                        if (sec->data->d_off != 0 ||
+                            sec->data->d_size != sec->sh.sh_size) {
+                                WARN("unexpected data attributes for %s",
+                                     sec->name);
+                                return -1;
+                        }
                 }
-
-                sec->len = sec->data->d_size;
+                sec->len = sec->sh.sh_size;
         }
 
         /* sanity check, one more call to elf_nextscn() should return NULL */
@@ -508,6 +509,7 @@ struct section *elf_create_rela_section(struct elf *elf, struct section *base)
         strcat(relaname, base->name);
 
         sec = elf_create_section(elf, relaname, sizeof(GElf_Rela), 0);
+        free(relaname);
         if (!sec)
                 return NULL;
 
@@ -561,6 +563,7 @@ int elf_write(struct elf *elf)
         struct section *sec;
         Elf_Scn *s;
 
+        /* Update section headers for changed sections: */
         list_for_each_entry(sec, &elf->sections, list) {
                 if (sec->changed) {
                         s = elf_getscn(elf->elf, sec->idx);
@@ -568,13 +571,17 @@ int elf_write(struct elf *elf)
                                 WARN_ELF("elf_getscn");
                                 return -1;
                         }
-                        if (!gelf_update_shdr (s, &sec->sh)) {
+                        if (!gelf_update_shdr(s, &sec->sh)) {
                                 WARN_ELF("gelf_update_shdr");
                                 return -1;
                         }
                 }
         }
 
+        /* Make sure the new section header entries get updated properly. */
+        elf_flagelf(elf->elf, ELF_C_SET, ELF_F_DIRTY);
+
+        /* Write all changes to the file. */
         if (elf_update(elf->elf, ELF_C_WRITE) < 0) {
                 WARN_ELF("elf_update");
                 return -1;
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 62072822dc85..627b7cada144 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -1,34 +1,8 @@
 tools/perf
-tools/arch/alpha/include/asm/barrier.h
-tools/arch/arm/include/asm/barrier.h
-tools/arch/arm64/include/asm/barrier.h
-tools/arch/ia64/include/asm/barrier.h
-tools/arch/mips/include/asm/barrier.h
-tools/arch/powerpc/include/asm/barrier.h
-tools/arch/s390/include/asm/barrier.h
-tools/arch/sh/include/asm/barrier.h
-tools/arch/sparc/include/asm/barrier.h
-tools/arch/sparc/include/asm/barrier_32.h
-tools/arch/sparc/include/asm/barrier_64.h
-tools/arch/tile/include/asm/barrier.h
-tools/arch/x86/include/asm/barrier.h
-tools/arch/x86/include/asm/cmpxchg.h
-tools/arch/x86/include/asm/cpufeatures.h
-tools/arch/x86/include/asm/disabled-features.h
-tools/arch/x86/include/asm/required-features.h
-tools/arch/x86/include/uapi/asm/svm.h
-tools/arch/x86/include/uapi/asm/vmx.h
-tools/arch/x86/include/uapi/asm/kvm.h
-tools/arch/x86/include/uapi/asm/kvm_perf.h
-tools/arch/x86/lib/memcpy_64.S
-tools/arch/x86/lib/memset_64.S
-tools/arch/s390/include/uapi/asm/kvm_perf.h
-tools/arch/s390/include/uapi/asm/sie.h
-tools/arch/xtensa/include/asm/barrier.h
+tools/arch
 tools/scripts
 tools/build
-tools/arch/x86/include/asm/atomic.h
-tools/arch/x86/include/asm/rmwcc.h
+tools/include
 tools/lib/traceevent
 tools/lib/api
 tools/lib/bpf
@@ -42,60 +16,3 @@ tools/lib/find_bit.c
 tools/lib/bitmap.c
 tools/lib/str_error_r.c
 tools/lib/vsprintf.c
-tools/include/asm/alternative-asm.h
-tools/include/asm/atomic.h
-tools/include/asm/barrier.h
-tools/include/asm/bug.h
-tools/include/asm-generic/atomic-gcc.h
-tools/include/asm-generic/barrier.h
-tools/include/asm-generic/bitops/arch_hweight.h
-tools/include/asm-generic/bitops/atomic.h
-tools/include/asm-generic/bitops/const_hweight.h
-tools/include/asm-generic/bitops/__ffs.h
-tools/include/asm-generic/bitops/__ffz.h
-tools/include/asm-generic/bitops/__fls.h
-tools/include/asm-generic/bitops/find.h
-tools/include/asm-generic/bitops/fls64.h
-tools/include/asm-generic/bitops/fls.h
-tools/include/asm-generic/bitops/hweight.h
-tools/include/asm-generic/bitops.h
-tools/include/linux/atomic.h
-tools/include/linux/bitops.h
-tools/include/linux/compiler.h
-tools/include/linux/compiler-gcc.h
-tools/include/linux/coresight-pmu.h
-tools/include/linux/bug.h
-tools/include/linux/filter.h
-tools/include/linux/hash.h
-tools/include/linux/kernel.h
-tools/include/linux/list.h
-tools/include/linux/log2.h
-tools/include/uapi/asm-generic/fcntl.h
-tools/include/uapi/asm-generic/ioctls.h
-tools/include/uapi/asm-generic/mman-common.h
-tools/include/uapi/asm-generic/mman.h
-tools/include/uapi/drm/drm.h
-tools/include/uapi/drm/i915_drm.h
-tools/include/uapi/linux/bpf.h
-tools/include/uapi/linux/bpf_common.h
-tools/include/uapi/linux/fcntl.h
-tools/include/uapi/linux/hw_breakpoint.h
-tools/include/uapi/linux/kvm.h
-tools/include/uapi/linux/mman.h
-tools/include/uapi/linux/perf_event.h
-tools/include/uapi/linux/sched.h
-tools/include/uapi/linux/stat.h
-tools/include/uapi/linux/vhost.h
-tools/include/uapi/sound/asound.h
-tools/include/linux/poison.h
-tools/include/linux/rbtree.h
-tools/include/linux/rbtree_augmented.h
-tools/include/linux/refcount.h
-tools/include/linux/string.h
-tools/include/linux/stringify.h
-tools/include/linux/types.h
-tools/include/linux/err.h
-tools/include/linux/bitmap.h
-tools/include/linux/time64.h
-tools/arch/*/include/uapi/asm/mman.h
-tools/arch/*/include/uapi/asm/perf_regs.h
diff --git a/tools/perf/arch/s390/util/Build b/tools/perf/arch/s390/util/Build
index bd518b623d7a..5bd7b9260cc0 100644
--- a/tools/perf/arch/s390/util/Build
+++ b/tools/perf/arch/s390/util/Build
@@ -1,5 +1,4 @@
 libperf-y += header.o
-libperf-y += sym-handling.o
 libperf-y += kvm-stat.o
 
 libperf-$(CONFIG_DWARF) += dwarf-regs.o
diff --git a/tools/perf/arch/s390/util/sym-handling.c b/tools/perf/arch/s390/util/sym-handling.c
deleted file mode 100644
index e103f6e46afe..000000000000
--- a/tools/perf/arch/s390/util/sym-handling.c
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Architecture specific ELF symbol handling and relocation mapping.
- *
- * Copyright 2017 IBM Corp.
- * Author(s): Thomas Richter <tmricht@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- */
-
-#include "symbol.h"
-
-#ifdef HAVE_LIBELF_SUPPORT
-bool elf__needs_adjust_symbols(GElf_Ehdr ehdr)
-{
-        if (ehdr.e_type == ET_EXEC)
-                return false;
-        return ehdr.e_type == ET_REL || ehdr.e_type == ET_DYN;
-}
-
-void arch__adjust_sym_map_offset(GElf_Sym *sym,
-                                 GElf_Shdr *shdr __maybe_unused,
-                                 struct map *map)
-{
-        if (map->type == MAP__FUNCTION)
-                sym->st_value += map->start;
-}
-#endif
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 510b513e0f01..be09d77cade0 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -65,8 +65,6 @@ static int parse_callchain_mode(const char *value)
                 callchain_param.mode = CHAIN_FOLDED;
                 return 0;
         }
-
-        pr_err("Invalid callchain mode: %s\n", value);
         return -1;
 }
 
@@ -82,8 +80,6 @@ static int parse_callchain_order(const char *value)
                 callchain_param.order_set = true;
                 return 0;
         }
-
-        pr_err("Invalid callchain order: %s\n", value);
         return -1;
 }
 
@@ -105,8 +101,6 @@ static int parse_callchain_sort_key(const char *value)
                 callchain_param.branch_callstack = 1;
                 return 0;
         }
-
-        pr_err("Invalid callchain sort key: %s\n", value);
         return -1;
 }
 
@@ -124,8 +118,6 @@ static int parse_callchain_value(const char *value)
                 callchain_param.value = CCVAL_COUNT;
                 return 0;
         }
-
-        pr_err("Invalid callchain config key: %s\n", value);
         return -1;
 }
 
@@ -319,12 +311,27 @@ int perf_callchain_config(const char *var, const char *value)
 
                 return ret;
         }
-        if (!strcmp(var, "print-type"))
-                return parse_callchain_mode(value);
-        if (!strcmp(var, "order"))
-                return parse_callchain_order(value);
-        if (!strcmp(var, "sort-key"))
-                return parse_callchain_sort_key(value);
+        if (!strcmp(var, "print-type")){
+                int ret;
+                ret = parse_callchain_mode(value);
+                if (ret == -1)
+                        pr_err("Invalid callchain mode: %s\n", value);
+                return ret;
+        }
+        if (!strcmp(var, "order")){
+                int ret;
+                ret = parse_callchain_order(value);
+                if (ret == -1)
+                        pr_err("Invalid callchain order: %s\n", value);
+                return ret;
+        }
+        if (!strcmp(var, "sort-key")){
+                int ret;
+                ret = parse_callchain_sort_key(value);
+                if (ret == -1)
+                        pr_err("Invalid callchain sort key: %s\n", value);
+                return ret;
+        }
         if (!strcmp(var, "threshold")) {
                 callchain_param.min_percent = strtod(value, &endptr);
                 if (value == endptr) {
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 4bb89373eb52..0dccdb89572c 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -271,12 +271,17 @@ struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx)
         return evsel;
 }
 
+static bool perf_event_can_profile_kernel(void)
+{
+        return geteuid() == 0 || perf_event_paranoid() == -1;
+}
+
 struct perf_evsel *perf_evsel__new_cycles(bool precise)
 {
         struct perf_event_attr attr = {
                 .type   = PERF_TYPE_HARDWARE,
                 .config = PERF_COUNT_HW_CPU_CYCLES,
-                .exclude_kernel = geteuid() != 0,
+                .exclude_kernel = !perf_event_can_profile_kernel(),
         };
         struct perf_evsel *evsel;
 
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 5c39f420111e..9cf781f0d8a2 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -810,12 +810,6 @@ static u64 ref_reloc(struct kmap *kmap)
 void __weak arch__sym_update(struct symbol *s __maybe_unused,
                 GElf_Sym *sym __maybe_unused) { }
 
-void __weak arch__adjust_sym_map_offset(GElf_Sym *sym, GElf_Shdr *shdr,
-                                       struct map *map __maybe_unused)
-{
-        sym->st_value -= shdr->sh_addr - shdr->sh_offset;
-}
-
 int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
                   struct symsrc *runtime_ss, int kmodule)
 {
@@ -996,7 +990,7 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
 
                         /* Adjust symbol to map to file offset */
                         if (adjust_kernel_syms)
-                                arch__adjust_sym_map_offset(&sym, &shdr, map);
+                                sym.st_value -= shdr.sh_addr - shdr.sh_offset;
 
                         if (strcmp(section_name,
                                    (curr_dso->short_name +
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 2bd6a1f01a1c..aad99e7e179b 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -344,9 +344,6 @@ int setup_intlist(struct intlist **list, const char *list_str,
 #ifdef HAVE_LIBELF_SUPPORT
 bool elf__needs_adjust_symbols(GElf_Ehdr ehdr);
 void arch__sym_update(struct symbol *s, GElf_Sym *sym);
-void arch__adjust_sym_map_offset(GElf_Sym *sym,
-                                 GElf_Shdr *shdr __maybe_unused,
-                                 struct map *map __maybe_unused);
 #endif
 
 #define SYMBOL_A 0
diff --git a/tools/perf/util/syscalltbl.c b/tools/perf/util/syscalltbl.c
index 19e5db90394c..6eea7cff3d4e 100644
--- a/tools/perf/util/syscalltbl.c
+++ b/tools/perf/util/syscalltbl.c
@@ -15,9 +15,9 @@
 
 #include "syscalltbl.h"
 #include <stdlib.h>
+#include <linux/compiler.h>
 
 #ifdef HAVE_SYSCALL_TABLE
-#include <linux/compiler.h>
 #include <string.h>
 #include "string2.h"
 #include "util.h"
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index d20791c3f499..bef419d4266d 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -1527,9 +1527,6 @@ static void nfit_test1_setup(struct nfit_test *t)
         set_bit(ND_CMD_ARS_START, &acpi_desc->bus_cmd_force_en);
         set_bit(ND_CMD_ARS_STATUS, &acpi_desc->bus_cmd_force_en);
         set_bit(ND_CMD_CLEAR_ERROR, &acpi_desc->bus_cmd_force_en);
-        set_bit(ND_CMD_GET_CONFIG_SIZE, &acpi_desc->dimm_cmd_force_en);
-        set_bit(ND_CMD_GET_CONFIG_DATA, &acpi_desc->dimm_cmd_force_en);
-        set_bit(ND_CMD_SET_CONFIG_DATA, &acpi_desc->dimm_cmd_force_en);
 }
 
 static int nfit_test_blk_do_io(struct nd_blk_region *ndbr, resource_size_t dpa,
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 26ce4f7168be..ff805643b5f7 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -52,6 +52,10 @@ override LDFLAGS =
 override MAKEFLAGS =
 endif
 
+ifneq ($(KBUILD_SRC),)
+override LDFLAGS =
+endif
+
 BUILD := $(O)
 ifndef BUILD
   BUILD := $(KBUILD_OUTPUT)
@@ -62,32 +66,32 @@ endif
 
 export BUILD
 all:
-        for TARGET in $(TARGETS); do            \
+        @for TARGET in $(TARGETS); do           \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET;\
         done;
 
 run_tests: all
-        for TARGET in $(TARGETS); do \
+        @for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests;\
         done;
 
 hotplug:
-        for TARGET in $(TARGETS_HOTPLUG); do \
+        @for TARGET in $(TARGETS_HOTPLUG); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET;\
         done;
 
 run_hotplug: hotplug
-        for TARGET in $(TARGETS_HOTPLUG); do \
+        @for TARGET in $(TARGETS_HOTPLUG); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET run_full_test;\
         done;
 
 clean_hotplug:
-        for TARGET in $(TARGETS_HOTPLUG); do \
+        @for TARGET in $(TARGETS_HOTPLUG); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
         done;
@@ -103,7 +107,7 @@ install:
 ifdef INSTALL_PATH
         @# Ask all targets to install their files
         mkdir -p $(INSTALL_PATH)
-        for TARGET in $(TARGETS); do \
+        @for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install; \
         done;
@@ -128,7 +132,7 @@ else
 endif
 
 clean:
-        for TARGET in $(TARGETS); do \
+        @for TARGET in $(TARGETS); do \
                 BUILD_TARGET=$$BUILD/$$TARGET;  \
                 make OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
         done;
diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h
index 20ecbaa0d85d..6c53a8906eff 100644
--- a/tools/testing/selftests/bpf/bpf_util.h
+++ b/tools/testing/selftests/bpf/bpf_util.h
@@ -12,6 +12,7 @@ static inline unsigned int bpf_num_possible_cpus(void)
         unsigned int start, end, possible_cpus = 0;
         char buff[128];
         FILE *fp;
+        int n;
 
         fp = fopen(fcpu, "r");
         if (!fp) {
@@ -20,17 +21,17 @@ static inline unsigned int bpf_num_possible_cpus(void)
         }
 
         while (fgets(buff, sizeof(buff), fp)) {
-                if (sscanf(buff, "%u-%u", &start, &end) == 2) {
-                        possible_cpus = start == 0 ? end + 1 : 0;
-                        break;
+                n = sscanf(buff, "%u-%u", &start, &end);
+                if (n == 0) {
+                        printf("Failed to retrieve # possible CPUs!\n");
+                        exit(1);
+                } else if (n == 1) {
+                        end = start;
                 }
+                possible_cpus = start == 0 ? end + 1 : 0;
+                break;
         }
-
         fclose(fp);
-        if (!possible_cpus) {
-                printf("Failed to retrieve # possible CPUs!\n");
-                exit(1);
-        }
 
         return possible_cpus;
 }
diff --git a/tools/testing/selftests/breakpoints/Makefile b/tools/testing/selftests/breakpoints/Makefile
index 6b214b7b10fb..247b0a1899d7 100644
--- a/tools/testing/selftests/breakpoints/Makefile
+++ b/tools/testing/selftests/breakpoints/Makefile
@@ -2,14 +2,14 @@
 uname_M := $(shell uname -m 2>/dev/null || echo not)
 ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
 
+TEST_GEN_PROGS := step_after_suspend_test
+
 ifeq ($(ARCH),x86)
-TEST_GEN_PROGS := breakpoint_test
+TEST_GEN_PROGS += breakpoint_test
 endif
 ifneq (,$(filter $(ARCH),aarch64 arm64))
-TEST_GEN_PROGS := breakpoint_test_arm64
+TEST_GEN_PROGS += breakpoint_test_arm64
 endif
 
-TEST_GEN_PROGS += step_after_suspend_test
-
 include ../lib.mk
 
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
index 2a1cb9908746..a4fd4c851a5b 100644
--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
@@ -1,6 +1,8 @@
 #!/bin/sh
 # description: Register/unregister many kprobe events
 
+[ -f kprobe_events ] || exit_unsupported # this is configurable
+
 # ftrace fentry skip size depends on the machine architecture.
 # Currently HAVE_KPROBES_ON_FTRACE defined on x86 and powerpc64le
 case `uname -m` in
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index 7c647f619d63..f0c0369ccb79 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -7,14 +7,17 @@ TEST_PROGS := run.sh
 include ../lib.mk
 
 all:
-        for DIR in $(SUBDIRS); do               \
+        @for DIR in $(SUBDIRS); do              \
                 BUILD_TARGET=$(OUTPUT)/$$DIR;   \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
+                if [ -e $$DIR/$(TEST_PROGS) ]; then
+                        rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/;
+                fi
         done
 
 override define RUN_TESTS
-        $(OUTPUT)/run.sh
+        @cd $(OUTPUT); ./run.sh
 endef
 
 override define INSTALL_RULE
@@ -33,7 +36,7 @@ override define EMIT_TESTS
 endef
 
 override define CLEAN
-        for DIR in $(SUBDIRS); do               \
+        @for DIR in $(SUBDIRS); do              \
                 BUILD_TARGET=$(OUTPUT)/$$DIR;   \
                 mkdir $$BUILD_TARGET  -p;       \
                 make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\
diff --git a/tools/testing/selftests/intel_pstate/Makefile b/tools/testing/selftests/intel_pstate/Makefile
index 849a90ffe8dd..a97e24edde39 100644
--- a/tools/testing/selftests/intel_pstate/Makefile
+++ b/tools/testing/selftests/intel_pstate/Makefile
@@ -1,7 +1,9 @@
 CFLAGS := $(CFLAGS) -Wall -D_GNU_SOURCE
 LDLIBS := $(LDLIBS) -lm
 
+ifeq (,$(filter $(ARCH),x86))
 TEST_GEN_FILES := msr aperf
+endif
 
 TEST_PROGS := run.sh
 
diff --git a/tools/testing/selftests/intel_pstate/run.sh b/tools/testing/selftests/intel_pstate/run.sh
index 7868c106b8b1..d3ab48f91cd6 100755
--- a/tools/testing/selftests/intel_pstate/run.sh
+++ b/tools/testing/selftests/intel_pstate/run.sh
@@ -29,13 +29,12 @@
 
 EVALUATE_ONLY=0
 
-max_cpus=$(($(nproc)-1))
+if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then
+        echo "$0 # Skipped: Test can only run on x86 architectures."
+        exit 0
+fi
 
-# compile programs
-gcc aperf.c -Wall -D_GNU_SOURCE -o aperf  -lm
-[ $? -ne 0 ] && echo "Problem compiling aperf.c." && exit 1
-gcc -o msr msr.c -lm
-[ $? -ne 0 ] && echo "Problem compiling msr.c." && exit 1
+max_cpus=$(($(nproc)-1))
 
 function run_test () {
 
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 693616651da5..f65886af7c0c 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -6,7 +6,14 @@ ifeq (0,$(MAKELEVEL))
 OUTPUT := $(shell pwd)
 endif
 
+# The following are built by lib.mk common compile rules.
+# TEST_CUSTOM_PROGS should be used by tests that require
+# custom build rule and prevent common build rule use.
+# TEST_PROGS are for test shell scripts.
+# TEST_CUSTOM_PROGS and TEST_PROGS will be run by common run_tests
+# and install targets. Common clean doesn't touch them.
 TEST_GEN_PROGS := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS))
+TEST_GEN_PROGS_EXTENDED := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_PROGS_EXTENDED))
 TEST_GEN_FILES := $(patsubst %,$(OUTPUT)/%,$(TEST_GEN_FILES))
 
 all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
@@ -20,17 +27,28 @@ define RUN_TESTS
                 test_num=`echo $$test_num+1 | bc`;      \
                 echo "selftests: $$BASENAME_TEST";      \
                 echo "========================================";        \
-                if [ ! -x $$BASENAME_TEST ]; then       \
+                if [ ! -x $$TEST ]; then        \
                         echo "selftests: Warning: file $$BASENAME_TEST is not executable, correct this.";\
                         echo "not ok 1..$$test_num selftests: $$BASENAME_TEST [FAIL]"; \
                 else                                    \
-                        cd `dirname $$TEST` > /dev/null; (./$$BASENAME_TEST && echo "ok 1..$$test_num selftests: $$BASENAME_TEST [PASS]") || echo "not ok 1..$$test_num selftests:  $$BASENAME_TEST [FAIL]"; cd - > /dev/null;\
+                        cd `dirname $$TEST` > /dev/null; (./$$BASENAME_TEST > /tmp/$$BASENAME_TEST 2>&1 && echo "ok 1..$$test_num selftests: $$BASENAME_TEST [PASS]") || echo "not ok 1..$$test_num selftests:  $$BASENAME_TEST [FAIL]"; cd - > /dev/null;\
                 fi;                                     \
         done;
 endef
 
 run_tests: all
-        $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_PROGS))
+ifneq ($(KBUILD_SRC),)
+        @if [ "X$(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES)" != "X" ]; then
+                @rsync -aq $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT)
+        fi
+        @if [ "X$(TEST_PROGS)" != "X" ]; then
+                $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(OUTPUT)/$(TEST_PROGS))
+        else
+                $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS))
+        fi
+else
+        $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_PROGS))
+endif
 
 define INSTALL_RULE
         @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then                                        \
@@ -38,10 +56,10 @@ define INSTALL_RULE
                 echo "rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/";    \
                 rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/;           \
         fi
-        @if [ "X$(TEST_GEN_PROGS)$(TEST_GEN_PROGS_EXTENDED)$(TEST_GEN_FILES)" != "X" ]; then                                    \
+        @if [ "X$(TEST_GEN_PROGS)$(TEST_CUSTOM_PROGS)$(TEST_GEN_PROGS_EXTENDED)$(TEST_GEN_FILES)" != "X" ]; then                                        \
                 mkdir -p ${INSTALL_PATH};                                                                               \
-                echo "rsync -a $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/";        \
-                rsync -a $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/;               \
+                echo "rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/";   \
+                rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/;          \
         fi
 endef
 
@@ -53,15 +71,20 @@ else
 endif
 
 define EMIT_TESTS
-        @for TEST in $(TEST_GEN_PROGS) $(TEST_PROGS); do \
+        @for TEST in $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_PROGS); do \
                 BASENAME_TEST=`basename $$TEST`;        \
-                echo "(./$$BASENAME_TEST && echo \"selftests: $$BASENAME_TEST [PASS]\") || echo \"selftests: $$BASENAME_TEST [FAIL]\""; \
+                echo "(./$$BASENAME_TEST > /tmp/$$BASENAME_TEST 2>&1 && echo \"selftests: $$BASENAME_TEST [PASS]\") || echo \"selftests: $$BASENAME_TEST [FAIL]\""; \
         done;
 endef
 
 emit_tests:
         $(EMIT_TESTS)
 
+# define if isn't already. It is undefined in make O= case.
+ifeq ($(RM),)
+RM := rm -f
+endif
+
 define CLEAN
         $(RM) -r $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(EXTRA_CLEAN)
 endef
@@ -69,6 +92,15 @@ endef
 clean:
         $(CLEAN)
 
+# When make O= with kselftest target from main level
+# the following aren't defined.
+#
+ifneq ($(KBUILD_SRC),)
+LINK.c = $(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH)
+COMPILE.S = $(CC) $(ASFLAGS) $(CPPFLAGS) $(TARGET_ARCH) -c
+LINK.S = $(CC) $(ASFLAGS) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH)
+endif
+
 $(OUTPUT)/%:%.c
         $(LINK.c) $^ $(LDLIBS) -o $@
 
diff --git a/tools/testing/selftests/memfd/run_tests.sh b/tools/testing/selftests/memfd/run_tests.sh
index daabb350697c..daabb350697c 100644..100755
--- a/tools/testing/selftests/memfd/run_tests.sh
+++ b/tools/testing/selftests/memfd/run_tests.sh
diff --git a/tools/testing/selftests/mqueue/Makefile b/tools/testing/selftests/mqueue/Makefile
index 79a664aeb8d7..0f5e347b068d 100644
--- a/tools/testing/selftests/mqueue/Makefile
+++ b/tools/testing/selftests/mqueue/Makefile
@@ -5,8 +5,8 @@ TEST_GEN_PROGS := mq_open_tests mq_perf_tests
 include ../lib.mk
 
 override define RUN_TESTS
-        @./mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
-        @./mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
+        $(OUTPUT)/mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
+        $(OUTPUT)//mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
 endef
 
 override define EMIT_TESTS
diff --git a/tools/testing/selftests/net/.gitignore b/tools/testing/selftests/net/.gitignore
index 9801253e4802..c612d6e38c62 100644
--- a/tools/testing/selftests/net/.gitignore
+++ b/tools/testing/selftests/net/.gitignore
@@ -6,3 +6,4 @@ reuseport_bpf
 reuseport_bpf_cpu
 reuseport_bpf_numa
 reuseport_dualstack
+reuseaddr_conflict
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index de1f5772b878..d86bca991f45 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,9 +5,9 @@ CFLAGS += -I../../../../usr/include/
 
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
 TEST_GEN_FILES =  socket
-TEST_GEN_FILES += psock_fanout psock_tpacket
-TEST_GEN_FILES += reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
-TEST_GEN_FILES += reuseport_dualstack msg_zerocopy
+TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
+TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
+TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict
 
 include ../lib.mk
 
diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
index 40232af5b023..3ab6ec403905 100644
--- a/tools/testing/selftests/net/msg_zerocopy.c
+++ b/tools/testing/selftests/net/msg_zerocopy.c
@@ -55,7 +55,7 @@
 #include <unistd.h>
 
 #ifndef SO_EE_ORIGIN_ZEROCOPY
-#define SO_EE_ORIGIN_ZEROCOPY           SO_EE_ORIGIN_UPAGE
+#define SO_EE_ORIGIN_ZEROCOPY           5
 #endif
 
 #ifndef SO_ZEROCOPY
diff --git a/tools/testing/selftests/net/netdevice.sh b/tools/testing/selftests/net/netdevice.sh
index 4e00568d70c2..90cb903c3381 100755
--- a/tools/testing/selftests/net/netdevice.sh
+++ b/tools/testing/selftests/net/netdevice.sh
@@ -178,7 +178,7 @@ if [ "$(id -u)" -ne 0 ];then
         exit 0
 fi
 
-ip -Version 2>/dev/null >/dev/null
+ip link show 2>/dev/null >/dev/null
 if [ $? -ne 0 ];then
         echo "SKIP: Could not run test without the ip tool"
         exit 0
diff --git a/tools/testing/selftests/net/reuseaddr_conflict.c b/tools/testing/selftests/net/reuseaddr_conflict.c
new file mode 100644
index 000000000000..7c5b12664b03
--- /dev/null
+++ b/tools/testing/selftests/net/reuseaddr_conflict.c
@@ -0,0 +1,114 @@
+/*
+ * Test for the regression introduced by
+ *
+ * b9470c27607b ("inet: kill smallest_size and smallest_port")
+ *
+ * If we open an ipv4 socket on a port with reuseaddr we shouldn't reset the tb
+ * when we open the ipv6 conterpart, which is what was happening previously.
+ */
+#include <errno.h>
+#include <error.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define PORT 9999
+
+int open_port(int ipv6, int any)
+{
+        int fd = -1;
+        int reuseaddr = 1;
+        int v6only = 1;
+        int addrlen;
+        int ret = -1;
+        struct sockaddr *addr;
+        int family = ipv6 ? AF_INET6 : AF_INET;
+
+        struct sockaddr_in6 addr6 = {
+                .sin6_family = AF_INET6,
+                .sin6_port = htons(PORT),
+                .sin6_addr = in6addr_any
+        };
+        struct sockaddr_in addr4 = {
+                .sin_family = AF_INET,
+                .sin_port = htons(PORT),
+                .sin_addr.s_addr = any ? htonl(INADDR_ANY) : inet_addr("127.0.0.1"),
+        };
+
+
+        if (ipv6) {
+                addr = (struct sockaddr*)&addr6;
+                addrlen = sizeof(addr6);
+        } else {
+                addr = (struct sockaddr*)&addr4;
+                addrlen = sizeof(addr4);
+        }
+
+        if ((fd = socket(family, SOCK_STREAM, IPPROTO_TCP)) < 0) {
+                perror("socket");
+                goto out;
+        }
+
+        if (ipv6 && setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, (void*)&v6only,
+                               sizeof(v6only)) < 0) {
+                perror("setsockopt IPV6_V6ONLY");
+                goto out;
+        }
+
+        if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &reuseaddr,
+                       sizeof(reuseaddr)) < 0) {
+                perror("setsockopt SO_REUSEADDR");
+                goto out;
+        }
+
+        if (bind(fd, addr, addrlen) < 0) {
+                perror("bind");
+                goto out;
+        }
+
+        if (any)
+                return fd;
+
+        if (listen(fd, 1) < 0) {
+                perror("listen");
+                goto out;
+        }
+        return fd;
+out:
+        close(fd);
+        return ret;
+}
+
+int main(void)
+{
+        int listenfd;
+        int fd1, fd2;
+
+        fprintf(stderr, "Opening 127.0.0.1:%d\n", PORT);
+        listenfd = open_port(0, 0);
+        if (listenfd < 0)
+                error(1, errno, "Couldn't open listen socket");
+        fprintf(stderr, "Opening INADDR_ANY:%d\n", PORT);
+        fd1 = open_port(0, 1);
+        if (fd1 >= 0)
+                error(1, 0, "Was allowed to create an ipv4 reuseport on a already bound non-reuseport socket");
+        fprintf(stderr, "Opening in6addr_any:%d\n", PORT);
+        fd1 = open_port(1, 1);
+        if (fd1 < 0)
+                error(1, errno, "Couldn't open ipv6 reuseport");
+        fprintf(stderr, "Opening INADDR_ANY:%d\n", PORT);
+        fd2 = open_port(0, 1);
+        if (fd2 >= 0)
+                error(1, 0, "Was allowed to create an ipv4 reuseport on a already bound non-reuseport socket");
+        close(fd1);
+        fprintf(stderr, "Opening INADDR_ANY:%d after closing ipv6 socket\n", PORT);
+        fd1 = open_port(0, 1);
+        if (fd1 >= 0)
+                error(1, 0, "Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6");
+        fprintf(stderr, "Success");
+        return 0;
+}
diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
index aeb0c805f3ca..553d870b4ca9 100644
--- a/tools/testing/selftests/seccomp/Makefile
+++ b/tools/testing/selftests/seccomp/Makefile
@@ -1,8 +1,16 @@
-TEST_GEN_PROGS := seccomp_bpf
-CFLAGS += -Wl,-no-as-needed -Wall
-LDFLAGS += -lpthread
+all:
 
 include ../lib.mk
 
-$(TEST_GEN_PROGS): seccomp_bpf.c ../kselftest_harness.h
-        $(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
+.PHONY: all clean
+
+BINARIES := seccomp_bpf seccomp_benchmark
+CFLAGS += -Wl,-no-as-needed -Wall
+
+seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
+        $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
+
+TEST_PROGS += $(BINARIES)
+EXTRA_CLEAN := $(BINARIES)
+
+all: $(BINARIES)
diff --git a/tools/testing/selftests/seccomp/seccomp_benchmark.c b/tools/testing/selftests/seccomp/seccomp_benchmark.c
new file mode 100644
index 000000000000..5838c8697ec3
--- /dev/null
+++ b/tools/testing/selftests/seccomp/seccomp_benchmark.c
@@ -0,0 +1,99 @@
+/*
+ * Strictly speaking, this is not a test. But it can report during test
+ * runs so relative performace can be measured.
+ */
+#define _GNU_SOURCE
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+
+#define ARRAY_SIZE(a)    (sizeof(a) / sizeof(a[0]))
+
+unsigned long long timing(clockid_t clk_id, unsigned long long samples)
+{
+        pid_t pid, ret;
+        unsigned long long i;
+        struct timespec start, finish;
+
+        pid = getpid();
+        assert(clock_gettime(clk_id, &start) == 0);
+        for (i = 0; i < samples; i++) {
+                ret = syscall(__NR_getpid);
+                assert(pid == ret);
+        }
+        assert(clock_gettime(clk_id, &finish) == 0);
+
+        i = finish.tv_sec - start.tv_sec;
+        i *= 1000000000;
+        i += finish.tv_nsec - start.tv_nsec;
+
+        printf("%lu.%09lu - %lu.%09lu = %llu\n",
+                finish.tv_sec, finish.tv_nsec,
+                start.tv_sec, start.tv_nsec,
+                i);
+
+        return i;
+}
+
+unsigned long long calibrate(void)
+{
+        unsigned long long i;
+
+        printf("Calibrating reasonable sample size...\n");
+
+        for (i = 5; ; i++) {
+                unsigned long long samples = 1 << i;
+
+                /* Find something that takes more than 5 seconds to run. */
+                if (timing(CLOCK_REALTIME, samples) / 1000000000ULL > 5)
+                        return samples;
+        }
+}
+
+int main(int argc, char *argv[])
+{
+        struct sock_filter filter[] = {
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+        };
+        struct sock_fprog prog = {
+                .len = (unsigned short)ARRAY_SIZE(filter),
+                .filter = filter,
+        };
+        long ret;
+        unsigned long long samples;
+        unsigned long long native, filtered;
+
+        if (argc > 1)
+                samples = strtoull(argv[1], NULL, 0);
+        else
+                samples = calibrate();
+
+        printf("Benchmarking %llu samples...\n", samples);
+
+        native = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
+        printf("getpid native: %llu ns\n", native);
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        assert(ret == 0);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+        assert(ret == 0);
+
+        filtered = timing(CLOCK_PROCESS_CPUTIME_ID, samples) / samples;
+        printf("getpid RET_ALLOW: %llu ns\n", filtered);
+
+        printf("Estimated seccomp overhead per syscall: %llu ns\n",
+                filtered - native);
+
+        if (filtered == native)
+                printf("Trying running again with more samples.\n");
+
+        return 0;
+}
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 4d6f92a9df6b..24dbf634e2dd 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -6,10 +6,18 @@
  */
 
 #include <sys/types.h>
-#include <asm/siginfo.h>
-#define __have_siginfo_t 1
-#define __have_sigval_t 1
-#define __have_sigevent_t 1
+
+/*
+ * glibc 2.26 and later have SIGSYS in siginfo_t. Before that,
+ * we need to use the kernel's siginfo.h file and trick glibc
+ * into accepting it.
+ */
+#if !__GLIBC_PREREQ(2, 26)
+# include <asm/siginfo.h>
+# define __have_siginfo_t 1
+# define __have_sigval_t 1
+# define __have_sigevent_t 1
+#endif
 
 #include <errno.h>
 #include <linux/filter.h>
@@ -68,17 +76,7 @@
 #define SECCOMP_MODE_FILTER 2
 #endif
 
-#ifndef SECCOMP_RET_KILL
-#define SECCOMP_RET_KILL        0x00000000U /* kill the task immediately */
-#define SECCOMP_RET_TRAP        0x00030000U /* disallow and force a SIGSYS */
-#define SECCOMP_RET_ERRNO       0x00050000U /* returns an errno */
-#define SECCOMP_RET_TRACE       0x7ff00000U /* pass to a tracer or disallow */
-#define SECCOMP_RET_ALLOW       0x7fff0000U /* allow */
-
-/* Masks for the return value sections. */
-#define SECCOMP_RET_ACTION      0x7fff0000U
-#define SECCOMP_RET_DATA        0x0000ffffU
-
+#ifndef SECCOMP_RET_ALLOW
 struct seccomp_data {
         int nr;
         __u32 arch;
@@ -87,6 +85,70 @@ struct seccomp_data {
 };
 #endif
 
+#ifndef SECCOMP_RET_KILL_PROCESS
+#define SECCOMP_RET_KILL_PROCESS 0x80000000U /* kill the process */
+#define SECCOMP_RET_KILL_THREAD  0x00000000U /* kill the thread */
+#endif
+#ifndef SECCOMP_RET_KILL
+#define SECCOMP_RET_KILL         SECCOMP_RET_KILL_THREAD
+#define SECCOMP_RET_TRAP         0x00030000U /* disallow and force a SIGSYS */
+#define SECCOMP_RET_ERRNO        0x00050000U /* returns an errno */
+#define SECCOMP_RET_TRACE        0x7ff00000U /* pass to a tracer or disallow */
+#define SECCOMP_RET_ALLOW        0x7fff0000U /* allow */
+#endif
+#ifndef SECCOMP_RET_LOG
+#define SECCOMP_RET_LOG          0x7ffc0000U /* allow after logging */
+#endif
+
+#ifndef __NR_seccomp
+# if defined(__i386__)
+#  define __NR_seccomp 354
+# elif defined(__x86_64__)
+#  define __NR_seccomp 317
+# elif defined(__arm__)
+#  define __NR_seccomp 383
+# elif defined(__aarch64__)
+#  define __NR_seccomp 277
+# elif defined(__hppa__)
+#  define __NR_seccomp 338
+# elif defined(__powerpc__)
+#  define __NR_seccomp 358
+# elif defined(__s390__)
+#  define __NR_seccomp 348
+# else
+#  warning "seccomp syscall number unknown for this architecture"
+#  define __NR_seccomp 0xffff
+# endif
+#endif
+
+#ifndef SECCOMP_SET_MODE_STRICT
+#define SECCOMP_SET_MODE_STRICT 0
+#endif
+
+#ifndef SECCOMP_SET_MODE_FILTER
+#define SECCOMP_SET_MODE_FILTER 1
+#endif
+
+#ifndef SECCOMP_GET_ACTION_AVAIL
+#define SECCOMP_GET_ACTION_AVAIL 2
+#endif
+
+#ifndef SECCOMP_FILTER_FLAG_TSYNC
+#define SECCOMP_FILTER_FLAG_TSYNC 1
+#endif
+
+#ifndef SECCOMP_FILTER_FLAG_LOG
+#define SECCOMP_FILTER_FLAG_LOG 2
+#endif
+
+#ifndef seccomp
+int seccomp(unsigned int op, unsigned int flags, void *args)
+{
+        errno = 0;
+        return syscall(__NR_seccomp, op, flags, args);
+}
+#endif
+
 #if __BYTE_ORDER == __LITTLE_ENDIAN
 #define syscall_arg(_n) (offsetof(struct seccomp_data, args[_n]))
 #elif __BYTE_ORDER == __BIG_ENDIAN
@@ -136,7 +198,7 @@ TEST(no_new_privs_support)
         }
 }
 
-/* Tests kernel support by checking for a copy_from_user() fault on * NULL. */
+/* Tests kernel support by checking for a copy_from_user() fault on NULL. */
 TEST(mode_filter_support)
 {
         long ret;
@@ -342,6 +404,28 @@ TEST(empty_prog)
         EXPECT_EQ(EINVAL, errno);
 }
 
+TEST(log_all)
+{
+        struct sock_filter filter[] = {
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
+        };
+        struct sock_fprog prog = {
+                .len = (unsigned short)ARRAY_SIZE(filter),
+                .filter = filter,
+        };
+        long ret;
+        pid_t parent = getppid();
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+        ASSERT_EQ(0, ret);
+
+        /* getppid() should succeed and be logged (no check for logging) */
+        EXPECT_EQ(parent, syscall(__NR_getppid));
+}
+
 TEST_SIGNAL(unknown_ret_is_kill_inside, SIGSYS)
 {
         struct sock_filter filter[] = {
@@ -520,6 +604,117 @@ TEST_SIGNAL(KILL_one_arg_six, SIGSYS)
         close(fd);
 }
 
+/* This is a thread task to die via seccomp filter violation. */
+void *kill_thread(void *data)
+{
+        bool die = (bool)data;
+
+        if (die) {
+                prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
+                return (void *)SIBLING_EXIT_FAILURE;
+        }
+
+        return (void *)SIBLING_EXIT_UNKILLED;
+}
+
+/* Prepare a thread that will kill itself or both of us. */
+void kill_thread_or_group(struct __test_metadata *_metadata, bool kill_process)
+{
+        pthread_t thread;
+        void *status;
+        /* Kill only when calling __NR_prctl. */
+        struct sock_filter filter_thread[] = {
+                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
+                        offsetof(struct seccomp_data, nr)),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_THREAD),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+        };
+        struct sock_fprog prog_thread = {
+                .len = (unsigned short)ARRAY_SIZE(filter_thread),
+                .filter = filter_thread,
+        };
+        struct sock_filter filter_process[] = {
+                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
+                        offsetof(struct seccomp_data, nr)),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_prctl, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL_PROCESS),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+        };
+        struct sock_fprog prog_process = {
+                .len = (unsigned short)ARRAY_SIZE(filter_process),
+                .filter = filter_process,
+        };
+
+        ASSERT_EQ(0, prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
+                TH_LOG("Kernel does not support PR_SET_NO_NEW_PRIVS!");
+        }
+
+        ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0,
+                             kill_process ? &prog_process : &prog_thread));
+
+        /*
+         * Add the KILL_THREAD rule again to make sure that the KILL_PROCESS
+         * flag cannot be downgraded by a new filter.
+         */
+        ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog_thread));
+
+        /* Start a thread that will exit immediately. */
+        ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)false));
+        ASSERT_EQ(0, pthread_join(thread, &status));
+        ASSERT_EQ(SIBLING_EXIT_UNKILLED, (unsigned long)status);
+
+        /* Start a thread that will die immediately. */
+        ASSERT_EQ(0, pthread_create(&thread, NULL, kill_thread, (void *)true));
+        ASSERT_EQ(0, pthread_join(thread, &status));
+        ASSERT_NE(SIBLING_EXIT_FAILURE, (unsigned long)status);
+
+        /*
+         * If we get here, only the spawned thread died. Let the parent know
+         * the whole process didn't die (i.e. this thread, the spawner,
+         * stayed running).
+         */
+        exit(42);
+}
+
+TEST(KILL_thread)
+{
+        int status;
+        pid_t child_pid;
+
+        child_pid = fork();
+        ASSERT_LE(0, child_pid);
+        if (child_pid == 0) {
+                kill_thread_or_group(_metadata, false);
+                _exit(38);
+        }
+
+        ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
+
+        /* If only the thread was killed, we'll see exit 42. */
+        ASSERT_TRUE(WIFEXITED(status));
+        ASSERT_EQ(42, WEXITSTATUS(status));
+}
+
+TEST(KILL_process)
+{
+        int status;
+        pid_t child_pid;
+
+        child_pid = fork();
+        ASSERT_LE(0, child_pid);
+        if (child_pid == 0) {
+                kill_thread_or_group(_metadata, true);
+                _exit(38);
+        }
+
+        ASSERT_EQ(child_pid, waitpid(child_pid, &status, 0));
+
+        /* If the entire process was killed, we'll see SIGSYS. */
+        ASSERT_TRUE(WIFSIGNALED(status));
+        ASSERT_EQ(SIGSYS, WTERMSIG(status));
+}
+
 /* TODO(wad) add 64-bit versus 32-bit arg tests. */
 TEST(arg_out_of_range)
 {
@@ -541,26 +736,30 @@ TEST(arg_out_of_range)
         EXPECT_EQ(EINVAL, errno);
 }
 
+#define ERRNO_FILTER(name, errno)                                       \
+        struct sock_filter _read_filter_##name[] = {                    \
+                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,                          \
+                        offsetof(struct seccomp_data, nr)),             \
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),       \
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | errno),     \
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),             \
+        };                                                              \
+        struct sock_fprog prog_##name = {                               \
+                .len = (unsigned short)ARRAY_SIZE(_read_filter_##name), \
+                .filter = _read_filter_##name,                          \
+        }
+
+/* Make sure basic errno values are correctly passed through a filter. */
 TEST(ERRNO_valid)
 {
-        struct sock_filter filter[] = {
-                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
-                        offsetof(struct seccomp_data, nr)),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
-                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | E2BIG),
-                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
-        };
-        struct sock_fprog prog = {
-                .len = (unsigned short)ARRAY_SIZE(filter),
-                .filter = filter,
-        };
+        ERRNO_FILTER(valid, E2BIG);
         long ret;
         pid_t parent = getppid();
 
         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
         ASSERT_EQ(0, ret);
 
-        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_valid);
         ASSERT_EQ(0, ret);
 
         EXPECT_EQ(parent, syscall(__NR_getppid));
@@ -568,26 +767,17 @@ TEST(ERRNO_valid)
         EXPECT_EQ(E2BIG, errno);
 }
 
+/* Make sure an errno of zero is correctly handled by the arch code. */
 TEST(ERRNO_zero)
 {
-        struct sock_filter filter[] = {
-                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
-                        offsetof(struct seccomp_data, nr)),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
-                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | 0),
-                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
-        };
-        struct sock_fprog prog = {
-                .len = (unsigned short)ARRAY_SIZE(filter),
-                .filter = filter,
-        };
+        ERRNO_FILTER(zero, 0);
         long ret;
         pid_t parent = getppid();
 
         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
         ASSERT_EQ(0, ret);
 
-        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_zero);
         ASSERT_EQ(0, ret);
 
         EXPECT_EQ(parent, syscall(__NR_getppid));
@@ -595,26 +785,21 @@ TEST(ERRNO_zero)
         EXPECT_EQ(0, read(0, NULL, 0));
 }
 
+/*
+ * The SECCOMP_RET_DATA mask is 16 bits wide, but errno is smaller.
+ * This tests that the errno value gets capped correctly, fixed by
+ * 580c57f10768 ("seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO").
+ */
 TEST(ERRNO_capped)
 {
-        struct sock_filter filter[] = {
-                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
-                        offsetof(struct seccomp_data, nr)),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_read, 0, 1),
-                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ERRNO | 4096),
-                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
-        };
-        struct sock_fprog prog = {
-                .len = (unsigned short)ARRAY_SIZE(filter),
-                .filter = filter,
-        };
+        ERRNO_FILTER(capped, 4096);
         long ret;
         pid_t parent = getppid();
 
         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
         ASSERT_EQ(0, ret);
 
-        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_capped);
         ASSERT_EQ(0, ret);
 
         EXPECT_EQ(parent, syscall(__NR_getppid));
@@ -622,6 +807,37 @@ TEST(ERRNO_capped)
         EXPECT_EQ(4095, errno);
 }
 
+/*
+ * Filters are processed in reverse order: last applied is executed first.
+ * Since only the SECCOMP_RET_ACTION mask is tested for return values, the
+ * SECCOMP_RET_DATA mask results will follow the most recently applied
+ * matching filter return (and not the lowest or highest value).
+ */
+TEST(ERRNO_order)
+{
+        ERRNO_FILTER(first,  11);
+        ERRNO_FILTER(second, 13);
+        ERRNO_FILTER(third,  12);
+        long ret;
+        pid_t parent = getppid();
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_first);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_second);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog_third);
+        ASSERT_EQ(0, ret);
+
+        EXPECT_EQ(parent, syscall(__NR_getppid));
+        EXPECT_EQ(-1, read(0, NULL, 0));
+        EXPECT_EQ(12, errno);
+}
+
 FIXTURE_DATA(TRAP) {
         struct sock_fprog prog;
 };
@@ -676,7 +892,7 @@ TEST_F_SIGNAL(TRAP, ign, SIGSYS)
         syscall(__NR_getpid);
 }
 
-static struct siginfo TRAP_info;
+static siginfo_t TRAP_info;
 static volatile int TRAP_nr;
 static void TRAP_action(int nr, siginfo_t *info, void *void_context)
 {
@@ -735,6 +951,7 @@ TEST_F(TRAP, handler)
 
 FIXTURE_DATA(precedence) {
         struct sock_fprog allow;
+        struct sock_fprog log;
         struct sock_fprog trace;
         struct sock_fprog error;
         struct sock_fprog trap;
@@ -746,6 +963,13 @@ FIXTURE_SETUP(precedence)
         struct sock_filter allow_insns[] = {
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
         };
+        struct sock_filter log_insns[] = {
+                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
+                        offsetof(struct seccomp_data, nr)),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 1, 0),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_LOG),
+        };
         struct sock_filter trace_insns[] = {
                 BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
                         offsetof(struct seccomp_data, nr)),
@@ -782,6 +1006,7 @@ FIXTURE_SETUP(precedence)
         memcpy(self->_x.filter, &_x##_insns, sizeof(_x##_insns)); \
         self->_x.len = (unsigned short)ARRAY_SIZE(_x##_insns)
         FILTER_ALLOC(allow);
+        FILTER_ALLOC(log);
         FILTER_ALLOC(trace);
         FILTER_ALLOC(error);
         FILTER_ALLOC(trap);
@@ -792,6 +1017,7 @@ FIXTURE_TEARDOWN(precedence)
 {
 #define FILTER_FREE(_x) if (self->_x.filter) free(self->_x.filter)
         FILTER_FREE(allow);
+        FILTER_FREE(log);
         FILTER_FREE(trace);
         FILTER_FREE(error);
         FILTER_FREE(trap);
@@ -809,6 +1035,8 @@ TEST_F(precedence, allow_ok)
 
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
@@ -833,6 +1061,8 @@ TEST_F_SIGNAL(precedence, kill_is_highest, SIGSYS)
 
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
@@ -864,6 +1094,8 @@ TEST_F_SIGNAL(precedence, kill_is_highest_in_any_order, SIGSYS)
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
@@ -885,6 +1117,8 @@ TEST_F_SIGNAL(precedence, trap_is_second, SIGSYS)
 
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
@@ -910,6 +1144,8 @@ TEST_F_SIGNAL(precedence, trap_is_second_in_any_order, SIGSYS)
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trap);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
@@ -931,6 +1167,8 @@ TEST_F(precedence, errno_is_third)
 
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
@@ -949,6 +1187,8 @@ TEST_F(precedence, errno_is_third_in_any_order)
         ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
         ASSERT_EQ(0, ret);
 
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->error);
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
@@ -971,6 +1211,8 @@ TEST_F(precedence, trace_is_fourth)
 
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->trace);
         ASSERT_EQ(0, ret);
         /* Should work just fine. */
@@ -992,12 +1234,54 @@ TEST_F(precedence, trace_is_fourth_in_any_order)
         ASSERT_EQ(0, ret);
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
         ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
         /* Should work just fine. */
         EXPECT_EQ(parent, syscall(__NR_getppid));
         /* No ptracer */
         EXPECT_EQ(-1, syscall(__NR_getpid));
 }
 
+TEST_F(precedence, log_is_fifth)
+{
+        pid_t mypid, parent;
+        long ret;
+
+        mypid = getpid();
+        parent = getppid();
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
+        ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
+        /* Should work just fine. */
+        EXPECT_EQ(parent, syscall(__NR_getppid));
+        /* Should also work just fine */
+        EXPECT_EQ(mypid, syscall(__NR_getpid));
+}
+
+TEST_F(precedence, log_is_fifth_in_any_order)
+{
+        pid_t mypid, parent;
+        long ret;
+
+        mypid = getpid();
+        parent = getppid();
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->log);
+        ASSERT_EQ(0, ret);
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->allow);
+        ASSERT_EQ(0, ret);
+        /* Should work just fine. */
+        EXPECT_EQ(parent, syscall(__NR_getppid));
+        /* Should also work just fine */
+        EXPECT_EQ(mypid, syscall(__NR_getpid));
+}
+
 #ifndef PTRACE_O_TRACESECCOMP
 #define PTRACE_O_TRACESECCOMP   0x00000080
 #endif
@@ -1262,6 +1546,13 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 # error "Do not know how to find your architecture's registers and syscalls"
 #endif
 
+/* When the syscall return can't be changed, stub out the tests for it. */
+#ifdef SYSCALL_NUM_RET_SHARE_REG
+# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
+#else
+# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
+#endif
+
 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
  * architectures without HAVE_ARCH_TRACEHOOK (e.g. User-mode Linux).
  */
@@ -1357,7 +1648,7 @@ void change_syscall(struct __test_metadata *_metadata,
 #ifdef SYSCALL_NUM_RET_SHARE_REG
                 TH_LOG("Can't modify syscall return on this architecture");
 #else
-                regs.SYSCALL_RET = 1;
+                regs.SYSCALL_RET = EPERM;
 #endif
 
 #ifdef HAVE_GETREGS
@@ -1426,6 +1717,8 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
 
         if (nr == __NR_getpid)
                 change_syscall(_metadata, tracee, __NR_getppid);
+        if (nr == __NR_open)
+                change_syscall(_metadata, tracee, -1);
 }
 
 FIXTURE_DATA(TRACE_syscall) {
@@ -1480,6 +1773,28 @@ FIXTURE_TEARDOWN(TRACE_syscall)
                 free(self->prog.filter);
 }
 
+TEST_F(TRACE_syscall, ptrace_syscall_redirected)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+
+        /* Tracer will redirect getpid to getppid. */
+        EXPECT_NE(self->mypid, syscall(__NR_getpid));
+}
+
+TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+
+        /* Tracer should skip the open syscall, resulting in EPERM. */
+        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_open));
+}
+
 TEST_F(TRACE_syscall, syscall_allowed)
 {
         long ret;
@@ -1520,13 +1835,8 @@ TEST_F(TRACE_syscall, syscall_dropped)
         ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
         ASSERT_EQ(0, ret);
 
-#ifdef SYSCALL_NUM_RET_SHARE_REG
-        /* gettid has been skipped */
-        EXPECT_EQ(-1, syscall(__NR_gettid));
-#else
         /* gettid has been skipped and an altered return value stored. */
-        EXPECT_EQ(1, syscall(__NR_gettid));
-#endif
+        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
         EXPECT_NE(self->mytid, syscall(__NR_gettid));
 }
 
@@ -1557,6 +1867,7 @@ TEST_F(TRACE_syscall, skip_after_RET_TRACE)
         ASSERT_EQ(0, ret);
 
         /* Tracer will redirect getpid to getppid, and we should see EPERM. */
+        errno = 0;
         EXPECT_EQ(-1, syscall(__NR_getpid));
         EXPECT_EQ(EPERM, errno);
 }
@@ -1654,47 +1965,6 @@ TEST_F_SIGNAL(TRACE_syscall, kill_after_ptrace, SIGSYS)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-#ifndef __NR_seccomp
-# if defined(__i386__)
-#  define __NR_seccomp 354
-# elif defined(__x86_64__)
-#  define __NR_seccomp 317
-# elif defined(__arm__)
-#  define __NR_seccomp 383
-# elif defined(__aarch64__)
-#  define __NR_seccomp 277
-# elif defined(__hppa__)
-#  define __NR_seccomp 338
-# elif defined(__powerpc__)
-#  define __NR_seccomp 358
-# elif defined(__s390__)
-#  define __NR_seccomp 348
-# else
-#  warning "seccomp syscall number unknown for this architecture"
-#  define __NR_seccomp 0xffff
-# endif
-#endif
-
-#ifndef SECCOMP_SET_MODE_STRICT
-#define SECCOMP_SET_MODE_STRICT 0
-#endif
-
-#ifndef SECCOMP_SET_MODE_FILTER
-#define SECCOMP_SET_MODE_FILTER 1
-#endif
-
-#ifndef SECCOMP_FILTER_FLAG_TSYNC
-#define SECCOMP_FILTER_FLAG_TSYNC 1
-#endif
-
-#ifndef seccomp
-int seccomp(unsigned int op, unsigned int flags, void *args)
-{
-        errno = 0;
-        return syscall(__NR_seccomp, op, flags, args);
-}
-#endif
-
 TEST(seccomp_syscall)
 {
         struct sock_filter filter[] = {
@@ -1783,6 +2053,67 @@ TEST(seccomp_syscall_mode_lock)
         }
 }
 
+/*
+ * Test detection of known and unknown filter flags. Userspace needs to be able
+ * to check if a filter flag is supported by the current kernel and a good way
+ * of doing that is by attempting to enter filter mode, with the flag bit in
+ * question set, and a NULL pointer for the _args_ parameter. EFAULT indicates
+ * that the flag is valid and EINVAL indicates that the flag is invalid.
+ */
+TEST(detect_seccomp_filter_flags)
+{
+        unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC,
+                                 SECCOMP_FILTER_FLAG_LOG };
+        unsigned int flag, all_flags;
+        int i;
+        long ret;
+
+        /* Test detection of known-good filter flags */
+        for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) {
+                flag = flags[i];
+                ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
+                ASSERT_NE(ENOSYS, errno) {
+                        TH_LOG("Kernel does not support seccomp syscall!");
+                }
+                EXPECT_EQ(-1, ret);
+                EXPECT_EQ(EFAULT, errno) {
+                        TH_LOG("Failed to detect that a known-good filter flag (0x%X) is supported!",
+                               flag);
+                }
+
+                all_flags |= flag;
+        }
+
+        /* Test detection of all known-good filter flags */
+        ret = seccomp(SECCOMP_SET_MODE_FILTER, all_flags, NULL);
+        EXPECT_EQ(-1, ret);
+        EXPECT_EQ(EFAULT, errno) {
+                TH_LOG("Failed to detect that all known-good filter flags (0x%X) are supported!",
+                       all_flags);
+        }
+
+        /* Test detection of an unknown filter flag */
+        flag = -1;
+        ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
+        EXPECT_EQ(-1, ret);
+        EXPECT_EQ(EINVAL, errno) {
+                TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported!",
+                       flag);
+        }
+
+        /*
+         * Test detection of an unknown filter flag that may simply need to be
+         * added to this test
+         */
+        flag = flags[ARRAY_SIZE(flags) - 1] << 1;
+        ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL);
+        EXPECT_EQ(-1, ret);
+        EXPECT_EQ(EINVAL, errno) {
+                TH_LOG("Failed to detect that an unknown filter flag (0x%X) is unsupported! Does a new flag need to be added to this test?",
+                       flag);
+        }
+}
+
 TEST(TSYNC_first)
 {
         struct sock_filter filter[] = {
@@ -2421,6 +2752,99 @@ TEST(syscall_restart)
                 _metadata->passed = 0;
 }
 
+TEST_SIGNAL(filter_flag_log, SIGSYS)
+{
+        struct sock_filter allow_filter[] = {
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+        };
+        struct sock_filter kill_filter[] = {
+                BPF_STMT(BPF_LD|BPF_W|BPF_ABS,
+                        offsetof(struct seccomp_data, nr)),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getpid, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_KILL),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
+        };
+        struct sock_fprog allow_prog = {
+                .len = (unsigned short)ARRAY_SIZE(allow_filter),
+                .filter = allow_filter,
+        };
+        struct sock_fprog kill_prog = {
+                .len = (unsigned short)ARRAY_SIZE(kill_filter),
+                .filter = kill_filter,
+        };
+        long ret;
+        pid_t parent = getppid();
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        /* Verify that the FILTER_FLAG_LOG flag isn't accepted in strict mode */
+        ret = seccomp(SECCOMP_SET_MODE_STRICT, SECCOMP_FILTER_FLAG_LOG,
+                      &allow_prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
+        EXPECT_NE(0, ret) {
+                TH_LOG("Kernel accepted FILTER_FLAG_LOG flag in strict mode!");
+        }
+        EXPECT_EQ(EINVAL, errno) {
+                TH_LOG("Kernel returned unexpected errno for FILTER_FLAG_LOG flag in strict mode!");
+        }
+
+        /* Verify that a simple, permissive filter can be added with no flags */
+        ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &allow_prog);
+        EXPECT_EQ(0, ret);
+
+        /* See if the same filter can be added with the FILTER_FLAG_LOG flag */
+        ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
+                      &allow_prog);
+        ASSERT_NE(EINVAL, errno) {
+                TH_LOG("Kernel does not support the FILTER_FLAG_LOG flag!");
+        }
+        EXPECT_EQ(0, ret);
+
+        /* Ensure that the kill filter works with the FILTER_FLAG_LOG flag */
+        ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG,
+                      &kill_prog);
+        EXPECT_EQ(0, ret);
+
+        EXPECT_EQ(parent, syscall(__NR_getppid));
+        /* getpid() should never return. */
+        EXPECT_EQ(0, syscall(__NR_getpid));
+}
+
+TEST(get_action_avail)
+{
+        __u32 actions[] = { SECCOMP_RET_KILL_THREAD, SECCOMP_RET_TRAP,
+                            SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE,
+                            SECCOMP_RET_LOG,   SECCOMP_RET_ALLOW };
+        __u32 unknown_action = 0x10000000U;
+        int i;
+        long ret;
+
+        ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[0]);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
+        ASSERT_NE(EINVAL, errno) {
+                TH_LOG("Kernel does not support SECCOMP_GET_ACTION_AVAIL operation!");
+        }
+        EXPECT_EQ(ret, 0);
+
+        for (i = 0; i < ARRAY_SIZE(actions); i++) {
+                ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &actions[i]);
+                EXPECT_EQ(ret, 0) {
+                        TH_LOG("Expected action (0x%X) not available!",
+                               actions[i]);
+                }
+        }
+
+        /* Check that an unknown action is handled properly (EOPNOTSUPP) */
+        ret = seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &unknown_action);
+        EXPECT_EQ(ret, -1);
+        EXPECT_EQ(errno, EOPNOTSUPP);
+}
+
 /*
  * TODO:
  * - add microbenchmarks
@@ -2429,6 +2853,8 @@ TEST(syscall_restart)
  * - endianness checking when appropriate
  * - 64-bit arg prodding
  * - arch value testing (x86 modes especially)
+ * - verify that FILTER_FLAG_LOG filters generate log messages
+ * - verify that RET_LOG generates log messages
  * - ...
  */
 
diff --git a/tools/testing/selftests/sigaltstack/sas.c b/tools/testing/selftests/sigaltstack/sas.c
index 7d406c3973ba..97bb150837df 100644
--- a/tools/testing/selftests/sigaltstack/sas.c
+++ b/tools/testing/selftests/sigaltstack/sas.c
@@ -39,7 +39,11 @@ void my_usr1(int sig, siginfo_t *si, void *u)
         stack_t stk;
         struct stk_data *p;
 
+#if __s390x__
+        register unsigned long sp asm("%15");
+#else
         register unsigned long sp asm("sp");
+#endif
 
         if (sp < (unsigned long)sstack ||
                         sp >= (unsigned long)sstack + SIGSTKSZ) {
diff --git a/tools/testing/selftests/sync/Makefile b/tools/testing/selftests/sync/Makefile
index 4981c6b6d050..8e04d0afcbd7 100644
--- a/tools/testing/selftests/sync/Makefile
+++ b/tools/testing/selftests/sync/Makefile
@@ -2,12 +2,16 @@ CFLAGS += -O2 -g -std=gnu89 -pthread -Wall -Wextra
 CFLAGS += -I../../../../usr/include/
 LDFLAGS += -pthread
 
-TEST_PROGS = sync_test
-
-all: $(TEST_PROGS)
+.PHONY: all clean
 
 include ../lib.mk
 
+# lib.mk TEST_CUSTOM_PROGS var is for custom tests that need special
+# build rules. lib.mk will run and install them.
+
+TEST_CUSTOM_PROGS := $(OUTPUT)/sync_test
+all: $(TEST_CUSTOM_PROGS)
+
 OBJS = sync_test.o sync.o
 
 TESTS += sync_alloc.o
@@ -18,6 +22,16 @@ TESTS += sync_stress_parallelism.o
 TESTS += sync_stress_consumer.o
 TESTS += sync_stress_merge.o
 
-sync_test: $(OBJS) $(TESTS)
+OBJS := $(patsubst %,$(OUTPUT)/%,$(OBJS))
+TESTS := $(patsubst %,$(OUTPUT)/%,$(TESTS))
+
+$(TEST_CUSTOM_PROGS): $(TESTS) $(OBJS)
+        $(CC) -o $(TEST_CUSTOM_PROGS) $(OBJS) $(TESTS) $(CFLAGS) $(LDFLAGS)
+
+$(OBJS): $(OUTPUT)/%.o: %.c
+        $(CC) -c $^ -o $@
+
+$(TESTS): $(OUTPUT)/%.o: %.c
+        $(CC) -c $^ -o $@
 
-EXTRA_CLEAN := sync_test $(OBJS) $(TESTS)
+EXTRA_CLEAN := $(TEST_CUSTOM_PROGS) $(OBJS) $(TESTS)
diff --git a/tools/testing/selftests/timers/set-timer-lat.c b/tools/testing/selftests/timers/set-timer-lat.c
index 9c92b7bd5641..50da45437daa 100644
--- a/tools/testing/selftests/timers/set-timer-lat.c
+++ b/tools/testing/selftests/timers/set-timer-lat.c
@@ -143,7 +143,8 @@ int setup_timer(int clock_id, int flags, int interval, timer_t *tm1)
                         printf("%-22s %s missing CAP_WAKE_ALARM?    : [UNSUPPORTED]\n",
                                         clockstring(clock_id),
                                         flags ? "ABSTIME":"RELTIME");
-                        return 0;
+                        /* Indicate timer isn't set, so caller doesn't wait */
+                        return 1;
                 }
                 printf("%s - timer_create() failed\n", clockstring(clock_id));
                 return -1;
@@ -213,8 +214,9 @@ int do_timer(int clock_id, int flags)
         int err;
 
         err = setup_timer(clock_id, flags, interval, &tm1);
+        /* Unsupported case - return 0 to not fail the test */
         if (err)
-                return err;
+                return err == 1 ? 0 : err;
 
         while (alarmcount < 5)
                 sleep(1);
@@ -228,18 +230,17 @@ int do_timer_oneshot(int clock_id, int flags)
         timer_t tm1;
         const int interval = 0;
         struct timeval timeout;
-        fd_set fds;
         int err;
 
         err = setup_timer(clock_id, flags, interval, &tm1);
+        /* Unsupported case - return 0 to not fail the test */
         if (err)
-                return err;
+                return err == 1 ? 0 : err;
 
         memset(&timeout, 0, sizeof(timeout));
         timeout.tv_sec = 5;
-        FD_ZERO(&fds);
         do {
-                err = select(FD_SETSIZE, &fds, NULL, NULL, &timeout);
+                err = select(0, NULL, NULL, NULL, &timeout);
         } while (err == -1 && errno == EINTR);
 
         timer_delete(tm1);
diff --git a/tools/testing/selftests/watchdog/Makefile b/tools/testing/selftests/watchdog/Makefile
index f863c664e3d1..ee068511fd0b 100644
--- a/tools/testing/selftests/watchdog/Makefile
+++ b/tools/testing/selftests/watchdog/Makefile
@@ -1,8 +1,3 @@
-TEST_PROGS := watchdog-test
-
-all: $(TEST_PROGS)
+TEST_GEN_PROGS := watchdog-test
 
 include ../lib.mk
-
-clean:
-        rm -fr $(TEST_PROGS)
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index c608ab495282..f2ac53ab8243 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -565,8 +565,6 @@ kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args)
 {
         if (args->flags & ~(KVM_IRQFD_FLAG_DEASSIGN | KVM_IRQFD_FLAG_RESAMPLE))
                 return -EINVAL;
-        if (args->gsi >= KVM_MAX_IRQ_ROUTES)
-                return -EINVAL;
 
         if (args->flags & KVM_IRQFD_FLAG_DEASSIGN)
                 return kvm_irqfd_deassign(kvm, args);