Merge tag 'asoc-fix-v4.4-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Last minute fixes for v4.4

A few final fixes for v4.4, the main one being the two patches to the
new Sky Lake drivers which fix a previous incorrect fix that went in
during an earlier -rc.

152 files changed, 1608 insertions, 857 deletions

diff --git a/Documentation/devicetree/bindings/net/cpsw.txt b/Documentation/devicetree/bindings/net/cpsw.txt
index 9853f8e70966..28a4781ab6d7 100644
--- a/Documentation/devicetree/bindings/net/cpsw.txt
+++ b/Documentation/devicetree/bindings/net/cpsw.txt
@@ -40,18 +40,18 @@ Optional properties:
 
 Slave Properties:
 Required properties:
-- phy_id                : Specifies slave phy id
 - phy-mode              : See ethernet.txt file in the same directory
 
 Optional properties:
 - dual_emac_res_vlan    : Specifies VID to be used to segregate the ports
 - mac-address           : See ethernet.txt file in the same directory
+- phy_id                : Specifies slave phy id
 - phy-handle            : See ethernet.txt file in the same directory
 
 Slave sub-nodes:
 - fixed-link            : See fixed-link.txt file in the same directory
-                          Either the properties phy_id and phy-mode,
-                          or the sub-node fixed-link can be specified
+                          Either the property phy_id, or the sub-node
+                          fixed-link can be specified
 
 Note: "ti,hwmods" field is used to fetch the base address and irq
 resources from TI, omap hwmod data base during device registration.
diff --git a/Makefile b/Makefile
index 4e2b18d56091..9d94adeceab6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc8
 NAME = Blurry Fish Butt
 
 # *DOCUMENTATION*
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index cf0cf34eeb24..aeb19021099e 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -81,7 +81,7 @@ endif
 LIBGCC  := $(shell $(CC) $(cflags-y) --print-libgcc-file-name)
 
 # Modules with short calls might break for calls into builtin-kernel
-KBUILD_CFLAGS_MODULE    += -mlong-calls
+KBUILD_CFLAGS_MODULE    += -mlong-calls -mno-millicode
 
 # Finally dump eveything into kernel build system
 KBUILD_CFLAGS   += $(cflags-y)
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index abf06e81c929..210ef3e72332 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -62,9 +62,7 @@ extern int ioc_exists;
 #define ARC_REG_IC_IVIC         0x10
 #define ARC_REG_IC_CTRL         0x11
 #define ARC_REG_IC_IVIL         0x19
-#if defined(CONFIG_ARC_MMU_V3) || defined(CONFIG_ARC_MMU_V4)
 #define ARC_REG_IC_PTAG         0x1E
-#endif
 #define ARC_REG_IC_PTAG_HI      0x1F
 
 /* Bit val in IC_CTRL */
diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index cf2828ab0905..5eb707640e9c 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -293,13 +293,13 @@ static void init_unwind_hdr(struct unwind_table *table,
                 const u32 *cie = cie_for_fde(fde, table);
                 signed ptrType;
 
-                if (cie == &not_fde)    /* only process FDE here */
+                if (cie == &not_fde)
                         continue;
                 if (cie == NULL || cie == &bad_cie)
-                        continue;       /* say FDE->CIE.version != 1 */
+                        goto ret_err;
                 ptrType = fde_pointer_type(cie);
                 if (ptrType < 0)
-                        continue;
+                        goto ret_err;
 
                 ptr = (const u8 *)(fde + 2);
                 if (!read_pointer(&ptr, (const u8 *)(fde + 1) + *fde,
@@ -315,14 +315,14 @@ static void init_unwind_hdr(struct unwind_table *table,
         }
 
         if (tableSize || !n)
-                return;
+                goto ret_err;
 
         hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
             + 2 * n * sizeof(unsigned long);
 
         header = alloc(hdrSize);
         if (!header)
-                return;
+                goto ret_err;
 
         header->version = 1;
         header->eh_frame_ptr_enc = DW_EH_PE_abs | DW_EH_PE_native;
@@ -343,10 +343,6 @@ static void init_unwind_hdr(struct unwind_table *table,
 
                 if (fde[1] == 0xffffffff)
                         continue;       /* this is a CIE */
-
-                if (*(u8 *)(cie + 2) != 1)
-                        continue;       /* FDE->CIE.version not supported */
-
                 ptr = (const u8 *)(fde + 2);
                 header->table[n].start = read_pointer(&ptr,
                                                       (const u8 *)(fde + 1) +
@@ -365,6 +361,10 @@ static void init_unwind_hdr(struct unwind_table *table,
         table->hdrsz = hdrSize;
         smp_wmb();
         table->header = (const void *)header;
+        return;
+
+ret_err:
+        panic("Attention !!! Dwarf FDE parsing errors\n");;
 }
 
 #ifdef CONFIG_MODULES
@@ -523,8 +523,7 @@ static const u32 *cie_for_fde(const u32 *fde, const struct unwind_table *table)
 
         if (*cie <= sizeof(*cie) + 4 || *cie >= fde[1] - sizeof(*fde)
             || (*cie & (sizeof(*cie) - 1))
-            || (cie[1] != 0xffffffff)
-            || ( *(u8 *)(cie + 2) != 1))   /* version 1 supported */
+            || (cie[1] != 0xffffffff))
                 return NULL;    /* this is not a (valid) CIE */
         return cie;
 }
@@ -605,9 +604,6 @@ static signed fde_pointer_type(const u32 *cie)
         const u8 *ptr = (const u8 *)(cie + 2);
         unsigned version = *ptr;
 
-        if (version != 1)
-                return -1;      /* unsupported */
-
         if (*++ptr) {
                 const char *aug;
                 const u8 *end = (const u8 *)(cie + 1) + *cie;
@@ -1019,9 +1015,7 @@ int arc_unwind(struct unwind_frame_info *frame)
                 ptr = (const u8 *)(cie + 2);
                 end = (const u8 *)(cie + 1) + *cie;
                 frame->call_frame = 1;
-                if ((state.version = *ptr) != 1)
-                        cie = NULL;     /* unsupported version */
-                else if (*++ptr) {
+                if (*++ptr) {
                         /* check if augmentation size is first (thus present) */
                         if (*ptr == 'z') {
                                 while (++ptr < end && *ptr) {
diff --git a/arch/arc/mm/highmem.c b/arch/arc/mm/highmem.c
index 065ee6bfa82a..92dd92cad7f9 100644
--- a/arch/arc/mm/highmem.c
+++ b/arch/arc/mm/highmem.c
@@ -111,7 +111,7 @@ void __kunmap_atomic(void *kv)
 }
 EXPORT_SYMBOL(__kunmap_atomic);
 
-noinline pte_t *alloc_kmap_pgtable(unsigned long kvaddr)
+static noinline pte_t * __init alloc_kmap_pgtable(unsigned long kvaddr)
 {
         pgd_t *pgd_k;
         pud_t *pud_k;
@@ -127,7 +127,7 @@ noinline pte_t *alloc_kmap_pgtable(unsigned long kvaddr)
         return pte_k;
 }
 
-void kmap_init(void)
+void __init kmap_init(void)
 {
         /* Due to recursive include hell, we can't do this in processor.h */
         BUILD_BUG_ON(PAGE_OFFSET < (VMALLOC_END + FIXMAP_SIZE + PKMAP_SIZE));
diff --git a/arch/arm/boot/dts/imx6q-gw5400-a.dts b/arch/arm/boot/dts/imx6q-gw5400-a.dts
index 58adf176425a..a51834e1dd27 100644
--- a/arch/arm/boot/dts/imx6q-gw5400-a.dts
+++ b/arch/arm/boot/dts/imx6q-gw5400-a.dts
@@ -154,7 +154,7 @@
 &fec {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet>;
-        phy-mode = "rgmii";
+        phy-mode = "rgmii-id";
         phy-reset-gpios = <&gpio1 30 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
index 7b31fdb79ced..dc0cebfe22d7 100644
--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
@@ -94,7 +94,7 @@
 &fec {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet>;
-        phy-mode = "rgmii";
+        phy-mode = "rgmii-id";
         phy-reset-gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 1b66328a8498..18cd4114a23e 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -154,7 +154,7 @@
 &fec {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet>;
-        phy-mode = "rgmii";
+        phy-mode = "rgmii-id";
         phy-reset-gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index 7c51839ff934..eea90f37bbb8 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -155,7 +155,7 @@
 &fec {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet>;
-        phy-mode = "rgmii";
+        phy-mode = "rgmii-id";
         phy-reset-gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
index 929e0b37bd9e..6c11a2ae35ef 100644
--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
@@ -145,7 +145,7 @@
 &fec {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet>;
-        phy-mode = "rgmii";
+        phy-mode = "rgmii-id";
         phy-reset-gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
index 8263fc18a7d9..d354d406954d 100644
--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
@@ -113,14 +113,14 @@
 &clks {
         assigned-clocks = <&clks IMX6QDL_PLL4_BYPASS_SRC>,
                           <&clks IMX6QDL_PLL4_BYPASS>,
-                          <&clks IMX6QDL_CLK_PLL4_POST_DIV>,
                           <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
-                          <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+                          <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
+                          <&clks IMX6QDL_CLK_PLL4_POST_DIV>;
         assigned-clock-parents = <&clks IMX6QDL_CLK_LVDS2_IN>,
                                  <&clks IMX6QDL_PLL4_BYPASS_SRC>,
                                  <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
                                  <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
-        assigned-clock-rates = <0>, <0>, <24576000>;
+        assigned-clock-rates = <0>, <0>, <0>, <0>, <24576000>;
 };
 
 &ecspi1 {
diff --git a/arch/arm/boot/dts/omap4-duovero-parlor.dts b/arch/arm/boot/dts/omap4-duovero-parlor.dts
index 1a78f013f37a..b75f7b2b7c4a 100644
--- a/arch/arm/boot/dts/omap4-duovero-parlor.dts
+++ b/arch/arm/boot/dts/omap4-duovero-parlor.dts
@@ -189,3 +189,7 @@
         };
 };
 
+&uart3 {
+        interrupts-extended = <&wakeupgen GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH
+                               &omap4_pmx_core OMAP4_UART3_RX>;
+};
diff --git a/arch/arm/boot/dts/sun6i-a31s-primo81.dts b/arch/arm/boot/dts/sun6i-a31s-primo81.dts
index 2d4250b1faf8..68b479b8772c 100644
--- a/arch/arm/boot/dts/sun6i-a31s-primo81.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-primo81.dts
@@ -83,6 +83,7 @@
                 reg = <0x5d>;
                 interrupt-parent = <&pio>;
                 interrupts = <0 3 IRQ_TYPE_LEVEL_HIGH>; /* PA3 */
+                touchscreen-swapped-x-y;
         };
 };
 
diff --git a/arch/arm/boot/dts/tegra124-nyan.dtsi b/arch/arm/boot/dts/tegra124-nyan.dtsi
index 40c23a0b7cfc..ec1aa64ded68 100644
--- a/arch/arm/boot/dts/tegra124-nyan.dtsi
+++ b/arch/arm/boot/dts/tegra124-nyan.dtsi
@@ -399,7 +399,7 @@
 
         /* CPU DFLL clock */
         clock@0,70110000 {
-                status = "okay";
+                status = "disabled";
                 vdd-cpu-supply = <&vdd_cpu>;
                 nvidia,i2c-fs-rate = <400000>;
         };
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index b83f3b7737fb..087acb569b63 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -193,15 +193,44 @@ struct oabi_flock64 {
         pid_t   l_pid;
 } __attribute__ ((packed,aligned(4)));
 
-asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
+static long do_locks(unsigned int fd, unsigned int cmd,
                                  unsigned long arg)
 {
-        struct oabi_flock64 user;
         struct flock64 kernel;
-        mm_segment_t fs = USER_DS; /* initialized to kill a warning */
-        unsigned long local_arg = arg;
-        int ret;
+        struct oabi_flock64 user;
+        mm_segment_t fs;
+        long ret;
+
+        if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
+                           sizeof(user)))
+                return -EFAULT;
+        kernel.l_type   = user.l_type;
+        kernel.l_whence = user.l_whence;
+        kernel.l_start  = user.l_start;
+        kernel.l_len    = user.l_len;
+        kernel.l_pid    = user.l_pid;
+
+        fs = get_fs();
+        set_fs(KERNEL_DS);
+        ret = sys_fcntl64(fd, cmd, (unsigned long)&kernel);
+        set_fs(fs);
+
+        if (!ret && (cmd == F_GETLK64 || cmd == F_OFD_GETLK)) {
+                user.l_type     = kernel.l_type;
+                user.l_whence   = kernel.l_whence;
+                user.l_start    = kernel.l_start;
+                user.l_len      = kernel.l_len;
+                user.l_pid      = kernel.l_pid;
+                if (copy_to_user((struct oabi_flock64 __user *)arg,
+                                 &user, sizeof(user)))
+                        ret = -EFAULT;
+        }
+        return ret;
+}
 
+asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
+                                 unsigned long arg)
+{
         switch (cmd) {
         case F_OFD_GETLK:
         case F_OFD_SETLK:
@@ -209,39 +238,11 @@ asmlinkage long sys_oabi_fcntl64(unsigned int fd, unsigned int cmd,
         case F_GETLK64:
         case F_SETLK64:
         case F_SETLKW64:
-                if (copy_from_user(&user, (struct oabi_flock64 __user *)arg,
-                                   sizeof(user)))
-                        return -EFAULT;
-                kernel.l_type   = user.l_type;
-                kernel.l_whence = user.l_whence;
-                kernel.l_start  = user.l_start;
-                kernel.l_len    = user.l_len;
-                kernel.l_pid    = user.l_pid;
-                local_arg = (unsigned long)&kernel;
-                fs = get_fs();
-                set_fs(KERNEL_DS);
-        }
-
-        ret = sys_fcntl64(fd, cmd, local_arg);
+                return do_locks(fd, cmd, arg);
 
-        switch (cmd) {
-        case F_GETLK64:
-                if (!ret) {
-                        user.l_type     = kernel.l_type;
-                        user.l_whence   = kernel.l_whence;
-                        user.l_start    = kernel.l_start;
-                        user.l_len      = kernel.l_len;
-                        user.l_pid      = kernel.l_pid;
-                        if (copy_to_user((struct oabi_flock64 __user *)arg,
-                                         &user, sizeof(user)))
-                                ret = -EFAULT;
-                }
-        case F_SETLK64:
-        case F_SETLKW64:
-                set_fs(fs);
+        default:
+                return sys_fcntl64(fd, cmd, arg);
         }
-
-        return ret;
 }
 
 struct oabi_epoll_event {
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 4b4371db5799..0517f0c1581a 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -65,6 +65,8 @@ config SOC_AM43XX
         select MACH_OMAP_GENERIC
         select MIGHT_HAVE_CACHE_L2X0
         select HAVE_ARM_SCU
+        select GENERIC_CLOCKEVENTS_BROADCAST
+        select HAVE_ARM_TWD
 
 config SOC_DRA7XX
         bool "TI DRA7XX"
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index b18ebbefae09..f86692dbcfd5 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -320,6 +320,12 @@ static int __init omap_dm_timer_init_one(struct omap_dm_timer *timer,
         return r;
 }
 
+#if !defined(CONFIG_SMP) && defined(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST)
+void tick_broadcast(const struct cpumask *mask)
+{
+}
+#endif
+
 static void __init omap2_gp_clockevent_init(int gptimer_id,
                                                 const char *fck_source,
                                                 const char *property)
diff --git a/arch/m32r/include/asm/Kbuild b/arch/m32r/include/asm/Kbuild
index fd104bd221ce..860e440611c9 100644
--- a/arch/m32r/include/asm/Kbuild
+++ b/arch/m32r/include/asm/Kbuild
@@ -3,6 +3,7 @@ generic-y += clkdev.h
 generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
+generic-y += kvm_para.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
 generic-y += module.h
diff --git a/arch/m32r/include/asm/io.h b/arch/m32r/include/asm/io.h
index 61b8931bc192..4b0f5e001d4d 100644
--- a/arch/m32r/include/asm/io.h
+++ b/arch/m32r/include/asm/io.h
@@ -168,13 +168,21 @@ static inline void _writel(unsigned long l, unsigned long addr)
 #define writew_relaxed writew
 #define writel_relaxed writel
 
-#define ioread8 read
+#define ioread8 readb
 #define ioread16 readw
 #define ioread32 readl
 #define iowrite8 writeb
 #define iowrite16 writew
 #define iowrite32 writel
 
+#define ioread8_rep(p, dst, count) insb((unsigned long)(p), (dst), (count))
+#define ioread16_rep(p, dst, count) insw((unsigned long)(p), (dst), (count))
+#define ioread32_rep(p, dst, count) insl((unsigned long)(p), (dst), (count))
+
+#define iowrite8_rep(p, src, count) outsb((unsigned long)(p), (src), (count))
+#define iowrite16_rep(p, src, count) outsw((unsigned long)(p), (src), (count))
+#define iowrite32_rep(p, src, count) outsl((unsigned long)(p), (src), (count))
+
 #define ioread16be(addr)        be16_to_cpu(readw(addr))
 #define ioread32be(addr)        be32_to_cpu(readl(addr))
 #define iowrite16be(v, addr)    writew(cpu_to_be16(v), (addr))
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 5305d694ffe5..095ecafe6bd3 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -599,7 +599,7 @@ extern void __put_user_unknown(void);
  * On error, the variable @x is set to zero.
  */
 #define __get_user_unaligned(x,ptr) \
-        __get_user__unalignednocheck((x),(ptr),sizeof(*(ptr)))
+        __get_user_unaligned_nocheck((x),(ptr),sizeof(*(ptr)))
 
 /*
  * Yuck.  We need two variants, one for 64bit operation and one
@@ -620,8 +620,8 @@ extern void __get_user_unaligned_unknown(void);
 do {                                                                    \
         switch (size) {                                                 \
         case 1: __get_data_asm(val, "lb", ptr); break;                  \
-        case 2: __get_user_unaligned_asm(val, "ulh", ptr); break;       \
-        case 4: __get_user_unaligned_asm(val, "ulw", ptr); break;       \
+        case 2: __get_data_unaligned_asm(val, "ulh", ptr); break;       \
+        case 4: __get_data_unaligned_asm(val, "ulw", ptr); break;       \
         case 8: __GET_USER_UNALIGNED_DW(val, ptr); break;               \
         default: __get_user_unaligned_unknown(); break;                 \
         }                                                               \
@@ -1122,9 +1122,15 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
         __cu_to = (to);                                                 \
         __cu_from = (from);                                             \
         __cu_len = (n);                                                 \
-        might_fault();                                                  \
-        __cu_len = __invoke_copy_from_user(__cu_to, __cu_from,          \
-                                           __cu_len);                   \
+        if (eva_kernel_access()) {                                      \
+                __cu_len = __invoke_copy_from_kernel(__cu_to,           \
+                                                     __cu_from,         \
+                                                     __cu_len);         \
+        } else {                                                        \
+                might_fault();                                          \
+                __cu_len = __invoke_copy_from_user(__cu_to, __cu_from,  \
+                                                   __cu_len);           \
+        }                                                               \
         __cu_len;                                                       \
 })
 
@@ -1229,16 +1235,28 @@ __clear_user(void __user *addr, __kernel_size_t size)
 {
         __kernel_size_t res;
 
-        might_fault();
-        __asm__ __volatile__(
-                "move\t$4, %1\n\t"
-                "move\t$5, $0\n\t"
-                "move\t$6, %2\n\t"
-                __MODULE_JAL(__bzero)
-                "move\t%0, $6"
-                : "=r" (res)
-                : "r" (addr), "r" (size)
-                : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+        if (eva_kernel_access()) {
+                __asm__ __volatile__(
+                        "move\t$4, %1\n\t"
+                        "move\t$5, $0\n\t"
+                        "move\t$6, %2\n\t"
+                        __MODULE_JAL(__bzero_kernel)
+                        "move\t%0, $6"
+                        : "=r" (res)
+                        : "r" (addr), "r" (size)
+                        : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+        } else {
+                might_fault();
+                __asm__ __volatile__(
+                        "move\t$4, %1\n\t"
+                        "move\t$5, $0\n\t"
+                        "move\t$6, %2\n\t"
+                        __MODULE_JAL(__bzero)
+                        "move\t%0, $6"
+                        : "=r" (res)
+                        : "r" (addr), "r" (size)
+                        : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+        }
 
         return res;
 }
@@ -1384,7 +1402,7 @@ static inline long strlen_user(const char __user *s)
                 might_fault();
                 __asm__ __volatile__(
                         "move\t$4, %1\n\t"
-                        __MODULE_JAL(__strlen_kernel_asm)
+                        __MODULE_JAL(__strlen_user_asm)
                         "move\t%0, $2"
                         : "=r" (res)
                         : "r" (s)
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 8fd5a276cad2..ac81edd44563 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -257,7 +257,6 @@ LEAF(mips_cps_core_init)
         has_mt  t0, 3f
 
         .set    push
-        .set    mips64r2
         .set    mt
 
         /* Only allow 1 TC per VPE to execute... */
@@ -376,7 +375,6 @@ LEAF(mips_cps_boot_vpes)
          nop
 
         .set    push
-        .set    mips64r2
         .set    mt
 
 1:      /* Enter VPE configuration state */
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index 291af0b5c482..e2b6ab74643d 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -17,6 +17,7 @@
 #include <asm/fpu.h>
 #include <asm/msa.h>
 
+extern void *__bzero_kernel(void *__s, size_t __count);
 extern void *__bzero(void *__s, size_t __count);
 extern long __strncpy_from_kernel_nocheck_asm(char *__to,
                                               const char *__from, long __len);
@@ -64,6 +65,7 @@ EXPORT_SYMBOL(__copy_from_user_eva);
 EXPORT_SYMBOL(__copy_in_user_eva);
 EXPORT_SYMBOL(__copy_to_user_eva);
 EXPORT_SYMBOL(__copy_user_inatomic_eva);
+EXPORT_SYMBOL(__bzero_kernel);
 #endif
 EXPORT_SYMBOL(__bzero);
 EXPORT_SYMBOL(__strncpy_from_kernel_nocheck_asm);
diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S
index b8e63fd00375..8f0019a2e5c8 100644
--- a/arch/mips/lib/memset.S
+++ b/arch/mips/lib/memset.S
@@ -283,6 +283,8 @@ LEAF(memset)
 1:
 #ifndef CONFIG_EVA
 FEXPORT(__bzero)
+#else
+FEXPORT(__bzero_kernel)
 #endif
         __BUILD_BZERO LEGACY_MODE
 
diff --git a/arch/mips/pci/pci-rt2880.c b/arch/mips/pci/pci-rt2880.c
index dbbeccc3d714..a245cad4372a 100644
--- a/arch/mips/pci/pci-rt2880.c
+++ b/arch/mips/pci/pci-rt2880.c
@@ -221,7 +221,6 @@ int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 static int rt288x_pci_probe(struct platform_device *pdev)
 {
         void __iomem *io_map_base;
-        int i;
 
         rt2880_pci_base = ioremap_nocache(RT2880_PCI_BASE, PAGE_SIZE);
 
diff --git a/arch/mips/pmcs-msp71xx/msp_setup.c b/arch/mips/pmcs-msp71xx/msp_setup.c
index 78b2ef49dbc7..9d293b3e9130 100644
--- a/arch/mips/pmcs-msp71xx/msp_setup.c
+++ b/arch/mips/pmcs-msp71xx/msp_setup.c
@@ -39,7 +39,6 @@ extern void msp_serial_setup(void);
 void msp7120_reset(void)
 {
         void *start, *end, *iptr;
-        register int i;
 
         /* Diasble all interrupts */
         local_irq_disable();
diff --git a/arch/mips/sni/reset.c b/arch/mips/sni/reset.c
index db8f88b6a3af..6afa34346b81 100644
--- a/arch/mips/sni/reset.c
+++ b/arch/mips/sni/reset.c
@@ -26,7 +26,7 @@ static inline void kb_wait(void)
 /* XXX This ends up at the ARC firmware prompt ...  */
 void sni_machine_restart(char *command)
 {
-        int i, j;
+        int i;
 
         /* This does a normal via the keyboard controller like a PC.
            We can do that easier ...  */
diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
index ef5f348f386a..14568900fc1d 100644
--- a/arch/mips/vdso/Makefile
+++ b/arch/mips/vdso/Makefile
@@ -26,8 +26,8 @@ aflags-vdso := $(ccflags-vdso) \
 # the comments on that file.
 #
 ifndef CONFIG_CPU_MIPSR6
-  ifeq ($(call ld-ifversion, -gt, 22400000, y),)
-    $(warning MIPS VDSO requires binutils > 2.24)
+  ifeq ($(call ld-ifversion, -lt, 22500000, y),y)
+    $(warning MIPS VDSO requires binutils >= 2.25)
     obj-vdso-y := $(filter-out gettimeofday.o, $(obj-vdso-y))
     ccflags-vdso += -DDISABLE_MIPS_VDSO
   endif
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index dc1ea796fd60..2264f68f3c2f 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -435,6 +435,55 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs, int in_syscall)
                 regs->gr[28]);
 }
 
+/*
+ * Check how the syscall number gets loaded into %r20 within
+ * the delay branch in userspace and adjust as needed.
+ */
+
+static void check_syscallno_in_delay_branch(struct pt_regs *regs)
+{
+        u32 opcode, source_reg;
+        u32 __user *uaddr;
+        int err;
+
+        /* Usually we don't have to restore %r20 (the system call number)
+         * because it gets loaded in the delay slot of the branch external
+         * instruction via the ldi instruction.
+         * In some cases a register-to-register copy instruction might have
+         * been used instead, in which case we need to copy the syscall
+         * number into the source register before returning to userspace.
+         */
+
+        /* A syscall is just a branch, so all we have to do is fiddle the
+         * return pointer so that the ble instruction gets executed again.
+         */
+        regs->gr[31] -= 8; /* delayed branching */
+
+        /* Get assembler opcode of code in delay branch */
+        uaddr = (unsigned int *) ((regs->gr[31] & ~3) + 4);
+        err = get_user(opcode, uaddr);
+        if (err)
+                return;
+
+        /* Check if delay branch uses "ldi int,%r20" */
+        if ((opcode & 0xffff0000) == 0x34140000)
+                return; /* everything ok, just return */
+
+        /* Check if delay branch uses "nop" */
+        if (opcode == INSN_NOP)
+                return;
+
+        /* Check if delay branch uses "copy %rX,%r20" */
+        if ((opcode & 0xffe0ffff) == 0x08000254) {
+                source_reg = (opcode >> 16) & 31;
+                regs->gr[source_reg] = regs->gr[20];
+                return;
+        }
+
+        pr_warn("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n",
+                current->comm, task_pid_nr(current), opcode);
+}
+
 static inline void
 syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
 {
@@ -457,10 +506,7 @@ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
                 }
                 /* fallthrough */
         case -ERESTARTNOINTR:
-                /* A syscall is just a branch, so all
-                 * we have to do is fiddle the return pointer.
-                 */
-                regs->gr[31] -= 8; /* delayed branching */
+                check_syscallno_in_delay_branch(regs);
                 break;
         }
 }
@@ -510,15 +556,9 @@ insert_restart_trampoline(struct pt_regs *regs)
         }
         case -ERESTARTNOHAND:
         case -ERESTARTSYS:
-        case -ERESTARTNOINTR: {
-                /* Hooray for delayed branching.  We don't
-                 * have to restore %r20 (the system call
-                 * number) because it gets loaded in the delay
-                 * slot of the branch external instruction.
-                 */
-                regs->gr[31] -= 8;
+        case -ERESTARTNOINTR:
+                check_syscallno_in_delay_branch(regs);
                 return;
-        }
         default:
                 break;
         }
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 54b45b73195f..a7352b59e6f9 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -224,6 +224,12 @@ static void kvmppc_core_vcpu_put_hv(struct kvm_vcpu *vcpu)
 
 static void kvmppc_set_msr_hv(struct kvm_vcpu *vcpu, u64 msr)
 {
+        /*
+         * Check for illegal transactional state bit combination
+         * and if we find it, force the TS field to a safe state.
+         */
+        if ((msr & MSR_TS_MASK) == MSR_TS_MASK)
+                msr &= ~MSR_TS_MASK;
         vcpu->arch.shregs.msr = msr;
         kvmppc_end_cede(vcpu);
 }
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index 8140d10c6785..6e72961608f0 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -1920,16 +1920,23 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr)
                         }
                         if (separator)
                                 ptr += sprintf(ptr, "%c", separator);
+                        /*
+                         * Use four '%' characters below because of the
+                         * following two conversions:
+                         *
+                         *  1) sprintf: %%%%r -> %%r
+                         *  2) printk : %%r   -> %r
+                         */
                         if (operand->flags & OPERAND_GPR)
-                                ptr += sprintf(ptr, "%%r%i", value);
+                                ptr += sprintf(ptr, "%%%%r%i", value);
                         else if (operand->flags & OPERAND_FPR)
-                                ptr += sprintf(ptr, "%%f%i", value);
+                                ptr += sprintf(ptr, "%%%%f%i", value);
                         else if (operand->flags & OPERAND_AR)
-                                ptr += sprintf(ptr, "%%a%i", value);
+                                ptr += sprintf(ptr, "%%%%a%i", value);
                         else if (operand->flags & OPERAND_CR)
-                                ptr += sprintf(ptr, "%%c%i", value);
+                                ptr += sprintf(ptr, "%%%%c%i", value);
                         else if (operand->flags & OPERAND_VR)
-                                ptr += sprintf(ptr, "%%v%i", value);
+                                ptr += sprintf(ptr, "%%%%v%i", value);
                         else if (operand->flags & OPERAND_PCREL)
                                 ptr += sprintf(ptr, "%lx", (signed int) value
                                                                       + addr);
diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
index 370ca1e71ffb..93310837c2df 100644
--- a/arch/sparc/include/asm/elf_64.h
+++ b/arch/sparc/include/asm/elf_64.h
@@ -95,6 +95,7 @@
  * really available.  So we simply advertise only "crypto" support.
  */
 #define HWCAP_SPARC_CRYPTO      0x04000000 /* CRYPTO insns available */
+#define HWCAP_SPARC_ADI         0x08000000 /* ADI available */
 
 #define CORE_DUMP_USE_REGSET
 
diff --git a/arch/sparc/include/uapi/asm/unistd.h b/arch/sparc/include/uapi/asm/unistd.h
index efe9479f837b..1c26d440d288 100644
--- a/arch/sparc/include/uapi/asm/unistd.h
+++ b/arch/sparc/include/uapi/asm/unistd.h
@@ -417,8 +417,13 @@
 #define __NR_bpf                349
 #define __NR_execveat           350
 #define __NR_membarrier         351
+#define __NR_userfaultfd        352
+#define __NR_bind               353
+#define __NR_listen             354
+#define __NR_setsockopt         355
+#define __NR_mlock2             356
 
-#define NR_syscalls             352
+#define NR_syscalls             357
 
 /* Bitmask values returned from kern_features system call.  */
 #define KERN_FEATURE_MIXED_MODE_STACK   0x00000001
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 3d61fcae7ee3..f2d30cab5b3f 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -946,6 +946,12 @@ ENTRY(__retl_one)
          mov    1, %o0
 ENDPROC(__retl_one)
 
+ENTRY(__retl_one_fp)
+        VISExitHalf
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one_fp)
+
 ENTRY(__ret_one_asi)
         wr      %g0, ASI_AIUS, %asi
         ret
@@ -958,6 +964,13 @@ ENTRY(__retl_one_asi)
          mov    1, %o0
 ENDPROC(__retl_one_asi)
 
+ENTRY(__retl_one_asi_fp)
+        wr      %g0, ASI_AIUS, %asi
+        VISExitHalf
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one_asi_fp)
+
 ENTRY(__retl_o1)
         retl
          mov    %o1, %o0
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 3091267c5cc3..6596f66ce112 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -1828,11 +1828,18 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry,
 void
 perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
 {
+        u64 saved_fault_address = current_thread_info()->fault_address;
+        u8 saved_fault_code = get_thread_fault_code();
+        mm_segment_t old_fs;
+
         perf_callchain_store(entry, regs->tpc);
 
         if (!current->mm)
                 return;
 
+        old_fs = get_fs();
+        set_fs(USER_DS);
+
         flushw_user();
 
         pagefault_disable();
@@ -1843,4 +1850,8 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
                 perf_callchain_user_64(entry, regs);
 
         pagefault_enable();
+
+        set_fs(old_fs);
+        set_thread_fault_code(saved_fault_code);
+        current_thread_info()->fault_address = saved_fault_address;
 }
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index 39f0c662f4c8..d08bdaffdbfc 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -73,7 +73,13 @@ rtrap_nmi:	ldx			[%sp + PTREGS_OFF + PT_V9_TSTATE], %l1
                 andn                    %l1, %l4, %l1
                 srl                     %l4, 20, %l4
                 ba,pt                   %xcc, rtrap_no_irq_enable
-                 wrpr                   %l4, %pil
+                nop
+                /* Do not actually set the %pil here.  We will do that
+                 * below after we clear PSTATE_IE in the %pstate register.
+                 * If we re-enable interrupts here, we can recurse down
+                 * the hardirq stack potentially endlessly, causing a
+                 * stack overflow.
+                 */
 
                 .align                  64
                 .globl                  rtrap_irq, rtrap, irqsz_patchme, rtrap_xcall
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index f7b261749383..f3185e2b028b 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -380,7 +380,8 @@ static const char *hwcaps[] = {
          */
         "mul32", "div32", "fsmuld", "v8plus", "popc", "vis", "vis2",
         "ASIBlkInit", "fmaf", "vis3", "hpc", "random", "trans", "fjfmau",
-        "ima", "cspare", "pause", "cbcond",
+        "ima", "cspare", "pause", "cbcond", NULL /*reserved for crypto */,
+        "adp",
 };
 
 static const char *crypto_hwcaps[] = {
@@ -396,7 +397,7 @@ void cpucap_info(struct seq_file *m)
         seq_puts(m, "cpucaps\t\t: ");
         for (i = 0; i < ARRAY_SIZE(hwcaps); i++) {
                 unsigned long bit = 1UL << i;
-                if (caps & bit) {
+                if (hwcaps[i] && (caps & bit)) {
                         seq_printf(m, "%s%s",
                                    printed ? "," : "", hwcaps[i]);
                         printed++;
@@ -450,7 +451,7 @@ static void __init report_hwcaps(unsigned long caps)
 
         for (i = 0; i < ARRAY_SIZE(hwcaps); i++) {
                 unsigned long bit = 1UL << i;
-                if (caps & bit)
+                if (hwcaps[i] && (caps & bit))
                         report_one_hwcap(&printed, hwcaps[i]);
         }
         if (caps & HWCAP_SPARC_CRYPTO)
@@ -485,7 +486,7 @@ static unsigned long __init mdesc_cpu_hwcap_list(void)
                 for (i = 0; i < ARRAY_SIZE(hwcaps); i++) {
                         unsigned long bit = 1UL << i;
 
-                        if (!strcmp(prop, hwcaps[i])) {
+                        if (hwcaps[i] && !strcmp(prop, hwcaps[i])) {
                                 caps |= bit;
                                 break;
                         }
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index cc23b62b6e38..e663b6c78de2 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -35,18 +35,18 @@ sys_call_table:
 /*80*/  .long sys_setgroups16, sys_getpgrp, sys_setgroups, sys_setitimer, sys_ftruncate64
 /*85*/  .long sys_swapon, sys_getitimer, sys_setuid, sys_sethostname, sys_setgid
 /*90*/  .long sys_dup2, sys_setfsuid, sys_fcntl, sys_select, sys_setfsgid
-/*95*/  .long sys_fsync, sys_setpriority, sys_nis_syscall, sys_nis_syscall, sys_nis_syscall
+/*95*/  .long sys_fsync, sys_setpriority, sys_socket, sys_connect, sys_accept
 /*100*/ .long sys_getpriority, sys_rt_sigreturn, sys_rt_sigaction, sys_rt_sigprocmask, sys_rt_sigpending
 /*105*/ .long sys_rt_sigtimedwait, sys_rt_sigqueueinfo, sys_rt_sigsuspend, sys_setresuid, sys_getresuid
-/*110*/ .long sys_setresgid, sys_getresgid, sys_setregid, sys_nis_syscall, sys_nis_syscall
-/*115*/ .long sys_getgroups, sys_gettimeofday, sys_getrusage, sys_nis_syscall, sys_getcwd
+/*110*/ .long sys_setresgid, sys_getresgid, sys_setregid, sys_recvmsg, sys_sendmsg
+/*115*/ .long sys_getgroups, sys_gettimeofday, sys_getrusage, sys_getsockopt, sys_getcwd
 /*120*/ .long sys_readv, sys_writev, sys_settimeofday, sys_fchown16, sys_fchmod
-/*125*/ .long sys_nis_syscall, sys_setreuid16, sys_setregid16, sys_rename, sys_truncate
-/*130*/ .long sys_ftruncate, sys_flock, sys_lstat64, sys_nis_syscall, sys_nis_syscall
-/*135*/ .long sys_nis_syscall, sys_mkdir, sys_rmdir, sys_utimes, sys_stat64
-/*140*/ .long sys_sendfile64, sys_nis_syscall, sys_futex, sys_gettid, sys_getrlimit
+/*125*/ .long sys_recvfrom, sys_setreuid16, sys_setregid16, sys_rename, sys_truncate
+/*130*/ .long sys_ftruncate, sys_flock, sys_lstat64, sys_sendto, sys_shutdown
+/*135*/ .long sys_socketpair, sys_mkdir, sys_rmdir, sys_utimes, sys_stat64
+/*140*/ .long sys_sendfile64, sys_getpeername, sys_futex, sys_gettid, sys_getrlimit
 /*145*/ .long sys_setrlimit, sys_pivot_root, sys_prctl, sys_pciconfig_read, sys_pciconfig_write
-/*150*/ .long sys_nis_syscall, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
+/*150*/ .long sys_getsockname, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
 /*155*/ .long sys_fcntl64, sys_inotify_rm_watch, sys_statfs, sys_fstatfs, sys_oldumount
 /*160*/ .long sys_sched_setaffinity, sys_sched_getaffinity, sys_getdomainname, sys_setdomainname, sys_nis_syscall
 /*165*/ .long sys_quotactl, sys_set_tid_address, sys_mount, sys_ustat, sys_setxattr
@@ -87,4 +87,5 @@ sys_call_table:
 /*335*/ .long sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .long sys_ni_syscall, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
 /*345*/ .long sys_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create, sys_bpf
-/*350*/ .long sys_execveat, sys_membarrier
+/*350*/ .long sys_execveat, sys_membarrier, sys_userfaultfd, sys_bind, sys_listen
+/*355*/ .long sys_setsockopt, sys_mlock2
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index f229468a7479..1557121f4cdc 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -37,15 +37,15 @@ sys_call_table32:
 /*80*/  .word sys_setgroups16, sys_getpgrp, sys_setgroups, compat_sys_setitimer, sys32_ftruncate64
         .word sys_swapon, compat_sys_getitimer, sys_setuid, sys_sethostname, sys_setgid
 /*90*/  .word sys_dup2, sys_setfsuid, compat_sys_fcntl, sys32_select, sys_setfsgid
-        .word sys_fsync, sys_setpriority, sys_nis_syscall, sys_nis_syscall, sys_nis_syscall
+        .word sys_fsync, sys_setpriority, sys_socket, sys_connect, sys_accept
 /*100*/ .word sys_getpriority, sys32_rt_sigreturn, compat_sys_rt_sigaction, compat_sys_rt_sigprocmask, compat_sys_rt_sigpending
         .word compat_sys_rt_sigtimedwait, compat_sys_rt_sigqueueinfo, compat_sys_rt_sigsuspend, sys_setresuid, sys_getresuid
-/*110*/ .word sys_setresgid, sys_getresgid, sys_setregid, sys_nis_syscall, sys_nis_syscall
-        .word sys_getgroups, compat_sys_gettimeofday, compat_sys_getrusage, sys_nis_syscall, sys_getcwd
+/*110*/ .word sys_setresgid, sys_getresgid, sys_setregid, compat_sys_recvmsg, compat_sys_sendmsg
+        .word sys_getgroups, compat_sys_gettimeofday, compat_sys_getrusage, compat_sys_getsockopt, sys_getcwd
 /*120*/ .word compat_sys_readv, compat_sys_writev, compat_sys_settimeofday, sys_fchown16, sys_fchmod
-        .word sys_nis_syscall, sys_setreuid16, sys_setregid16, sys_rename, compat_sys_truncate
-/*130*/ .word compat_sys_ftruncate, sys_flock, compat_sys_lstat64, sys_nis_syscall, sys_nis_syscall
-        .word sys_nis_syscall, sys_mkdir, sys_rmdir, compat_sys_utimes, compat_sys_stat64
+        .word sys_recvfrom, sys_setreuid16, sys_setregid16, sys_rename, compat_sys_truncate
+/*130*/ .word compat_sys_ftruncate, sys_flock, compat_sys_lstat64, sys_sendto, sys_shutdown
+        .word sys_socketpair, sys_mkdir, sys_rmdir, compat_sys_utimes, compat_sys_stat64
 /*140*/ .word sys_sendfile64, sys_nis_syscall, sys32_futex, sys_gettid, compat_sys_getrlimit
         .word compat_sys_setrlimit, sys_pivot_root, sys_prctl, sys_pciconfig_read, sys_pciconfig_write
 /*150*/ .word sys_nis_syscall, sys_inotify_init, sys_inotify_add_watch, sys_poll, sys_getdents64
@@ -88,7 +88,8 @@ sys_call_table32:
         .word sys_syncfs, compat_sys_sendmmsg, sys_setns, compat_sys_process_vm_readv, compat_sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
         .word sys32_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create, sys_bpf
-/*350*/ .word sys32_execveat, sys_membarrier
+/*350*/ .word sys32_execveat, sys_membarrier, sys_userfaultfd, sys_bind, sys_listen
+        .word compat_sys_setsockopt, sys_mlock2
 
 #endif /* CONFIG_COMPAT */
 
@@ -168,4 +169,5 @@ sys_call_table:
         .word sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
         .word sys_renameat2, sys_seccomp, sys_getrandom, sys_memfd_create, sys_bpf
-/*350*/ .word sys64_execveat, sys_membarrier
+/*350*/ .word sys64_execveat, sys_membarrier, sys_userfaultfd, sys_bind, sys_listen
+        .word sys_setsockopt, sys_mlock2
diff --git a/arch/sparc/lib/NG2copy_from_user.S b/arch/sparc/lib/NG2copy_from_user.S
index 119ccb9a54f4..d5242b8c4f94 100644
--- a/arch/sparc/lib/NG2copy_from_user.S
+++ b/arch/sparc/lib/NG2copy_from_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_LD_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_asi_fp;\
+        .text;                  \
+        .align 4;
+
 #ifndef ASI_AIUS
 #define ASI_AIUS        0x11
 #endif
diff --git a/arch/sparc/lib/NG2copy_to_user.S b/arch/sparc/lib/NG2copy_to_user.S
index 7fe1ccefd9d0..4e962d993b10 100644
--- a/arch/sparc/lib/NG2copy_to_user.S
+++ b/arch/sparc/lib/NG2copy_to_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_ST_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_asi_fp;\
+        .text;                  \
+        .align 4;
+
 #ifndef ASI_AIUS
 #define ASI_AIUS        0x11
 #endif
diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
index 30eee6e8a81b..d5f585df2f3f 100644
--- a/arch/sparc/lib/NG2memcpy.S
+++ b/arch/sparc/lib/NG2memcpy.S
@@ -34,10 +34,16 @@
 #ifndef EX_LD
 #define EX_LD(x)        x
 #endif
+#ifndef EX_LD_FP
+#define EX_LD_FP(x)     x
+#endif
 
 #ifndef EX_ST
 #define EX_ST(x)        x
 #endif
+#ifndef EX_ST_FP
+#define EX_ST_FP(x)     x
+#endif
 
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)    x
@@ -134,40 +140,40 @@
         fsrc2           %x6, %f12; \
         fsrc2           %x7, %f14;
 #define FREG_LOAD_1(base, x0) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0))
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0))
 #define FREG_LOAD_2(base, x0, x1) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD(LOAD(ldd, base + 0x08, %x1));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1));
 #define FREG_LOAD_3(base, x0, x1, x2) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD(LOAD(ldd, base + 0x10, %x2));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2));
 #define FREG_LOAD_4(base, x0, x1, x2, x3) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD(LOAD(ldd, base + 0x18, %x3));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3));
 #define FREG_LOAD_5(base, x0, x1, x2, x3, x4) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD(LOAD(ldd, base + 0x18, %x3)); \
-        EX_LD(LOAD(ldd, base + 0x20, %x4));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \
+        EX_LD_FP(LOAD(ldd, base + 0x20, %x4));
 #define FREG_LOAD_6(base, x0, x1, x2, x3, x4, x5) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD(LOAD(ldd, base + 0x18, %x3)); \
-        EX_LD(LOAD(ldd, base + 0x20, %x4)); \
-        EX_LD(LOAD(ldd, base + 0x28, %x5));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \
+        EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); \
+        EX_LD_FP(LOAD(ldd, base + 0x28, %x5));
 #define FREG_LOAD_7(base, x0, x1, x2, x3, x4, x5, x6) \
-        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
-        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
-        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
-        EX_LD(LOAD(ldd, base + 0x18, %x3)); \
-        EX_LD(LOAD(ldd, base + 0x20, %x4)); \
-        EX_LD(LOAD(ldd, base + 0x28, %x5)); \
-        EX_LD(LOAD(ldd, base + 0x30, %x6));
+        EX_LD_FP(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD_FP(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD_FP(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD_FP(LOAD(ldd, base + 0x18, %x3)); \
+        EX_LD_FP(LOAD(ldd, base + 0x20, %x4)); \
+        EX_LD_FP(LOAD(ldd, base + 0x28, %x5)); \
+        EX_LD_FP(LOAD(ldd, base + 0x30, %x6));
 
         .register       %g2,#scratch
         .register       %g3,#scratch
@@ -275,11 +281,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          nop
         /* fall through for 0 < low bits < 8 */
 110:    sub             %o4, 64, %g2
-        EX_LD(LOAD_BLK(%g2, %f0))
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+        EX_LD_FP(LOAD_BLK(%g2, %f0))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f14, f16)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_8(f16, f18, f20, f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -290,10 +296,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 120:    sub             %o4, 56, %g2
         FREG_LOAD_7(%g2, f0, f2, f4, f6, f8, f10, f12)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f16, f18)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_7(f18, f20, f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -304,10 +310,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 130:    sub             %o4, 48, %g2
         FREG_LOAD_6(%g2, f0, f2, f4, f6, f8, f10)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f4, f6, f8, f10, f16, f18, f20)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_6(f20, f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -318,10 +324,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 140:    sub             %o4, 40, %g2
         FREG_LOAD_5(%g2, f0, f2, f4, f6, f8)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f4, f6, f8, f16, f18, f20, f22)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_5(f22, f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -332,10 +338,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 150:    sub             %o4, 32, %g2
         FREG_LOAD_4(%g2, f0, f2, f4, f6)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f4, f6, f16, f18, f20, f22, f24)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_4(f24, f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -346,10 +352,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 160:    sub             %o4, 24, %g2
         FREG_LOAD_3(%g2, f0, f2, f4)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f4, f16, f18, f20, f22, f24, f26)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_3(f26, f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -360,10 +366,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 170:    sub             %o4, 16, %g2
         FREG_LOAD_2(%g2, f0, f2)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f2, f16, f18, f20, f22, f24, f26, f28)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_2(f28, f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -374,10 +380,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
 180:    sub             %o4, 8, %g2
         FREG_LOAD_1(%g2, f0)
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
-        EX_LD(LOAD_BLK(%o4, %f16))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f16))
         FREG_FROB(f0, f16, f18, f20, f22, f24, f26, f28, f30)
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         FREG_MOVE_1(f30)
         subcc           %g1, 64, %g1
         add             %o4, 64, %o4
@@ -387,10 +393,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          nop
 
 190:
-1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+1:      EX_ST_FP(STORE_INIT(%g0, %o4 + %g3))
         subcc           %g1, 64, %g1
-        EX_LD(LOAD_BLK(%o4, %f0))
-        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        EX_LD_FP(LOAD_BLK(%o4, %f0))
+        EX_ST_FP(STORE_BLK(%f0, %o4 + %g3))
         add             %o4, 64, %o4
         bne,pt          %xcc, 1b
          LOAD(prefetch, %o4 + 64, #one_read)
diff --git a/arch/sparc/lib/NG4copy_from_user.S b/arch/sparc/lib/NG4copy_from_user.S
index fd9f903ffa32..2e8ee7ad07a9 100644
--- a/arch/sparc/lib/NG4copy_from_user.S
+++ b/arch/sparc/lib/NG4copy_from_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_LD_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_asi_fp;\
+        .text;                  \
+        .align 4;
+
 #ifndef ASI_AIUS
 #define ASI_AIUS        0x11
 #endif
diff --git a/arch/sparc/lib/NG4copy_to_user.S b/arch/sparc/lib/NG4copy_to_user.S
index 9744c4540a8d..be0bf4590df8 100644
--- a/arch/sparc/lib/NG4copy_to_user.S
+++ b/arch/sparc/lib/NG4copy_to_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_ST_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_asi_fp;\
+        .text;                  \
+        .align 4;
+
 #ifndef ASI_AIUS
 #define ASI_AIUS        0x11
 #endif
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 83aeeb1dffdb..8e13ee1f4454 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -48,10 +48,16 @@
 #ifndef EX_LD
 #define EX_LD(x)        x
 #endif
+#ifndef EX_LD_FP
+#define EX_LD_FP(x)     x
+#endif
 
 #ifndef EX_ST
 #define EX_ST(x)        x
 #endif
+#ifndef EX_ST_FP
+#define EX_ST_FP(x)     x
+#endif
 
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)    x
@@ -210,17 +216,17 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %o2, %o4, %o2
         alignaddr       %o1, %g0, %g1
         add             %o1, %o4, %o1
-        EX_LD(LOAD(ldd, %g1 + 0x00, %f0))
-1:      EX_LD(LOAD(ldd, %g1 + 0x08, %f2))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x00, %f0))
+1:      EX_LD_FP(LOAD(ldd, %g1 + 0x08, %f2))
         subcc           %o4, 0x40, %o4
-        EX_LD(LOAD(ldd, %g1 + 0x10, %f4))
-        EX_LD(LOAD(ldd, %g1 + 0x18, %f6))
-        EX_LD(LOAD(ldd, %g1 + 0x20, %f8))
-        EX_LD(LOAD(ldd, %g1 + 0x28, %f10))
-        EX_LD(LOAD(ldd, %g1 + 0x30, %f12))
-        EX_LD(LOAD(ldd, %g1 + 0x38, %f14))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x10, %f4))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x18, %f6))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x20, %f8))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x28, %f10))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x30, %f12))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x38, %f14))
         faligndata      %f0, %f2, %f16
-        EX_LD(LOAD(ldd, %g1 + 0x40, %f0))
+        EX_LD_FP(LOAD(ldd, %g1 + 0x40, %f0))
         faligndata      %f2, %f4, %f18
         add             %g1, 0x40, %g1
         faligndata      %f4, %f6, %f20
@@ -229,14 +235,14 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         faligndata      %f10, %f12, %f26
         faligndata      %f12, %f14, %f28
         faligndata      %f14, %f0, %f30
-        EX_ST(STORE(std, %f16, %o0 + 0x00))
-        EX_ST(STORE(std, %f18, %o0 + 0x08))
-        EX_ST(STORE(std, %f20, %o0 + 0x10))
-        EX_ST(STORE(std, %f22, %o0 + 0x18))
-        EX_ST(STORE(std, %f24, %o0 + 0x20))
-        EX_ST(STORE(std, %f26, %o0 + 0x28))
-        EX_ST(STORE(std, %f28, %o0 + 0x30))
-        EX_ST(STORE(std, %f30, %o0 + 0x38))
+        EX_ST_FP(STORE(std, %f16, %o0 + 0x00))
+        EX_ST_FP(STORE(std, %f18, %o0 + 0x08))
+        EX_ST_FP(STORE(std, %f20, %o0 + 0x10))
+        EX_ST_FP(STORE(std, %f22, %o0 + 0x18))
+        EX_ST_FP(STORE(std, %f24, %o0 + 0x20))
+        EX_ST_FP(STORE(std, %f26, %o0 + 0x28))
+        EX_ST_FP(STORE(std, %f28, %o0 + 0x30))
+        EX_ST_FP(STORE(std, %f30, %o0 + 0x38))
         add             %o0, 0x40, %o0
         bne,pt          %icc, 1b
          LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
diff --git a/arch/sparc/lib/U1copy_from_user.S b/arch/sparc/lib/U1copy_from_user.S
index a6ae2ea04bf5..ecc5692fa2b4 100644
--- a/arch/sparc/lib/U1copy_from_user.S
+++ b/arch/sparc/lib/U1copy_from_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_LD_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_fp;\
+        .text;                  \
+        .align 4;
+
 #define FUNC_NAME               ___copy_from_user
 #define LOAD(type,addr,dest)    type##a [addr] %asi, dest
 #define LOAD_BLK(addr,dest)     ldda [addr] ASI_BLK_AIUS, dest
diff --git a/arch/sparc/lib/U1copy_to_user.S b/arch/sparc/lib/U1copy_to_user.S
index f4b970eeb485..9eea392e44d4 100644
--- a/arch/sparc/lib/U1copy_to_user.S
+++ b/arch/sparc/lib/U1copy_to_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_ST_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_fp;\
+        .text;                  \
+        .align 4;
+
 #define FUNC_NAME               ___copy_to_user
 #define STORE(type,src,addr)    type##a src, [addr] ASI_AIUS
 #define STORE_BLK(src,addr)     stda src, [addr] ASI_BLK_AIUS
diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
index b67142b7768e..3e6209ebb7d7 100644
--- a/arch/sparc/lib/U1memcpy.S
+++ b/arch/sparc/lib/U1memcpy.S
@@ -25,10 +25,16 @@
 #ifndef EX_LD
 #define EX_LD(x)        x
 #endif
+#ifndef EX_LD_FP
+#define EX_LD_FP(x)     x
+#endif
 
 #ifndef EX_ST
 #define EX_ST(x)        x
 #endif
+#ifndef EX_ST_FP
+#define EX_ST_FP(x)     x
+#endif
 
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)    x
@@ -73,8 +79,8 @@
         faligndata              %f8, %f9, %f62;
 
 #define MAIN_LOOP_CHUNK(src, dest, fdest, fsrc, len, jmptgt)    \
-        EX_LD(LOAD_BLK(%src, %fdest));                          \
-        EX_ST(STORE_BLK(%fsrc, %dest));                         \
+        EX_LD_FP(LOAD_BLK(%src, %fdest));                               \
+        EX_ST_FP(STORE_BLK(%fsrc, %dest));                              \
         add                     %src, 0x40, %src;               \
         subcc                   %len, 0x40, %len;               \
         be,pn                   %xcc, jmptgt;                   \
@@ -89,12 +95,12 @@
 
 #define DO_SYNC                 membar  #Sync;
 #define STORE_SYNC(dest, fsrc)                          \
-        EX_ST(STORE_BLK(%fsrc, %dest));                 \
+        EX_ST_FP(STORE_BLK(%fsrc, %dest));                      \
         add                     %dest, 0x40, %dest;     \
         DO_SYNC
 
 #define STORE_JUMP(dest, fsrc, target)                  \
-        EX_ST(STORE_BLK(%fsrc, %dest));                 \
+        EX_ST_FP(STORE_BLK(%fsrc, %dest));                      \
         add                     %dest, 0x40, %dest;     \
         ba,pt                   %xcc, target;           \
          nop;
@@ -103,7 +109,7 @@
         subcc                   %left, 8, %left;\
         bl,pn                   %xcc, 95f;      \
          faligndata             %f0, %f1, %f48; \
-        EX_ST(STORE(std, %f48, %dest));         \
+        EX_ST_FP(STORE(std, %f48, %dest));              \
         add                     %dest, 8, %dest;
 
 #define UNEVEN_VISCHUNK_LAST(dest, f0, f1, left)        \
@@ -160,8 +166,8 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
          and            %g2, 0x38, %g2
 
 1:      subcc           %g1, 0x1, %g1
-        EX_LD(LOAD(ldub, %o1 + 0x00, %o3))
-        EX_ST(STORE(stb, %o3, %o1 + %GLOBAL_SPARE))
+        EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3))
+        EX_ST_FP(STORE(stb, %o3, %o1 + %GLOBAL_SPARE))
         bgu,pt          %XCC, 1b
          add            %o1, 0x1, %o1
 
@@ -172,20 +178,20 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         be,pt           %icc, 3f
          alignaddr      %o1, %g0, %o1
 
-        EX_LD(LOAD(ldd, %o1, %f4))
-1:      EX_LD(LOAD(ldd, %o1 + 0x8, %f6))
+        EX_LD_FP(LOAD(ldd, %o1, %f4))
+1:      EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6))
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f4, %f6, %f0
-        EX_ST(STORE(std, %f0, %o0))
+        EX_ST_FP(STORE(std, %f0, %o0))
         be,pn           %icc, 3f
          add            %o0, 0x8, %o0
 
-        EX_LD(LOAD(ldd, %o1 + 0x8, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4))
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f6, %f4, %f0
-        EX_ST(STORE(std, %f0, %o0))
+        EX_ST_FP(STORE(std, %f0, %o0))
         bne,pt          %icc, 1b
          add            %o0, 0x8, %o0
 
@@ -208,13 +214,13 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
         add             %g1, %GLOBAL_SPARE, %g1
         subcc           %o2, %g3, %o2
 
-        EX_LD(LOAD_BLK(%o1, %f0))
+        EX_LD_FP(LOAD_BLK(%o1, %f0))
         add             %o1, 0x40, %o1
         add             %g1, %g3, %g1
-        EX_LD(LOAD_BLK(%o1, %f16))
+        EX_LD_FP(LOAD_BLK(%o1, %f16))
         add             %o1, 0x40, %o1
         sub             %GLOBAL_SPARE, 0x80, %GLOBAL_SPARE
-        EX_LD(LOAD_BLK(%o1, %f32))
+        EX_LD_FP(LOAD_BLK(%o1, %f32))
         add             %o1, 0x40, %o1
 
         /* There are 8 instances of the unrolled loop,
@@ -426,28 +432,28 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
 62:     FINISH_VISCHUNK(o0, f44, f46, g3)
 63:     UNEVEN_VISCHUNK_LAST(o0, f46, f0,  g3)
 
-93:     EX_LD(LOAD(ldd, %o1, %f2))
+93:     EX_LD_FP(LOAD(ldd, %o1, %f2))
         add             %o1, 8, %o1
         subcc           %g3, 8, %g3
         faligndata      %f0, %f2, %f8
-        EX_ST(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0))
         bl,pn           %xcc, 95f
          add            %o0, 8, %o0
-        EX_LD(LOAD(ldd, %o1, %f0))
+        EX_LD_FP(LOAD(ldd, %o1, %f0))
         add             %o1, 8, %o1
         subcc           %g3, 8, %g3
         faligndata      %f2, %f0, %f8
-        EX_ST(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0))
         bge,pt          %xcc, 93b
          add            %o0, 8, %o0
 
 95:     brz,pt          %o2, 2f
          mov            %g1, %o1
 
-1:      EX_LD(LOAD(ldub, %o1, %o3))
+1:      EX_LD_FP(LOAD(ldub, %o1, %o3))
         add             %o1, 1, %o1
         subcc           %o2, 1, %o2
-        EX_ST(STORE(stb, %o3, %o0))
+        EX_ST_FP(STORE(stb, %o3, %o0))
         bne,pt          %xcc, 1b
          add            %o0, 1, %o0
 
diff --git a/arch/sparc/lib/U3copy_from_user.S b/arch/sparc/lib/U3copy_from_user.S
index b1acd1331c33..88ad73d86fe4 100644
--- a/arch/sparc/lib/U3copy_from_user.S
+++ b/arch/sparc/lib/U3copy_from_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_LD_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_fp;\
+        .text;                  \
+        .align 4;
+
 #define FUNC_NAME               U3copy_from_user
 #define LOAD(type,addr,dest)    type##a [addr] %asi, dest
 #define EX_RETVAL(x)            0
diff --git a/arch/sparc/lib/U3copy_to_user.S b/arch/sparc/lib/U3copy_to_user.S
index ef1e493afdfa..845139d75537 100644
--- a/arch/sparc/lib/U3copy_to_user.S
+++ b/arch/sparc/lib/U3copy_to_user.S
@@ -11,6 +11,14 @@
         .text;                  \
         .align 4;
 
+#define EX_ST_FP(x)             \
+98:     x;                      \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, __retl_one_fp;\
+        .text;                  \
+        .align 4;
+
 #define FUNC_NAME               U3copy_to_user
 #define STORE(type,src,addr)    type##a src, [addr] ASI_AIUS
 #define STORE_BLK(src,addr)     stda src, [addr] ASI_BLK_AIUS
diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
index 7cae9cc6a204..491ee69e4995 100644
--- a/arch/sparc/lib/U3memcpy.S
+++ b/arch/sparc/lib/U3memcpy.S
@@ -24,10 +24,16 @@
 #ifndef EX_LD
 #define EX_LD(x)        x
 #endif
+#ifndef EX_LD_FP
+#define EX_LD_FP(x)     x
+#endif
 
 #ifndef EX_ST
 #define EX_ST(x)        x
 #endif
+#ifndef EX_ST_FP
+#define EX_ST_FP(x)     x
+#endif
 
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)    x
@@ -120,8 +126,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          and            %g2, 0x38, %g2
 
 1:      subcc           %g1, 0x1, %g1
-        EX_LD(LOAD(ldub, %o1 + 0x00, %o3))
-        EX_ST(STORE(stb, %o3, %o1 + GLOBAL_SPARE))
+        EX_LD_FP(LOAD(ldub, %o1 + 0x00, %o3))
+        EX_ST_FP(STORE(stb, %o3, %o1 + GLOBAL_SPARE))
         bgu,pt          %XCC, 1b
          add            %o1, 0x1, %o1
 
@@ -132,20 +138,20 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         be,pt           %icc, 3f
          alignaddr      %o1, %g0, %o1
 
-        EX_LD(LOAD(ldd, %o1, %f4))
-1:      EX_LD(LOAD(ldd, %o1 + 0x8, %f6))
+        EX_LD_FP(LOAD(ldd, %o1, %f4))
+1:      EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f6))
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f4, %f6, %f0
-        EX_ST(STORE(std, %f0, %o0))
+        EX_ST_FP(STORE(std, %f0, %o0))
         be,pn           %icc, 3f
          add            %o0, 0x8, %o0
 
-        EX_LD(LOAD(ldd, %o1 + 0x8, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x8, %f4))
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f6, %f4, %f2
-        EX_ST(STORE(std, %f2, %o0))
+        EX_ST_FP(STORE(std, %f2, %o0))
         bne,pt          %icc, 1b
          add            %o0, 0x8, %o0
 
@@ -155,25 +161,25 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         LOAD(prefetch, %o1 + 0x080, #one_read)
         LOAD(prefetch, %o1 + 0x0c0, #one_read)
         LOAD(prefetch, %o1 + 0x100, #one_read)
-        EX_LD(LOAD(ldd, %o1 + 0x000, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x000, %f0))
         LOAD(prefetch, %o1 + 0x140, #one_read)
-        EX_LD(LOAD(ldd, %o1 + 0x008, %f2))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
         LOAD(prefetch, %o1 + 0x180, #one_read)
-        EX_LD(LOAD(ldd, %o1 + 0x010, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
         LOAD(prefetch, %o1 + 0x1c0, #one_read)
         faligndata      %f0, %f2, %f16
-        EX_LD(LOAD(ldd, %o1 + 0x018, %f6))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
         faligndata      %f2, %f4, %f18
-        EX_LD(LOAD(ldd, %o1 + 0x020, %f8))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
         faligndata      %f4, %f6, %f20
-        EX_LD(LOAD(ldd, %o1 + 0x028, %f10))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
         faligndata      %f6, %f8, %f22
 
-        EX_LD(LOAD(ldd, %o1 + 0x030, %f12))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
         faligndata      %f8, %f10, %f24
-        EX_LD(LOAD(ldd, %o1 + 0x038, %f14))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
         faligndata      %f10, %f12, %f26
-        EX_LD(LOAD(ldd, %o1 + 0x040, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
 
         subcc           GLOBAL_SPARE, 0x80, GLOBAL_SPARE
         add             %o1, 0x40, %o1
@@ -184,26 +190,26 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
         .align          64
 1:
-        EX_LD(LOAD(ldd, %o1 + 0x008, %f2))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
         faligndata      %f12, %f14, %f28
-        EX_LD(LOAD(ldd, %o1 + 0x010, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
         faligndata      %f14, %f0, %f30
-        EX_ST(STORE_BLK(%f16, %o0))
-        EX_LD(LOAD(ldd, %o1 + 0x018, %f6))
+        EX_ST_FP(STORE_BLK(%f16, %o0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
         faligndata      %f0, %f2, %f16
         add             %o0, 0x40, %o0
 
-        EX_LD(LOAD(ldd, %o1 + 0x020, %f8))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
         faligndata      %f2, %f4, %f18
-        EX_LD(LOAD(ldd, %o1 + 0x028, %f10))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
         faligndata      %f4, %f6, %f20
-        EX_LD(LOAD(ldd, %o1 + 0x030, %f12))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
         subcc           %o3, 0x01, %o3
         faligndata      %f6, %f8, %f22
-        EX_LD(LOAD(ldd, %o1 + 0x038, %f14))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
 
         faligndata      %f8, %f10, %f24
-        EX_LD(LOAD(ldd, %o1 + 0x040, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
         LOAD(prefetch, %o1 + 0x1c0, #one_read)
         faligndata      %f10, %f12, %f26
         bg,pt           %XCC, 1b
@@ -211,29 +217,29 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
         /* Finally we copy the last full 64-byte block. */
 2:
-        EX_LD(LOAD(ldd, %o1 + 0x008, %f2))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x008, %f2))
         faligndata      %f12, %f14, %f28
-        EX_LD(LOAD(ldd, %o1 + 0x010, %f4))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x010, %f4))
         faligndata      %f14, %f0, %f30
-        EX_ST(STORE_BLK(%f16, %o0))
-        EX_LD(LOAD(ldd, %o1 + 0x018, %f6))
+        EX_ST_FP(STORE_BLK(%f16, %o0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x018, %f6))
         faligndata      %f0, %f2, %f16
-        EX_LD(LOAD(ldd, %o1 + 0x020, %f8))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x020, %f8))
         faligndata      %f2, %f4, %f18
-        EX_LD(LOAD(ldd, %o1 + 0x028, %f10))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x028, %f10))
         faligndata      %f4, %f6, %f20
-        EX_LD(LOAD(ldd, %o1 + 0x030, %f12))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x030, %f12))
         faligndata      %f6, %f8, %f22
-        EX_LD(LOAD(ldd, %o1 + 0x038, %f14))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x038, %f14))
         faligndata      %f8, %f10, %f24
         cmp             %g1, 0
         be,pt           %XCC, 1f
          add            %o0, 0x40, %o0
-        EX_LD(LOAD(ldd, %o1 + 0x040, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0))
 1:      faligndata      %f10, %f12, %f26
         faligndata      %f12, %f14, %f28
         faligndata      %f14, %f0, %f30
-        EX_ST(STORE_BLK(%f16, %o0))
+        EX_ST_FP(STORE_BLK(%f16, %o0))
         add             %o0, 0x40, %o0
         add             %o1, 0x40, %o1
         membar          #Sync
@@ -253,20 +259,20 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 
         sub             %o2, %g2, %o2
         be,a,pt         %XCC, 1f
-         EX_LD(LOAD(ldd, %o1 + 0x00, %f0))
+         EX_LD_FP(LOAD(ldd, %o1 + 0x00, %f0))
 
-1:      EX_LD(LOAD(ldd, %o1 + 0x08, %f2))
+1:      EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f2))
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f0, %f2, %f8
-        EX_ST(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0))
         be,pn           %XCC, 2f
          add            %o0, 0x8, %o0
-        EX_LD(LOAD(ldd, %o1 + 0x08, %f0))
+        EX_LD_FP(LOAD(ldd, %o1 + 0x08, %f0))
         add             %o1, 0x8, %o1
         subcc           %g2, 0x8, %g2
         faligndata      %f2, %f0, %f8
-        EX_ST(STORE(std, %f8, %o0))
+        EX_ST_FP(STORE(std, %f8, %o0))
         bne,pn          %XCC, 1b
          add            %o0, 0x8, %o0
 
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index 06332cb7e7d1..3f5c48ddba45 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -38,6 +38,14 @@ static inline bool guest_cpuid_has_xsave(struct kvm_vcpu *vcpu)
         return best && (best->ecx & bit(X86_FEATURE_XSAVE));
 }
 
+static inline bool guest_cpuid_has_mtrr(struct kvm_vcpu *vcpu)
+{
+        struct kvm_cpuid_entry2 *best;
+
+        best = kvm_find_cpuid_entry(vcpu, 1, 0);
+        return best && (best->edx & bit(X86_FEATURE_MTRR));
+}
+
 static inline bool guest_cpuid_has_tsc_adjust(struct kvm_vcpu *vcpu)
 {
         struct kvm_cpuid_entry2 *best;
diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
index 9e8bf13572e6..3f8c732117ec 100644
--- a/arch/x86/kvm/mtrr.c
+++ b/arch/x86/kvm/mtrr.c
@@ -120,14 +120,22 @@ static u8 mtrr_default_type(struct kvm_mtrr *mtrr_state)
         return mtrr_state->deftype & IA32_MTRR_DEF_TYPE_TYPE_MASK;
 }
 
-static u8 mtrr_disabled_type(void)
+static u8 mtrr_disabled_type(struct kvm_vcpu *vcpu)
 {
         /*
          * Intel SDM 11.11.2.2: all MTRRs are disabled when
          * IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC
          * memory type is applied to all of physical memory.
+         *
+         * However, virtual machines can be run with CPUID such that
+         * there are no MTRRs.  In that case, the firmware will never
+         * enable MTRRs and it is obviously undesirable to run the
+         * guest entirely with UC memory and we use WB.
          */
-        return MTRR_TYPE_UNCACHABLE;
+        if (guest_cpuid_has_mtrr(vcpu))
+                return MTRR_TYPE_UNCACHABLE;
+        else
+                return MTRR_TYPE_WRBACK;
 }
 
 /*
@@ -267,7 +275,7 @@ static int fixed_mtrr_addr_to_seg(u64 addr)
 
         for (seg = 0; seg < seg_num; seg++) {
                 mtrr_seg = &fixed_seg_table[seg];
-                if (mtrr_seg->start >= addr && addr < mtrr_seg->end)
+                if (mtrr_seg->start <= addr && addr < mtrr_seg->end)
                         return seg;
         }
 
@@ -300,7 +308,6 @@ static void var_mtrr_range(struct kvm_mtrr_range *range, u64 *start, u64 *end)
         *start = range->base & PAGE_MASK;
 
         mask = range->mask & PAGE_MASK;
-        mask |= ~0ULL << boot_cpu_data.x86_phys_bits;
 
         /* This cannot overflow because writing to the reserved bits of
          * variable MTRRs causes a #GP.
@@ -356,10 +363,14 @@ static void set_var_mtrr_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data)
         if (var_mtrr_range_is_valid(cur))
                 list_del(&mtrr_state->var_ranges[index].node);
 
+        /* Extend the mask with all 1 bits to the left, since those
+         * bits must implicitly be 0.  The bits are then cleared
+         * when reading them.
+         */
         if (!is_mtrr_mask)
                 cur->base = data;
         else
-                cur->mask = data;
+                cur->mask = data | (-1LL << cpuid_maxphyaddr(vcpu));
 
         /* add it to the list if it's enabled. */
         if (var_mtrr_range_is_valid(cur)) {
@@ -426,6 +437,8 @@ int kvm_mtrr_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
                         *pdata = vcpu->arch.mtrr_state.var_ranges[index].base;
                 else
                         *pdata = vcpu->arch.mtrr_state.var_ranges[index].mask;
+
+                *pdata &= (1ULL << cpuid_maxphyaddr(vcpu)) - 1;
         }
 
         return 0;
@@ -670,7 +683,7 @@ u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
         }
 
         if (iter.mtrr_disabled)
-                return mtrr_disabled_type();
+                return mtrr_disabled_type(vcpu);
 
         /* not contained in any MTRRs. */
         if (type == -1)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 83a1c643f9a5..899c40f826dd 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3422,6 +3422,8 @@ static int handle_exit(struct kvm_vcpu *vcpu)
         struct kvm_run *kvm_run = vcpu->run;
         u32 exit_code = svm->vmcb->control.exit_code;
 
+        trace_kvm_exit(exit_code, vcpu, KVM_ISA_SVM);
+
         if (!is_cr_intercept(svm, INTERCEPT_CR0_WRITE))
                 vcpu->arch.cr0 = svm->vmcb->save.cr0;
         if (npt_enabled)
@@ -3892,8 +3894,6 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
         vcpu->arch.regs[VCPU_REGS_RSP] = svm->vmcb->save.rsp;
         vcpu->arch.regs[VCPU_REGS_RIP] = svm->vmcb->save.rip;
 
-        trace_kvm_exit(svm->vmcb->control.exit_code, vcpu, KVM_ISA_SVM);
-
         if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
                 kvm_before_handle_nmi(&svm->vcpu);
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index af823a388c19..44976a596fa6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2803,7 +2803,7 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 msr_info->data = vcpu->arch.ia32_xss;
                 break;
         case MSR_TSC_AUX:
-                if (!guest_cpuid_has_rdtscp(vcpu))
+                if (!guest_cpuid_has_rdtscp(vcpu) && !msr_info->host_initiated)
                         return 1;
                 /* Otherwise falls through */
         default:
@@ -2909,7 +2909,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                         clear_atomic_switch_msr(vmx, MSR_IA32_XSS);
                 break;
         case MSR_TSC_AUX:
-                if (!guest_cpuid_has_rdtscp(vcpu))
+                if (!guest_cpuid_has_rdtscp(vcpu) && !msr_info->host_initiated)
                         return 1;
                 /* Check reserved bit, higher 32 bits should be zero */
                 if ((data >> 32) != 0)
@@ -8042,6 +8042,8 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
         u32 exit_reason = vmx->exit_reason;
         u32 vectoring_info = vmx->idt_vectoring_info;
 
+        trace_kvm_exit(exit_reason, vcpu, KVM_ISA_VMX);
+
         /*
          * Flush logged GPAs PML buffer, this will make dirty_bitmap more
          * updated. Another good is, in kvm_vm_ioctl_get_dirty_log, before
@@ -8668,7 +8670,6 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
         vmx->loaded_vmcs->launched = 1;
 
         vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
-        trace_kvm_exit(vmx->exit_reason, vcpu, KVM_ISA_VMX);
 
         /*
          * the KVM_REQ_EVENT optimization bit is only on for one entry, and if
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index eed32283d22c..7ffc224bbe41 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3572,9 +3572,11 @@ static int kvm_vm_ioctl_get_pit(struct kvm *kvm, struct kvm_pit_state *ps)
 
 static int kvm_vm_ioctl_set_pit(struct kvm *kvm, struct kvm_pit_state *ps)
 {
+        int i;
         mutex_lock(&kvm->arch.vpit->pit_state.lock);
         memcpy(&kvm->arch.vpit->pit_state, ps, sizeof(struct kvm_pit_state));
-        kvm_pit_load_count(kvm, 0, ps->channels[0].count, 0);
+        for (i = 0; i < 3; i++)
+                kvm_pit_load_count(kvm, i, ps->channels[i].count, 0);
         mutex_unlock(&kvm->arch.vpit->pit_state.lock);
         return 0;
 }
@@ -3593,6 +3595,7 @@ static int kvm_vm_ioctl_get_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
 static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
 {
         int start = 0;
+        int i;
         u32 prev_legacy, cur_legacy;
         mutex_lock(&kvm->arch.vpit->pit_state.lock);
         prev_legacy = kvm->arch.vpit->pit_state.flags & KVM_PIT_FLAGS_HPET_LEGACY;
@@ -3602,7 +3605,8 @@ static int kvm_vm_ioctl_set_pit2(struct kvm *kvm, struct kvm_pit_state2 *ps)
         memcpy(&kvm->arch.vpit->pit_state.channels, &ps->channels,
                sizeof(kvm->arch.vpit->pit_state.channels));
         kvm->arch.vpit->pit_state.flags = ps->flags;
-        kvm_pit_load_count(kvm, 0, kvm->arch.vpit->pit_state.channels[0].count, start);
+        for (i = 0; i < 3; i++)
+                kvm_pit_load_count(kvm, i, kvm->arch.vpit->pit_state.channels[i].count, start);
         mutex_unlock(&kvm->arch.vpit->pit_state.lock);
         return 0;
 }
@@ -6515,6 +6519,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
         if (req_immediate_exit)
                 smp_send_reschedule(vcpu->cpu);
 
+        trace_kvm_entry(vcpu->vcpu_id);
+        wait_lapic_expire(vcpu);
         __kvm_guest_enter();
 
         if (unlikely(vcpu->arch.switch_db_regs)) {
@@ -6527,8 +6533,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
                 vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
         }
 
-        trace_kvm_entry(vcpu->vcpu_id);
-        wait_lapic_expire(vcpu);
         kvm_x86_ops->run(vcpu);
 
         /*
diff --git a/arch/x86/um/signal.c b/arch/x86/um/signal.c
index e5f854ce2d72..14fcd01ed992 100644
--- a/arch/x86/um/signal.c
+++ b/arch/x86/um/signal.c
@@ -470,7 +470,7 @@ long sys_sigreturn(void)
         struct sigcontext __user *sc = &frame->sc;
         int sig_size = (_NSIG_WORDS - 1) * sizeof(unsigned long);
 
-        if (copy_from_user(&set.sig[0], (void *)sc->oldmask, sizeof(set.sig[0])) ||
+        if (copy_from_user(&set.sig[0], &sc->oldmask, sizeof(set.sig[0])) ||
             copy_from_user(&set.sig[1], frame->extramask, sig_size))
                 goto segfault;
 
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index 3705eabd7e22..df0c40559583 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -1,6 +1,7 @@
 #include <linux/types.h>
 #include <linux/tick.h>
 
+#include <xen/xen.h>
 #include <xen/interface/xen.h>
 #include <xen/grant_table.h>
 #include <xen/events.h>
diff --git a/block/blk-core.c b/block/blk-core.c
index 3636be469fa2..33e2f62d5062 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -207,6 +207,22 @@ void blk_delay_queue(struct request_queue *q, unsigned long msecs)
 EXPORT_SYMBOL(blk_delay_queue);
 
 /**
+ * blk_start_queue_async - asynchronously restart a previously stopped queue
+ * @q:    The &struct request_queue in question
+ *
+ * Description:
+ *   blk_start_queue_async() will clear the stop flag on the queue, and
+ *   ensure that the request_fn for the queue is run from an async
+ *   context.
+ **/
+void blk_start_queue_async(struct request_queue *q)
+{
+        queue_flag_clear(QUEUE_FLAG_STOPPED, q);
+        blk_run_queue_async(q);
+}
+EXPORT_SYMBOL(blk_start_queue_async);
+
+/**
  * blk_start_queue - restart a previously stopped queue
  * @q:    The &struct request_queue in question
  *
@@ -1689,8 +1705,6 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio)
         struct request *req;
         unsigned int request_count = 0;
 
-        blk_queue_split(q, &bio, q->bio_split);
-
         /*
          * low level driver can indicate that it wants pages above a
          * certain limit bounced to low memory (ie for highmem, or even
@@ -1698,6 +1712,8 @@ static blk_qc_t blk_queue_bio(struct request_queue *q, struct bio *bio)
          */
         blk_queue_bounce(q, &bio);
 
+        blk_queue_split(q, &bio, q->bio_split);
+
         if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) {
                 bio->bi_error = -EIO;
                 bio_endio(bio);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index e01405a3e8b3..e73846a3d08a 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -81,7 +81,7 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
         struct bio *new = NULL;
 
         bio_for_each_segment(bv, bio, iter) {
-                if (sectors + (bv.bv_len >> 9) > queue_max_sectors(q))
+                if (sectors + (bv.bv_len >> 9) > blk_max_size_offset(q, bio->bi_iter.bi_sector))
                         goto split;
 
                 /*
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index ca9efe17db1a..634b4d1ab681 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -47,7 +47,7 @@ struct skcipher_ctx {
         bool merge;
         bool enc;
 
-        struct ablkcipher_request req;
+        struct skcipher_request req;
 };
 
 struct skcipher_async_rsgl {
@@ -64,13 +64,13 @@ struct skcipher_async_req {
 };
 
 #define GET_SREQ(areq, ctx) (struct skcipher_async_req *)((char *)areq + \
-        crypto_ablkcipher_reqsize(crypto_ablkcipher_reqtfm(&ctx->req)))
+        crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req)))
 
 #define GET_REQ_SIZE(ctx) \
-        crypto_ablkcipher_reqsize(crypto_ablkcipher_reqtfm(&ctx->req))
+        crypto_skcipher_reqsize(crypto_skcipher_reqtfm(&ctx->req))
 
 #define GET_IV_SIZE(ctx) \
-        crypto_ablkcipher_ivsize(crypto_ablkcipher_reqtfm(&ctx->req))
+        crypto_skcipher_ivsize(crypto_skcipher_reqtfm(&ctx->req))
 
 #define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \
                       sizeof(struct scatterlist) - 1)
@@ -302,8 +302,8 @@ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,
         struct sock *sk = sock->sk;
         struct alg_sock *ask = alg_sk(sk);
         struct skcipher_ctx *ctx = ask->private;
-        struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(&ctx->req);
-        unsigned ivsize = crypto_ablkcipher_ivsize(tfm);
+        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(&ctx->req);
+        unsigned ivsize = crypto_skcipher_ivsize(tfm);
         struct skcipher_sg_list *sgl;
         struct af_alg_control con = {};
         long copied = 0;
@@ -507,7 +507,7 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
         struct skcipher_sg_list *sgl;
         struct scatterlist *sg;
         struct skcipher_async_req *sreq;
-        struct ablkcipher_request *req;
+        struct skcipher_request *req;
         struct skcipher_async_rsgl *last_rsgl = NULL;
         unsigned int txbufs = 0, len = 0, tx_nents = skcipher_all_sg_nents(ctx);
         unsigned int reqlen = sizeof(struct skcipher_async_req) +
@@ -531,9 +531,9 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
         }
         sg_init_table(sreq->tsg, tx_nents);
         memcpy(sreq->iv, ctx->iv, GET_IV_SIZE(ctx));
-        ablkcipher_request_set_tfm(req, crypto_ablkcipher_reqtfm(&ctx->req));
-        ablkcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                        skcipher_async_cb, sk);
+        skcipher_request_set_tfm(req, crypto_skcipher_reqtfm(&ctx->req));
+        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                      skcipher_async_cb, sk);
 
         while (iov_iter_count(&msg->msg_iter)) {
                 struct skcipher_async_rsgl *rsgl;
@@ -608,10 +608,10 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
         if (mark)
                 sg_mark_end(sreq->tsg + txbufs - 1);
 
-        ablkcipher_request_set_crypt(req, sreq->tsg, sreq->first_sgl.sgl.sg,
-                                     len, sreq->iv);
-        err = ctx->enc ? crypto_ablkcipher_encrypt(req) :
-                         crypto_ablkcipher_decrypt(req);
+        skcipher_request_set_crypt(req, sreq->tsg, sreq->first_sgl.sgl.sg,
+                                   len, sreq->iv);
+        err = ctx->enc ? crypto_skcipher_encrypt(req) :
+                         crypto_skcipher_decrypt(req);
         if (err == -EINPROGRESS) {
                 atomic_inc(&ctx->inflight);
                 err = -EIOCBQUEUED;
@@ -632,7 +632,7 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
         struct sock *sk = sock->sk;
         struct alg_sock *ask = alg_sk(sk);
         struct skcipher_ctx *ctx = ask->private;
-        unsigned bs = crypto_ablkcipher_blocksize(crypto_ablkcipher_reqtfm(
+        unsigned bs = crypto_skcipher_blocksize(crypto_skcipher_reqtfm(
                 &ctx->req));
         struct skcipher_sg_list *sgl;
         struct scatterlist *sg;
@@ -669,14 +669,13 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
                 if (!used)
                         goto free;
 
-                ablkcipher_request_set_crypt(&ctx->req, sg,
-                                             ctx->rsgl.sg, used,
-                                             ctx->iv);
+                skcipher_request_set_crypt(&ctx->req, sg, ctx->rsgl.sg, used,
+                                           ctx->iv);
 
                 err = af_alg_wait_for_completion(
                                 ctx->enc ?
-                                        crypto_ablkcipher_encrypt(&ctx->req) :
-                                        crypto_ablkcipher_decrypt(&ctx->req),
+                                        crypto_skcipher_encrypt(&ctx->req) :
+                                        crypto_skcipher_decrypt(&ctx->req),
                                 &ctx->completion);
 
 free:
@@ -751,17 +750,17 @@ static struct proto_ops algif_skcipher_ops = {
 
 static void *skcipher_bind(const char *name, u32 type, u32 mask)
 {
-        return crypto_alloc_ablkcipher(name, type, mask);
+        return crypto_alloc_skcipher(name, type, mask);
 }
 
 static void skcipher_release(void *private)
 {
-        crypto_free_ablkcipher(private);
+        crypto_free_skcipher(private);
 }
 
 static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
 {
-        return crypto_ablkcipher_setkey(private, key, keylen);
+        return crypto_skcipher_setkey(private, key, keylen);
 }
 
 static void skcipher_wait(struct sock *sk)
@@ -778,13 +777,13 @@ static void skcipher_sock_destruct(struct sock *sk)
 {
         struct alg_sock *ask = alg_sk(sk);
         struct skcipher_ctx *ctx = ask->private;
-        struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(&ctx->req);
+        struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(&ctx->req);
 
         if (atomic_read(&ctx->inflight))
                 skcipher_wait(sk);
 
         skcipher_free_sgl(sk);
-        sock_kzfree_s(sk, ctx->iv, crypto_ablkcipher_ivsize(tfm));
+        sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm));
         sock_kfree_s(sk, ctx, ctx->len);
         af_alg_release_parent(sk);
 }
@@ -793,20 +792,20 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
 {
         struct skcipher_ctx *ctx;
         struct alg_sock *ask = alg_sk(sk);
-        unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(private);
+        unsigned int len = sizeof(*ctx) + crypto_skcipher_reqsize(private);
 
         ctx = sock_kmalloc(sk, len, GFP_KERNEL);
         if (!ctx)
                 return -ENOMEM;
 
-        ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(private),
+        ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(private),
                                GFP_KERNEL);
         if (!ctx->iv) {
                 sock_kfree_s(sk, ctx, len);
                 return -ENOMEM;
         }
 
-        memset(ctx->iv, 0, crypto_ablkcipher_ivsize(private));
+        memset(ctx->iv, 0, crypto_skcipher_ivsize(private));
 
         INIT_LIST_HEAD(&ctx->tsgl);
         ctx->len = len;
@@ -819,9 +818,9 @@ static int skcipher_accept_parent(void *private, struct sock *sk)
 
         ask->private = ctx;
 
-        ablkcipher_request_set_tfm(&ctx->req, private);
-        ablkcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                        af_alg_complete, &ctx->completion);
+        skcipher_request_set_tfm(&ctx->req, private);
+        skcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+                                      af_alg_complete, &ctx->completion);
 
         sk->sk_destruct = skcipher_sock_destruct;
 
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index f4e02ae93f58..11154a330f07 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -200,7 +200,8 @@ static int acpi_pss_perf_init(struct acpi_processor *pr,
                 goto err_remove_sysfs_thermal;
         }
 
-        sysfs_remove_link(&pr->cdev->device.kobj, "device");
+        return 0;
+
  err_remove_sysfs_thermal:
         sysfs_remove_link(&device->dev.kobj, "thermal_cooling");
  err_thermal_unregister:
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 8162475d96b5..09e3c0d87ecc 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -219,6 +219,9 @@ static void end_cmd(struct nullb_cmd *cmd)
 {
         struct request_queue *q = NULL;
 
+        if (cmd->rq)
+                q = cmd->rq->q;
+
         switch (queue_mode)  {
         case NULL_Q_MQ:
                 blk_mq_end_request(cmd->rq, 0);
@@ -229,23 +232,19 @@ static void end_cmd(struct nullb_cmd *cmd)
                 break;
         case NULL_Q_BIO:
                 bio_endio(cmd->bio);
-                goto free_cmd;
+                break;
         }
 
-        if (cmd->rq)
-                q = cmd->rq->q;
+        free_cmd(cmd);
 
         /* Restart queue if needed, as we are freeing a tag */
-        if (q && !q->mq_ops && blk_queue_stopped(q)) {
+        if (queue_mode == NULL_Q_RQ && blk_queue_stopped(q)) {
                 unsigned long flags;
 
                 spin_lock_irqsave(q->queue_lock, flags);
-                if (blk_queue_stopped(q))
-                        blk_start_queue(q);
+                blk_start_queue_async(q);
                 spin_unlock_irqrestore(q->queue_lock, flags);
         }
-free_cmd:
-        free_cmd(cmd);
 }
 
 static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
index 846bc29c157d..25996e256110 100644
--- a/drivers/bus/sunxi-rsb.c
+++ b/drivers/bus/sunxi-rsb.c
@@ -342,13 +342,13 @@ static int sunxi_rsb_read(struct sunxi_rsb *rsb, u8 rtaddr, u8 addr,
 
         ret = _sunxi_rsb_run_xfer(rsb);
         if (ret)
-                goto out;
+                goto unlock;
 
         *buf = readl(rsb->regs + RSB_DATA);
 
+unlock:
         mutex_unlock(&rsb->lock);
 
-out:
         return ret;
 }
 
@@ -527,9 +527,9 @@ static int sunxi_rsb_init_device_mode(struct sunxi_rsb *rsb)
  */
 
 static const struct sunxi_rsb_addr_map sunxi_rsb_addr_maps[] = {
-        { 0x3e3, 0x2d }, /* Primary PMIC: AXP223, AXP809, AXP81X, ... */
+        { 0x3a3, 0x2d }, /* Primary PMIC: AXP223, AXP809, AXP81X, ... */
         { 0x745, 0x3a }, /* Secondary PMIC: AXP806, ... */
-        { 0xe89, 0x45 }, /* Peripheral IC: AC100, ... */
+        { 0xe89, 0x4e }, /* Peripheral IC: AC100, ... */
 };
 
 static u8 sunxi_rsb_get_rtaddr(u16 hwaddr)
diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
index 2c3b16fd3a01..de5e89b2eaaa 100644
--- a/drivers/cpufreq/scpi-cpufreq.c
+++ b/drivers/cpufreq/scpi-cpufreq.c
@@ -31,7 +31,7 @@ static struct scpi_ops *scpi_ops;
 
 static struct scpi_dvfs_info *scpi_get_dvfs_info(struct device *cpu_dev)
 {
-        u8 domain = topology_physical_package_id(cpu_dev->id);
+        int domain = topology_physical_package_id(cpu_dev->id);
 
         if (domain < 0)
                 return ERR_PTR(-EINVAL);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 5a5f04d0902d..048cfe073dae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1264,7 +1264,8 @@ struct amdgpu_cs_parser {
         struct ww_acquire_ctx   ticket;
 
         /* user fence */
-        struct amdgpu_user_fence uf;
+        struct amdgpu_user_fence        uf;
+        struct amdgpu_bo_list_entry     uf_entry;
 };
 
 struct amdgpu_job {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 4f352ec9dec4..25a3e2485cc2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -127,6 +127,37 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type,
         return 0;
 }
 
+static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
+                                      struct drm_amdgpu_cs_chunk_fence *fence_data)
+{
+        struct drm_gem_object *gobj;
+        uint32_t handle;
+
+        handle = fence_data->handle;
+        gobj = drm_gem_object_lookup(p->adev->ddev, p->filp,
+                                     fence_data->handle);
+        if (gobj == NULL)
+                return -EINVAL;
+
+        p->uf.bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj));
+        p->uf.offset = fence_data->offset;
+
+        if (amdgpu_ttm_tt_has_userptr(p->uf.bo->tbo.ttm)) {
+                drm_gem_object_unreference_unlocked(gobj);
+                return -EINVAL;
+        }
+
+        p->uf_entry.robj = amdgpu_bo_ref(p->uf.bo);
+        p->uf_entry.prefered_domains = AMDGPU_GEM_DOMAIN_GTT;
+        p->uf_entry.allowed_domains = AMDGPU_GEM_DOMAIN_GTT;
+        p->uf_entry.priority = 0;
+        p->uf_entry.tv.bo = &p->uf_entry.robj->tbo;
+        p->uf_entry.tv.shared = true;
+
+        drm_gem_object_unreference_unlocked(gobj);
+        return 0;
+}
+
 int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 {
         union drm_amdgpu_cs *cs = data;
@@ -207,28 +238,15 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 
                 case AMDGPU_CHUNK_ID_FENCE:
                         size = sizeof(struct drm_amdgpu_cs_chunk_fence);
-                        if (p->chunks[i].length_dw * sizeof(uint32_t) >= size) {
-                                uint32_t handle;
-                                struct drm_gem_object *gobj;
-                                struct drm_amdgpu_cs_chunk_fence *fence_data;
-
-                                fence_data = (void *)p->chunks[i].kdata;
-                                handle = fence_data->handle;
-                                gobj = drm_gem_object_lookup(p->adev->ddev,
-                                                             p->filp, handle);
-                                if (gobj == NULL) {
-                                        ret = -EINVAL;
-                                        goto free_partial_kdata;
-                                }
-
-                                p->uf.bo = gem_to_amdgpu_bo(gobj);
-                                amdgpu_bo_ref(p->uf.bo);
-                                drm_gem_object_unreference_unlocked(gobj);
-                                p->uf.offset = fence_data->offset;
-                        } else {
+                        if (p->chunks[i].length_dw * sizeof(uint32_t) < size) {
                                 ret = -EINVAL;
                                 goto free_partial_kdata;
                         }
+
+                        ret = amdgpu_cs_user_fence_chunk(p, (void *)p->chunks[i].kdata);
+                        if (ret)
+                                goto free_partial_kdata;
+
                         break;
 
                 case AMDGPU_CHUNK_ID_DEPENDENCIES:
@@ -391,6 +409,9 @@ static int amdgpu_cs_parser_relocs(struct amdgpu_cs_parser *p)
         p->vm_bos = amdgpu_vm_get_bos(p->adev, &fpriv->vm,
                                       &p->validated);
 
+        if (p->uf.bo)
+                list_add(&p->uf_entry.tv.head, &p->validated);
+
         if (need_mmap_lock)
                 down_read(&current->mm->mmap_sem);
 
@@ -488,8 +509,8 @@ static void amdgpu_cs_parser_fini(struct amdgpu_cs_parser *parser, int error, bo
                 for (i = 0; i < parser->num_ibs; i++)
                         amdgpu_ib_free(parser->adev, &parser->ibs[i]);
         kfree(parser->ibs);
-        if (parser->uf.bo)
-                amdgpu_bo_unref(&parser->uf.bo);
+        amdgpu_bo_unref(&parser->uf.bo);
+        amdgpu_bo_unref(&parser->uf_entry.robj);
 }
 
 static int amdgpu_bo_vm_update_pte(struct amdgpu_cs_parser *p,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index b3ba27fd9a6b..e69357172ffb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -55,6 +55,9 @@ static int exynos_crtc_atomic_check(struct drm_crtc *crtc,
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
 
+        if (!state->enable)
+                return 0;
+
         if (exynos_crtc->ops->atomic_check)
                 return exynos_crtc->ops->atomic_check(exynos_crtc, state);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index a01e51581c4c..f4af19a0d569 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2193,8 +2193,17 @@ struct drm_i915_gem_request {
         struct drm_i915_private *i915;
         struct intel_engine_cs *ring;
 
-        /** GEM sequence number associated with this request. */
-        uint32_t seqno;
+         /** GEM sequence number associated with the previous request,
+          * when the HWS breadcrumb is equal to this the GPU is processing
+          * this request.
+          */
+        u32 previous_seqno;
+
+         /** GEM sequence number associated with this request,
+          * when the HWS breadcrumb is equal or greater than this the GPU
+          * has finished processing this request.
+          */
+        u32 seqno;
 
         /** Position in the ringbuffer of the start of the request */
         u32 head;
@@ -2839,6 +2848,7 @@ i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
 
 int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
                   u32 flags);
+void __i915_vma_set_map_and_fenceable(struct i915_vma *vma);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 /*
  * BEWARE: Do not use the function below unless you can _absolutely_
@@ -2910,15 +2920,17 @@ i915_seqno_passed(uint32_t seq1, uint32_t seq2)
         return (int32_t)(seq1 - seq2) >= 0;
 }
 
+static inline bool i915_gem_request_started(struct drm_i915_gem_request *req,
+                                           bool lazy_coherency)
+{
+        u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency);
+        return i915_seqno_passed(seqno, req->previous_seqno);
+}
+
 static inline bool i915_gem_request_completed(struct drm_i915_gem_request *req,
                                               bool lazy_coherency)
 {
-        u32 seqno;
-
-        BUG_ON(req == NULL);
-
-        seqno = req->ring->get_seqno(req->ring, lazy_coherency);
-
+        u32 seqno = req->ring->get_seqno(req->ring, lazy_coherency);
         return i915_seqno_passed(seqno, req->seqno);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 32e6aade6223..f56af0aaafde 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1146,23 +1146,74 @@ static bool missed_irq(struct drm_i915_private *dev_priv,
         return test_bit(ring->id, &dev_priv->gpu_error.missed_irq_rings);
 }
 
-static int __i915_spin_request(struct drm_i915_gem_request *req)
+static unsigned long local_clock_us(unsigned *cpu)
+{
+        unsigned long t;
+
+        /* Cheaply and approximately convert from nanoseconds to microseconds.
+         * The result and subsequent calculations are also defined in the same
+         * approximate microseconds units. The principal source of timing
+         * error here is from the simple truncation.
+         *
+         * Note that local_clock() is only defined wrt to the current CPU;
+         * the comparisons are no longer valid if we switch CPUs. Instead of
+         * blocking preemption for the entire busywait, we can detect the CPU
+         * switch and use that as indicator of system load and a reason to
+         * stop busywaiting, see busywait_stop().
+         */
+        *cpu = get_cpu();
+        t = local_clock() >> 10;
+        put_cpu();
+
+        return t;
+}
+
+static bool busywait_stop(unsigned long timeout, unsigned cpu)
+{
+        unsigned this_cpu;
+
+        if (time_after(local_clock_us(&this_cpu), timeout))
+                return true;
+
+        return this_cpu != cpu;
+}
+
+static int __i915_spin_request(struct drm_i915_gem_request *req, int state)
 {
         unsigned long timeout;
+        unsigned cpu;
+
+        /* When waiting for high frequency requests, e.g. during synchronous
+         * rendering split between the CPU and GPU, the finite amount of time
+         * required to set up the irq and wait upon it limits the response
+         * rate. By busywaiting on the request completion for a short while we
+         * can service the high frequency waits as quick as possible. However,
+         * if it is a slow request, we want to sleep as quickly as possible.
+         * The tradeoff between waiting and sleeping is roughly the time it
+         * takes to sleep on a request, on the order of a microsecond.
+         */
 
-        if (i915_gem_request_get_ring(req)->irq_refcount)
+        if (req->ring->irq_refcount)
                 return -EBUSY;
 
-        timeout = jiffies + 1;
+        /* Only spin if we know the GPU is processing this request */
+        if (!i915_gem_request_started(req, true))
+                return -EAGAIN;
+
+        timeout = local_clock_us(&cpu) + 5;
         while (!need_resched()) {
                 if (i915_gem_request_completed(req, true))
                         return 0;
 
-                if (time_after_eq(jiffies, timeout))
+                if (signal_pending_state(state, current))
+                        break;
+
+                if (busywait_stop(timeout, cpu))
                         break;
 
                 cpu_relax_lowlatency();
         }
+
         if (i915_gem_request_completed(req, false))
                 return 0;
 
@@ -1197,6 +1248,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         struct drm_i915_private *dev_priv = dev->dev_private;
         const bool irq_test_in_progress =
                 ACCESS_ONCE(dev_priv->gpu_error.test_irq_rings) & intel_ring_flag(ring);
+        int state = interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE;
         DEFINE_WAIT(wait);
         unsigned long timeout_expire;
         s64 before, now;
@@ -1229,7 +1281,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         before = ktime_get_raw_ns();
 
         /* Optimistic spin for the next jiffie before touching IRQs */
-        ret = __i915_spin_request(req);
+        ret = __i915_spin_request(req, state);
         if (ret == 0)
                 goto out;
 
@@ -1241,8 +1293,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
         for (;;) {
                 struct timer_list timer;
 
-                prepare_to_wait(&ring->irq_queue, &wait,
-                                interruptible ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(&ring->irq_queue, &wait, state);
 
                 /* We need to check whether any gpu reset happened in between
                  * the caller grabbing the seqno and now ... */
@@ -1260,7 +1311,7 @@ int __i915_wait_request(struct drm_i915_gem_request *req,
                         break;
                 }
 
-                if (interruptible && signal_pending(current)) {
+                if (signal_pending_state(state, current)) {
                         ret = -ERESTARTSYS;
                         break;
                 }
@@ -2554,6 +2605,7 @@ void __i915_add_request(struct drm_i915_gem_request *request,
         request->batch_obj = obj;
 
         request->emitted_jiffies = jiffies;
+        request->previous_seqno = ring->last_submitted_seqno;
         ring->last_submitted_seqno = request->seqno;
         list_add_tail(&request->list, &ring->request_list);
 
@@ -4080,6 +4132,29 @@ i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
         return false;
 }
 
+void __i915_vma_set_map_and_fenceable(struct i915_vma *vma)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+        bool mappable, fenceable;
+        u32 fence_size, fence_alignment;
+
+        fence_size = i915_gem_get_gtt_size(obj->base.dev,
+                                           obj->base.size,
+                                           obj->tiling_mode);
+        fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
+                                                     obj->base.size,
+                                                     obj->tiling_mode,
+                                                     true);
+
+        fenceable = (vma->node.size == fence_size &&
+                     (vma->node.start & (fence_alignment - 1)) == 0);
+
+        mappable = (vma->node.start + fence_size <=
+                    to_i915(obj->base.dev)->gtt.mappable_end);
+
+        obj->map_and_fenceable = mappable && fenceable;
+}
+
 static int
 i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
                        struct i915_address_space *vm,
@@ -4147,25 +4222,7 @@ i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
 
         if (ggtt_view && ggtt_view->type == I915_GGTT_VIEW_NORMAL &&
             (bound ^ vma->bound) & GLOBAL_BIND) {
-                bool mappable, fenceable;
-                u32 fence_size, fence_alignment;
-
-                fence_size = i915_gem_get_gtt_size(obj->base.dev,
-                                                   obj->base.size,
-                                                   obj->tiling_mode);
-                fence_alignment = i915_gem_get_gtt_alignment(obj->base.dev,
-                                                             obj->base.size,
-                                                             obj->tiling_mode,
-                                                             true);
-
-                fenceable = (vma->node.size == fence_size &&
-                             (vma->node.start & (fence_alignment - 1)) == 0);
-
-                mappable = (vma->node.start + fence_size <=
-                            dev_priv->gtt.mappable_end);
-
-                obj->map_and_fenceable = mappable && fenceable;
-
+                __i915_vma_set_map_and_fenceable(vma);
                 WARN_ON(flags & PIN_MAPPABLE && !obj->map_and_fenceable);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 43f35d12b677..86c7500454b4 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2676,6 +2676,7 @@ static int i915_gem_setup_global_gtt(struct drm_device *dev,
                         return ret;
                 }
                 vma->bound |= GLOBAL_BIND;
+                __i915_vma_set_map_and_fenceable(vma);
                 list_add_tail(&vma->mm_list, &ggtt_vm->inactive_list);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index cdacf3f5b77a..87e919a06b27 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -687,6 +687,7 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
                 }
 
                 vma->bound |= GLOBAL_BIND;
+                __i915_vma_set_map_and_fenceable(vma);
                 list_add_tail(&vma->mm_list, &ggtt->inactive_list);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 62211abe4922..32cf97346978 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -116,6 +116,7 @@ static void skylake_pfit_enable(struct intel_crtc *crtc);
 static void ironlake_pfit_disable(struct intel_crtc *crtc, bool force);
 static void ironlake_pfit_enable(struct intel_crtc *crtc);
 static void intel_modeset_setup_hw_state(struct drm_device *dev);
+static void intel_pre_disable_primary(struct drm_crtc *crtc);
 
 typedef struct {
         int     min, max;
@@ -2607,6 +2608,8 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         struct drm_i915_gem_object *obj;
         struct drm_plane *primary = intel_crtc->base.primary;
         struct drm_plane_state *plane_state = primary->state;
+        struct drm_crtc_state *crtc_state = intel_crtc->base.state;
+        struct intel_plane *intel_plane = to_intel_plane(primary);
         struct drm_framebuffer *fb;
 
         if (!plane_config->fb)
@@ -2643,6 +2646,18 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
                 }
         }
 
+        /*
+         * We've failed to reconstruct the BIOS FB.  Current display state
+         * indicates that the primary plane is visible, but has a NULL FB,
+         * which will lead to problems later if we don't fix it up.  The
+         * simplest solution is to just disable the primary plane now and
+         * pretend the BIOS never had it enabled.
+         */
+        to_intel_plane_state(plane_state)->visible = false;
+        crtc_state->plane_mask &= ~(1 << drm_plane_index(primary));
+        intel_pre_disable_primary(&intel_crtc->base);
+        intel_plane->disable_plane(primary, &intel_crtc->base);
+
         return;
 
 valid_fb:
@@ -9910,14 +9925,14 @@ static bool haswell_get_pipe_config(struct intel_crtc *crtc,
         return true;
 }
 
-static void i845_update_cursor(struct drm_crtc *crtc, u32 base)
+static void i845_update_cursor(struct drm_crtc *crtc, u32 base, bool on)
 {
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         uint32_t cntl = 0, size = 0;
 
-        if (base) {
+        if (on) {
                 unsigned int width = intel_crtc->base.cursor->state->crtc_w;
                 unsigned int height = intel_crtc->base.cursor->state->crtc_h;
                 unsigned int stride = roundup_pow_of_two(width) * 4;
@@ -9972,16 +9987,15 @@ static void i845_update_cursor(struct drm_crtc *crtc, u32 base)
         }
 }
 
-static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
+static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base, bool on)
 {
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         int pipe = intel_crtc->pipe;
-        uint32_t cntl;
+        uint32_t cntl = 0;
 
-        cntl = 0;
-        if (base) {
+        if (on) {
                 cntl = MCURSOR_GAMMA_ENABLE;
                 switch (intel_crtc->base.cursor->state->crtc_w) {
                         case 64:
@@ -10032,18 +10046,17 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
         int y = cursor_state->crtc_y;
         u32 base = 0, pos = 0;
 
-        if (on)
-                base = intel_crtc->cursor_addr;
+        base = intel_crtc->cursor_addr;
 
         if (x >= intel_crtc->config->pipe_src_w)
-                base = 0;
+                on = false;
 
         if (y >= intel_crtc->config->pipe_src_h)
-                base = 0;
+                on = false;
 
         if (x < 0) {
                 if (x + cursor_state->crtc_w <= 0)
-                        base = 0;
+                        on = false;
 
                 pos |= CURSOR_POS_SIGN << CURSOR_X_SHIFT;
                 x = -x;
@@ -10052,16 +10065,13 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
 
         if (y < 0) {
                 if (y + cursor_state->crtc_h <= 0)
-                        base = 0;
+                        on = false;
 
                 pos |= CURSOR_POS_SIGN << CURSOR_Y_SHIFT;
                 y = -y;
         }
         pos |= y << CURSOR_Y_SHIFT;
 
-        if (base == 0 && intel_crtc->cursor_base == 0)
-                return;
-
         I915_WRITE(CURPOS(pipe), pos);
 
         /* ILK+ do this automagically */
@@ -10072,9 +10082,9 @@ static void intel_crtc_update_cursor(struct drm_crtc *crtc,
         }
 
         if (IS_845G(dev) || IS_I865G(dev))
-                i845_update_cursor(crtc, base);
+                i845_update_cursor(crtc, base, on);
         else
-                i9xx_update_cursor(crtc, base);
+                i9xx_update_cursor(crtc, base, on);
 }
 
 static bool cursor_size_ok(struct drm_device *dev,
@@ -12113,18 +12123,22 @@ static void intel_dump_pipe_config(struct intel_crtc *crtc,
 static bool check_digital_port_conflicts(struct drm_atomic_state *state)
 {
         struct drm_device *dev = state->dev;
-        struct intel_encoder *encoder;
         struct drm_connector *connector;
-        struct drm_connector_state *connector_state;
         unsigned int used_ports = 0;
-        int i;
 
         /*
          * Walk the connector list instead of the encoder
          * list to detect the problem on ddi platforms
          * where there's just one encoder per digital port.
          */
-        for_each_connector_in_state(state, connector, connector_state, i) {
+        drm_for_each_connector(connector, dev) {
+                struct drm_connector_state *connector_state;
+                struct intel_encoder *encoder;
+
+                connector_state = drm_atomic_get_existing_connector_state(state, connector);
+                if (!connector_state)
+                        connector_state = connector->state;
+
                 if (!connector_state->best_encoder)
                         continue;
 
@@ -13718,6 +13732,7 @@ intel_check_cursor_plane(struct drm_plane *plane,
         struct drm_crtc *crtc = crtc_state->base.crtc;
         struct drm_framebuffer *fb = state->base.fb;
         struct drm_i915_gem_object *obj = intel_fb_obj(fb);
+        enum pipe pipe = to_intel_plane(plane)->pipe;
         unsigned stride;
         int ret;
 
@@ -13751,6 +13766,22 @@ intel_check_cursor_plane(struct drm_plane *plane,
                 return -EINVAL;
         }
 
+        /*
+         * There's something wrong with the cursor on CHV pipe C.
+         * If it straddles the left edge of the screen then
+         * moving it away from the edge or disabling it often
+         * results in a pipe underrun, and often that can lead to
+         * dead pipe (constant underrun reported, and it scans
+         * out just a solid color). To recover from that, the
+         * display power well must be turned off and on again.
+         * Refuse the put the cursor into that compromised position.
+         */
+        if (IS_CHERRYVIEW(plane->dev) && pipe == PIPE_C &&
+            state->visible && state->base.crtc_x < 0) {
+                DRM_DEBUG_KMS("CHV cursor C not allowed to straddle the left screen edge\n");
+                return -EINVAL;
+        }
+
         return 0;
 }
 
@@ -13774,9 +13805,6 @@ intel_commit_cursor_plane(struct drm_plane *plane,
         crtc = crtc ? crtc : plane->crtc;
         intel_crtc = to_intel_crtc(crtc);
 
-        if (intel_crtc->cursor_bo == obj)
-                goto update;
-
         if (!obj)
                 addr = 0;
         else if (!INTEL_INFO(dev)->cursor_needs_physical)
@@ -13785,9 +13813,7 @@ intel_commit_cursor_plane(struct drm_plane *plane,
                 addr = obj->phys_handle->busaddr;
 
         intel_crtc->cursor_addr = addr;
-        intel_crtc->cursor_bo = obj;
 
-update:
         if (crtc->state->active)
                 intel_crtc_update_cursor(crtc, state->visible);
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f2a1142bff34..0d00f07b7163 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -550,7 +550,6 @@ struct intel_crtc {
         int adjusted_x;
         int adjusted_y;
 
-        struct drm_i915_gem_object *cursor_bo;
         uint32_t cursor_addr;
         uint32_t cursor_cntl;
         uint32_t cursor_size;
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 81cdd9ff3892..e6c035b0fc1c 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1374,17 +1374,18 @@ intel_hdmi_detect(struct drm_connector *connector, bool force)
         struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
         struct drm_i915_private *dev_priv = to_i915(connector->dev);
         bool live_status = false;
-        unsigned int retry = 3;
+        unsigned int try;
 
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
                       connector->base.id, connector->name);
 
         intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
 
-        while (!live_status && --retry) {
+        for (try = 0; !live_status && try < 9; try++) {
+                if (try)
+                        msleep(10);
                 live_status = intel_digital_port_connected(dev_priv,
                                 hdmi_to_dig_port(intel_hdmi));
-                mdelay(10);
         }
 
         if (!live_status)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
index 43006db6fd58..80fed7e78dcb 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c
@@ -83,6 +83,7 @@ nvbios_fan_parse(struct nvkm_bios *bios, struct nvbios_therm_fan *fan)
                         fan->type = NVBIOS_THERM_FAN_UNK;
                 }
 
+                fan->fan_mode = NVBIOS_THERM_FAN_LINEAR;
                 fan->min_duty = nvbios_rd08(bios, data + 0x02);
                 fan->max_duty = nvbios_rd08(bios, data + 0x03);
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d2d5d004f16d..2d762a2ecd81 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1265,15 +1265,17 @@ static bool cma_protocol_roce(const struct rdma_cm_id *id)
         return cma_protocol_roce_dev_port(device, port_num);
 }
 
-static bool cma_match_net_dev(const struct rdma_id_private *id_priv,
-                              const struct net_device *net_dev)
+static bool cma_match_net_dev(const struct rdma_cm_id *id,
+                              const struct net_device *net_dev,
+                              u8 port_num)
 {
-        const struct rdma_addr *addr = &id_priv->id.route.addr;
+        const struct rdma_addr *addr = &id->route.addr;
 
         if (!net_dev)
                 /* This request is an AF_IB request or a RoCE request */
-                return addr->src_addr.ss_family == AF_IB ||
-                       cma_protocol_roce(&id_priv->id);
+                return (!id->port_num || id->port_num == port_num) &&
+                       (addr->src_addr.ss_family == AF_IB ||
+                        cma_protocol_roce_dev_port(id->device, port_num));
 
         return !addr->dev_addr.bound_dev_if ||
                (net_eq(dev_net(net_dev), addr->dev_addr.net) &&
@@ -1295,13 +1297,13 @@ static struct rdma_id_private *cma_find_listener(
         hlist_for_each_entry(id_priv, &bind_list->owners, node) {
                 if (cma_match_private_data(id_priv, ib_event->private_data)) {
                         if (id_priv->id.device == cm_id->device &&
-                            cma_match_net_dev(id_priv, net_dev))
+                            cma_match_net_dev(&id_priv->id, net_dev, req->port))
                                 return id_priv;
                         list_for_each_entry(id_priv_dev,
                                             &id_priv->listen_list,
                                             listen_list) {
                                 if (id_priv_dev->id.device == cm_id->device &&
-                                    cma_match_net_dev(id_priv_dev, net_dev))
+                                    cma_match_net_dev(&id_priv_dev->id, net_dev, req->port))
                                         return id_priv_dev;
                         }
                 }
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index 8d133c40fa0e..c394376ebe06 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -286,7 +286,7 @@ int mlx4_ib_destroy_srq(struct ib_srq *srq)
                 mlx4_ib_db_unmap_user(to_mucontext(srq->uobject->context), &msrq->db);
                 ib_umem_release(msrq->umem);
         } else {
-                kfree(msrq->wrid);
+                kvfree(msrq->wrid);
                 mlx4_buf_free(dev->dev, msrq->msrq.max << msrq->msrq.wqe_shift,
                               &msrq->buf);
                 mlx4_db_free(dev->dev, &msrq->db);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index ae80590aabdf..040bb8b5cb15 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -232,6 +232,10 @@ struct phy_info {
         u16 interface_type;
 };
 
+enum ocrdma_flags {
+        OCRDMA_FLAGS_LINK_STATUS_INIT = 0x01
+};
+
 struct ocrdma_dev {
         struct ib_device ibdev;
         struct ocrdma_dev_attr attr;
@@ -287,6 +291,7 @@ struct ocrdma_dev {
         atomic_t update_sl;
         u16 pvid;
         u32 asic_id;
+        u32 flags;
 
         ulong last_stats_time;
         struct mutex stats_lock; /* provide synch for debugfs operations */
@@ -591,4 +596,9 @@ static inline u8 ocrdma_is_enabled_and_synced(u32 state)
                 (state & OCRDMA_STATE_FLAG_SYNC);
 }
 
+static inline u8 ocrdma_get_ae_link_state(u32 ae_state)
+{
+        return ((ae_state & OCRDMA_AE_LSC_LS_MASK) >> OCRDMA_AE_LSC_LS_SHIFT);
+}
+
 #endif
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 30f67bebffa3..283ca842ff74 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -579,6 +579,8 @@ static int ocrdma_mbx_create_mq(struct ocrdma_dev *dev,
 
         cmd->async_event_bitmap = BIT(OCRDMA_ASYNC_GRP5_EVE_CODE);
         cmd->async_event_bitmap |= BIT(OCRDMA_ASYNC_RDMA_EVE_CODE);
+        /* Request link events on this  MQ. */
+        cmd->async_event_bitmap |= BIT(OCRDMA_ASYNC_LINK_EVE_CODE);
 
         cmd->async_cqid_ringsize = cq->id;
         cmd->async_cqid_ringsize |= (ocrdma_encoded_q_len(mq->len) <<
@@ -819,20 +821,42 @@ static void ocrdma_process_grp5_aync(struct ocrdma_dev *dev,
         }
 }
 
+static void ocrdma_process_link_state(struct ocrdma_dev *dev,
+                                      struct ocrdma_ae_mcqe *cqe)
+{
+        struct ocrdma_ae_lnkst_mcqe *evt;
+        u8 lstate;
+
+        evt = (struct ocrdma_ae_lnkst_mcqe *)cqe;
+        lstate = ocrdma_get_ae_link_state(evt->speed_state_ptn);
+
+        if (!(lstate & OCRDMA_AE_LSC_LLINK_MASK))
+                return;
+
+        if (dev->flags & OCRDMA_FLAGS_LINK_STATUS_INIT)
+                ocrdma_update_link_state(dev, (lstate & OCRDMA_LINK_ST_MASK));
+}
+
 static void ocrdma_process_acqe(struct ocrdma_dev *dev, void *ae_cqe)
 {
         /* async CQE processing */
         struct ocrdma_ae_mcqe *cqe = ae_cqe;
         u32 evt_code = (cqe->valid_ae_event & OCRDMA_AE_MCQE_EVENT_CODE_MASK) >>
                         OCRDMA_AE_MCQE_EVENT_CODE_SHIFT;
-
-        if (evt_code == OCRDMA_ASYNC_RDMA_EVE_CODE)
+        switch (evt_code) {
+        case OCRDMA_ASYNC_LINK_EVE_CODE:
+                ocrdma_process_link_state(dev, cqe);
+                break;
+        case OCRDMA_ASYNC_RDMA_EVE_CODE:
                 ocrdma_dispatch_ibevent(dev, cqe);
-        else if (evt_code == OCRDMA_ASYNC_GRP5_EVE_CODE)
+                break;
+        case OCRDMA_ASYNC_GRP5_EVE_CODE:
                 ocrdma_process_grp5_aync(dev, cqe);
-        else
+                break;
+        default:
                 pr_err("%s(%d) invalid evt code=0x%x\n", __func__,
                        dev->id, evt_code);
+        }
 }
 
 static void ocrdma_process_mcqe(struct ocrdma_dev *dev, struct ocrdma_mcqe *cqe)
@@ -1363,7 +1387,8 @@ mbx_err:
         return status;
 }
 
-int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed)
+int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed,
+                              u8 *lnk_state)
 {
         int status = -ENOMEM;
         struct ocrdma_get_link_speed_rsp *rsp;
@@ -1384,8 +1409,11 @@ int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed)
                 goto mbx_err;
 
         rsp = (struct ocrdma_get_link_speed_rsp *)cmd;
-        *lnk_speed = (rsp->pflt_pps_ld_pnum & OCRDMA_PHY_PS_MASK)
-                        >> OCRDMA_PHY_PS_SHIFT;
+        if (lnk_speed)
+                *lnk_speed = (rsp->pflt_pps_ld_pnum & OCRDMA_PHY_PS_MASK)
+                              >> OCRDMA_PHY_PS_SHIFT;
+        if (lnk_state)
+                *lnk_state = (rsp->res_lnk_st & OCRDMA_LINK_ST_MASK);
 
 mbx_err:
         kfree(cmd);
@@ -2515,9 +2543,10 @@ static int ocrdma_set_av_params(struct ocrdma_qp *qp,
         ocrdma_cpu_to_le32(&cmd->params.sgid[0], sizeof(cmd->params.sgid));
         cmd->params.vlan_dmac_b4_to_b5 = mac_addr[4] | (mac_addr[5] << 8);
 
-        if (vlan_id < 0x1000) {
-                if (dev->pfc_state) {
-                        vlan_id = 0;
+        if (vlan_id == 0xFFFF)
+                vlan_id = 0;
+        if (vlan_id || dev->pfc_state) {
+                if (!vlan_id) {
                         pr_err("ocrdma%d:Using VLAN with PFC is recommended\n",
                                dev->id);
                         pr_err("ocrdma%d:Using VLAN 0 for this connection\n",
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
index 7ed885c1851e..ebc1f442aec3 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.h
@@ -106,7 +106,8 @@ void ocrdma_ring_cq_db(struct ocrdma_dev *, u16 cq_id, bool armed,
                        bool solicited, u16 cqe_popped);
 
 /* verbs specific mailbox commands */
-int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed);
+int ocrdma_mbx_get_link_speed(struct ocrdma_dev *dev, u8 *lnk_speed,
+                              u8 *lnk_st);
 int ocrdma_query_config(struct ocrdma_dev *,
                         struct ocrdma_mbx_query_config *config);
 
@@ -153,5 +154,6 @@ char *port_speed_string(struct ocrdma_dev *dev);
 void ocrdma_init_service_level(struct ocrdma_dev *);
 void ocrdma_alloc_pd_pool(struct ocrdma_dev *dev);
 void ocrdma_free_pd_range(struct ocrdma_dev *dev);
+void ocrdma_update_link_state(struct ocrdma_dev *dev, u8 lstate);
 
 #endif                          /* __OCRDMA_HW_H__ */
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 62b7009daa6c..3afb40b85159 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -290,6 +290,7 @@ static void ocrdma_remove_sysfiles(struct ocrdma_dev *dev)
 static struct ocrdma_dev *ocrdma_add(struct be_dev_info *dev_info)
 {
         int status = 0, i;
+        u8 lstate = 0;
         struct ocrdma_dev *dev;
 
         dev = (struct ocrdma_dev *)ib_alloc_device(sizeof(struct ocrdma_dev));
@@ -319,6 +320,11 @@ static struct ocrdma_dev *ocrdma_add(struct be_dev_info *dev_info)
         if (status)
                 goto alloc_err;
 
+        /* Query Link state and update */
+        status = ocrdma_mbx_get_link_speed(dev, NULL, &lstate);
+        if (!status)
+                ocrdma_update_link_state(dev, lstate);
+
         for (i = 0; i < ARRAY_SIZE(ocrdma_attributes); i++)
                 if (device_create_file(&dev->ibdev.dev, ocrdma_attributes[i]))
                         goto sysfs_err;
@@ -373,7 +379,7 @@ static void ocrdma_remove(struct ocrdma_dev *dev)
         ocrdma_remove_free(dev);
 }
 
-static int ocrdma_open(struct ocrdma_dev *dev)
+static int ocrdma_dispatch_port_active(struct ocrdma_dev *dev)
 {
         struct ib_event port_event;
 
@@ -384,32 +390,9 @@ static int ocrdma_open(struct ocrdma_dev *dev)
         return 0;
 }
 
-static int ocrdma_close(struct ocrdma_dev *dev)
+static int ocrdma_dispatch_port_error(struct ocrdma_dev *dev)
 {
-        int i;
-        struct ocrdma_qp *qp, **cur_qp;
         struct ib_event err_event;
-        struct ib_qp_attr attrs;
-        int attr_mask = IB_QP_STATE;
-
-        attrs.qp_state = IB_QPS_ERR;
-        mutex_lock(&dev->dev_lock);
-        if (dev->qp_tbl) {
-                cur_qp = dev->qp_tbl;
-                for (i = 0; i < OCRDMA_MAX_QP; i++) {
-                        qp = cur_qp[i];
-                        if (qp && qp->ibqp.qp_type != IB_QPT_GSI) {
-                                /* change the QP state to ERROR */
-                                _ocrdma_modify_qp(&qp->ibqp, &attrs, attr_mask);
-
-                                err_event.event = IB_EVENT_QP_FATAL;
-                                err_event.element.qp = &qp->ibqp;
-                                err_event.device = &dev->ibdev;
-                                ib_dispatch_event(&err_event);
-                        }
-                }
-        }
-        mutex_unlock(&dev->dev_lock);
 
         err_event.event = IB_EVENT_PORT_ERR;
         err_event.element.port_num = 1;
@@ -420,7 +403,7 @@ static int ocrdma_close(struct ocrdma_dev *dev)
 
 static void ocrdma_shutdown(struct ocrdma_dev *dev)
 {
-        ocrdma_close(dev);
+        ocrdma_dispatch_port_error(dev);
         ocrdma_remove(dev);
 }
 
@@ -431,18 +414,28 @@ static void ocrdma_shutdown(struct ocrdma_dev *dev)
 static void ocrdma_event_handler(struct ocrdma_dev *dev, u32 event)
 {
         switch (event) {
-        case BE_DEV_UP:
-                ocrdma_open(dev);
-                break;
-        case BE_DEV_DOWN:
-                ocrdma_close(dev);
-                break;
         case BE_DEV_SHUTDOWN:
                 ocrdma_shutdown(dev);
                 break;
+        default:
+                break;
         }
 }
 
+void ocrdma_update_link_state(struct ocrdma_dev *dev, u8 lstate)
+{
+        if (!(dev->flags & OCRDMA_FLAGS_LINK_STATUS_INIT)) {
+                dev->flags |= OCRDMA_FLAGS_LINK_STATUS_INIT;
+                if (!lstate)
+                        return;
+        }
+
+        if (!lstate)
+                ocrdma_dispatch_port_error(dev);
+        else
+                ocrdma_dispatch_port_active(dev);
+}
+
 static struct ocrdma_driver ocrdma_drv = {
         .name                   = "ocrdma_driver",
         .add                    = ocrdma_add,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 6a38268bbe9f..99dd6fdf06d7 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -465,8 +465,11 @@ struct ocrdma_ae_qp_mcqe {
         u32 valid_ae_event;
 };
 
-#define OCRDMA_ASYNC_RDMA_EVE_CODE 0x14
-#define OCRDMA_ASYNC_GRP5_EVE_CODE 0x5
+enum ocrdma_async_event_code {
+        OCRDMA_ASYNC_LINK_EVE_CODE      = 0x01,
+        OCRDMA_ASYNC_GRP5_EVE_CODE      = 0x05,
+        OCRDMA_ASYNC_RDMA_EVE_CODE      = 0x14
+};
 
 enum ocrdma_async_grp5_events {
         OCRDMA_ASYNC_EVENT_QOS_VALUE    = 0x01,
@@ -489,6 +492,44 @@ enum OCRDMA_ASYNC_EVENT_TYPE {
         OCRDMA_MAX_ASYNC_ERRORS
 };
 
+struct ocrdma_ae_lnkst_mcqe {
+        u32 speed_state_ptn;
+        u32 qos_reason_falut;
+        u32 evt_tag;
+        u32 valid_ae_event;
+};
+
+enum {
+        OCRDMA_AE_LSC_PORT_NUM_MASK     = 0x3F,
+        OCRDMA_AE_LSC_PT_SHIFT          = 0x06,
+        OCRDMA_AE_LSC_PT_MASK           = (0x03 <<
+                        OCRDMA_AE_LSC_PT_SHIFT),
+        OCRDMA_AE_LSC_LS_SHIFT          = 0x08,
+        OCRDMA_AE_LSC_LS_MASK           = (0xFF <<
+                        OCRDMA_AE_LSC_LS_SHIFT),
+        OCRDMA_AE_LSC_LD_SHIFT          = 0x10,
+        OCRDMA_AE_LSC_LD_MASK           = (0xFF <<
+                        OCRDMA_AE_LSC_LD_SHIFT),
+        OCRDMA_AE_LSC_PPS_SHIFT         = 0x18,
+        OCRDMA_AE_LSC_PPS_MASK          = (0xFF <<
+                        OCRDMA_AE_LSC_PPS_SHIFT),
+        OCRDMA_AE_LSC_PPF_MASK          = 0xFF,
+        OCRDMA_AE_LSC_ER_SHIFT          = 0x08,
+        OCRDMA_AE_LSC_ER_MASK           = (0xFF <<
+                        OCRDMA_AE_LSC_ER_SHIFT),
+        OCRDMA_AE_LSC_QOS_SHIFT         = 0x10,
+        OCRDMA_AE_LSC_QOS_MASK          = (0xFFFF <<
+                        OCRDMA_AE_LSC_QOS_SHIFT)
+};
+
+enum {
+        OCRDMA_AE_LSC_PLINK_DOWN        = 0x00,
+        OCRDMA_AE_LSC_PLINK_UP          = 0x01,
+        OCRDMA_AE_LSC_LLINK_DOWN        = 0x02,
+        OCRDMA_AE_LSC_LLINK_MASK        = 0x02,
+        OCRDMA_AE_LSC_LLINK_UP          = 0x03
+};
+
 /* mailbox command request and responses */
 enum {
         OCRDMA_MBX_QUERY_CFG_CQ_OVERFLOW_SHIFT          = 2,
@@ -676,7 +717,7 @@ enum {
         OCRDMA_PHY_PFLT_SHIFT   = 0x18,
         OCRDMA_QOS_LNKSP_MASK   = 0xFFFF0000,
         OCRDMA_QOS_LNKSP_SHIFT  = 0x10,
-        OCRDMA_LLST_MASK        = 0xFF,
+        OCRDMA_LINK_ST_MASK     = 0x01,
         OCRDMA_PLFC_MASK        = 0x00000400,
         OCRDMA_PLFC_SHIFT       = 0x8,
         OCRDMA_PLRFC_MASK       = 0x00000200,
@@ -691,7 +732,7 @@ struct ocrdma_get_link_speed_rsp {
 
         u32 pflt_pps_ld_pnum;
         u32 qos_lsp;
-        u32 res_lls;
+        u32 res_lnk_st;
 };
 
 enum {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 583001bcfb8f..76e96f97b3f6 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -171,7 +171,7 @@ static inline void get_link_speed_and_width(struct ocrdma_dev *dev,
         int status;
         u8 speed;
 
-        status = ocrdma_mbx_get_link_speed(dev, &speed);
+        status = ocrdma_mbx_get_link_speed(dev, &speed, NULL);
         if (status)
                 speed = OCRDMA_PHYS_LINK_SPEED_ZERO;
 
diff --git a/drivers/lightnvm/gennvm.c b/drivers/lightnvm/gennvm.c
index f434e89e1c7a..a54b339951a3 100644
--- a/drivers/lightnvm/gennvm.c
+++ b/drivers/lightnvm/gennvm.c
@@ -75,7 +75,7 @@ static int gennvm_block_bb(struct ppa_addr ppa, int nr_blocks, u8 *blks,
         struct nvm_block *blk;
         int i;
 
-        lun = &gn->luns[(dev->nr_luns * ppa.g.ch) + ppa.g.lun];
+        lun = &gn->luns[(dev->luns_per_chnl * ppa.g.ch) + ppa.g.lun];
 
         for (i = 0; i < nr_blocks; i++) {
                 if (blks[i] == 0)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index dbedc58d8c00..61aacab424cf 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4326,8 +4326,7 @@ action_store(struct mddev *mddev, const char *page, size_t len)
                         }
                         mddev_unlock(mddev);
                 }
-        } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
-                   test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
+        } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                 return -EBUSY;
         else if (cmd_match(page, "resync"))
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
@@ -4340,8 +4339,12 @@ action_store(struct mddev *mddev, const char *page, size_t len)
                         return -EINVAL;
                 err = mddev_lock(mddev);
                 if (!err) {
-                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
-                        err = mddev->pers->start_reshape(mddev);
+                        if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
+                                err =  -EBUSY;
+                        else {
+                                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                                err = mddev->pers->start_reshape(mddev);
+                        }
                         mddev_unlock(mddev);
                 }
                 if (err)
diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index e87459f6d686..acd1460cf787 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/compiler.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
 #include <linux/slab.h>
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index b077e43b5ba9..c4cb15a3098c 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -236,7 +236,7 @@ int ubi_debugfs_init(void)
 
         dfs_rootdir = debugfs_create_dir("ubi", NULL);
         if (IS_ERR_OR_NULL(dfs_rootdir)) {
-                int err = dfs_rootdir ? -ENODEV : PTR_ERR(dfs_rootdir);
+                int err = dfs_rootdir ? PTR_ERR(dfs_rootdir) : -ENODEV;
 
                 pr_err("UBI error: cannot create \"ubi\" debugfs directory, error %d\n",
                        err);
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index 1fc23e48fe8e..10cf3b549959 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -1299,7 +1299,7 @@ static int self_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
         if (err && err != UBI_IO_BITFLIPS && !mtd_is_eccerr(err))
                 goto exit;
 
-        crc = crc32(UBI_CRC32_INIT, vid_hdr, UBI_EC_HDR_SIZE_CRC);
+        crc = crc32(UBI_CRC32_INIT, vid_hdr, UBI_VID_HDR_SIZE_CRC);
         hdr_crc = be32_to_cpu(vid_hdr->hdr_crc);
         if (hdr_crc != crc) {
                 ubi_err(ubi, "bad VID header CRC at PEB %d, calculated %#08x, read %#08x",
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index eb4489f9082f..56065632a5b8 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -603,6 +603,7 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
         return 0;
 }
 
+static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk);
 /**
  * do_sync_erase - run the erase worker synchronously.
  * @ubi: UBI device description object
@@ -615,20 +616,16 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
 static int do_sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
                          int vol_id, int lnum, int torture)
 {
-        struct ubi_work *wl_wrk;
+        struct ubi_work wl_wrk;
 
         dbg_wl("sync erase of PEB %i", e->pnum);
 
-        wl_wrk = kmalloc(sizeof(struct ubi_work), GFP_NOFS);
-        if (!wl_wrk)
-                return -ENOMEM;
-
-        wl_wrk->e = e;
-        wl_wrk->vol_id = vol_id;
-        wl_wrk->lnum = lnum;
-        wl_wrk->torture = torture;
+        wl_wrk.e = e;
+        wl_wrk.vol_id = vol_id;
+        wl_wrk.lnum = lnum;
+        wl_wrk.torture = torture;
 
-        return erase_worker(ubi, wl_wrk, 0);
+        return __erase_worker(ubi, &wl_wrk);
 }
 
 /**
@@ -1014,7 +1011,7 @@ out_unlock:
 }
 
 /**
- * erase_worker - physical eraseblock erase worker function.
+ * __erase_worker - physical eraseblock erase worker function.
  * @ubi: UBI device description object
  * @wl_wrk: the work object
  * @shutdown: non-zero if the worker has to free memory and exit
@@ -1025,8 +1022,7 @@ out_unlock:
  * needed. Returns zero in case of success and a negative error code in case of
  * failure.
  */
-static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
-                        int shutdown)
+static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
 {
         struct ubi_wl_entry *e = wl_wrk->e;
         int pnum = e->pnum;
@@ -1034,21 +1030,11 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         int lnum = wl_wrk->lnum;
         int err, available_consumed = 0;
 
-        if (shutdown) {
-                dbg_wl("cancel erasure of PEB %d EC %d", pnum, e->ec);
-                kfree(wl_wrk);
-                wl_entry_destroy(ubi, e);
-                return 0;
-        }
-
         dbg_wl("erase PEB %d EC %d LEB %d:%d",
                pnum, e->ec, wl_wrk->vol_id, wl_wrk->lnum);
 
         err = sync_erase(ubi, e, wl_wrk->torture);
         if (!err) {
-                /* Fine, we've erased it successfully */
-                kfree(wl_wrk);
-
                 spin_lock(&ubi->wl_lock);
                 wl_tree_add(e, &ubi->free);
                 ubi->free_count++;
@@ -1066,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
         }
 
         ubi_err(ubi, "failed to erase PEB %d, error %d", pnum, err);
-        kfree(wl_wrk);
 
         if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
             err == -EBUSY) {
@@ -1075,6 +1060,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
                 /* Re-schedule the LEB for erasure */
                 err1 = schedule_erase(ubi, e, vol_id, lnum, 0);
                 if (err1) {
+                        wl_entry_destroy(ubi, e);
                         err = err1;
                         goto out_ro;
                 }
@@ -1150,6 +1136,25 @@ out_ro:
         return err;
 }
 
+static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+                          int shutdown)
+{
+        int ret;
+
+        if (shutdown) {
+                struct ubi_wl_entry *e = wl_wrk->e;
+
+                dbg_wl("cancel erasure of PEB %d EC %d", e->pnum, e->ec);
+                kfree(wl_wrk);
+                wl_entry_destroy(ubi, e);
+                return 0;
+        }
+
+        ret = __erase_worker(ubi, wl_wrk);
+        kfree(wl_wrk);
+        return ret;
+}
+
 /**
  * ubi_wl_put_peb - return a PEB to the wear-leveling sub-system.
  * @ubi: UBI device description object
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index f8d7a2f06950..c82ab87fcbe8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3430,25 +3430,29 @@ static u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
         return rc;
 }
 
-#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - 3)
+/* VXLAN: 4 = 1 (for linear data BD) + 3 (2 for PBD and last BD) */
+#define BNX2X_NUM_VXLAN_TSO_WIN_SUB_BDS         4
+
+/* Regular: 3 = 1 (for linear data BD) + 2 (for PBD and last BD) */
+#define BNX2X_NUM_TSO_WIN_SUB_BDS               3
+
+#if (MAX_SKB_FRAGS >= MAX_FETCH_BD - BDS_PER_TX_PKT)
 /* check if packet requires linearization (packet is too fragmented)
    no need to check fragmentation if page size > 8K (there will be no
    violation to FW restrictions) */
 static int bnx2x_pkt_req_lin(struct bnx2x *bp, struct sk_buff *skb,
                              u32 xmit_type)
 {
-        int to_copy = 0;
-        int hlen = 0;
-        int first_bd_sz = 0;
+        int first_bd_sz = 0, num_tso_win_sub = BNX2X_NUM_TSO_WIN_SUB_BDS;
+        int to_copy = 0, hlen = 0;
 
-        /* 3 = 1 (for linear data BD) + 2 (for PBD and last BD) */
-        if (skb_shinfo(skb)->nr_frags >= (MAX_FETCH_BD - 3)) {
+        if (xmit_type & XMIT_GSO_ENC)
+                num_tso_win_sub = BNX2X_NUM_VXLAN_TSO_WIN_SUB_BDS;
 
+        if (skb_shinfo(skb)->nr_frags >= (MAX_FETCH_BD - num_tso_win_sub)) {
                 if (xmit_type & XMIT_GSO) {
                         unsigned short lso_mss = skb_shinfo(skb)->gso_size;
-                        /* Check if LSO packet needs to be copied:
-                           3 = 1 (for headers BD) + 2 (for PBD and last BD) */
-                        int wnd_size = MAX_FETCH_BD - 3;
+                        int wnd_size = MAX_FETCH_BD - num_tso_win_sub;
                         /* Number of windows to check */
                         int num_wnds = skb_shinfo(skb)->nr_frags - wnd_size;
                         int wnd_idx = 0;
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index d463563e1f70..6ee78c203eca 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -848,8 +848,6 @@ void be_roce_dev_remove(struct be_adapter *);
 /*
  * internal function to open-close roce device during ifup-ifdown.
  */
-void be_roce_dev_open(struct be_adapter *);
-void be_roce_dev_close(struct be_adapter *);
 void be_roce_dev_shutdown(struct be_adapter *);
 
 #endif                          /* BE_H */
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index b6ad02909d6b..8a1d9fffd7d6 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3299,8 +3299,10 @@ static int be_msix_register(struct be_adapter *adapter)
 
         return 0;
 err_msix:
-        for (i--, eqo = &adapter->eq_obj[i]; i >= 0; i--, eqo--)
+        for (i--; i >= 0; i--) {
+                eqo = &adapter->eq_obj[i];
                 free_irq(be_msix_vec_get(adapter, eqo), eqo);
+        }
         dev_warn(&adapter->pdev->dev, "MSIX Request IRQ failed - err %d\n",
                  status);
         be_msix_disable(adapter);
@@ -3432,8 +3434,6 @@ static int be_close(struct net_device *netdev)
 
         be_disable_if_filters(adapter);
 
-        be_roce_dev_close(adapter);
-
         if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
                 for_all_evt_queues(adapter, eqo, i) {
                         napi_disable(&eqo->napi);
@@ -3601,8 +3601,6 @@ static int be_open(struct net_device *netdev)
                 be_link_status_update(adapter, link_status);
 
         netif_tx_start_all_queues(netdev);
-        be_roce_dev_open(adapter);
-
 #ifdef CONFIG_BE2NET_VXLAN
         if (skyhawk_chip(adapter))
                 vxlan_get_rx_port(netdev);
diff --git a/drivers/net/ethernet/emulex/benet/be_roce.c b/drivers/net/ethernet/emulex/benet/be_roce.c
index 60368207bf58..4089156a7f5e 100644
--- a/drivers/net/ethernet/emulex/benet/be_roce.c
+++ b/drivers/net/ethernet/emulex/benet/be_roce.c
@@ -116,40 +116,6 @@ void be_roce_dev_remove(struct be_adapter *adapter)
         }
 }
 
-static void _be_roce_dev_open(struct be_adapter *adapter)
-{
-        if (ocrdma_drv && adapter->ocrdma_dev &&
-            ocrdma_drv->state_change_handler)
-                ocrdma_drv->state_change_handler(adapter->ocrdma_dev,
-                                                 BE_DEV_UP);
-}
-
-void be_roce_dev_open(struct be_adapter *adapter)
-{
-        if (be_roce_supported(adapter)) {
-                mutex_lock(&be_adapter_list_lock);
-                _be_roce_dev_open(adapter);
-                mutex_unlock(&be_adapter_list_lock);
-        }
-}
-
-static void _be_roce_dev_close(struct be_adapter *adapter)
-{
-        if (ocrdma_drv && adapter->ocrdma_dev &&
-            ocrdma_drv->state_change_handler)
-                ocrdma_drv->state_change_handler(adapter->ocrdma_dev,
-                                                 BE_DEV_DOWN);
-}
-
-void be_roce_dev_close(struct be_adapter *adapter)
-{
-        if (be_roce_supported(adapter)) {
-                mutex_lock(&be_adapter_list_lock);
-                _be_roce_dev_close(adapter);
-                mutex_unlock(&be_adapter_list_lock);
-        }
-}
-
 void be_roce_dev_shutdown(struct be_adapter *adapter)
 {
         if (be_roce_supported(adapter)) {
@@ -177,8 +143,6 @@ int be_roce_register_driver(struct ocrdma_driver *drv)
 
                 _be_roce_dev_add(dev);
                 netdev = dev->netdev;
-                if (netif_running(netdev) && netif_oper_up(netdev))
-                        _be_roce_dev_open(dev);
         }
         mutex_unlock(&be_adapter_list_lock);
         return 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_roce.h b/drivers/net/ethernet/emulex/benet/be_roce.h
index cde6ef905ec4..fde609789483 100644
--- a/drivers/net/ethernet/emulex/benet/be_roce.h
+++ b/drivers/net/ethernet/emulex/benet/be_roce.h
@@ -60,9 +60,7 @@ struct ocrdma_driver {
         void (*state_change_handler) (struct ocrdma_dev *, u32 new_state);
 };
 
-enum {
-        BE_DEV_UP       = 0,
-        BE_DEV_DOWN     = 1,
+enum be_roce_event {
         BE_DEV_SHUTDOWN = 2
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
index 8a083d73efdb..038f9ce391e6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
@@ -242,6 +242,13 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev)
         unsigned long flags;
         u64 ns, zero = 0;
 
+        /* mlx4_en_init_timestamp is called for each netdev.
+         * mdev->ptp_clock is common for all ports, skip initialization if
+         * was done for other port.
+         */
+        if (mdev->ptp_clock)
+                return;
+
         rwlock_init(&mdev->clock_lock);
 
         memset(&mdev->cycles, 0, sizeof(mdev->cycles));
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c
index 005f910ec955..e0ec280a7fa1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c
@@ -232,9 +232,6 @@ static void mlx4_en_remove(struct mlx4_dev *dev, void *endev_ptr)
                 if (mdev->pndev[i])
                         mlx4_en_destroy_netdev(mdev->pndev[i]);
 
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-                mlx4_en_remove_timestamp(mdev);
-
         flush_workqueue(mdev->workqueue);
         destroy_workqueue(mdev->workqueue);
         (void) mlx4_mr_free(dev, &mdev->mr);
@@ -320,10 +317,6 @@ static void *mlx4_en_add(struct mlx4_dev *dev)
         mlx4_foreach_port(i, dev, MLX4_PORT_TYPE_ETH)
                 mdev->port_cnt++;
 
-        /* Initialize time stamp mechanism */
-        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-                mlx4_en_init_timestamp(mdev);
-
         /* Set default number of RX rings*/
         mlx4_en_set_num_rx_rings(mdev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 886e1bc86374..7869f97de5da 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2072,6 +2072,9 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         /* flush any pending task for this netdev */
         flush_workqueue(mdev->workqueue);
 
+        if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
+                mlx4_en_remove_timestamp(mdev);
+
         /* Detach the netdev so tasks would not attempt to access it */
         mutex_lock(&mdev->state_lock);
         mdev->pndev[priv->port] = NULL;
@@ -3058,9 +3061,12 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         }
         queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
 
+        /* Initialize time stamp mechanism */
         if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-                queue_delayed_work(mdev->workqueue, &priv->service_task,
-                                   SERVICE_TASK_DELAY);
+                mlx4_en_init_timestamp(mdev);
+
+        queue_delayed_work(mdev->workqueue, &priv->service_task,
+                           SERVICE_TASK_DELAY);
 
         mlx4_en_set_stats_bitmap(mdev->dev, &priv->stats_bitmap,
                                  mdev->profile.prof[priv->port].rx_ppp,
diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c
index b83f7c0fcf99..122c2ee3dfe2 100644
--- a/drivers/net/ethernet/natsemi/natsemi.c
+++ b/drivers/net/ethernet/natsemi/natsemi.c
@@ -1937,6 +1937,12 @@ static void refill_rx(struct net_device *dev)
                                 break; /* Better luck next round. */
                         np->rx_dma[entry] = pci_map_single(np->pci_dev,
                                 skb->data, buflen, PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(np->pci_dev,
+                                                  np->rx_dma[entry])) {
+                                dev_kfree_skb_any(skb);
+                                np->rx_skbuff[entry] = NULL;
+                                break; /* Better luck next round. */
+                        }
                         np->rx_ring[entry].addr = cpu_to_le32(np->rx_dma[entry]);
                 }
                 np->rx_ring[entry].cmd_status = cpu_to_le32(np->rx_buf_sz);
@@ -2093,6 +2099,12 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
         np->tx_skbuff[entry] = skb;
         np->tx_dma[entry] = pci_map_single(np->pci_dev,
                                 skb->data,skb->len, PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(np->pci_dev, np->tx_dma[entry])) {
+                np->tx_skbuff[entry] = NULL;
+                dev_kfree_skb_irq(skb);
+                dev->stats.tx_dropped++;
+                return NETDEV_TX_OK;
+        }
 
         np->tx_ring[entry].addr = cpu_to_le32(np->tx_dma[entry]);
 
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index b1a452f291ee..34906750b7e7 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -252,7 +252,7 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
                 state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
         }
 
-        if (!idc->vnic_wait_limit) {
+        if (state != QLCNIC_DEV_NPAR_OPER) {
                 dev_err(&adapter->pdev->dev,
                         "vNIC mode not operational, state check timed out.\n");
                 return -EIO;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index a0eaf50499a2..6a8fc0f341ff 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1167,6 +1167,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN + 32 - 1;
         dma_addr_t dma_addr;
+        u32 buf_len;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1187,9 +1188,9 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 /* RX descriptor */
                 rxdesc = &mdp->rx_ring[i];
                 /* The size of the buffer is a multiple of 32 bytes. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 32);
-                dma_addr = dma_map_single(&ndev->dev, skb->data,
-                                          rxdesc->buffer_length,
+                buf_len = ALIGN(mdp->rx_buf_sz, 32);
+                rxdesc->len = cpu_to_edmac(mdp, buf_len << 16);
+                dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
                                           DMA_FROM_DEVICE);
                 if (dma_mapping_error(&ndev->dev, dma_addr)) {
                         kfree_skb(skb);
@@ -1220,7 +1221,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 mdp->tx_skbuff[i] = NULL;
                 txdesc = &mdp->tx_ring[i];
                 txdesc->status = cpu_to_edmac(mdp, TD_TFP);
-                txdesc->buffer_length = 0;
+                txdesc->len = cpu_to_edmac(mdp, 0);
                 if (i == 0) {
                         /* Tx descriptor address set */
                         sh_eth_write(ndev, mdp->tx_desc_dma, TDLAR);
@@ -1429,7 +1430,8 @@ static int sh_eth_txfree(struct net_device *ndev)
                 if (mdp->tx_skbuff[entry]) {
                         dma_unmap_single(&ndev->dev,
                                          edmac_to_cpu(mdp, txdesc->addr),
-                                         txdesc->buffer_length, DMA_TO_DEVICE);
+                                         edmac_to_cpu(mdp, txdesc->len) >> 16,
+                                         DMA_TO_DEVICE);
                         dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
                         mdp->tx_skbuff[entry] = NULL;
                         free_num++;
@@ -1439,7 +1441,7 @@ static int sh_eth_txfree(struct net_device *ndev)
                         txdesc->status |= cpu_to_edmac(mdp, TD_TDLE);
 
                 ndev->stats.tx_packets++;
-                ndev->stats.tx_bytes += txdesc->buffer_length;
+                ndev->stats.tx_bytes += edmac_to_cpu(mdp, txdesc->len) >> 16;
         }
         return free_num;
 }
@@ -1458,6 +1460,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         u32 desc_status;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN + 32 - 1;
         dma_addr_t dma_addr;
+        u32 buf_len;
 
         boguscnt = min(boguscnt, *quota);
         limit = boguscnt;
@@ -1466,7 +1469,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 /* RACT bit must be checked before all the following reads */
                 dma_rmb();
                 desc_status = edmac_to_cpu(mdp, rxdesc->status);
-                pkt_len = rxdesc->frame_length;
+                pkt_len = edmac_to_cpu(mdp, rxdesc->len) & RD_RFL;
 
                 if (--boguscnt < 0)
                         break;
@@ -1532,7 +1535,8 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 entry = mdp->dirty_rx % mdp->num_rx_ring;
                 rxdesc = &mdp->rx_ring[entry];
                 /* The size of the buffer is 32 byte boundary. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 32);
+                buf_len = ALIGN(mdp->rx_buf_sz, 32);
+                rxdesc->len = cpu_to_edmac(mdp, buf_len << 16);
 
                 if (mdp->rx_skbuff[entry] == NULL) {
                         skb = netdev_alloc_skb(ndev, skbuff_size);
@@ -1540,8 +1544,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                                 break;  /* Better luck next round. */
                         sh_eth_set_receive_align(skb);
                         dma_addr = dma_map_single(&ndev->dev, skb->data,
-                                                  rxdesc->buffer_length,
-                                                  DMA_FROM_DEVICE);
+                                                  buf_len, DMA_FROM_DEVICE);
                         if (dma_mapping_error(&ndev->dev, dma_addr)) {
                                 kfree_skb(skb);
                                 break;
@@ -2407,7 +2410,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 return NETDEV_TX_OK;
         }
         txdesc->addr = cpu_to_edmac(mdp, dma_addr);
-        txdesc->buffer_length = skb->len;
+        txdesc->len  = cpu_to_edmac(mdp, skb->len << 16);
 
         dma_wmb(); /* TACT bit must be set after all the above writes */
         if (entry >= mdp->num_tx_ring - 1)
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index 26ad1cf0bcf1..72fcfc924589 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -283,7 +283,7 @@ enum DMAC_IM_BIT {
         DMAC_M_RINT1 = 0x00000001,
 };
 
-/* Receive descriptor bit */
+/* Receive descriptor 0 bits */
 enum RD_STS_BIT {
         RD_RACT = 0x80000000, RD_RDLE = 0x40000000,
         RD_RFP1 = 0x20000000, RD_RFP0 = 0x10000000,
@@ -298,6 +298,12 @@ enum RD_STS_BIT {
 #define RDFEND  RD_RFP0
 #define RD_RFP  (RD_RFP1|RD_RFP0)
 
+/* Receive descriptor 1 bits */
+enum RD_LEN_BIT {
+        RD_RFL  = 0x0000ffff,   /* receive frame  length */
+        RD_RBL  = 0xffff0000,   /* receive buffer length */
+};
+
 /* FCFTR */
 enum FCFTR_BIT {
         FCFTR_RFF2 = 0x00040000, FCFTR_RFF1 = 0x00020000,
@@ -307,7 +313,7 @@ enum FCFTR_BIT {
 #define DEFAULT_FIFO_F_D_RFF    (FCFTR_RFF2 | FCFTR_RFF1 | FCFTR_RFF0)
 #define DEFAULT_FIFO_F_D_RFD    (FCFTR_RFD2 | FCFTR_RFD1 | FCFTR_RFD0)
 
-/* Transmit descriptor bit */
+/* Transmit descriptor 0 bits */
 enum TD_STS_BIT {
         TD_TACT = 0x80000000, TD_TDLE = 0x40000000,
         TD_TFP1 = 0x20000000, TD_TFP0 = 0x10000000,
@@ -317,6 +323,11 @@ enum TD_STS_BIT {
 #define TDFEND  TD_TFP0
 #define TD_TFP  (TD_TFP1|TD_TFP0)
 
+/* Transmit descriptor 1 bits */
+enum TD_LEN_BIT {
+        TD_TBL  = 0xffff0000,   /* transmit buffer length */
+};
+
 /* RMCR */
 enum RMCR_BIT {
         RMCR_RNC = 0x00000001,
@@ -425,15 +436,9 @@ enum TSU_FWSLC_BIT {
  */
 struct sh_eth_txdesc {
         u32 status;             /* TD0 */
-#if defined(__LITTLE_ENDIAN)
-        u16 pad0;               /* TD1 */
-        u16 buffer_length;      /* TD1 */
-#else
-        u16 buffer_length;      /* TD1 */
-        u16 pad0;               /* TD1 */
-#endif
+        u32 len;                /* TD1 */
         u32 addr;               /* TD2 */
-        u32 pad1;               /* padding data */
+        u32 pad0;               /* padding data */
 } __aligned(2) __packed;
 
 /* The sh ether Rx buffer descriptors.
@@ -441,13 +446,7 @@ struct sh_eth_txdesc {
  */
 struct sh_eth_rxdesc {
         u32 status;             /* RD0 */
-#if defined(__LITTLE_ENDIAN)
-        u16 frame_length;       /* RD1 */
-        u16 buffer_length;      /* RD1 */
-#else
-        u16 buffer_length;      /* RD1 */
-        u16 frame_length;       /* RD1 */
-#endif
+        u32 len;                /* RD1 */
         u32 addr;               /* RD2 */
         u32 pad0;               /* padding data */
 } __aligned(2) __packed;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 48b92c9de12a..fc958067d10a 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2026,45 +2026,54 @@ static int cpsw_probe_dt(struct cpsw_priv *priv,
         for_each_child_of_node(node, slave_node) {
                 struct cpsw_slave_data *slave_data = data->slave_data + i;
                 const void *mac_addr = NULL;
-                u32 phyid;
                 int lenp;
                 const __be32 *parp;
-                struct device_node *mdio_node;
-                struct platform_device *mdio;
 
                 /* This is no slave child node, continue */
                 if (strcmp(slave_node->name, "slave"))
                         continue;
 
                 priv->phy_node = of_parse_phandle(slave_node, "phy-handle", 0);
+                parp = of_get_property(slave_node, "phy_id", &lenp);
                 if (of_phy_is_fixed_link(slave_node)) {
-                        struct phy_device *pd;
+                        struct device_node *phy_node;
+                        struct phy_device *phy_dev;
 
+                        /* In the case of a fixed PHY, the DT node associated
+                         * to the PHY is the Ethernet MAC DT node.
+                         */
                         ret = of_phy_register_fixed_link(slave_node);
                         if (ret)
                                 return ret;
-                        pd = of_phy_find_device(slave_node);
-                        if (!pd)
+                        phy_node = of_node_get(slave_node);
+                        phy_dev = of_phy_find_device(phy_node);
+                        if (!phy_dev)
                                 return -ENODEV;
                         snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                                 PHY_ID_FMT, pd->bus->id, pd->phy_id);
-                        goto no_phy_slave;
-                }
-                parp = of_get_property(slave_node, "phy_id", &lenp);
-                if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
-                        dev_err(&pdev->dev, "Missing slave[%d] phy_id property\n", i);
+                                 PHY_ID_FMT, phy_dev->bus->id, phy_dev->addr);
+                } else if (parp) {
+                        u32 phyid;
+                        struct device_node *mdio_node;
+                        struct platform_device *mdio;
+
+                        if (lenp != (sizeof(__be32) * 2)) {
+                                dev_err(&pdev->dev, "Invalid slave[%d] phy_id property\n", i);
+                                goto no_phy_slave;
+                        }
+                        mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
+                        phyid = be32_to_cpup(parp+1);
+                        mdio = of_find_device_by_node(mdio_node);
+                        of_node_put(mdio_node);
+                        if (!mdio) {
+                                dev_err(&pdev->dev, "Missing mdio platform device\n");
+                                return -EINVAL;
+                        }
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, mdio->name, phyid);
+                } else {
+                        dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i);
                         goto no_phy_slave;
                 }
-                mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
-                phyid = be32_to_cpup(parp+1);
-                mdio = of_find_device_by_node(mdio_node);
-                of_node_put(mdio_node);
-                if (!mdio) {
-                        dev_err(&pdev->dev, "Missing mdio platform device\n");
-                        return -EINVAL;
-                }
-                snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                         PHY_ID_FMT, mdio->name, phyid);
                 slave_data->phy_if = of_get_phy_mode(slave_node);
                 if (slave_data->phy_if < 0) {
                         dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
@@ -2418,7 +2427,7 @@ static int cpsw_probe(struct platform_device *pdev)
         ndev->irq = platform_get_irq(pdev, 1);
         if (ndev->irq < 0) {
                 dev_err(priv->dev, "error getting irq resource\n");
-                ret = -ENOENT;
+                ret = ndev->irq;
                 goto clean_ale_ret;
         }
 
@@ -2439,8 +2448,10 @@ static int cpsw_probe(struct platform_device *pdev)
 
         /* RX IRQ */
         irq = platform_get_irq(pdev, 1);
-        if (irq < 0)
+        if (irq < 0) {
+                ret = irq;
                 goto clean_ale_ret;
+        }
 
         priv->irqs_table[0] = irq;
         ret = devm_request_irq(&pdev->dev, irq, cpsw_rx_interrupt,
@@ -2452,8 +2463,10 @@ static int cpsw_probe(struct platform_device *pdev)
 
         /* TX IRQ */
         irq = platform_get_irq(pdev, 2);
-        if (irq < 0)
+        if (irq < 0) {
+                ret = irq;
                 goto clean_ale_ret;
+        }
 
         priv->irqs_table[1] = irq;
         ret = devm_request_irq(&pdev->dev, irq, cpsw_tx_interrupt,
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index c2b79f5d1c89..58efdec12f30 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1155,7 +1155,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
         struct geneve_net *gn = net_generic(net, geneve_net_id);
         struct geneve_dev *t, *geneve = netdev_priv(dev);
         bool tun_collect_md, tun_on_same_port;
-        int err;
+        int err, encap_len;
 
         if (!remote)
                 return -EINVAL;
@@ -1187,6 +1187,14 @@ static int geneve_configure(struct net *net, struct net_device *dev,
         if (t)
                 return -EBUSY;
 
+        /* make enough headroom for basic scenario */
+        encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
+        if (remote->sa.sa_family == AF_INET)
+                encap_len += sizeof(struct iphdr);
+        else
+                encap_len += sizeof(struct ipv6hdr);
+        dev->needed_headroom = encap_len + ETH_HLEN;
+
         if (metadata) {
                 if (tun_on_same_port)
                         return -EPERM;
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 7c4a4151ef0f..9f0b1c342b77 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -683,14 +683,14 @@ static void sixpack_close(struct tty_struct *tty)
         if (!atomic_dec_and_test(&sp->refcnt))
                 down(&sp->dead_sem);
 
-        unregister_netdev(sp->dev);
-
-        del_timer(&sp->tx_t);
-        del_timer(&sp->resync_t);
+        del_timer_sync(&sp->tx_t);
+        del_timer_sync(&sp->resync_t);
 
         /* Free all 6pack frame buffers. */
         kfree(sp->rbuff);
         kfree(sp->xbuff);
+
+        unregister_netdev(sp->dev);
 }
 
 /* Perform I/O control on an active 6pack channel. */
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 216bfd350169..0b72b9de5207 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
         if (!atomic_dec_and_test(&ax->refcnt))
                 down(&ax->dead_sem);
 
-        unregister_netdev(ax->dev);
-
         /* Free all AX25 frame buffers. */
         kfree(ax->rbuff);
         kfree(ax->xbuff);
 
         ax->tty = NULL;
+
+        unregister_netdev(ax->dev);
 }
 
 /* Perform I/O control on an active ax25 channel. */
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 8973abdec9f6..bdd83d95ec0a 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -100,7 +100,7 @@ static const struct net_device_ops cdc_mbim_netdev_ops = {
         .ndo_stop             = usbnet_stop,
         .ndo_start_xmit       = usbnet_start_xmit,
         .ndo_tx_timeout       = usbnet_tx_timeout,
-        .ndo_change_mtu       = usbnet_change_mtu,
+        .ndo_change_mtu       = cdc_ncm_change_mtu,
         .ndo_set_mac_address  = eth_mac_addr,
         .ndo_validate_addr    = eth_validate_addr,
         .ndo_vlan_rx_add_vid  = cdc_mbim_rx_add_vid,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 1e9843a41168..e8a1144c5a8b 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -41,6 +41,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/ctype.h>
+#include <linux/etherdevice.h>
 #include <linux/ethtool.h>
 #include <linux/workqueue.h>
 #include <linux/mii.h>
@@ -689,6 +690,33 @@ static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
         kfree(ctx);
 }
 
+/* we need to override the usbnet change_mtu ndo for two reasons:
+ *  - respect the negotiated maximum datagram size
+ *  - avoid unwanted changes to rx and tx buffers
+ */
+int cdc_ncm_change_mtu(struct net_device *net, int new_mtu)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
+        int maxmtu = ctx->max_datagram_size - cdc_ncm_eth_hlen(dev);
+
+        if (new_mtu <= 0 || new_mtu > maxmtu)
+                return -EINVAL;
+        net->mtu = new_mtu;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cdc_ncm_change_mtu);
+
+static const struct net_device_ops cdc_ncm_netdev_ops = {
+        .ndo_open            = usbnet_open,
+        .ndo_stop            = usbnet_stop,
+        .ndo_start_xmit      = usbnet_start_xmit,
+        .ndo_tx_timeout      = usbnet_tx_timeout,
+        .ndo_change_mtu      = cdc_ncm_change_mtu,
+        .ndo_set_mac_address = eth_mac_addr,
+        .ndo_validate_addr   = eth_validate_addr,
+};
+
 int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags)
 {
         struct cdc_ncm_ctx *ctx;
@@ -823,6 +851,9 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
         /* add our sysfs attrs */
         dev->net->sysfs_groups[0] = &cdc_ncm_sysfs_attr_group;
 
+        /* must handle MTU changes */
+        dev->net->netdev_ops = &cdc_ncm_netdev_ops;
+
         return 0;
 
 error2:
@@ -1558,6 +1589,24 @@ static const struct usb_device_id cdc_devs[] = {
           .driver_info = (unsigned long) &wwan_info,
         },
 
+        /* DW5812 LTE Verizon Mobile Broadband Card
+         * Unlike DW5550 this device requires FLAG_NOARP
+         */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x81bb,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_noarp_info,
+        },
+
+        /* DW5813 LTE AT&T Mobile Broadband Card
+         * Unlike DW5550 this device requires FLAG_NOARP
+         */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x81bc,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_noarp_info,
+        },
+
         /* Dell branded MBM devices like DW5550 */
         { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
                 | USB_DEVICE_ID_MATCH_VENDOR,
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 0ef4a5ad5557..ba21d072be31 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -117,12 +117,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
                 kfree_skb(skb);
                 goto drop;
         }
-        /* don't change ip_summed == CHECKSUM_PARTIAL, as that
-         * will cause bad checksum on forwarded packets
-         */
-        if (skb->ip_summed == CHECKSUM_NONE &&
-            rcv->features & NETIF_F_RXCSUM)
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
         if (likely(dev_forward_skb(rcv, skb) == NET_RX_SUCCESS)) {
                 struct pcpu_vstats *stats = this_cpu_ptr(dev->vstats);
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index bf88ec3a65fa..d9a4aee246a6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -69,13 +69,19 @@
 #include "iwl-agn-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   19
+#define IWL7260_UCODE_API_MAX   17
+#define IWL7265_UCODE_API_MAX   19
+#define IWL7265D_UCODE_API_MAX  19
 
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    13
+#define IWL7265_UCODE_API_OK    13
+#define IWL7265D_UCODE_API_OK   13
 
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   13
+#define IWL7265_UCODE_API_MIN   13
+#define IWL7265D_UCODE_API_MIN  13
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
@@ -149,10 +155,7 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
 
-#define IWL_DEVICE_7000                                         \
-        .ucode_api_max = IWL7260_UCODE_API_MAX,                 \
-        .ucode_api_ok = IWL7260_UCODE_API_OK,                   \
-        .ucode_api_min = IWL7260_UCODE_API_MIN,                 \
+#define IWL_DEVICE_7000_COMMON                                  \
         .device_family = IWL_DEVICE_FAMILY_7000,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
@@ -163,6 +166,24 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,    \
         .dccm_offset = IWL7000_DCCM_OFFSET
 
+#define IWL_DEVICE_7000                                         \
+        IWL_DEVICE_7000_COMMON,                                 \
+        .ucode_api_max = IWL7260_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL7260_UCODE_API_OK,                   \
+        .ucode_api_min = IWL7260_UCODE_API_MIN
+
+#define IWL_DEVICE_7005                                         \
+        IWL_DEVICE_7000_COMMON,                                 \
+        .ucode_api_max = IWL7265_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL7265_UCODE_API_OK,                   \
+        .ucode_api_min = IWL7265_UCODE_API_MIN
+
+#define IWL_DEVICE_7005D                                        \
+        IWL_DEVICE_7000_COMMON,                                 \
+        .ucode_api_max = IWL7265D_UCODE_API_MAX,                \
+        .ucode_api_ok = IWL7265D_UCODE_API_OK,                  \
+        .ucode_api_min = IWL7265D_UCODE_API_MIN
+
 const struct iwl_cfg iwl7260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7260",
         .fw_name_pre = IWL7260_FW_PRE,
@@ -266,7 +287,7 @@ static const struct iwl_ht_params iwl7265_ht_params = {
 const struct iwl_cfg iwl3165_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 3165",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7000_ht_params,
         .nvm_ver = IWL3165_NVM_VERSION,
         .nvm_calib_ver = IWL3165_TX_POWER_VERSION,
@@ -277,7 +298,7 @@ const struct iwl_cfg iwl3165_2ac_cfg = {
 const struct iwl_cfg iwl7265_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7265",
         .fw_name_pre = IWL7265_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -288,7 +309,7 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
 const struct iwl_cfg iwl7265_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 7265",
         .fw_name_pre = IWL7265_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -299,7 +320,7 @@ const struct iwl_cfg iwl7265_2n_cfg = {
 const struct iwl_cfg iwl7265_n_cfg = {
         .name = "Intel(R) Wireless N 7265",
         .fw_name_pre = IWL7265_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -310,7 +331,7 @@ const struct iwl_cfg iwl7265_n_cfg = {
 const struct iwl_cfg iwl7265d_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7265",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -321,7 +342,7 @@ const struct iwl_cfg iwl7265d_2ac_cfg = {
 const struct iwl_cfg iwl7265d_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 7265",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -332,7 +353,7 @@ const struct iwl_cfg iwl7265d_2n_cfg = {
 const struct iwl_cfg iwl7265d_n_cfg = {
         .name = "Intel(R) Wireless N 7265",
         .fw_name_pre = IWL7265D_FW_PRE,
-        IWL_DEVICE_7000,
+        IWL_DEVICE_7005D,
         .ht_params = &iwl7265_ht_params,
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
@@ -342,5 +363,5 @@ const struct iwl_cfg iwl7265d_n_cfg = {
 
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7265_UCODE_API_OK));
+MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7265D_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 354acbde088e..2b976b110207 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -1222,8 +1222,8 @@ static u8 iwl_mvm_get_key_sta_id(struct iwl_mvm *mvm,
             mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
                 u8 sta_id = mvmvif->ap_sta_id;
 
-                sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
-                                                lockdep_is_held(&mvm->mutex));
+                sta = rcu_dereference_check(mvm->fw_id_to_mac_id[sta_id],
+                                            lockdep_is_held(&mvm->mutex));
                 /*
                  * It is possible that the 'sta' parameter is NULL,
                  * for example when a GTK is removed - the sta_id will then
@@ -1590,14 +1590,15 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
                              u16 *phase1key)
 {
         struct iwl_mvm_sta *mvm_sta;
-        u8 sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);
+        u8 sta_id;
         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
 
-        if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))
-                return;
-
         rcu_read_lock();
 
+        sta_id = iwl_mvm_get_key_sta_id(mvm, vif, sta);
+        if (WARN_ON_ONCE(sta_id == IWL_MVM_STATION_COUNT))
+                goto unlock;
+
         if (!sta) {
                 sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
                 if (WARN_ON(IS_ERR_OR_NULL(sta))) {
@@ -1609,6 +1610,8 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, mcast,
                              iv32, phase1key, CMD_ASYNC, keyconf->hw_key_idx);
+
+ unlock:
         rcu_read_unlock();
 }
 
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 9e294ff4e652..0c67b57be83c 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2540,8 +2540,17 @@ static void nvme_ns_remove(struct nvme_ns *ns)
 {
         bool kill = nvme_io_incapable(ns->dev) && !blk_queue_dying(ns->queue);
 
-        if (kill)
+        if (kill) {
                 blk_set_queue_dying(ns->queue);
+
+                /*
+                 * The controller was shutdown first if we got here through
+                 * device removal. The shutdown may requeue outstanding
+                 * requests. These need to be aborted immediately so
+                 * del_gendisk doesn't block indefinitely for their completion.
+                 */
+                blk_mq_abort_requeue_list(ns->queue);
+        }
         if (ns->disk->flags & GENHD_FL_UP)
                 del_gendisk(ns->disk);
         if (kill || !blk_queue_dying(ns->queue)) {
@@ -2977,6 +2986,15 @@ static void nvme_dev_remove(struct nvme_dev *dev)
 {
         struct nvme_ns *ns, *next;
 
+        if (nvme_io_incapable(dev)) {
+                /*
+                 * If the device is not capable of IO (surprise hot-removal,
+                 * for example), we need to quiesce prior to deleting the
+                 * namespaces. This will end outstanding requests and prevent
+                 * attempts to sync dirty data.
+                 */
+                nvme_dev_shutdown(dev);
+        }
         list_for_each_entry_safe(ns, next, &dev->namespaces, list)
                 nvme_ns_remove(ns);
 }
diff --git a/drivers/pci/host/pcie-hisi.c b/drivers/pci/host/pcie-hisi.c
index 163671a4f798..77f7c669a1b9 100644
--- a/drivers/pci/host/pcie-hisi.c
+++ b/drivers/pci/host/pcie-hisi.c
@@ -61,7 +61,9 @@ static int hisi_pcie_cfg_read(struct pcie_port *pp, int where, int size,
                 *val = *(u8 __force *) walker;
         else if (size == 2)
                 *val = *(u16 __force *) walker;
-        else if (size != 4)
+        else if (size == 4)
+                *val = reg_val;
+        else
                 return PCIBIOS_BAD_REGISTER_NUMBER;
 
         return PCIBIOS_SUCCESSFUL;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 61f768518a34..24ec282e15d8 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -599,8 +599,10 @@ static enum ap_wait ap_sm_read(struct ap_device *ap_dev)
         status = ap_sm_recv(ap_dev);
         switch (status.response_code) {
         case AP_RESPONSE_NORMAL:
-                if (ap_dev->queue_count > 0)
+                if (ap_dev->queue_count > 0) {
+                        ap_dev->state = AP_STATE_WORKING;
                         return AP_WAIT_AGAIN;
+                }
                 ap_dev->state = AP_STATE_IDLE;
                 return AP_WAIT_NONE;
         case AP_RESPONSE_NO_PENDING_REPLY:
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index b2a1a81e6fc8..1b831598df7c 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -984,6 +984,36 @@ static struct virtqueue *virtio_ccw_vq_by_ind(struct virtio_ccw_device *vcdev,
         return vq;
 }
 
+static void virtio_ccw_check_activity(struct virtio_ccw_device *vcdev,
+                                      __u32 activity)
+{
+        if (vcdev->curr_io & activity) {
+                switch (activity) {
+                case VIRTIO_CCW_DOING_READ_FEAT:
+                case VIRTIO_CCW_DOING_WRITE_FEAT:
+                case VIRTIO_CCW_DOING_READ_CONFIG:
+                case VIRTIO_CCW_DOING_WRITE_CONFIG:
+                case VIRTIO_CCW_DOING_WRITE_STATUS:
+                case VIRTIO_CCW_DOING_SET_VQ:
+                case VIRTIO_CCW_DOING_SET_IND:
+                case VIRTIO_CCW_DOING_SET_CONF_IND:
+                case VIRTIO_CCW_DOING_RESET:
+                case VIRTIO_CCW_DOING_READ_VQ_CONF:
+                case VIRTIO_CCW_DOING_SET_IND_ADAPTER:
+                case VIRTIO_CCW_DOING_SET_VIRTIO_REV:
+                        vcdev->curr_io &= ~activity;
+                        wake_up(&vcdev->wait_q);
+                        break;
+                default:
+                        /* don't know what to do... */
+                        dev_warn(&vcdev->cdev->dev,
+                                 "Suspicious activity '%08x'\n", activity);
+                        WARN_ON(1);
+                        break;
+                }
+        }
+}
+
 static void virtio_ccw_int_handler(struct ccw_device *cdev,
                                    unsigned long intparm,
                                    struct irb *irb)
@@ -995,6 +1025,12 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
 
         if (!vcdev)
                 return;
+        if (IS_ERR(irb)) {
+                vcdev->err = PTR_ERR(irb);
+                virtio_ccw_check_activity(vcdev, activity);
+                /* Don't poke around indicators, something's wrong. */
+                return;
+        }
         /* Check if it's a notification from the host. */
         if ((intparm == 0) &&
             (scsw_stctl(&irb->scsw) ==
@@ -1010,31 +1046,7 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
                         /* Map everything else to -EIO. */
                         vcdev->err = -EIO;
         }
-        if (vcdev->curr_io & activity) {
-                switch (activity) {
-                case VIRTIO_CCW_DOING_READ_FEAT:
-                case VIRTIO_CCW_DOING_WRITE_FEAT:
-                case VIRTIO_CCW_DOING_READ_CONFIG:
-                case VIRTIO_CCW_DOING_WRITE_CONFIG:
-                case VIRTIO_CCW_DOING_WRITE_STATUS:
-                case VIRTIO_CCW_DOING_SET_VQ:
-                case VIRTIO_CCW_DOING_SET_IND:
-                case VIRTIO_CCW_DOING_SET_CONF_IND:
-                case VIRTIO_CCW_DOING_RESET:
-                case VIRTIO_CCW_DOING_READ_VQ_CONF:
-                case VIRTIO_CCW_DOING_SET_IND_ADAPTER:
-                case VIRTIO_CCW_DOING_SET_VIRTIO_REV:
-                        vcdev->curr_io &= ~activity;
-                        wake_up(&vcdev->wait_q);
-                        break;
-                default:
-                        /* don't know what to do... */
-                        dev_warn(&cdev->dev, "Suspicious activity '%08x'\n",
-                                 activity);
-                        WARN_ON(1);
-                        break;
-                }
-        }
+        virtio_ccw_check_activity(vcdev, activity);
         for_each_set_bit(i, &vcdev->indicators,
                          sizeof(vcdev->indicators) * BITS_PER_BYTE) {
                 /* The bit clear must happen before the vring kick. */
diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c
index 064031870ba0..ca0d3802f2af 100644
--- a/drivers/tty/serial/sunhv.c
+++ b/drivers/tty/serial/sunhv.c
@@ -148,8 +148,10 @@ static int receive_chars_read(struct uart_port *port)
                         uart_handle_dcd_change(port, 1);
                 }
 
-                for (i = 0; i < bytes_read; i++)
-                        uart_handle_sysrq_char(port, con_read_page[i]);
+                if (port->sysrq != 0 &&  *con_read_page) {
+                        for (i = 0; i < bytes_read; i++)
+                                uart_handle_sysrq_char(port, con_read_page[i]);
+                }
 
                 if (port->state == NULL)
                         continue;
@@ -168,17 +170,17 @@ struct sunhv_ops {
         int (*receive_chars)(struct uart_port *port);
 };
 
-static struct sunhv_ops bychar_ops = {
+static const struct sunhv_ops bychar_ops = {
         .transmit_chars = transmit_chars_putchar,
         .receive_chars = receive_chars_getchar,
 };
 
-static struct sunhv_ops bywrite_ops = {
+static const struct sunhv_ops bywrite_ops = {
         .transmit_chars = transmit_chars_write,
         .receive_chars = receive_chars_read,
 };
 
-static struct sunhv_ops *sunhv_ops = &bychar_ops;
+static const struct sunhv_ops *sunhv_ops = &bychar_ops;
 
 static struct tty_port *receive_chars(struct uart_port *port)
 {
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 9ffef06b30d5..c9d6c715c0fb 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -616,6 +616,7 @@ nfsd4_cb_layout_prepare(struct nfsd4_callback *cb)
 
         mutex_lock(&ls->ls_mutex);
         nfs4_inc_and_copy_stateid(&ls->ls_recall_sid, &ls->ls_stid);
+        mutex_unlock(&ls->ls_mutex);
 }
 
 static int
@@ -659,7 +660,6 @@ nfsd4_cb_layout_release(struct nfsd4_callback *cb)
 
         trace_layout_recall_release(&ls->ls_stid.sc_stateid);
 
-        mutex_unlock(&ls->ls_mutex);
         nfsd4_return_all_layouts(ls, &reaplist);
         nfsd4_free_layouts(&reaplist);
         nfs4_put_stid(&ls->ls_stid);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index ce38b4ccc9ab..84f2f8079466 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2843,6 +2843,8 @@ again:
         res->state &= ~DLM_LOCK_RES_BLOCK_DIRTY;
         if (!ret)
                 BUG_ON(!(res->state & DLM_LOCK_RES_MIGRATING));
+        else
+                res->migration_pending = 0;
         spin_unlock(&res->spinlock);
 
         /*
diff --git a/fs/ocfs2/locks.c b/fs/ocfs2/locks.c
index 652ece4a9d9e..d56f0079b858 100644
--- a/fs/ocfs2/locks.c
+++ b/fs/ocfs2/locks.c
@@ -67,7 +67,10 @@ static int ocfs2_do_flock(struct file *file, struct inode *inode,
                  */
 
                 locks_lock_file_wait(file,
-                                     &(struct file_lock){.fl_type = F_UNLCK});
+                                &(struct file_lock) {
+                                        .fl_type = F_UNLCK,
+                                        .fl_flags = FL_FLOCK
+                                });
 
                 ocfs2_file_unlock(file);
         }
diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
index d5da6f624142..79b8021302b3 100644
--- a/fs/ocfs2/resize.c
+++ b/fs/ocfs2/resize.c
@@ -54,11 +54,12 @@
 static u16 ocfs2_calc_new_backup_super(struct inode *inode,
                                        struct ocfs2_group_desc *gd,
                                        u16 cl_cpg,
+                                       u16 old_bg_clusters,
                                        int set)
 {
         int i;
         u16 backups = 0;
-        u32 cluster;
+        u32 cluster, lgd_cluster;
         u64 blkno, gd_blkno, lgd_blkno = le64_to_cpu(gd->bg_blkno);
 
         for (i = 0; i < OCFS2_MAX_BACKUP_SUPERBLOCKS; i++) {
@@ -71,6 +72,12 @@ static u16 ocfs2_calc_new_backup_super(struct inode *inode,
                 else if (gd_blkno > lgd_blkno)
                         break;
 
+                /* check if already done backup super */
+                lgd_cluster = ocfs2_blocks_to_clusters(inode->i_sb, lgd_blkno);
+                lgd_cluster += old_bg_clusters;
+                if (lgd_cluster >= cluster)
+                        continue;
+
                 if (set)
                         ocfs2_set_bit(cluster % cl_cpg,
                                       (unsigned long *)gd->bg_bitmap);
@@ -99,6 +106,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
         u16 chain, num_bits, backups = 0;
         u16 cl_bpc = le16_to_cpu(cl->cl_bpc);
         u16 cl_cpg = le16_to_cpu(cl->cl_cpg);
+        u16 old_bg_clusters;
 
         trace_ocfs2_update_last_group_and_inode(new_clusters,
                                                 first_new_cluster);
@@ -112,6 +120,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
 
         group = (struct ocfs2_group_desc *)group_bh->b_data;
 
+        old_bg_clusters = le16_to_cpu(group->bg_bits) / cl_bpc;
         /* update the group first. */
         num_bits = new_clusters * cl_bpc;
         le16_add_cpu(&group->bg_bits, num_bits);
@@ -125,7 +134,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
                                      OCFS2_FEATURE_COMPAT_BACKUP_SB)) {
                 backups = ocfs2_calc_new_backup_super(bm_inode,
                                                      group,
-                                                     cl_cpg, 1);
+                                                     cl_cpg, old_bg_clusters, 1);
                 le16_add_cpu(&group->bg_free_bits_count, -1 * backups);
         }
 
@@ -163,7 +172,7 @@ out_rollback:
         if (ret < 0) {
                 ocfs2_calc_new_backup_super(bm_inode,
                                             group,
-                                            cl_cpg, 0);
+                                            cl_cpg, old_bg_clusters, 0);
                 le16_add_cpu(&group->bg_free_bits_count, backups);
                 le16_add_cpu(&group->bg_bits, -1 * num_bits);
                 le16_add_cpu(&group->bg_free_bits_count, -1 * num_bits);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0169ba2e2e64..c70e3588a48c 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -797,6 +797,7 @@ extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
 extern int blk_queue_enter(struct request_queue *q, gfp_t gfp);
 extern void blk_queue_exit(struct request_queue *q);
 extern void blk_start_queue(struct request_queue *q);
+extern void blk_start_queue_async(struct request_queue *q);
 extern void blk_stop_queue(struct request_queue *q);
 extern void blk_sync_queue(struct request_queue *q);
 extern void __blk_stop_queue(struct request_queue *q);
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 1f6526c76ee8..3a375d07d0dc 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -138,6 +138,7 @@ struct cdc_ncm_ctx {
 };
 
 u8 cdc_ncm_select_altsetting(struct usb_interface *intf);
+int cdc_ncm_change_mtu(struct net_device *net, int new_mtu);
 int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags);
 void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
 struct sk_buff *cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign);
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 5dbc8b0ee567..3e5d9075960f 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -176,11 +176,11 @@ extern void zone_statistics(struct zone *, struct zone *, gfp_t gfp);
 #define sub_zone_page_state(__z, __i, __d) mod_zone_page_state(__z, __i, -(__d))
 
 #ifdef CONFIG_SMP
-void __mod_zone_page_state(struct zone *, enum zone_stat_item item, int);
+void __mod_zone_page_state(struct zone *, enum zone_stat_item item, long);
 void __inc_zone_page_state(struct page *, enum zone_stat_item);
 void __dec_zone_page_state(struct page *, enum zone_stat_item);
 
-void mod_zone_page_state(struct zone *, enum zone_stat_item, int);
+void mod_zone_page_state(struct zone *, enum zone_stat_item, long);
 void inc_zone_page_state(struct page *, enum zone_stat_item);
 void dec_zone_page_state(struct page *, enum zone_stat_item);
 
@@ -205,7 +205,7 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat,
  * The functions directly modify the zone and global counters.
  */
 static inline void __mod_zone_page_state(struct zone *zone,
-                        enum zone_stat_item item, int delta)
+                        enum zone_stat_item item, long delta)
 {
         zone_page_state_add(delta, zone, item);
 }
diff --git a/include/sound/soc.h b/include/sound/soc.h
index a8b4b9c8b1d2..fb955e69a78e 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -1655,7 +1655,7 @@ extern const struct dev_pm_ops snd_soc_pm_ops;
 /* Helper functions */
 static inline void snd_soc_dapm_mutex_lock(struct snd_soc_dapm_context *dapm)
 {
-        mutex_lock(&dapm->card->dapm_mutex);
+        mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
 }
 
 static inline void snd_soc_dapm_mutex_unlock(struct snd_soc_dapm_context *dapm)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index eb9240c458fa..51282f579760 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -519,7 +519,8 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
                 return -ENOMEM;
 
         spin_lock(&ht->lock);
-        iter->walker->tbl = rht_dereference(ht->tbl, ht);
+        iter->walker->tbl =
+                rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
         list_add(&iter->walker->list, &iter->walker->tbl->walkers);
         spin_unlock(&ht->lock);
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index e234c21a5e6c..fc10620967c7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -903,14 +903,20 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
                 if (prev && reclaim->generation != iter->generation)
                         goto out_unlock;
 
-                do {
+                while (1) {
                         pos = READ_ONCE(iter->position);
+                        if (!pos || css_tryget(&pos->css))
+                                break;
                         /*
-                         * A racing update may change the position and
-                         * put the last reference, hence css_tryget(),
-                         * or retry to see the updated position.
+                         * css reference reached zero, so iter->position will
+                         * be cleared by ->css_released. However, we should not
+                         * rely on this happening soon, because ->css_released
+                         * is called from a work queue, and by busy-waiting we
+                         * might block it. So we clear iter->position right
+                         * away.
                          */
-                } while (pos && !css_tryget(&pos->css));
+                        (void)cmpxchg(&iter->position, pos, NULL);
+                }
         }
 
         if (pos)
@@ -956,17 +962,13 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
         }
 
         if (reclaim) {
-                if (cmpxchg(&iter->position, pos, memcg) == pos) {
-                        if (memcg)
-                                css_get(&memcg->css);
-                        if (pos)
-                                css_put(&pos->css);
-                }
-
                 /*
-                 * pairs with css_tryget when dereferencing iter->position
-                 * above.
+                 * The position could have already been updated by a competing
+                 * thread, so check that the value hasn't changed since we read
+                 * it to avoid reclaiming from the same cgroup twice.
                  */
+                (void)cmpxchg(&iter->position, pos, memcg);
+
                 if (pos)
                         css_put(&pos->css);
 
@@ -999,6 +1001,28 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
                 css_put(&prev->css);
 }
 
+static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+{
+        struct mem_cgroup *memcg = dead_memcg;
+        struct mem_cgroup_reclaim_iter *iter;
+        struct mem_cgroup_per_zone *mz;
+        int nid, zid;
+        int i;
+
+        while ((memcg = parent_mem_cgroup(memcg))) {
+                for_each_node(nid) {
+                        for (zid = 0; zid < MAX_NR_ZONES; zid++) {
+                                mz = &memcg->nodeinfo[nid]->zoneinfo[zid];
+                                for (i = 0; i <= DEF_PRIORITY; i++) {
+                                        iter = &mz->iter[i];
+                                        cmpxchg(&iter->position,
+                                                dead_memcg, NULL);
+                                }
+                        }
+                }
+        }
+}
+
 /*
  * Iteration constructs for visiting all cgroups (under a tree).  If
  * loops are exited prematurely (break), mem_cgroup_iter_break() must
@@ -4324,6 +4348,13 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
         wb_memcg_offline(memcg);
 }
 
+static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
+{
+        struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+
+        invalidate_reclaim_iterators(memcg);
+}
+
 static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
@@ -5185,6 +5216,7 @@ struct cgroup_subsys memory_cgrp_subsys = {
         .css_alloc = mem_cgroup_css_alloc,
         .css_online = mem_cgroup_css_online,
         .css_offline = mem_cgroup_css_offline,
+        .css_released = mem_cgroup_css_released,
         .css_free = mem_cgroup_css_free,
         .css_reset = mem_cgroup_css_reset,
         .can_attach = mem_cgroup_can_attach,
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 67d488ab495e..a042a9d537bb 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1375,23 +1375,30 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
  */
 int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
 {
-        unsigned long pfn;
+        unsigned long pfn, sec_end_pfn;
         struct zone *zone = NULL;
         struct page *page;
         int i;
-        for (pfn = start_pfn;
+        for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
              pfn < end_pfn;
-             pfn += MAX_ORDER_NR_PAGES) {
-                i = 0;
-                /* This is just a CONFIG_HOLES_IN_ZONE check.*/
-                while ((i < MAX_ORDER_NR_PAGES) && !pfn_valid_within(pfn + i))
-                        i++;
-                if (i == MAX_ORDER_NR_PAGES)
+             pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
+                /* Make sure the memory section is present first */
+                if (!present_section_nr(pfn_to_section_nr(pfn)))
                         continue;
-                page = pfn_to_page(pfn + i);
-                if (zone && page_zone(page) != zone)
-                        return 0;
-                zone = page_zone(page);
+                for (; pfn < sec_end_pfn && pfn < end_pfn;
+                     pfn += MAX_ORDER_NR_PAGES) {
+                        i = 0;
+                        /* This is just a CONFIG_HOLES_IN_ZONE check.*/
+                        while ((i < MAX_ORDER_NR_PAGES) &&
+                                !pfn_valid_within(pfn + i))
+                                i++;
+                        if (i == MAX_ORDER_NR_PAGES)
+                                continue;
+                        page = pfn_to_page(pfn + i);
+                        if (zone && page_zone(page) != zone)
+                                return 0;
+                        zone = page_zone(page);
+                }
         }
         return 1;
 }
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 0d5712b0206c..4ebc17d948cb 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -219,7 +219,7 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat,
  * particular counter cannot be updated from interrupt context.
  */
 void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
-                                int delta)
+                           long delta)
 {
         struct per_cpu_pageset __percpu *pcp = zone->pageset;
         s8 __percpu *p = pcp->vm_stat_diff + item;
@@ -318,8 +318,8 @@ EXPORT_SYMBOL(__dec_zone_page_state);
  *     1       Overstepping half of threshold
  *     -1      Overstepping minus half of threshold
 */
-static inline void mod_state(struct zone *zone,
-       enum zone_stat_item item, int delta, int overstep_mode)
+static inline void mod_state(struct zone *zone, enum zone_stat_item item,
+                             long delta, int overstep_mode)
 {
         struct per_cpu_pageset __percpu *pcp = zone->pageset;
         s8 __percpu *p = pcp->vm_stat_diff + item;
@@ -357,7 +357,7 @@ static inline void mod_state(struct zone *zone,
 }
 
 void mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
-                                        int delta)
+                         long delta)
 {
         mod_state(zone, item, delta, 0);
 }
@@ -384,7 +384,7 @@ EXPORT_SYMBOL(dec_zone_page_state);
  * Use interrupt disable to serialize counter updates
  */
 void mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
-                                        int delta)
+                         long delta)
 {
         unsigned long flags;
 
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 5396ff08af32..12045dea276c 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -39,7 +39,7 @@ void br_init_port(struct net_bridge_port *p)
         struct switchdev_attr attr = {
                 .id = SWITCHDEV_ATTR_ID_BRIDGE_AGEING_TIME,
                 .flags = SWITCHDEV_F_SKIP_EOPNOTSUPP | SWITCHDEV_F_DEFER,
-                .u.ageing_time = p->br->ageing_time,
+                .u.ageing_time = jiffies_to_clock_t(p->br->ageing_time),
         };
         int err;
 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index f34c31defafe..a09fb0dec725 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -253,9 +253,6 @@ ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
         p.i_key = p.o_key = 0;
         p.i_flags = p.o_flags = 0;
-        if (p.iph.ttl)
-                p.iph.frag_off |= htons(IP_DF);
-
         err = ip_tunnel_ioctl(dev, &p, cmd);
         if (err)
                 return err;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 1e0c3c835a63..7b0edb37a115 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -259,7 +259,7 @@ static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         xfrm_dst_ifdown(dst, dev);
 }
 
-static struct dst_ops xfrm4_dst_ops = {
+static struct dst_ops xfrm4_dst_ops_template = {
         .family =               AF_INET,
         .gc =                   xfrm4_garbage_collect,
         .update_pmtu =          xfrm4_update_pmtu,
@@ -273,7 +273,7 @@ static struct dst_ops xfrm4_dst_ops = {
 
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
         .family =               AF_INET,
-        .dst_ops =              &xfrm4_dst_ops,
+        .dst_ops =              &xfrm4_dst_ops_template,
         .dst_lookup =           xfrm4_dst_lookup,
         .get_saddr =            xfrm4_get_saddr,
         .decode_session =       _decode_session4,
@@ -295,7 +295,7 @@ static struct ctl_table xfrm4_policy_table[] = {
         { }
 };
 
-static int __net_init xfrm4_net_init(struct net *net)
+static int __net_init xfrm4_net_sysctl_init(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
@@ -323,7 +323,7 @@ err_alloc:
         return -ENOMEM;
 }
 
-static void __net_exit xfrm4_net_exit(struct net *net)
+static void __net_exit xfrm4_net_sysctl_exit(struct net *net)
 {
         struct ctl_table *table;
 
@@ -335,12 +335,44 @@ static void __net_exit xfrm4_net_exit(struct net *net)
         if (!net_eq(net, &init_net))
                 kfree(table);
 }
+#else /* CONFIG_SYSCTL */
+static int inline xfrm4_net_sysctl_init(struct net *net)
+{
+        return 0;
+}
+
+static void inline xfrm4_net_sysctl_exit(struct net *net)
+{
+}
+#endif
+
+static int __net_init xfrm4_net_init(struct net *net)
+{
+        int ret;
+
+        memcpy(&net->xfrm.xfrm4_dst_ops, &xfrm4_dst_ops_template,
+               sizeof(xfrm4_dst_ops_template));
+        ret = dst_entries_init(&net->xfrm.xfrm4_dst_ops);
+        if (ret)
+                return ret;
+
+        ret = xfrm4_net_sysctl_init(net);
+        if (ret)
+                dst_entries_destroy(&net->xfrm.xfrm4_dst_ops);
+
+        return ret;
+}
+
+static void __net_exit xfrm4_net_exit(struct net *net)
+{
+        xfrm4_net_sysctl_exit(net);
+        dst_entries_destroy(&net->xfrm.xfrm4_dst_ops);
+}
 
 static struct pernet_operations __net_initdata xfrm4_net_ops = {
         .init   = xfrm4_net_init,
         .exit   = xfrm4_net_exit,
 };
-#endif
 
 static void __init xfrm4_policy_init(void)
 {
@@ -349,13 +381,9 @@ static void __init xfrm4_policy_init(void)
 
 void __init xfrm4_init(void)
 {
-        dst_entries_init(&xfrm4_dst_ops);
-
         xfrm4_state_init();
         xfrm4_policy_init();
         xfrm4_protocol_init();
-#ifdef CONFIG_SYSCTL
         register_pernet_subsys(&xfrm4_net_ops);
-#endif
 }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 17f8e7ea133b..1f21087accab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5369,13 +5369,10 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
                 goto out;
         }
 
-        if (!write) {
-                err = snprintf(str, sizeof(str), "%pI6",
-                               &secret->secret);
-                if (err >= sizeof(str)) {
-                        err = -EIO;
-                        goto out;
-                }
+        err = snprintf(str, sizeof(str), "%pI6", &secret->secret);
+        if (err >= sizeof(str)) {
+                err = -EIO;
+                goto out;
         }
 
         err = proc_dostring(&lctl, write, buffer, lenp, ppos);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 882124ebb438..a8f6986dcbe5 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -552,7 +552,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr *nlh)
 
         rcu_read_lock();
         p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
-        if (p && ip6addrlbl_hold(p))
+        if (p && !ip6addrlbl_hold(p))
                 p = NULL;
         lseq = ip6addrlbl_table.seq;
         rcu_read_unlock();
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d6161e1c48c8..84afb9a77278 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1183,7 +1183,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
          */
         if (!in6_dev->cnf.accept_ra_from_local &&
             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
-                          NULL, 0)) {
+                          in6_dev->dev, 0)) {
                 ND_PRINTK(2, info,
                           "RA from local address detected on dev: %s: default router ignored\n",
                           skb->dev->name);
@@ -1337,7 +1337,7 @@ skip_linkparms:
 #ifdef CONFIG_IPV6_ROUTE_INFO
         if (!in6_dev->cnf.accept_ra_from_local &&
             ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
-                          NULL, 0)) {
+                          in6_dev->dev, 0)) {
                 ND_PRINTK(2, info,
                           "RA from local address detected on dev: %s: router info ignored.\n",
                           skb->dev->name);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 5643423fe67a..c074771a10f7 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -279,7 +279,7 @@ static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         xfrm_dst_ifdown(dst, dev);
 }
 
-static struct dst_ops xfrm6_dst_ops = {
+static struct dst_ops xfrm6_dst_ops_template = {
         .family =               AF_INET6,
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
@@ -293,7 +293,7 @@ static struct dst_ops xfrm6_dst_ops = {
 
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
         .family =               AF_INET6,
-        .dst_ops =              &xfrm6_dst_ops,
+        .dst_ops =              &xfrm6_dst_ops_template,
         .dst_lookup =           xfrm6_dst_lookup,
         .get_saddr =            xfrm6_get_saddr,
         .decode_session =       _decode_session6,
@@ -325,7 +325,7 @@ static struct ctl_table xfrm6_policy_table[] = {
         { }
 };
 
-static int __net_init xfrm6_net_init(struct net *net)
+static int __net_init xfrm6_net_sysctl_init(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
@@ -353,7 +353,7 @@ err_alloc:
         return -ENOMEM;
 }
 
-static void __net_exit xfrm6_net_exit(struct net *net)
+static void __net_exit xfrm6_net_sysctl_exit(struct net *net)
 {
         struct ctl_table *table;
 
@@ -365,24 +365,52 @@ static void __net_exit xfrm6_net_exit(struct net *net)
         if (!net_eq(net, &init_net))
                 kfree(table);
 }
+#else /* CONFIG_SYSCTL */
+static int inline xfrm6_net_sysctl_init(struct net *net)
+{
+        return 0;
+}
+
+static void inline xfrm6_net_sysctl_exit(struct net *net)
+{
+}
+#endif
+
+static int __net_init xfrm6_net_init(struct net *net)
+{
+        int ret;
+
+        memcpy(&net->xfrm.xfrm6_dst_ops, &xfrm6_dst_ops_template,
+               sizeof(xfrm6_dst_ops_template));
+        ret = dst_entries_init(&net->xfrm.xfrm6_dst_ops);
+        if (ret)
+                return ret;
+
+        ret = xfrm6_net_sysctl_init(net);
+        if (ret)
+                dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
+
+        return ret;
+}
+
+static void __net_exit xfrm6_net_exit(struct net *net)
+{
+        xfrm6_net_sysctl_exit(net);
+        dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
+}
 
 static struct pernet_operations xfrm6_net_ops = {
         .init   = xfrm6_net_init,
         .exit   = xfrm6_net_exit,
 };
-#endif
 
 int __init xfrm6_init(void)
 {
         int ret;
 
-        dst_entries_init(&xfrm6_dst_ops);
-
         ret = xfrm6_policy_init();
-        if (ret) {
-                dst_entries_destroy(&xfrm6_dst_ops);
+        if (ret)
                 goto out;
-        }
         ret = xfrm6_state_init();
         if (ret)
                 goto out_policy;
@@ -391,9 +419,7 @@ int __init xfrm6_init(void)
         if (ret)
                 goto out_state;
 
-#ifdef CONFIG_SYSCTL
         register_pernet_subsys(&xfrm6_net_ops);
-#endif
 out:
         return ret;
 out_state:
@@ -405,11 +431,8 @@ out_policy:
 
 void xfrm6_fini(void)
 {
-#ifdef CONFIG_SYSCTL
         unregister_pernet_subsys(&xfrm6_net_ops);
-#endif
         xfrm6_protocol_fini();
         xfrm6_policy_fini();
         xfrm6_state_fini();
-        dst_entries_destroy(&xfrm6_dst_ops);
 }
diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index 7b9c053ba750..edb3502f2016 100644
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -94,7 +94,7 @@ nft_do_chain_netdev(void *priv, struct sk_buff *skb,
 {
         struct nft_pktinfo pkt;
 
-        switch (eth_hdr(skb)->h_proto) {
+        switch (skb->protocol) {
         case htons(ETH_P_IP):
                 nft_netdev_set_pktinfo_ipv4(&pkt, skb, state);
                 break;
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 8cbca3432f90..939921532764 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -366,6 +366,7 @@ static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
                 goto nla_put_failure;
 
         switch (priv->key) {
+        case NFT_CT_L3PROTOCOL:
         case NFT_CT_PROTOCOL:
         case NFT_CT_SRC:
         case NFT_CT_DST:
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 3e8892216f94..e004067ec24a 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -698,6 +698,10 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
                 OVS_NLERR(log, "Failed to allocate conntrack template");
                 return -ENOMEM;
         }
+
+        __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
+        nf_conntrack_get(&ct_info.ct->ct_general);
+
         if (helper) {
                 err = ovs_ct_add_helper(&ct_info, helper, key, log);
                 if (err)
@@ -709,8 +713,6 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
         if (err)
                 goto err_free_ct;
 
-        __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
-        nf_conntrack_get(&ct_info.ct->ct_general);
         return 0;
 err_free_ct:
         __ovs_ct_free_action(&ct_info);
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 907d6fd28ede..d1bd4a45ca2d 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2434,7 +2434,10 @@ static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
                 if (!start)
                         return -EMSGSIZE;
 
-                err = ovs_nla_put_tunnel_info(skb, tun_info);
+                err =  ip_tun_to_nlattr(skb, &tun_info->key,
+                                        ip_tunnel_info_opts(tun_info),
+                                        tun_info->options_len,
+                                        ip_tunnel_info_af(tun_info));
                 if (err)
                         return err;
                 nla_nest_end(skb, start);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index cd34a4a34065..22c2bf367d7e 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4829,7 +4829,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
 
         retval = SCTP_DISPOSITION_CONSUME;
 
-        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        if (abort)
+                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
 
         /* Even if we can't send the ABORT due to low memory delete the
          * TCB.  This is a departure from our typical NOMEM handling.
@@ -4966,7 +4967,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
         retval = SCTP_DISPOSITION_CONSUME;
 
-        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        if (abort)
+                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
 
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9b6cc6de80d8..ef1d90fdc773 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1301,8 +1301,9 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
                                       int addrs_size,
                                       sctp_assoc_t *assoc_id)
 {
-        int err = 0;
         struct sockaddr *kaddrs;
+        gfp_t gfp = GFP_KERNEL;
+        int err = 0;
 
         pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
                  __func__, sk, addrs, addrs_size);
@@ -1315,7 +1316,9 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
                 return -EFAULT;
 
         /* Alloc space for the address array in kernel memory.  */
-        kaddrs = kmalloc(addrs_size, GFP_KERNEL);
+        if (sk->sk_socket->file)
+                gfp = GFP_USER | __GFP_NOWARN;
+        kaddrs = kmalloc(addrs_size, gfp);
         if (unlikely(!kaddrs))
                 return -ENOMEM;
 
@@ -1513,8 +1516,7 @@ static void sctp_close(struct sock *sk, long timeout)
                         struct sctp_chunk *chunk;
 
                         chunk = sctp_make_abort_user(asoc, NULL, 0);
-                        if (chunk)
-                                sctp_primitive_ABORT(net, asoc, chunk);
+                        sctp_primitive_ABORT(net, asoc, chunk);
                 } else
                         sctp_primitive_SHUTDOWN(net, asoc, NULL);
         }
@@ -5773,7 +5775,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
 
         len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
 
-        ids = kmalloc(len, GFP_KERNEL);
+        ids = kmalloc(len, GFP_USER | __GFP_NOWARN);
         if (unlikely(!ids))
                 return -ENOMEM;
 
@@ -7199,6 +7201,8 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
 
         if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
                 net_enable_timestamp();
+
+        security_sk_clone(sk, newsk);
 }
 
 static inline void sctp_copy_descendant(struct sock *sk_to,
diff --git a/net/socket.c b/net/socket.c
index 29822d6dd91e..d730ef9dfbf0 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -257,6 +257,7 @@ static struct inode *sock_alloc_inode(struct super_block *sb)
         }
         init_waitqueue_head(&wq->wait);
         wq->fasync_list = NULL;
+        wq->flags = 0;
         RCU_INIT_POINTER(ei->socket.wq, wq);
 
         ei->socket.state = SS_UNCONNECTED;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 948fa5560de5..b5e665b3cfb0 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2826,7 +2826,6 @@ static struct neighbour *xfrm_neigh_lookup(const struct dst_entry *dst,
 
 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
 {
-        struct net *net;
         int err = 0;
         if (unlikely(afinfo == NULL))
                 return -EINVAL;
@@ -2857,26 +2856,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
         }
         spin_unlock(&xfrm_policy_afinfo_lock);
 
-        rtnl_lock();
-        for_each_net(net) {
-                struct dst_ops *xfrm_dst_ops;
-
-                switch (afinfo->family) {
-                case AF_INET:
-                        xfrm_dst_ops = &net->xfrm.xfrm4_dst_ops;
-                        break;
-#if IS_ENABLED(CONFIG_IPV6)
-                case AF_INET6:
-                        xfrm_dst_ops = &net->xfrm.xfrm6_dst_ops;
-                        break;
-#endif
-                default:
-                        BUG();
-                }
-                *xfrm_dst_ops = *afinfo->dst_ops;
-        }
-        rtnl_unlock();
-
         return err;
 }
 EXPORT_SYMBOL(xfrm_policy_register_afinfo);
@@ -2912,22 +2891,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
 }
 EXPORT_SYMBOL(xfrm_policy_unregister_afinfo);
 
-static void __net_init xfrm_dst_ops_init(struct net *net)
-{
-        struct xfrm_policy_afinfo *afinfo;
-
-        rcu_read_lock();
-        afinfo = rcu_dereference(xfrm_policy_afinfo[AF_INET]);
-        if (afinfo)
-                net->xfrm.xfrm4_dst_ops = *afinfo->dst_ops;
-#if IS_ENABLED(CONFIG_IPV6)
-        afinfo = rcu_dereference(xfrm_policy_afinfo[AF_INET6]);
-        if (afinfo)
-                net->xfrm.xfrm6_dst_ops = *afinfo->dst_ops;
-#endif
-        rcu_read_unlock();
-}
-
 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
@@ -3076,7 +3039,6 @@ static int __net_init xfrm_net_init(struct net *net)
         rv = xfrm_policy_init(net);
         if (rv < 0)
                 goto out_policy;
-        xfrm_dst_ops_init(net);
         rv = xfrm_sysctl_init(net);
         if (rv < 0)
                 goto out_sysctl;
diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 698768bdc581..301d70b0174f 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -48,12 +48,17 @@
 
 static int fd_map;      /* File descriptor for file being modified. */
 static int mmap_failed; /* Boolean flag. */
-static void *ehdr_curr; /* current ElfXX_Ehdr *  for resource cleanup */
 static char gpfx;       /* prefix for global symbol name (sometimes '_') */
 static struct stat sb;  /* Remember .st_size, etc. */
 static jmp_buf jmpenv;  /* setjmp/longjmp per-file error escape */
 static const char *altmcount;   /* alternate mcount symbol name */
 static int warn_on_notrace_sect; /* warn when section has mcount not being recorded */
+static void *file_map;  /* pointer of the mapped file */
+static void *file_end;  /* pointer to the end of the mapped file */
+static int file_updated; /* flag to state file was changed */
+static void *file_ptr;  /* current file pointer location */
+static void *file_append; /* added to the end of the file */
+static size_t file_append_size; /* how much is added to end of file */
 
 /* setjmp() return values */
 enum {
@@ -67,10 +72,14 @@ static void
 cleanup(void)
 {
         if (!mmap_failed)
-                munmap(ehdr_curr, sb.st_size);
+                munmap(file_map, sb.st_size);
         else
-                free(ehdr_curr);
-        close(fd_map);
+                free(file_map);
+        file_map = NULL;
+        free(file_append);
+        file_append = NULL;
+        file_append_size = 0;
+        file_updated = 0;
 }
 
 static void __attribute__((noreturn))
@@ -92,12 +101,22 @@ succeed_file(void)
 static off_t
 ulseek(int const fd, off_t const offset, int const whence)
 {
-        off_t const w = lseek(fd, offset, whence);
-        if (w == (off_t)-1) {
-                perror("lseek");
+        switch (whence) {
+        case SEEK_SET:
+                file_ptr = file_map + offset;
+                break;
+        case SEEK_CUR:
+                file_ptr += offset;
+                break;
+        case SEEK_END:
+                file_ptr = file_map + (sb.st_size - offset);
+                break;
+        }
+        if (file_ptr < file_map) {
+                fprintf(stderr, "lseek: seek before file\n");
                 fail_file();
         }
-        return w;
+        return file_ptr - file_map;
 }
 
 static size_t
@@ -114,12 +133,38 @@ uread(int const fd, void *const buf, size_t const count)
 static size_t
 uwrite(int const fd, void const *const buf, size_t const count)
 {
-        size_t const n = write(fd, buf, count);
-        if (n != count) {
-                perror("write");
-                fail_file();
+        size_t cnt = count;
+        off_t idx = 0;
+
+        file_updated = 1;
+
+        if (file_ptr + count >= file_end) {
+                off_t aoffset = (file_ptr + count) - file_end;
+
+                if (aoffset > file_append_size) {
+                        file_append = realloc(file_append, aoffset);
+                        file_append_size = aoffset;
+                }
+                if (!file_append) {
+                        perror("write");
+                        fail_file();
+                }
+                if (file_ptr < file_end) {
+                        cnt = file_end - file_ptr;
+                } else {
+                        cnt = 0;
+                        idx = aoffset - count;
+                }
         }
-        return n;
+
+        if (cnt)
+                memcpy(file_ptr, buf, cnt);
+
+        if (cnt < count)
+                memcpy(file_append + idx, buf + cnt, count - cnt);
+
+        file_ptr += count;
+        return count;
 }
 
 static void *
@@ -192,9 +237,7 @@ static int make_nop_arm64(void *map, size_t const offset)
  */
 static void *mmap_file(char const *fname)
 {
-        void *addr;
-
-        fd_map = open(fname, O_RDWR);
+        fd_map = open(fname, O_RDONLY);
         if (fd_map < 0 || fstat(fd_map, &sb) < 0) {
                 perror(fname);
                 fail_file();
@@ -203,15 +246,58 @@ static void *mmap_file(char const *fname)
                 fprintf(stderr, "not a regular file: %s\n", fname);
                 fail_file();
         }
-        addr = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
-                    fd_map, 0);
+        file_map = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
+                        fd_map, 0);
         mmap_failed = 0;
-        if (addr == MAP_FAILED) {
+        if (file_map == MAP_FAILED) {
                 mmap_failed = 1;
-                addr = umalloc(sb.st_size);
-                uread(fd_map, addr, sb.st_size);
+                file_map = umalloc(sb.st_size);
+                uread(fd_map, file_map, sb.st_size);
+        }
+        close(fd_map);
+
+        file_end = file_map + sb.st_size;
+
+        return file_map;
+}
+
+static void write_file(const char *fname)
+{
+        char tmp_file[strlen(fname) + 4];
+        size_t n;
+
+        if (!file_updated)
+                return;
+
+        sprintf(tmp_file, "%s.rc", fname);
+
+        /*
+         * After reading the entire file into memory, delete it
+         * and write it back, to prevent weird side effects of modifying
+         * an object file in place.
+         */
+        fd_map = open(tmp_file, O_WRONLY | O_TRUNC | O_CREAT, sb.st_mode);
+        if (fd_map < 0) {
+                perror(fname);
+                fail_file();
+        }
+        n = write(fd_map, file_map, sb.st_size);
+        if (n != sb.st_size) {
+                perror("write");
+                fail_file();
+        }
+        if (file_append_size) {
+                n = write(fd_map, file_append, file_append_size);
+                if (n != file_append_size) {
+                        perror("write");
+                        fail_file();
+                }
+        }
+        close(fd_map);
+        if (rename(tmp_file, fname) < 0) {
+                perror(fname);
+                fail_file();
         }
-        return addr;
 }
 
 /* w8rev, w8nat, ...: Handle endianness. */
@@ -318,7 +404,6 @@ do_file(char const *const fname)
         Elf32_Ehdr *const ehdr = mmap_file(fname);
         unsigned int reltype = 0;
 
-        ehdr_curr = ehdr;
         w = w4nat;
         w2 = w2nat;
         w8 = w8nat;
@@ -441,6 +526,7 @@ do_file(char const *const fname)
         }
         }  /* end switch */
 
+        write_file(fname);
         cleanup();
 }
 
@@ -493,11 +579,14 @@ main(int argc, char *argv[])
                 case SJ_SETJMP:    /* normal sequence */
                         /* Avoid problems if early cleanup() */
                         fd_map = -1;
-                        ehdr_curr = NULL;
                         mmap_failed = 1;
+                        file_map = NULL;
+                        file_ptr = NULL;
+                        file_updated = 0;
                         do_file(file);
                         break;
                 case SJ_FAIL:    /* error in do_file or below */
+                        sprintf("%s: failed\n", file);
                         ++n_error;
                         break;
                 case SJ_SUCCEED:    /* premature success */
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index fb111eafcb89..1c3872aeed14 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -751,16 +751,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 
         /* the key is probably readable - now try to read it */
 can_read_key:
-        ret = key_validate(key);
-        if (ret == 0) {
-                ret = -EOPNOTSUPP;
-                if (key->type->read) {
-                        /* read the data with the semaphore held (since we
-                         * might sleep) */
-                        down_read(&key->sem);
+        ret = -EOPNOTSUPP;
+        if (key->type->read) {
+                /* Read the data with the semaphore held (since we might sleep)
+                 * to protect against the key being updated or revoked.
+                 */
+                down_read(&key->sem);
+                ret = key_validate(key);
+                if (ret == 0)
                         ret = key->type->read(key, buffer, buflen);
-                        up_read(&key->sem);
-                }
+                up_read(&key->sem);
         }
 
 error2:
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index b3ea24d64c50..93b400800905 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -1537,7 +1537,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream,
         bool reconfig;
         unsigned int aif_tx_state, aif_rx_state;
 
-        if (params_rate(params) % 8000)
+        if (params_rate(params) % 4000)
                 rates = &arizona_44k1_bclk_rates[0];
         else
                 rates = &arizona_48k_bclk_rates[0];
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index ef76940f9dcb..3e3c7f6be29d 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -1667,9 +1667,13 @@ static int rt5645_spk_event(struct snd_soc_dapm_widget *w,
                         RT5645_PWR_CLS_D_L,
                         RT5645_PWR_CLS_D | RT5645_PWR_CLS_D_R |
                         RT5645_PWR_CLS_D_L);
+                snd_soc_update_bits(codec, RT5645_GEN_CTRL3,
+                        RT5645_DET_CLK_MASK, RT5645_DET_CLK_MODE1);
                 break;
 
         case SND_SOC_DAPM_PRE_PMD:
+                snd_soc_update_bits(codec, RT5645_GEN_CTRL3,
+                        RT5645_DET_CLK_MASK, RT5645_DET_CLK_DIS);
                 snd_soc_write(codec, RT5645_EQ_CTRL2, 0);
                 snd_soc_update_bits(codec, RT5645_PWR_DIG1,
                         RT5645_PWR_CLS_D | RT5645_PWR_CLS_D_R |
diff --git a/sound/soc/codecs/rt5645.h b/sound/soc/codecs/rt5645.h
index 093e46d559fb..205e0715c99a 100644
--- a/sound/soc/codecs/rt5645.h
+++ b/sound/soc/codecs/rt5645.h
@@ -2122,6 +2122,10 @@ enum {
 /* General Control3 (0xfc) */
 #define RT5645_JD_PSV_MODE                      (0x1 << 12)
 #define RT5645_IRQ_CLK_GATE_CTRL                (0x1 << 11)
+#define RT5645_DET_CLK_MASK                     (0x3 << 9)
+#define RT5645_DET_CLK_DIS                      (0x0 << 9)
+#define RT5645_DET_CLK_MODE1                    (0x1 << 9)
+#define RT5645_DET_CLK_MODE2                    (0x2 << 9)
 #define RT5645_MICINDET_MANU                    (0x1 << 7)
 #define RT5645_RING2_SLEEVE_GND                 (0x1 << 5)
 
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index ffea427aeca8..ad4d0f82603e 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -1240,7 +1240,6 @@ int skl_tplg_init(struct snd_soc_platform *platform, struct hdac_ext_bus *ebus)
          */
         ret = snd_soc_tplg_component_load(&platform->component,
                                         &skl_tplg_ops, fw, 0);
-        release_firmware(fw);
         if (ret < 0) {
                 dev_err(bus->dev, "tplg component load failed%d\n", ret);
                 return -EINVAL;
@@ -1249,5 +1248,7 @@ int skl_tplg_init(struct snd_soc_platform *platform, struct hdac_ext_bus *ebus)
         skl->resource.max_mcps = SKL_MAX_MCPS;
         skl->resource.max_mem = SKL_FW_MAX_MEM;
 
+        skl->tplg = fw;
+
         return 0;
 }
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 5319529aedf7..caa69c4598a6 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -25,6 +25,7 @@
 #include <linux/pci.h>
 #include <linux/pm_runtime.h>
 #include <linux/platform_device.h>
+#include <linux/firmware.h>
 #include <sound/pcm.h>
 #include "skl.h"
 
@@ -520,6 +521,9 @@ static void skl_remove(struct pci_dev *pci)
         struct hdac_ext_bus *ebus = pci_get_drvdata(pci);
         struct skl *skl = ebus_to_skl(ebus);
 
+        if (skl->tplg)
+                release_firmware(skl->tplg);
+
         if (pci_dev_run_wake(pci))
                 pm_runtime_get_noresume(&pci->dev);
         pci_dev_put(pci);
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index dd2e79ae45a8..a0709e344d44 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -68,6 +68,8 @@ struct skl {
         struct skl_dsp_resource resource;
         struct list_head ppl_list;
         struct list_head dapm_path_list;
+
+        const struct firmware *tplg;
 };
 
 #define skl_to_ebus(s)  (&(s)->ebus)
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 65461f821a75..7a2f449bd85d 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1114,7 +1114,7 @@ bool kvm_vgic_map_is_active(struct kvm_vcpu *vcpu, struct irq_phys_map *map)
                         return true;
         }
 
-        return dist_active_irq(vcpu);
+        return vgic_irq_is_active(vcpu, map->virt_irq);
 }
 
 /*