Merge branch 'linus' into x86/mm

Make sure to get the latest fixes before applying the ptdump enhancements.

389 files changed, 3340 insertions, 1994 deletions

diff --git a/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
index 0dcb7c7d3e40..944657684d73 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/snps,archs-idu-intc.txt
@@ -15,6 +15,9 @@ Properties:
   Second cell specifies the irq distribution mode to cores
      0=Round Robin; 1=cpu0, 2=cpu1, 4=cpu2, 8=cpu3
 
+  The second cell in interrupts property is deprecated and may be ignored by
+  the kernel.
+
   intc accessed via the special ARC AUX register interface, hence "reg" property
   is not specified.
 
diff --git a/Documentation/media/uapi/cec/cec-func-close.rst b/Documentation/media/uapi/cec/cec-func-close.rst
index 8267c31b317d..895d9c2d1c04 100644
--- a/Documentation/media/uapi/cec/cec-func-close.rst
+++ b/Documentation/media/uapi/cec/cec-func-close.rst
@@ -33,11 +33,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 Closes the cec device. Resources associated with the file descriptor are
 freed. The device configuration remain unchanged.
 
diff --git a/Documentation/media/uapi/cec/cec-func-ioctl.rst b/Documentation/media/uapi/cec/cec-func-ioctl.rst
index 9e8dbb118d6a..7dcfd178fb24 100644
--- a/Documentation/media/uapi/cec/cec-func-ioctl.rst
+++ b/Documentation/media/uapi/cec/cec-func-ioctl.rst
@@ -39,11 +39,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 The :c:func:`ioctl()` function manipulates cec device parameters. The
 argument ``fd`` must be an open file descriptor.
 
diff --git a/Documentation/media/uapi/cec/cec-func-open.rst b/Documentation/media/uapi/cec/cec-func-open.rst
index af3f5b5c24c6..0304388cd159 100644
--- a/Documentation/media/uapi/cec/cec-func-open.rst
+++ b/Documentation/media/uapi/cec/cec-func-open.rst
@@ -46,11 +46,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To open a cec device applications call :c:func:`open()` with the
 desired device name. The function has no side effects; the device
 configuration remain unchanged.
diff --git a/Documentation/media/uapi/cec/cec-func-poll.rst b/Documentation/media/uapi/cec/cec-func-poll.rst
index cfb73e6027a5..6a863cfda6e0 100644
--- a/Documentation/media/uapi/cec/cec-func-poll.rst
+++ b/Documentation/media/uapi/cec/cec-func-poll.rst
@@ -39,11 +39,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 With the :c:func:`poll()` function applications can wait for CEC
 events.
 
diff --git a/Documentation/media/uapi/cec/cec-intro.rst b/Documentation/media/uapi/cec/cec-intro.rst
index 4a19ea5323a9..07ee2b8f89d6 100644
--- a/Documentation/media/uapi/cec/cec-intro.rst
+++ b/Documentation/media/uapi/cec/cec-intro.rst
@@ -3,11 +3,6 @@
 Introduction
 ============
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 HDMI connectors provide a single pin for use by the Consumer Electronics
 Control protocol. This protocol allows different devices connected by an
 HDMI cable to communicate. The protocol for CEC version 1.4 is defined
@@ -31,3 +26,15 @@ control just the CEC pin.
 Drivers that support CEC will create a CEC device node (/dev/cecX) to
 give userspace access to the CEC adapter. The
 :ref:`CEC_ADAP_G_CAPS` ioctl will tell userspace what it is allowed to do.
+
+In order to check the support and test it, it is suggested to download
+the `v4l-utils <https://git.linuxtv.org/v4l-utils.git/>`_ package. It
+provides three tools to handle CEC:
+
+- cec-ctl: the Swiss army knife of CEC. Allows you to configure, transmit
+  and monitor CEC messages.
+
+- cec-compliance: does a CEC compliance test of a remote CEC device to
+  determine how compliant the CEC implementation is.
+
+- cec-follower: emulates a CEC follower.
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst
index 2b0ddb14b280..a0e961f11017 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-caps.rst
@@ -29,11 +29,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 All cec devices must support :ref:`ioctl CEC_ADAP_G_CAPS <CEC_ADAP_G_CAPS>`. To query
 device information, applications call the ioctl with a pointer to a
 struct :c:type:`cec_caps`. The driver fills the structure and
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
index b878637e91b3..09f09bbe28d4 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
@@ -35,11 +35,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To query the current CEC logical addresses, applications call
 :ref:`ioctl CEC_ADAP_G_LOG_ADDRS <CEC_ADAP_G_LOG_ADDRS>` with a pointer to a
 struct :c:type:`cec_log_addrs` where the driver stores the logical addresses.
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst
index 3357deb43c85..a3cdc75cec3e 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-phys-addr.rst
@@ -35,11 +35,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To query the current physical address applications call
 :ref:`ioctl CEC_ADAP_G_PHYS_ADDR <CEC_ADAP_G_PHYS_ADDR>` with a pointer to a __u16 where the
 driver stores the physical address.
diff --git a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
index e256c6605de7..6e589a1fae17 100644
--- a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
@@ -30,11 +30,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 CEC devices can send asynchronous events. These can be retrieved by
 calling :c:func:`CEC_DQEVENT`. If the file descriptor is in
 non-blocking mode and no event is pending, then it will return -1 and
diff --git a/Documentation/media/uapi/cec/cec-ioc-g-mode.rst b/Documentation/media/uapi/cec/cec-ioc-g-mode.rst
index 4f5818b9d277..e4ded9df0a84 100644
--- a/Documentation/media/uapi/cec/cec-ioc-g-mode.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-g-mode.rst
@@ -31,11 +31,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 By default any filehandle can use :ref:`CEC_TRANSMIT`, but in order to prevent
 applications from stepping on each others toes it must be possible to
 obtain exclusive access to the CEC adapter. This ioctl sets the
diff --git a/Documentation/media/uapi/cec/cec-ioc-receive.rst b/Documentation/media/uapi/cec/cec-ioc-receive.rst
index bdf015b1d1dc..dc2adb391c0a 100644
--- a/Documentation/media/uapi/cec/cec-ioc-receive.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst
@@ -34,11 +34,6 @@ Arguments
 Description
 ===========
 
-.. note::
-
-   This documents the proposed CEC API. This API is not yet finalized
-   and is currently only available as a staging kernel module.
-
 To receive a CEC message the application has to fill in the
 ``timeout`` field of struct :c:type:`cec_msg` and pass it to
 :ref:`ioctl CEC_RECEIVE <CEC_RECEIVE>`.
diff --git a/MAINTAINERS b/MAINTAINERS
index 5f10c28b2e15..107c10e8f2d2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1091,7 +1091,7 @@ F:	arch/arm/boot/dts/aspeed-*
 F:      drivers/*/*aspeed*
 
 ARM/ATMEL AT91RM9200, AT91SAM9 AND SAMA5 SOC SUPPORT
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 M:      Alexandre Belloni <alexandre.belloni@free-electrons.com>
 M:      Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1773,7 +1773,7 @@ F:	drivers/soc/renesas/
 F:      include/linux/soc/renesas/
 
 ARM/SOCFPGA ARCHITECTURE
-M:      Dinh Nguyen <dinguyen@opensource.altera.com>
+M:      Dinh Nguyen <dinguyen@kernel.org>
 S:      Maintained
 F:      arch/arm/mach-socfpga/
 F:      arch/arm/boot/dts/socfpga*
@@ -1783,7 +1783,7 @@ W:	http://www.rocketboards.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux.git
 
 ARM/SOCFPGA CLOCK FRAMEWORK SUPPORT
-M:      Dinh Nguyen <dinguyen@opensource.altera.com>
+M:      Dinh Nguyen <dinguyen@kernel.org>
 S:      Maintained
 F:      drivers/clk/socfpga/
 
@@ -2175,56 +2175,56 @@ F:	include/linux/atm*
 F:      include/uapi/linux/atm*
 
 ATMEL AT91 / AT32 MCI DRIVER
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 S:      Maintained
 F:      drivers/mmc/host/atmel-mci.c
 
 ATMEL AT91 SAMA5D2-Compatible Shutdown Controller
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 S:      Supported
 F:      drivers/power/reset/at91-sama5d2_shdwc.c
 
 ATMEL SAMA5D2 ADC DRIVER
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-iio@vger.kernel.org
 S:      Supported
 F:      drivers/iio/adc/at91-sama5d2_adc.c
 
 ATMEL Audio ALSA driver
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/atmel
 
 ATMEL XDMA DRIVER
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-arm-kernel@lists.infradead.org
 L:      dmaengine@vger.kernel.org
 S:      Supported
 F:      drivers/dma/at_xdmac.c
 
 ATMEL I2C DRIVER
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-i2c@vger.kernel.org
 S:      Supported
 F:      drivers/i2c/busses/i2c-at91.c
 
 ATMEL ISI DRIVER
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-media@vger.kernel.org
 S:      Supported
 F:      drivers/media/platform/soc_camera/atmel-isi.c
 F:      include/media/atmel-isi.h
 
 ATMEL LCDFB DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/fbdev/atmel_lcdfb.c
 F:      include/video/atmel_lcdc.h
 
 ATMEL MACB ETHERNET DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 S:      Supported
 F:      drivers/net/ethernet/cadence/
 
@@ -2236,32 +2236,32 @@ S:	Supported
 F:      drivers/mtd/nand/atmel_nand*
 
 ATMEL SDMMC DRIVER
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-mmc@vger.kernel.org
 S:      Supported
 F:      drivers/mmc/host/sdhci-of-at91.c
 
 ATMEL SPI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 S:      Supported
 F:      drivers/spi/spi-atmel.*
 
 ATMEL SSC DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/misc/atmel-ssc.c
 F:      include/linux/atmel-ssc.h
 
 ATMEL Timer Counter (TC) AND CLOCKSOURCE DRIVERS
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/misc/atmel_tclib.c
 F:      drivers/clocksource/tcb_clksrc.c
 
 ATMEL USBA UDC DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/usb/gadget/udc/atmel_usba_udc.*
@@ -9736,7 +9736,7 @@ S:	Maintained
 F:      drivers/pinctrl/pinctrl-at91.*
 
 PIN CONTROLLER - ATMEL AT91 PIO4
-M:      Ludovic Desroches <ludovic.desroches@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-gpio@vger.kernel.org
 S:      Supported
@@ -10195,7 +10195,6 @@ F:	drivers/media/tuners/qt1010*
 QUALCOMM ATHEROS ATH9K WIRELESS DRIVER
 M:      QCA ath9k Development <ath9k-devel@qca.qualcomm.com>
 L:      linux-wireless@vger.kernel.org
-L:      ath9k-devel@lists.ath9k.org
 W:      http://wireless.kernel.org/en/users/Drivers/ath9k
 S:      Supported
 F:      drivers/net/wireless/ath/ath9k/
@@ -13066,7 +13065,7 @@ F:	drivers/input/serio/userio.c
 F:      include/uapi/linux/userio.h
 
 VIRTIO CONSOLE DRIVER
-M:      Amit Shah <amit.shah@redhat.com>
+M:      Amit Shah <amit@kernel.org>
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      drivers/char/virtio_console.c
diff --git a/Makefile b/Makefile
index 098840012b9b..503dae1de8ef 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 4
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
-NAME = Anniversary Edition
+EXTRAVERSION = -rc8
+NAME = Fearless Coyote
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
@@ -797,7 +797,7 @@ KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
 KBUILD_ARFLAGS := $(call ar-option,D)
 
 # check for 'asm goto'
-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y)
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
         KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
         KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
 endif
diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
index a36e8601114d..d5da2115d78a 100644
--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -26,7 +26,9 @@ static inline void __delay(unsigned long loops)
         "       lp  1f                  \n"
         "       nop                     \n"
         "1:                             \n"
-        : : "r"(loops));
+        :
+        : "r"(loops)
+        : "lp_count");
 }
 
 extern void __bad_udelay(void);
diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
index 689dd867fdff..8b90d25a15cc 100644
--- a/arch/arc/kernel/head.S
+++ b/arch/arc/kernel/head.S
@@ -71,14 +71,14 @@ ENTRY(stext)
         GET_CPU_ID  r5
         cmp     r5, 0
         mov.nz  r0, r5
-#ifdef CONFIG_ARC_SMP_HALT_ON_RESET
-        ; Non-Master can proceed as system would be booted sufficiently
-        jnz     first_lines_of_secondary
-#else
+        bz      .Lmaster_proceed
+
         ; Non-Masters wait for Master to boot enough and bring them up
-        jnz     arc_platform_smp_wait_to_boot
-#endif
-        ; Master falls thru
+        ; when they resume, tail-call to entry point
+        mov     blink, @first_lines_of_secondary
+        j       arc_platform_smp_wait_to_boot
+
+.Lmaster_proceed:
 #endif
 
         ; Clear BSS before updating any globals
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 9274f8ade8c7..9f6b68fd4f3b 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -93,11 +93,10 @@ static void mcip_probe_n_setup(void)
         READ_BCR(ARC_REG_MCIP_BCR, mp);
 
         sprintf(smp_cpuinfo_buf,
-                "Extn [SMP]\t: ARConnect (v%d): %d cores with %s%s%s%s%s\n",
+                "Extn [SMP]\t: ARConnect (v%d): %d cores with %s%s%s%s\n",
                 mp.ver, mp.num_cores,
                 IS_AVAIL1(mp.ipi, "IPI "),
                 IS_AVAIL1(mp.idu, "IDU "),
-                IS_AVAIL1(mp.llm, "LLM "),
                 IS_AVAIL1(mp.dbg, "DEBUG "),
                 IS_AVAIL1(mp.gfrc, "GFRC"));
 
@@ -175,7 +174,6 @@ static void idu_irq_unmask(struct irq_data *data)
         raw_spin_unlock_irqrestore(&mcip_lock, flags);
 }
 
-#ifdef CONFIG_SMP
 static int
 idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
                      bool force)
@@ -205,12 +203,27 @@ idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
 
         return IRQ_SET_MASK_OK;
 }
-#endif
+
+static void idu_irq_enable(struct irq_data *data)
+{
+        /*
+         * By default send all common interrupts to all available online CPUs.
+         * The affinity of common interrupts in IDU must be set manually since
+         * in some cases the kernel will not call irq_set_affinity() by itself:
+         *   1. When the kernel is not configured with support of SMP.
+         *   2. When the kernel is configured with support of SMP but upper
+         *      interrupt controllers does not support setting of the affinity
+         *      and cannot propagate it to IDU.
+         */
+        idu_irq_set_affinity(data, cpu_online_mask, false);
+        idu_irq_unmask(data);
+}
 
 static struct irq_chip idu_irq_chip = {
         .name                   = "MCIP IDU Intc",
         .irq_mask               = idu_irq_mask,
         .irq_unmask             = idu_irq_unmask,
+        .irq_enable             = idu_irq_enable,
 #ifdef CONFIG_SMP
         .irq_set_affinity       = idu_irq_set_affinity,
 #endif
@@ -243,36 +256,14 @@ static int idu_irq_xlate(struct irq_domain *d, struct device_node *n,
                          const u32 *intspec, unsigned int intsize,
                          irq_hw_number_t *out_hwirq, unsigned int *out_type)
 {
-        irq_hw_number_t hwirq = *out_hwirq = intspec[0];
-        int distri = intspec[1];
-        unsigned long flags;
-
+        /*
+         * Ignore value of interrupt distribution mode for common interrupts in
+         * IDU which resides in intspec[1] since setting an affinity using value
+         * from Device Tree is deprecated in ARC.
+         */
+        *out_hwirq = intspec[0];
         *out_type = IRQ_TYPE_NONE;
 
-        /* XXX: validate distribution scheme again online cpu mask */
-        if (distri == 0) {
-                /* 0 - Round Robin to all cpus, otherwise 1 bit per core */
-                raw_spin_lock_irqsave(&mcip_lock, flags);
-                idu_set_dest(hwirq, BIT(num_online_cpus()) - 1);
-                idu_set_mode(hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_RR);
-                raw_spin_unlock_irqrestore(&mcip_lock, flags);
-        } else {
-                /*
-                 * DEST based distribution for Level Triggered intr can only
-                 * have 1 CPU, so generalize it to always contain 1 cpu
-                 */
-                int cpu = ffs(distri);
-
-                if (cpu != fls(distri))
-                        pr_warn("IDU irq %lx distri mode set to cpu %x\n",
-                                hwirq, cpu);
-
-                raw_spin_lock_irqsave(&mcip_lock, flags);
-                idu_set_dest(hwirq, cpu);
-                idu_set_mode(hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_DEST);
-                raw_spin_unlock_irqrestore(&mcip_lock, flags);
-        }
-
         return 0;
 }
 
diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c
index 88674d972c9d..2afbafadb6ab 100644
--- a/arch/arc/kernel/smp.c
+++ b/arch/arc/kernel/smp.c
@@ -90,22 +90,37 @@ void __init smp_cpus_done(unsigned int max_cpus)
  */
 static volatile int wake_flag;
 
+#ifdef CONFIG_ISA_ARCOMPACT
+
+#define __boot_read(f)          f
+#define __boot_write(f, v)      f = v
+
+#else
+
+#define __boot_read(f)          arc_read_uncached_32(&f)
+#define __boot_write(f, v)      arc_write_uncached_32(&f, v)
+
+#endif
+
 static void arc_default_smp_cpu_kick(int cpu, unsigned long pc)
 {
         BUG_ON(cpu == 0);
-        wake_flag = cpu;
+
+        __boot_write(wake_flag, cpu);
 }
 
 void arc_platform_smp_wait_to_boot(int cpu)
 {
-        while (wake_flag != cpu)
+        /* for halt-on-reset, we've waited already */
+        if (IS_ENABLED(CONFIG_ARC_SMP_HALT_ON_RESET))
+                return;
+
+        while (__boot_read(wake_flag) != cpu)
                 ;
 
-        wake_flag = 0;
-        __asm__ __volatile__("j @first_lines_of_secondary       \n");
+        __boot_write(wake_flag, 0);
 }
 
-
 const char *arc_platform_smp_cpuinfo(void)
 {
         return plat_smp_ops.info ? : "";
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index abd961f3e763..5f69c3bd59bb 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -241,8 +241,9 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
         if (state.fault)
                 goto fault;
 
+        /* clear any remanants of delay slot */
         if (delay_mode(regs)) {
-                regs->ret = regs->bta;
+                regs->ret = regs->bta & ~1U;
                 regs->status32 &= ~STATUS_DE_MASK;
         } else {
                 regs->ret += state.instr_len;
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index f10fe8526239..01d178a2009f 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -617,7 +617,7 @@ dtb-$(CONFIG_ARCH_ORION5X) += \
         orion5x-lacie-ethernet-disk-mini-v2.dtb \
         orion5x-linkstation-lsgl.dtb \
         orion5x-linkstation-lswtgl.dtb \
-        orion5x-lschl.dtb \
+        orion5x-linkstation-lschl.dtb \
         orion5x-lswsgl.dtb \
         orion5x-maxtor-shared-storage-2.dtb \
         orion5x-netgear-wnr854t.dtb \
diff --git a/arch/arm/boot/dts/imx1.dtsi b/arch/arm/boot/dts/imx1.dtsi
index b792eee3899b..2ee40bc9ec21 100644
--- a/arch/arm/boot/dts/imx1.dtsi
+++ b/arch/arm/boot/dts/imx1.dtsi
@@ -18,6 +18,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 gpio0 = &gpio1;
diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index ac2a9da62b6c..43ccbbf754a3 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -16,6 +16,14 @@
         #size-cells = <1>;
 
         interrupt-parent = <&icoll>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 gpio0 = &gpio0;
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index 831d09a28155..acd475659156 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -14,6 +14,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index 9d8b5969ee3b..b397384248f4 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -19,6 +19,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
index 3aabf65a6a52..d6a2190b60ef 100644
--- a/arch/arm/boot/dts/imx28.dtsi
+++ b/arch/arm/boot/dts/imx28.dtsi
@@ -17,6 +17,14 @@
         #size-cells = <1>;
 
         interrupt-parent = <&icoll>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &mac0;
diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
index 85cd8be22f71..23b0d2cf9acd 100644
--- a/arch/arm/boot/dts/imx31.dtsi
+++ b/arch/arm/boot/dts/imx31.dtsi
@@ -12,6 +12,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 serial0 = &uart1;
diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
index 9f40e6229189..d0496c65cea2 100644
--- a/arch/arm/boot/dts/imx35.dtsi
+++ b/arch/arm/boot/dts/imx35.dtsi
@@ -13,6 +13,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
index fe0221e4cbf7..ceae909e2201 100644
--- a/arch/arm/boot/dts/imx50.dtsi
+++ b/arch/arm/boot/dts/imx50.dtsi
@@ -17,6 +17,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
index 33526cade735..1ee1d542d9ad 100644
--- a/arch/arm/boot/dts/imx51.dtsi
+++ b/arch/arm/boot/dts/imx51.dtsi
@@ -19,6 +19,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index ca51dc03e327..2e516f4985e4 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -19,6 +19,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
index 1ade1951e620..7aa120fbdc71 100644
--- a/arch/arm/boot/dts/imx6dl.dtsi
+++ b/arch/arm/boot/dts/imx6dl.dtsi
@@ -137,7 +137,7 @@
 &gpio4 {
         gpio-ranges = <&iomuxc  5 136 1>, <&iomuxc  6 145 1>, <&iomuxc  7 150 1>,
                       <&iomuxc  8 146 1>, <&iomuxc  9 151 1>, <&iomuxc 10 147 1>,
-                      <&iomuxc 11 151 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
+                      <&iomuxc 11 152 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
                       <&iomuxc 14 149 1>, <&iomuxc 15 154 1>, <&iomuxc 16  39 7>,
                       <&iomuxc 23  56 1>, <&iomuxc 24  61 7>, <&iomuxc 31  46 1>;
 };
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 89b834f3fa17..e7d30f45b161 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -16,6 +16,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
index 19cbd879c448..cc9572ea2860 100644
--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -14,6 +14,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec;
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index 10f333016197..dd4ec85ecbaa 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -15,6 +15,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 can0 = &flexcan1;
diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
index 39845a7e0463..53d3f8e41e9b 100644
--- a/arch/arm/boot/dts/imx6ul.dtsi
+++ b/arch/arm/boot/dts/imx6ul.dtsi
@@ -15,6 +15,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 ethernet0 = &fec1;
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 8ff2cbdd8f0d..be33dfc86838 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -50,6 +50,14 @@
 / {
         #address-cells = <1>;
         #size-cells = <1>;
+        /*
+         * The decompressor and also some bootloaders rely on a
+         * pre-existing /chosen node to be available to insert the
+         * command line and merge other ATAGS info.
+         * Also for U-Boot there must be a pre-existing /memory node.
+         */
+        chosen {};
+        memory { device_type = "memory"; reg = <0 0>; };
 
         aliases {
                 gpio0 = &gpio1;
diff --git a/arch/arm/boot/dts/orion5x-lschl.dts b/arch/arm/boot/dts/orion5x-linkstation-lschl.dts
index 947409252845..ea6c881634b9 100644
--- a/arch/arm/boot/dts/orion5x-lschl.dts
+++ b/arch/arm/boot/dts/orion5x-linkstation-lschl.dts
@@ -2,7 +2,7 @@
  * Device Tree file for Buffalo Linkstation LS-CHLv3
  *
  * Copyright (C) 2016 Ash Hughes <ashley.hughes@blueyonder.co.uk>
- * Copyright (C) 2015, 2016
+ * Copyright (C) 2015-2017
  * Roger Shimizu <rogershimizu@gmail.com>
  *
  * This file is dual-licensed: you can use it either under the terms
@@ -52,7 +52,7 @@
 #include <dt-bindings/gpio/gpio.h>
 
 / {
-        model = "Buffalo Linkstation Live v3 (LS-CHL)";
+        model = "Buffalo Linkstation LiveV3 (LS-CHL)";
         compatible = "buffalo,lschl", "marvell,orion5x-88f5182", "marvell,orion5x";
 
         memory { /* 128 MB */
diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
index c8b2944e304a..ace97e8576db 100644
--- a/arch/arm/boot/dts/stih407-family.dtsi
+++ b/arch/arm/boot/dts/stih407-family.dtsi
@@ -680,6 +680,7 @@
                                 phy-names       = "usb2-phy", "usb3-phy";
                                 phys            = <&usb2_picophy0>,
                                                   <&phy_port2 PHY_TYPE_USB3>;
+                                snps,dis_u3_susphy_quirk;
                         };
                 };
 
diff --git a/arch/arm/configs/ezx_defconfig b/arch/arm/configs/ezx_defconfig
index ea316c4b890e..d3f1768840e2 100644
--- a/arch/arm/configs/ezx_defconfig
+++ b/arch/arm/configs/ezx_defconfig
@@ -64,8 +64,8 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/arm/configs/imote2_defconfig b/arch/arm/configs/imote2_defconfig
index 18e59feaa307..7f479cdb3479 100644
--- a/arch/arm/configs/imote2_defconfig
+++ b/arch/arm/configs/imote2_defconfig
@@ -56,8 +56,8 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index ce131ed5939d..ae738a6319f6 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target,
                    const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        struct pt_regs newregs;
+        struct pt_regs newregs = *task_pt_regs(target);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &newregs,
diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
index 699157759120..c03bf28d8bbc 100644
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -60,7 +60,6 @@
 
 #define to_mmdc_pmu(p) container_of(p, struct mmdc_pmu, pmu)
 
-static enum cpuhp_state cpuhp_mmdc_state;
 static int ddr_type;
 
 struct fsl_mmdc_devtype_data {
@@ -82,6 +81,7 @@ static const struct of_device_id imx_mmdc_dt_ids[] = {
 
 #ifdef CONFIG_PERF_EVENTS
 
+static enum cpuhp_state cpuhp_mmdc_state;
 static DEFINE_IDA(mmdc_ida);
 
 PMU_EVENT_ATTR_STRING(total-cycles, mmdc_pmu_total_cycles, "event=0x00")
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 3a2e678b8d30..0122ad1a6027 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
 
 void __init early_abt_enable(void)
 {
-        fsr_info[22].fn = early_abort_handler;
+        fsr_info[FSR_FS_AEA].fn = early_abort_handler;
         local_abt_enable();
-        fsr_info[22].fn = do_bad;
+        fsr_info[FSR_FS_AEA].fn = do_bad;
 }
 
 #ifndef CONFIG_ARM_LPAE
diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
index 67532f242271..afc1f84e763b 100644
--- a/arch/arm/mm/fault.h
+++ b/arch/arm/mm/fault.h
@@ -11,11 +11,15 @@
 #define FSR_FS5_0               (0x3f)
 
 #ifdef CONFIG_ARM_LPAE
+#define FSR_FS_AEA              17
+
 static inline int fsr_fs(unsigned int fsr)
 {
         return fsr & FSR_FS5_0;
 }
 #else
+#define FSR_FS_AEA              22
+
 static inline int fsr_fs(unsigned int fsr)
 {
         return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
index eada0b58ba1c..0cbe24b49710 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi
@@ -55,6 +55,24 @@
         #address-cells = <2>;
         #size-cells = <2>;
 
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                /* 16 MiB reserved for Hardware ROM Firmware */
+                hwrom_reserved: hwrom@0 {
+                        reg = <0x0 0x0 0x0 0x1000000>;
+                        no-map;
+                };
+
+                /* 2 MiB reserved for ARM Trusted Firmware (BL31) */
+                secmon_reserved: secmon@10000000 {
+                        reg = <0x0 0x10000000 0x0 0x200000>;
+                        no-map;
+                };
+        };
+
         cpus {
                 #address-cells = <0x2>;
                 #size-cells = <0x0>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
index 5d28e1cdc998..c59403adb387 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
@@ -151,6 +151,18 @@
         status = "okay";
         pinctrl-0 = <&eth_rgmii_pins>;
         pinctrl-names = "default";
+        phy-handle = <&eth_phy0>;
+
+        mdio {
+                compatible = "snps,dwmac-mdio";
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                eth_phy0: ethernet-phy@0 {
+                        reg = <0>;
+                        eee-broken-1000t;
+                };
+        };
 };
 
 &ir {
diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
index c53dbeae79f2..838dad5c209f 100644
--- a/arch/arm64/crypto/aes-modes.S
+++ b/arch/arm64/crypto/aes-modes.S
@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt)
         cbz             w6, .Lcbcencloop
 
         ld1             {v0.16b}, [x5]                  /* get iv */
-        enc_prepare     w3, x2, x5
+        enc_prepare     w3, x2, x6
 
 .Lcbcencloop:
         ld1             {v1.16b}, [x1], #16             /* get next pt block */
         eor             v0.16b, v0.16b, v1.16b          /* ..and xor with iv */
-        encrypt_block   v0, w3, x2, x5, w6
+        encrypt_block   v0, w3, x2, x6, w7
         st1             {v0.16b}, [x0], #16
         subs            w4, w4, #1
         bne             .Lcbcencloop
+        st1             {v0.16b}, [x5]                  /* return iv */
         ret
 AES_ENDPROC(aes_cbc_encrypt)
 
@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt)
         cbz             w6, .LcbcdecloopNx
 
         ld1             {v7.16b}, [x5]                  /* get iv */
-        dec_prepare     w3, x2, x5
+        dec_prepare     w3, x2, x6
 
 .LcbcdecloopNx:
 #if INTERLEAVE >= 2
@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt)
 .Lcbcdecloop:
         ld1             {v1.16b}, [x1], #16             /* get next ct block */
         mov             v0.16b, v1.16b                  /* ...and copy to v0 */
-        decrypt_block   v0, w3, x2, x5, w6
+        decrypt_block   v0, w3, x2, x6, w7
         eor             v0.16b, v0.16b, v7.16b          /* xor with iv => pt */
         mov             v7.16b, v1.16b                  /* ct is next iv */
         st1             {v0.16b}, [x0], #16
@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt)
         bne             .Lcbcdecloop
 .Lcbcdecout:
         FRAME_POP
+        st1             {v7.16b}, [x5]                  /* return iv */
         ret
 AES_ENDPROC(aes_cbc_decrypt)
 
@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt)
 
 AES_ENTRY(aes_ctr_encrypt)
         FRAME_PUSH
-        cbnz            w6, .Lctrfirst          /* 1st time around? */
-        umov            x5, v4.d[1]             /* keep swabbed ctr in reg */
-        rev             x5, x5
-#if INTERLEAVE >= 2
-        cmn             w5, w4                  /* 32 bit overflow? */
-        bcs             .Lctrinc
-        add             x5, x5, #1              /* increment BE ctr */
-        b               .LctrincNx
-#else
-        b               .Lctrinc
-#endif
-.Lctrfirst:
+        cbz             w6, .Lctrnotfirst       /* 1st time around? */
         enc_prepare     w3, x2, x6
         ld1             {v4.16b}, [x5]
-        umov            x5, v4.d[1]             /* keep swabbed ctr in reg */
-        rev             x5, x5
+
+.Lctrnotfirst:
+        umov            x8, v4.d[1]             /* keep swabbed ctr in reg */
+        rev             x8, x8
 #if INTERLEAVE >= 2
-        cmn             w5, w4                  /* 32 bit overflow? */
+        cmn             w8, w4                  /* 32 bit overflow? */
         bcs             .Lctrloop
 .LctrloopNx:
         subs            w4, w4, #INTERLEAVE
@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt)
 #if INTERLEAVE == 2
         mov             v0.8b, v4.8b
         mov             v1.8b, v4.8b
-        rev             x7, x5
-        add             x5, x5, #1
+        rev             x7, x8
+        add             x8, x8, #1
         ins             v0.d[1], x7
-        rev             x7, x5
-        add             x5, x5, #1
+        rev             x7, x8
+        add             x8, x8, #1
         ins             v1.d[1], x7
         ld1             {v2.16b-v3.16b}, [x1], #32      /* get 2 input blocks */
         do_encrypt_block2x
@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt)
         st1             {v0.16b-v1.16b}, [x0], #32
 #else
         ldr             q8, =0x30000000200000001        /* addends 1,2,3[,0] */
-        dup             v7.4s, w5
+        dup             v7.4s, w8
         mov             v0.16b, v4.16b
         add             v7.4s, v7.4s, v8.4s
         mov             v1.16b, v4.16b
@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt)
         eor             v2.16b, v7.16b, v2.16b
         eor             v3.16b, v5.16b, v3.16b
         st1             {v0.16b-v3.16b}, [x0], #64
-        add             x5, x5, #INTERLEAVE
+        add             x8, x8, #INTERLEAVE
 #endif
-        cbz             w4, .LctroutNx
-.LctrincNx:
-        rev             x7, x5
+        rev             x7, x8
         ins             v4.d[1], x7
+        cbz             w4, .Lctrout
         b               .LctrloopNx
-.LctroutNx:
-        sub             x5, x5, #1
-        rev             x7, x5
-        ins             v4.d[1], x7
-        b               .Lctrout
 .Lctr1x:
         adds            w4, w4, #INTERLEAVE
         beq             .Lctrout
@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt)
 .Lctrloop:
         mov             v0.16b, v4.16b
         encrypt_block   v0, w3, x2, x6, w7
+
+        adds            x8, x8, #1              /* increment BE ctr */
+        rev             x7, x8
+        ins             v4.d[1], x7
+        bcs             .Lctrcarry              /* overflow? */
+
+.Lctrcarrydone:
         subs            w4, w4, #1
         bmi             .Lctrhalfblock          /* blocks < 0 means 1/2 block */
         ld1             {v3.16b}, [x1], #16
         eor             v3.16b, v0.16b, v3.16b
         st1             {v3.16b}, [x0], #16
-        beq             .Lctrout
-.Lctrinc:
-        adds            x5, x5, #1              /* increment BE ctr */
-        rev             x7, x5
-        ins             v4.d[1], x7
-        bcc             .Lctrloop               /* no overflow? */
-        umov            x7, v4.d[0]             /* load upper word of ctr  */
-        rev             x7, x7                  /* ... to handle the carry */
-        add             x7, x7, #1
-        rev             x7, x7
-        ins             v4.d[0], x7
-        b               .Lctrloop
+        bne             .Lctrloop
+
+.Lctrout:
+        st1             {v4.16b}, [x5]          /* return next CTR value */
+        FRAME_POP
+        ret
+
 .Lctrhalfblock:
         ld1             {v3.8b}, [x1]
         eor             v3.8b, v0.8b, v3.8b
         st1             {v3.8b}, [x0]
-.Lctrout:
         FRAME_POP
         ret
+
+.Lctrcarry:
+        umov            x7, v4.d[0]             /* load upper word of ctr  */
+        rev             x7, x7                  /* ... to handle the carry */
+        add             x7, x7, #1
+        rev             x7, x7
+        ins             v4.d[0], x7
+        b               .Lctrcarrydone
 AES_ENDPROC(aes_ctr_encrypt)
         .ltorg
 
diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
index 23e9e13bd2aa..655e65f38f31 100644
--- a/arch/arm64/kernel/topology.c
+++ b/arch/arm64/kernel/topology.c
@@ -11,6 +11,7 @@
  * for more details.
  */
 
+#include <linux/acpi.h>
 #include <linux/cpu.h>
 #include <linux/cpumask.h>
 #include <linux/init.h>
@@ -209,7 +210,12 @@ static struct notifier_block init_cpu_capacity_notifier = {
 
 static int __init register_cpufreq_notifier(void)
 {
-        if (cap_parsing_failed)
+        /*
+         * on ACPI-based systems we need to use the default cpu capacity
+         * until we have the necessary code to parse the cpu capacity, so
+         * skip registering cpufreq notifier.
+         */
+        if (!acpi_disabled || cap_parsing_failed)
                 return -EINVAL;
 
         if (!alloc_cpumask_var(&cpus_to_visit, GFP_KERNEL)) {
diff --git a/arch/parisc/include/asm/bitops.h b/arch/parisc/include/asm/bitops.h
index 3f9406d9b9d6..da87943328a5 100644
--- a/arch/parisc/include/asm/bitops.h
+++ b/arch/parisc/include/asm/bitops.h
@@ -6,7 +6,7 @@
 #endif
 
 #include <linux/compiler.h>
-#include <asm/types.h>          /* for BITS_PER_LONG/SHIFT_PER_LONG */
+#include <asm/types.h>
 #include <asm/byteorder.h>
 #include <asm/barrier.h>
 #include <linux/atomic.h>
@@ -17,6 +17,12 @@
  * to include/asm-i386/bitops.h or kerneldoc
  */
 
+#if __BITS_PER_LONG == 64
+#define SHIFT_PER_LONG 6
+#else
+#define SHIFT_PER_LONG 5
+#endif
+
 #define CHOP_SHIFTCOUNT(x) (((unsigned long) (x)) & (BITS_PER_LONG - 1))
 
 
diff --git a/arch/parisc/include/uapi/asm/bitsperlong.h b/arch/parisc/include/uapi/asm/bitsperlong.h
index e0a23c7bdd43..07fa7e50bdc0 100644
--- a/arch/parisc/include/uapi/asm/bitsperlong.h
+++ b/arch/parisc/include/uapi/asm/bitsperlong.h
@@ -3,10 +3,8 @@
 
 #if defined(__LP64__)
 #define __BITS_PER_LONG 64
-#define SHIFT_PER_LONG 6
 #else
 #define __BITS_PER_LONG 32
-#define SHIFT_PER_LONG 5
 #endif
 
 #include <asm-generic/bitsperlong.h>
diff --git a/arch/parisc/include/uapi/asm/swab.h b/arch/parisc/include/uapi/asm/swab.h
index e78403b129ef..928e1bbac98f 100644
--- a/arch/parisc/include/uapi/asm/swab.h
+++ b/arch/parisc/include/uapi/asm/swab.h
@@ -1,6 +1,7 @@
 #ifndef _PARISC_SWAB_H
 #define _PARISC_SWAB_H
 
+#include <asm/bitsperlong.h>
 #include <linux/types.h>
 #include <linux/compiler.h>
 
@@ -38,7 +39,7 @@ static inline __attribute_const__ __u32 __arch_swab32(__u32 x)
 }
 #define __arch_swab32 __arch_swab32
 
-#if BITS_PER_LONG > 32
+#if __BITS_PER_LONG > 32
 /*
 ** From "PA-RISC 2.0 Architecture", HP Professional Books.
 ** See Appendix I page 8 , "Endian Byte Swapping".
@@ -61,6 +62,6 @@ static inline __attribute_const__ __u64 __arch_swab64(__u64 x)
         return x;
 }
 #define __arch_swab64 __arch_swab64
-#endif /* BITS_PER_LONG > 32 */
+#endif /* __BITS_PER_LONG > 32 */
 
 #endif /* _PARISC_SWAB_H */
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index a8ee573fe610..281f4f1fcd1f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -164,7 +164,6 @@ config PPC
         select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE
         select HAVE_ARCH_HARDENED_USERCOPY
         select HAVE_KERNEL_GZIP
-        select HAVE_CC_STACKPROTECTOR
 
 config GENERIC_CSUM
         def_bool CPU_LITTLE_ENDIAN
@@ -484,6 +483,7 @@ config RELOCATABLE
         bool "Build a relocatable kernel"
         depends on (PPC64 && !COMPILE_TEST) || (FLATMEM && (44x || FSL_BOOKE))
         select NONSTATIC_KERNEL
+        select MODULE_REL_CRCS if MODVERSIONS
         help
           This builds a kernel image that is capable of running at the
           location the kernel is loaded at. For ppc32, there is no any
diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
index b312b152461b..6e834caa3720 100644
--- a/arch/powerpc/include/asm/cpu_has_feature.h
+++ b/arch/powerpc/include/asm/cpu_has_feature.h
@@ -23,7 +23,9 @@ static __always_inline bool cpu_has_feature(unsigned long feature)
 {
         int i;
 
+#ifndef __clang__ /* clang can't cope with this */
         BUILD_BUG_ON(!__builtin_constant_p(feature));
+#endif
 
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
         if (!static_key_initialized) {
diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
index a34c764ca8dd..233a7e8cc8e3 100644
--- a/arch/powerpc/include/asm/mmu.h
+++ b/arch/powerpc/include/asm/mmu.h
@@ -160,7 +160,9 @@ static __always_inline bool mmu_has_feature(unsigned long feature)
 {
         int i;
 
+#ifndef __clang__ /* clang can't cope with this */
         BUILD_BUG_ON(!__builtin_constant_p(feature));
+#endif
 
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
         if (!static_key_initialized) {
diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
index cc12c61ef315..53885512b8d3 100644
--- a/arch/powerpc/include/asm/module.h
+++ b/arch/powerpc/include/asm/module.h
@@ -90,9 +90,5 @@ static inline int module_finalize_ftrace(struct module *mod, const Elf_Shdr *sec
 }
 #endif
 
-#if defined(CONFIG_MODVERSIONS) && defined(CONFIG_PPC64)
-#define ARCH_RELOCATES_KCRCTAB
-#define reloc_start PHYSICAL_START
-#endif
 #endif /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_MODULE_H */
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 0d4531aa2052..dff79798903d 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -649,9 +649,10 @@
 #define   SRR1_ISI_N_OR_G       0x10000000 /* ISI: Access is no-exec or G */
 #define   SRR1_ISI_PROT         0x08000000 /* ISI: Other protection fault */
 #define   SRR1_WAKEMASK         0x00380000 /* reason for wakeup */
-#define   SRR1_WAKEMASK_P8      0x003c0000 /* reason for wakeup on POWER8 */
+#define   SRR1_WAKEMASK_P8      0x003c0000 /* reason for wakeup on POWER8 and 9 */
 #define   SRR1_WAKESYSERR       0x00300000 /* System error */
 #define   SRR1_WAKEEE           0x00200000 /* External interrupt */
+#define   SRR1_WAKEHVI          0x00240000 /* Hypervisor Virtualization Interrupt (P9) */
 #define   SRR1_WAKEMT           0x00280000 /* mtctrl */
 #define   SRR1_WAKEHMI          0x00280000 /* Hypervisor maintenance */
 #define   SRR1_WAKEDEC          0x00180000 /* Decrementer interrupt */
diff --git a/arch/powerpc/include/asm/stackprotector.h b/arch/powerpc/include/asm/stackprotector.h
deleted file mode 100644
index 6720190eabec..000000000000
--- a/arch/powerpc/include/asm/stackprotector.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * GCC stack protector support.
- *
- * Stack protector works by putting predefined pattern at the start of
- * the stack frame and verifying that it hasn't been overwritten when
- * returning from the function.  The pattern is called stack canary
- * and gcc expects it to be defined by a global variable called
- * "__stack_chk_guard" on PPC.  This unfortunately means that on SMP
- * we cannot have a different canary value per task.
- */
-
-#ifndef _ASM_STACKPROTECTOR_H
-#define _ASM_STACKPROTECTOR_H
-
-#include <linux/random.h>
-#include <linux/version.h>
-#include <asm/reg.h>
-
-extern unsigned long __stack_chk_guard;
-
-/*
- * Initialize the stackprotector canary value.
- *
- * NOTE: this must only be called from functions that never return,
- * and it must always be inlined.
- */
-static __always_inline void boot_init_stack_canary(void)
-{
-        unsigned long canary;
-
-        /* Try to get a semi random initial value. */
-        get_random_bytes(&canary, sizeof(canary));
-        canary ^= mftb();
-        canary ^= LINUX_VERSION_CODE;
-
-        current->stack_canary = canary;
-        __stack_chk_guard = current->stack_canary;
-}
-
-#endif  /* _ASM_STACKPROTECTOR_H */
diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
index f0b238516e9b..e0b9e576905a 100644
--- a/arch/powerpc/include/asm/xics.h
+++ b/arch/powerpc/include/asm/xics.h
@@ -44,6 +44,7 @@ static inline int icp_hv_init(void) { return -ENODEV; }
 
 #ifdef CONFIG_PPC_POWERNV
 extern int icp_opal_init(void);
+extern void icp_opal_flush_interrupt(void);
 #else
 static inline int icp_opal_init(void) { return -ENODEV; }
 #endif
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index 23f8082d7bfa..f4c2b52e58b3 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -19,10 +19,6 @@ CFLAGS_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN)
 
-# -fstack-protector triggers protection checks in this code,
-# but it is being used too early to link to meaningful stack_chk logic.
-CFLAGS_prom_init.o += $(call cc-option, -fno-stack-protector)
-
 ifdef CONFIG_FUNCTION_TRACER
 # Do not trace early boot code
 CFLAGS_REMOVE_cputable.o = -mno-sched-epilog $(CC_FLAGS_FTRACE)
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 0601e6a7297c..195a9fc8f81c 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -91,9 +91,6 @@ int main(void)
         DEFINE(TI_livepatch_sp, offsetof(struct thread_info, livepatch_sp));
 #endif
 
-#ifdef CONFIG_CC_STACKPROTECTOR
-        DEFINE(TSK_STACK_CANARY, offsetof(struct task_struct, stack_canary));
-#endif
         DEFINE(KSP, offsetof(struct thread_struct, ksp));
         DEFINE(PT_REGS, offsetof(struct thread_struct, regs));
 #ifdef CONFIG_BOOKE
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index d88573bdd090..b94887165a10 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -545,7 +545,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata)
 static void *__eeh_clear_pe_frozen_state(void *data, void *flag)
 {
         struct eeh_pe *pe = (struct eeh_pe *)data;
-        bool *clear_sw_state = flag;
+        bool clear_sw_state = *(bool *)flag;
         int i, rc = 1;
 
         for (i = 0; rc && i < 3; i++)
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 5742dbdbee46..3841d749a430 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -674,11 +674,7 @@ BEGIN_FTR_SECTION
         mtspr   SPRN_SPEFSCR,r0         /* restore SPEFSCR reg */
 END_FTR_SECTION_IFSET(CPU_FTR_SPE)
 #endif /* CONFIG_SPE */
-#if defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_SMP)
-        lwz     r0,TSK_STACK_CANARY(r2)
-        lis     r4,__stack_chk_guard@ha
-        stw     r0,__stack_chk_guard@l(r4)
-#endif
+
         lwz     r0,_CCR(r1)
         mtcrf   0xFF,r0
         /* r3-r12 are destroyed -- Cort */
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index bb1807184bad..0b0f89685b67 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -286,14 +286,6 @@ static void dedotify_versions(struct modversion_info *vers,
         for (end = (void *)vers + size; vers < end; vers++)
                 if (vers->name[0] == '.') {
                         memmove(vers->name, vers->name+1, strlen(vers->name));
-#ifdef ARCH_RELOCATES_KCRCTAB
-                        /* The TOC symbol has no CRC computed. To avoid CRC
-                         * check failing, we must force it to the expected
-                         * value (see CRC check in module.c).
-                         */
-                        if (!strcmp(vers->name, "TOC."))
-                                vers->crc = -(unsigned long)reloc_start;
-#endif
                 }
 }
 
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 04885cec24df..5dd056df0baa 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -64,12 +64,6 @@
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 
-#ifdef CONFIG_CC_STACKPROTECTOR
-#include <linux/stackprotector.h>
-unsigned long __stack_chk_guard __read_mostly;
-EXPORT_SYMBOL(__stack_chk_guard);
-#endif
-
 /* Transactional Memory debug */
 #ifdef TM_DEBUG_SW
 #define TM_DEBUG(x...) printk(KERN_INFO x)
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index ec47a939cbdd..ac83eb04a8b8 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -2834,6 +2834,9 @@ static void __init prom_find_boot_cpu(void)
 
         cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
 
+        if (!PHANDLE_VALID(cpu_pkg))
+                return;
+
         prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
         prom.cpu = be32_to_cpu(rval);
 
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 6fd30ac7d14a..62a50d6d1053 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -253,8 +253,11 @@ int do_page_fault(struct pt_regs *regs, unsigned long address,
         if (unlikely(debugger_fault_handler(regs)))
                 goto bail;
 
-        /* On a kernel SLB miss we can only check for a valid exception entry */
-        if (!user_mode(regs) && (address >= TASK_SIZE)) {
+        /*
+         * The kernel should never take an execute fault nor should it
+         * take a page fault to a kernel address.
+         */
+        if (!user_mode(regs) && (is_exec || (address >= TASK_SIZE))) {
                 rc = SIGSEGV;
                 goto bail;
         }
@@ -391,20 +394,6 @@ good_area:
 
         if (is_exec) {
                 /*
-                 * An execution fault + no execute ?
-                 *
-                 * On CPUs that don't have CPU_FTR_COHERENT_ICACHE we
-                 * deliberately create NX mappings, and use the fault to do the
-                 * cache flush. This is usually handled in hash_page_do_lazy_icache()
-                 * but we could end up here if that races with a concurrent PTE
-                 * update. In that case we need to fall through here to the VMA
-                 * check below.
-                 */
-                if (cpu_has_feature(CPU_FTR_COHERENT_ICACHE) &&
-                        (regs->msr & SRR1_ISI_N_OR_G))
-                        goto bad_area;
-
-                /*
                  * Allow execution from readable areas if the MMU does not
                  * provide separate controls over reading and executing.
                  *
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index cfa53ccc8baf..34f1a0dbc898 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -65,7 +65,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
                 if (!pmdp)
                         return -ENOMEM;
                 if (map_page_size == PMD_SIZE) {
-                        ptep = (pte_t *)pudp;
+                        ptep = pmdp_ptep(pmdp);
                         goto set_the_pte;
                 }
                 ptep = pte_alloc_kernel(pmdp, ea);
@@ -90,7 +90,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
                 }
                 pmdp = pmd_offset(pudp, ea);
                 if (map_page_size == PMD_SIZE) {
-                        ptep = (pte_t *)pudp;
+                        ptep = pmdp_ptep(pmdp);
                         goto set_the_pte;
                 }
                 if (!pmd_present(*pmdp)) {
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index 61b79119065f..952713d6cf04 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -50,9 +50,7 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
         for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
                 __tlbiel_pid(pid, set, ric);
         }
-        if (cpu_has_feature(CPU_FTR_POWER9_DD1))
-                asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
-        return;
+        asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
 }
 
 static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
@@ -85,8 +83,6 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
         asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
                      : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
         asm volatile("ptesync": : :"memory");
-        if (cpu_has_feature(CPU_FTR_POWER9_DD1))
-                asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
 }
 
 static inline void _tlbie_va(unsigned long va, unsigned long pid,
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index c789258ae1e1..eec0e8d0454d 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -155,8 +155,10 @@ static void pnv_smp_cpu_kill_self(void)
                 wmask = SRR1_WAKEMASK_P8;
 
         idle_states = pnv_get_supported_cpuidle_states();
+
         /* We don't want to take decrementer interrupts while we are offline,
-         * so clear LPCR:PECE1. We keep PECE2 enabled.
+         * so clear LPCR:PECE1. We keep PECE2 (and LPCR_PECE_HVEE on P9)
+         * enabled as to let IPIs in.
          */
         mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
 
@@ -206,8 +208,12 @@ static void pnv_smp_cpu_kill_self(void)
                  * contains 0.
                  */
                 if (((srr1 & wmask) == SRR1_WAKEEE) ||
+                    ((srr1 & wmask) == SRR1_WAKEHVI) ||
                     (local_paca->irq_happened & PACA_IRQ_EE)) {
-                        icp_native_flush_interrupt();
+                        if (cpu_has_feature(CPU_FTR_ARCH_300))
+                                icp_opal_flush_interrupt();
+                        else
+                                icp_native_flush_interrupt();
                 } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
                         unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
                         asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
@@ -221,6 +227,8 @@ static void pnv_smp_cpu_kill_self(void)
                 if (srr1 && !generic_check_cpu_restart(cpu))
                         DBG("CPU%d Unexpected exit while offline !\n", cpu);
         }
+
+        /* Re-enable decrementer interrupts */
         mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1);
         DBG("CPU%d coming online...\n", cpu);
 }
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index 60c57657c772..f9670eabfcfa 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -120,18 +120,49 @@ static void icp_opal_cause_ipi(int cpu, unsigned long data)
 {
         int hw_cpu = get_hard_smp_processor_id(cpu);
 
+        kvmppc_set_host_ipi(cpu, 1);
         opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
 }
 
 static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
 {
-        int hw_cpu = hard_smp_processor_id();
+        int cpu = smp_processor_id();
 
-        opal_int_set_mfrr(hw_cpu, 0xff);
+        kvmppc_set_host_ipi(cpu, 0);
+        opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
 
         return smp_ipi_demux();
 }
 
+/*
+ * Called when an interrupt is received on an off-line CPU to
+ * clear the interrupt, so that the CPU can go back to nap mode.
+ */
+void icp_opal_flush_interrupt(void)
+{
+        unsigned int xirr;
+        unsigned int vec;
+
+        do {
+                xirr = icp_opal_get_xirr();
+                vec = xirr & 0x00ffffff;
+                if (vec == XICS_IRQ_SPURIOUS)
+                        break;
+                if (vec == XICS_IPI) {
+                        /* Clear pending IPI */
+                        int cpu = smp_processor_id();
+                        kvmppc_set_host_ipi(cpu, 0);
+                        opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+                } else {
+                        pr_err("XICS: hw interrupt 0x%x to offline cpu, "
+                               "disabling\n", vec);
+                        xics_mask_unknown_vec(vec);
+                }
+
+                /* EOI the interrupt */
+        } while (opal_int_eoi(xirr) > 0);
+}
+
 #endif /* CONFIG_SMP */
 
 static const struct icp_ops icp_opal_ops = {
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index b84be675e507..d0317993e947 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -35,15 +35,15 @@ void __tsb_context_switch(unsigned long pgd_pa,
 static inline void tsb_context_switch(struct mm_struct *mm)
 {
         __tsb_context_switch(__pa(mm->pgd),
-                             &mm->context.tsb_block[0],
+                             &mm->context.tsb_block[MM_TSB_BASE],
 #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
-                             (mm->context.tsb_block[1].tsb ?
-                              &mm->context.tsb_block[1] :
+                             (mm->context.tsb_block[MM_TSB_HUGE].tsb ?
+                              &mm->context.tsb_block[MM_TSB_HUGE] :
                               NULL)
 #else
                              NULL
 #endif
-                             , __pa(&mm->context.tsb_descr[0]));
+                             , __pa(&mm->context.tsb_descr[MM_TSB_BASE]));
 }
 
 void tsb_grow(struct mm_struct *mm,
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index 3bebf395252c..4d0248aa0928 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1021,7 +1021,7 @@ static void __init alloc_one_queue(unsigned long *pa_ptr, unsigned long qmask)
         unsigned long order = get_order(size);
         unsigned long p;
 
-        p = __get_free_pages(GFP_KERNEL, order);
+        p = __get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
         if (!p) {
                 prom_printf("SUN4V: Error, cannot allocate queue.\n");
                 prom_halt();
diff --git a/arch/sparc/kernel/sstate.c b/arch/sparc/kernel/sstate.c
index c59af546f522..3caed4023589 100644
--- a/arch/sparc/kernel/sstate.c
+++ b/arch/sparc/kernel/sstate.c
@@ -43,8 +43,8 @@ static const char poweroff_msg[32] __attribute__((aligned(32))) =
         "Linux powering off";
 static const char rebooting_msg[32] __attribute__((aligned(32))) =
         "Linux rebooting";
-static const char panicing_msg[32] __attribute__((aligned(32))) =
-        "Linux panicing";
+static const char panicking_msg[32] __attribute__((aligned(32))) =
+        "Linux panicking";
 
 static int sstate_reboot_call(struct notifier_block *np, unsigned long type, void *_unused)
 {
@@ -76,7 +76,7 @@ static struct notifier_block sstate_reboot_notifier = {
 
 static int sstate_panic_event(struct notifier_block *n, unsigned long event, void *ptr)
 {
-        do_set_sstate(HV_SOFT_STATE_TRANSITION, panicing_msg);
+        do_set_sstate(HV_SOFT_STATE_TRANSITION, panicking_msg);
 
         return NOTIFY_DONE;
 }
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index 4bc10e44d1ca..dfc97a47c9a0 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2051,6 +2051,73 @@ void sun4v_resum_overflow(struct pt_regs *regs)
         atomic_inc(&sun4v_resum_oflow_cnt);
 }
 
+/* Given a set of registers, get the virtual addressi that was being accessed
+ * by the faulting instructions at tpc.
+ */
+static unsigned long sun4v_get_vaddr(struct pt_regs *regs)
+{
+        unsigned int insn;
+
+        if (!copy_from_user(&insn, (void __user *)regs->tpc, 4)) {
+                return compute_effective_address(regs, insn,
+                                                 (insn >> 25) & 0x1f);
+        }
+        return 0;
+}
+
+/* Attempt to handle non-resumable errors generated from userspace.
+ * Returns true if the signal was handled, false otherwise.
+ */
+bool sun4v_nonresum_error_user_handled(struct pt_regs *regs,
+                                  struct sun4v_error_entry *ent) {
+
+        unsigned int attrs = ent->err_attrs;
+
+        if (attrs & SUN4V_ERR_ATTRS_MEMORY) {
+                unsigned long addr = ent->err_raddr;
+                siginfo_t info;
+
+                if (addr == ~(u64)0) {
+                        /* This seems highly unlikely to ever occur */
+                        pr_emerg("SUN4V NON-RECOVERABLE ERROR: Memory error detected in unknown location!\n");
+                } else {
+                        unsigned long page_cnt = DIV_ROUND_UP(ent->err_size,
+                                                              PAGE_SIZE);
+
+                        /* Break the unfortunate news. */
+                        pr_emerg("SUN4V NON-RECOVERABLE ERROR: Memory failed at %016lX\n",
+                                 addr);
+                        pr_emerg("SUN4V NON-RECOVERABLE ERROR:   Claiming %lu ages.\n",
+                                 page_cnt);
+
+                        while (page_cnt-- > 0) {
+                                if (pfn_valid(addr >> PAGE_SHIFT))
+                                        get_page(pfn_to_page(addr >> PAGE_SHIFT));
+                                addr += PAGE_SIZE;
+                        }
+                }
+                info.si_signo = SIGKILL;
+                info.si_errno = 0;
+                info.si_trapno = 0;
+                force_sig_info(info.si_signo, &info, current);
+
+                return true;
+        }
+        if (attrs & SUN4V_ERR_ATTRS_PIO) {
+                siginfo_t info;
+
+                info.si_signo = SIGBUS;
+                info.si_code = BUS_ADRERR;
+                info.si_addr = (void __user *)sun4v_get_vaddr(regs);
+                force_sig_info(info.si_signo, &info, current);
+
+                return true;
+        }
+
+        /* Default to doing nothing */
+        return false;
+}
+
 /* We run with %pil set to PIL_NORMAL_MAX and PSTATE_IE enabled in %pstate.
  * Log the event, clear the first word of the entry, and die.
  */
@@ -2075,6 +2142,12 @@ void sun4v_nonresum_error(struct pt_regs *regs, unsigned long offset)
 
         put_cpu();
 
+        if (!(regs->tstate & TSTATE_PRIV) &&
+            sun4v_nonresum_error_user_handled(regs, &local_copy)) {
+                /* DON'T PANIC: This userspace error was handled. */
+                return;
+        }
+
 #ifdef CONFIG_PCI
         /* Check for the special PCI poke sequence. */
         if (pci_poke_in_progress && pci_poke_cpu == cpu) {
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 6ef688a1ef3e..7ff1b0c86a8e 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1085,9 +1085,9 @@ static void aesni_free_simds(void)
                     aesni_simd_skciphers[i]; i++)
                 simd_skcipher_free(aesni_simd_skciphers[i]);
 
-        for (i = 0; i < ARRAY_SIZE(aesni_simd_skciphers2) &&
-                    aesni_simd_skciphers2[i].simd; i++)
-                simd_skcipher_free(aesni_simd_skciphers2[i].simd);
+        for (i = 0; i < ARRAY_SIZE(aesni_simd_skciphers2); i++)
+                if (aesni_simd_skciphers2[i].simd)
+                        simd_skcipher_free(aesni_simd_skciphers2[i].simd);
 }
 
 static int __init aesni_init(void)
@@ -1168,7 +1168,7 @@ static int __init aesni_init(void)
                 simd = simd_skcipher_create_compat(algname, drvname, basename);
                 err = PTR_ERR(simd);
                 if (IS_ERR(simd))
-                        goto unregister_simds;
+                        continue;
 
                 aesni_simd_skciphers2[i].simd = simd;
         }
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 17c3564d087a..22ef4f72cf32 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -161,7 +161,13 @@ static u64 rapl_timer_ms;
 
 static inline struct rapl_pmu *cpu_to_rapl_pmu(unsigned int cpu)
 {
-        return rapl_pmus->pmus[topology_logical_package_id(cpu)];
+        unsigned int pkgid = topology_logical_package_id(cpu);
+
+        /*
+         * The unsigned check also catches the '-1' return value for non
+         * existent mappings in the topology map.
+         */
+        return pkgid < rapl_pmus->maxpkg ? rapl_pmus->pmus[pkgid] : NULL;
 }
 
 static inline u64 rapl_read_counter(struct perf_event *event)
@@ -402,6 +408,8 @@ static int rapl_pmu_event_init(struct perf_event *event)
 
         /* must be done before validate_group */
         pmu = cpu_to_rapl_pmu(event->cpu);
+        if (!pmu)
+                return -EINVAL;
         event->cpu = pmu->cpu;
         event->pmu_private = pmu;
         event->hw.event_base = msr;
@@ -585,6 +593,20 @@ static int rapl_cpu_online(unsigned int cpu)
         struct rapl_pmu *pmu = cpu_to_rapl_pmu(cpu);
         int target;
 
+        if (!pmu) {
+                pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu));
+                if (!pmu)
+                        return -ENOMEM;
+
+                raw_spin_lock_init(&pmu->lock);
+                INIT_LIST_HEAD(&pmu->active_list);
+                pmu->pmu = &rapl_pmus->pmu;
+                pmu->timer_interval = ms_to_ktime(rapl_timer_ms);
+                rapl_hrtimer_init(pmu);
+
+                rapl_pmus->pmus[topology_logical_package_id(cpu)] = pmu;
+        }
+
         /*
          * Check if there is an online cpu in the package which collects rapl
          * events already.
@@ -598,27 +620,6 @@ static int rapl_cpu_online(unsigned int cpu)
         return 0;
 }
 
-static int rapl_cpu_prepare(unsigned int cpu)
-{
-        struct rapl_pmu *pmu = cpu_to_rapl_pmu(cpu);
-
-        if (pmu)
-                return 0;
-
-        pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu));
-        if (!pmu)
-                return -ENOMEM;
-
-        raw_spin_lock_init(&pmu->lock);
-        INIT_LIST_HEAD(&pmu->active_list);
-        pmu->pmu = &rapl_pmus->pmu;
-        pmu->timer_interval = ms_to_ktime(rapl_timer_ms);
-        pmu->cpu = -1;
-        rapl_hrtimer_init(pmu);
-        rapl_pmus->pmus[topology_logical_package_id(cpu)] = pmu;
-        return 0;
-}
-
 static int rapl_check_hw_unit(bool apply_quirk)
 {
         u64 msr_rapl_power_unit_bits;
@@ -803,29 +804,21 @@ static int __init rapl_pmu_init(void)
         /*
          * Install callbacks. Core will call them for each online cpu.
          */
-
-        ret = cpuhp_setup_state(CPUHP_PERF_X86_RAPL_PREP, "perf/x86/rapl:prepare",
-                                rapl_cpu_prepare, NULL);
-        if (ret)
-                goto out;
-
         ret = cpuhp_setup_state(CPUHP_AP_PERF_X86_RAPL_ONLINE,
                                 "perf/x86/rapl:online",
                                 rapl_cpu_online, rapl_cpu_offline);
         if (ret)
-                goto out1;
+                goto out;
 
         ret = perf_pmu_register(&rapl_pmus->pmu, "power", -1);
         if (ret)
-                goto out2;
+                goto out1;
 
         rapl_advertise();
         return 0;
 
-out2:
-        cpuhp_remove_state(CPUHP_AP_PERF_X86_RAPL_ONLINE);
 out1:
-        cpuhp_remove_state(CPUHP_PERF_X86_RAPL_PREP);
+        cpuhp_remove_state(CPUHP_AP_PERF_X86_RAPL_ONLINE);
 out:
         pr_warn("Initialization failed (%d), disabled\n", ret);
         cleanup_rapl_pmus();
@@ -836,7 +829,6 @@ module_init(rapl_pmu_init);
 static void __exit intel_rapl_exit(void)
 {
         cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_RAPL_ONLINE);
-        cpuhp_remove_state_nocalls(CPUHP_PERF_X86_RAPL_PREP);
         perf_pmu_unregister(&rapl_pmus->pmu);
         cleanup_rapl_pmus();
 }
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 8c4ccdc3a3f3..1ab45976474d 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -100,7 +100,13 @@ ssize_t uncore_event_show(struct kobject *kobj,
 
 struct intel_uncore_box *uncore_pmu_to_box(struct intel_uncore_pmu *pmu, int cpu)
 {
-        return pmu->boxes[topology_logical_package_id(cpu)];
+        unsigned int pkgid = topology_logical_package_id(cpu);
+
+        /*
+         * The unsigned check also catches the '-1' return value for non
+         * existent mappings in the topology map.
+         */
+        return pkgid < max_packages ? pmu->boxes[pkgid] : NULL;
 }
 
 u64 uncore_msr_read_counter(struct intel_uncore_box *box, struct perf_event *event)
@@ -764,30 +770,6 @@ static void uncore_pmu_unregister(struct intel_uncore_pmu *pmu)
         pmu->registered = false;
 }
 
-static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu)
-{
-        struct intel_uncore_pmu *pmu = type->pmus;
-        struct intel_uncore_box *box;
-        int i, pkg;
-
-        if (pmu) {
-                pkg = topology_physical_package_id(cpu);
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        box = pmu->boxes[pkg];
-                        if (box)
-                                uncore_box_exit(box);
-                }
-        }
-}
-
-static void uncore_exit_boxes(void *dummy)
-{
-        struct intel_uncore_type **types;
-
-        for (types = uncore_msr_uncores; *types; types++)
-                __uncore_exit_boxes(*types++, smp_processor_id());
-}
-
 static void uncore_free_boxes(struct intel_uncore_pmu *pmu)
 {
         int pkg;
@@ -1058,86 +1040,6 @@ static void uncore_pci_exit(void)
         }
 }
 
-static int uncore_cpu_dying(unsigned int cpu)
-{
-        struct intel_uncore_type *type, **types = uncore_msr_uncores;
-        struct intel_uncore_pmu *pmu;
-        struct intel_uncore_box *box;
-        int i, pkg;
-
-        pkg = topology_logical_package_id(cpu);
-        for (; *types; types++) {
-                type = *types;
-                pmu = type->pmus;
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        box = pmu->boxes[pkg];
-                        if (box && atomic_dec_return(&box->refcnt) == 0)
-                                uncore_box_exit(box);
-                }
-        }
-        return 0;
-}
-
-static int first_init;
-
-static int uncore_cpu_starting(unsigned int cpu)
-{
-        struct intel_uncore_type *type, **types = uncore_msr_uncores;
-        struct intel_uncore_pmu *pmu;
-        struct intel_uncore_box *box;
-        int i, pkg, ncpus = 1;
-
-        if (first_init) {
-                /*
-                 * On init we get the number of online cpus in the package
-                 * and set refcount for all of them.
-                 */
-                ncpus = cpumask_weight(topology_core_cpumask(cpu));
-        }
-
-        pkg = topology_logical_package_id(cpu);
-        for (; *types; types++) {
-                type = *types;
-                pmu = type->pmus;
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        box = pmu->boxes[pkg];
-                        if (!box)
-                                continue;
-                        /* The first cpu on a package activates the box */
-                        if (atomic_add_return(ncpus, &box->refcnt) == ncpus)
-                                uncore_box_init(box);
-                }
-        }
-
-        return 0;
-}
-
-static int uncore_cpu_prepare(unsigned int cpu)
-{
-        struct intel_uncore_type *type, **types = uncore_msr_uncores;
-        struct intel_uncore_pmu *pmu;
-        struct intel_uncore_box *box;
-        int i, pkg;
-
-        pkg = topology_logical_package_id(cpu);
-        for (; *types; types++) {
-                type = *types;
-                pmu = type->pmus;
-                for (i = 0; i < type->num_boxes; i++, pmu++) {
-                        if (pmu->boxes[pkg])
-                                continue;
-                        /* First cpu of a package allocates the box */
-                        box = uncore_alloc_box(type, cpu_to_node(cpu));
-                        if (!box)
-                                return -ENOMEM;
-                        box->pmu = pmu;
-                        box->pkgid = pkg;
-                        pmu->boxes[pkg] = box;
-                }
-        }
-        return 0;
-}
-
 static void uncore_change_type_ctx(struct intel_uncore_type *type, int old_cpu,
                                    int new_cpu)
 {
@@ -1177,12 +1079,14 @@ static void uncore_change_context(struct intel_uncore_type **uncores,
 
 static int uncore_event_cpu_offline(unsigned int cpu)
 {
-        int target;
+        struct intel_uncore_type *type, **types = uncore_msr_uncores;
+        struct intel_uncore_pmu *pmu;
+        struct intel_uncore_box *box;
+        int i, pkg, target;
 
         /* Check if exiting cpu is used for collecting uncore events */
         if (!cpumask_test_and_clear_cpu(cpu, &uncore_cpu_mask))
-                return 0;
-
+                goto unref;
         /* Find a new cpu to collect uncore events */
         target = cpumask_any_but(topology_core_cpumask(cpu), cpu);
 
@@ -1194,12 +1098,82 @@ static int uncore_event_cpu_offline(unsigned int cpu)
 
         uncore_change_context(uncore_msr_uncores, cpu, target);
         uncore_change_context(uncore_pci_uncores, cpu, target);
+
+unref:
+        /* Clear the references */
+        pkg = topology_logical_package_id(cpu);
+        for (; *types; types++) {
+                type = *types;
+                pmu = type->pmus;
+                for (i = 0; i < type->num_boxes; i++, pmu++) {
+                        box = pmu->boxes[pkg];
+                        if (box && atomic_dec_return(&box->refcnt) == 0)
+                                uncore_box_exit(box);
+                }
+        }
         return 0;
 }
 
+static int allocate_boxes(struct intel_uncore_type **types,
+                         unsigned int pkg, unsigned int cpu)
+{
+        struct intel_uncore_box *box, *tmp;
+        struct intel_uncore_type *type;
+        struct intel_uncore_pmu *pmu;
+        LIST_HEAD(allocated);
+        int i;
+
+        /* Try to allocate all required boxes */
+        for (; *types; types++) {
+                type = *types;
+                pmu = type->pmus;
+                for (i = 0; i < type->num_boxes; i++, pmu++) {
+                        if (pmu->boxes[pkg])
+                                continue;
+                        box = uncore_alloc_box(type, cpu_to_node(cpu));
+                        if (!box)
+                                goto cleanup;
+                        box->pmu = pmu;
+                        box->pkgid = pkg;
+                        list_add(&box->active_list, &allocated);
+                }
+        }
+        /* Install them in the pmus */
+        list_for_each_entry_safe(box, tmp, &allocated, active_list) {
+                list_del_init(&box->active_list);
+                box->pmu->boxes[pkg] = box;
+        }
+        return 0;
+
+cleanup:
+        list_for_each_entry_safe(box, tmp, &allocated, active_list) {
+                list_del_init(&box->active_list);
+                kfree(box);
+        }
+        return -ENOMEM;
+}
+
 static int uncore_event_cpu_online(unsigned int cpu)
 {
-        int target;
+        struct intel_uncore_type *type, **types = uncore_msr_uncores;
+        struct intel_uncore_pmu *pmu;
+        struct intel_uncore_box *box;
+        int i, ret, pkg, target;
+
+        pkg = topology_logical_package_id(cpu);
+        ret = allocate_boxes(types, pkg, cpu);
+        if (ret)
+                return ret;
+
+        for (; *types; types++) {
+                type = *types;
+                pmu = type->pmus;
+                for (i = 0; i < type->num_boxes; i++, pmu++) {
+                        box = pmu->boxes[pkg];
+                        if (!box && atomic_inc_return(&box->refcnt) == 1)
+                                uncore_box_init(box);
+                }
+        }
 
         /*
          * Check if there is an online cpu in the package
@@ -1389,38 +1363,16 @@ static int __init intel_uncore_init(void)
         if (cret && pret)
                 return -ENODEV;
 
-        /*
-         * Install callbacks. Core will call them for each online cpu.
-         *
-         * The first online cpu of each package allocates and takes
-         * the refcounts for all other online cpus in that package.
-         * If msrs are not enabled no allocation is required and
-         * uncore_cpu_prepare() is not called for each online cpu.
-         */
-        if (!cret) {
-               ret = cpuhp_setup_state(CPUHP_PERF_X86_UNCORE_PREP,
-                                       "perf/x86/intel/uncore:prepare",
-                                       uncore_cpu_prepare, NULL);
-                if (ret)
-                        goto err;
-        } else {
-                cpuhp_setup_state_nocalls(CPUHP_PERF_X86_UNCORE_PREP,
-                                          "perf/x86/intel/uncore:prepare",
-                                          uncore_cpu_prepare, NULL);
-        }
-        first_init = 1;
-        cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING,
-                          "perf/x86/uncore:starting",
-                          uncore_cpu_starting, uncore_cpu_dying);
-        first_init = 0;
-        cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
-                          "perf/x86/uncore:online",
-                          uncore_event_cpu_online, uncore_event_cpu_offline);
+        /* Install hotplug callbacks to setup the targets for each package */
+        ret = cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
+                                "perf/x86/intel/uncore:online",
+                                uncore_event_cpu_online,
+                                uncore_event_cpu_offline);
+        if (ret)
+                goto err;
         return 0;
 
 err:
-        /* Undo box->init_box() */
-        on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1);
         uncore_types_exit(uncore_msr_uncores);
         uncore_pci_exit();
         return ret;
@@ -1429,9 +1381,7 @@ module_init(intel_uncore_init);
 
 static void __exit intel_uncore_exit(void)
 {
-        cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_UNCORE_ONLINE);
-        cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_UNCORE_STARTING);
-        cpuhp_remove_state_nocalls(CPUHP_PERF_X86_UNCORE_PREP);
+        cpuhp_remove_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE);
         uncore_types_exit(uncore_msr_uncores);
         uncore_pci_exit();
 }
diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
index 38711df3bcb5..2266f864b747 100644
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -140,6 +140,7 @@ extern void __init load_ucode_bsp(void);
 extern void load_ucode_ap(void);
 void reload_early_microcode(void);
 extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
+extern bool initrd_gone;
 #else
 static inline int __init microcode_init(void)                   { return 0; };
 static inline void __init load_ucode_bsp(void)                  { }
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 1be64da0384e..e6cfe7ba2d65 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -104,6 +104,7 @@ struct cpuinfo_x86 {
         __u8                    x86_phys_bits;
         /* CPUID returned core id bits: */
         __u8                    x86_coreid_bits;
+        __u8                    cu_id;
         /* Max extended CPUID function supported: */
         __u32                   extended_cpuid_level;
         /* Maximum supported CPUID level, -1=no CPUID: */
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 1e35dd06b090..bd6b8c270c24 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1875,7 +1875,6 @@ static struct irq_chip ioapic_chip __read_mostly = {
         .irq_ack                = irq_chip_ack_parent,
         .irq_eoi                = ioapic_ack_level,
         .irq_set_affinity       = ioapic_set_affinity,
-        .irq_retrigger          = irq_chip_retrigger_hierarchy,
         .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
@@ -1887,7 +1886,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
         .irq_ack                = irq_chip_ack_parent,
         .irq_eoi                = ioapic_ir_ack_level,
         .irq_set_affinity       = ioapic_set_affinity,
-        .irq_retrigger          = irq_chip_retrigger_hierarchy,
         .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
@@ -2117,6 +2115,7 @@ static inline void __init check_timer(void)
                         if (idx != -1 && irq_trigger(idx))
                                 unmask_ioapic_irq(irq_get_chip_data(0));
                 }
+                irq_domain_deactivate_irq(irq_data);
                 irq_domain_activate_irq(irq_data);
                 if (timer_irq_works()) {
                         if (disable_timer_pin_1 > 0)
@@ -2138,6 +2137,7 @@ static inline void __init check_timer(void)
                  * legacy devices should be connected to IO APIC #0
                  */
                 replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2);
+                irq_domain_deactivate_irq(irq_data);
                 irq_domain_activate_irq(irq_data);
                 legacy_pic->unmask(0);
                 if (timer_irq_works()) {
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 1d3167269a67..2b4cf04239b6 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -309,8 +309,22 @@ static void amd_get_topology(struct cpuinfo_x86 *c)
 
         /* get information required for multi-node processors */
         if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
+                u32 eax, ebx, ecx, edx;
 
-                node_id = cpuid_ecx(0x8000001e) & 7;
+                cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
+
+                node_id  = ecx & 0xff;
+                smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
+
+                if (c->x86 == 0x15)
+                        c->cu_id = ebx & 0xff;
+
+                if (c->x86 >= 0x17) {
+                        c->cpu_core_id = ebx & 0xff;
+
+                        if (smp_num_siblings > 1)
+                                c->x86_max_cores /= smp_num_siblings;
+                }
 
                 /*
                  * We may have multiple LLCs if L3 caches exist, so check if we
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 9bab7a8a4293..ede03e849a8b 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1015,6 +1015,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
         c->x86_model_id[0] = '\0';  /* Unset */
         c->x86_max_cores = 1;
         c->x86_coreid_bits = 0;
+        c->cu_id = 0xff;
 #ifdef CONFIG_X86_64
         c->x86_clflush_size = 64;
         c->x86_phys_bits = 36;
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 00ef43233e03..537c6647d84c 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1373,20 +1373,15 @@ static unsigned long mce_adjust_timer_default(unsigned long interval)
 
 static unsigned long (*mce_adjust_timer)(unsigned long interval) = mce_adjust_timer_default;
 
-static void __restart_timer(struct timer_list *t, unsigned long interval)
+static void __start_timer(struct timer_list *t, unsigned long interval)
 {
         unsigned long when = jiffies + interval;
         unsigned long flags;
 
         local_irq_save(flags);
 
-        if (timer_pending(t)) {
-                if (time_before(when, t->expires))
-                        mod_timer(t, when);
-        } else {
-                t->expires = round_jiffies(when);
-                add_timer_on(t, smp_processor_id());
-        }
+        if (!timer_pending(t) || time_before(when, t->expires))
+                mod_timer(t, round_jiffies(when));
 
         local_irq_restore(flags);
 }
@@ -1421,7 +1416,7 @@ static void mce_timer_fn(unsigned long data)
 
 done:
         __this_cpu_write(mce_next_interval, iv);
-        __restart_timer(t, iv);
+        __start_timer(t, iv);
 }
 
 /*
@@ -1432,7 +1427,7 @@ void mce_timer_kick(unsigned long interval)
         struct timer_list *t = this_cpu_ptr(&mce_timer);
         unsigned long iv = __this_cpu_read(mce_next_interval);
 
-        __restart_timer(t, interval);
+        __start_timer(t, interval);
 
         if (interval < iv)
                 __this_cpu_write(mce_next_interval, interval);
@@ -1779,17 +1774,15 @@ static void __mcheck_cpu_clear_vendor(struct cpuinfo_x86 *c)
         }
 }
 
-static void mce_start_timer(unsigned int cpu, struct timer_list *t)
+static void mce_start_timer(struct timer_list *t)
 {
         unsigned long iv = check_interval * HZ;
 
         if (mca_cfg.ignore_ce || !iv)
                 return;
 
-        per_cpu(mce_next_interval, cpu) = iv;
-
-        t->expires = round_jiffies(jiffies + iv);
-        add_timer_on(t, cpu);
+        this_cpu_write(mce_next_interval, iv);
+        __start_timer(t, iv);
 }
 
 static void __mcheck_cpu_setup_timer(void)
@@ -1806,7 +1799,7 @@ static void __mcheck_cpu_init_timer(void)
         unsigned int cpu = smp_processor_id();
 
         setup_pinned_timer(t, mce_timer_fn, cpu);
-        mce_start_timer(cpu, t);
+        mce_start_timer(t);
 }
 
 /* Handle unconfigured int18 (should never happen) */
@@ -2566,7 +2559,7 @@ static int mce_cpu_dead(unsigned int cpu)
 
 static int mce_cpu_online(unsigned int cpu)
 {
-        struct timer_list *t = &per_cpu(mce_timer, cpu);
+        struct timer_list *t = this_cpu_ptr(&mce_timer);
         int ret;
 
         mce_device_create(cpu);
@@ -2577,13 +2570,13 @@ static int mce_cpu_online(unsigned int cpu)
                 return ret;
         }
         mce_reenable_cpu();
-        mce_start_timer(cpu, t);
+        mce_start_timer(t);
         return 0;
 }
 
 static int mce_cpu_pre_down(unsigned int cpu)
 {
-        struct timer_list *t = &per_cpu(mce_timer, cpu);
+        struct timer_list *t = this_cpu_ptr(&mce_timer);
 
         mce_disable_cpu();
         del_timer_sync(t);
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 6a31e2691f3a..079e81733a58 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -384,8 +384,9 @@ void load_ucode_amd_ap(unsigned int family)
 reget:
                 if (!get_builtin_microcode(&cp, family)) {
 #ifdef CONFIG_BLK_DEV_INITRD
-                        cp = find_cpio_data(ucode_path, (void *)initrd_start,
-                                            initrd_end - initrd_start, NULL);
+                        if (!initrd_gone)
+                                cp = find_cpio_data(ucode_path, (void *)initrd_start,
+                                                    initrd_end - initrd_start, NULL);
 #endif
                         if (!(cp.data && cp.size)) {
                                 /*
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 2af69d27da62..73102d932760 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -46,6 +46,8 @@
 static struct microcode_ops     *microcode_ops;
 static bool dis_ucode_ldr = true;
 
+bool initrd_gone;
+
 LIST_HEAD(microcode_cache);
 
 /*
@@ -190,21 +192,24 @@ void load_ucode_ap(void)
 static int __init save_microcode_in_initrd(void)
 {
         struct cpuinfo_x86 *c = &boot_cpu_data;
+        int ret = -EINVAL;
 
         switch (c->x86_vendor) {
         case X86_VENDOR_INTEL:
                 if (c->x86 >= 6)
-                        return save_microcode_in_initrd_intel();
+                        ret = save_microcode_in_initrd_intel();
                 break;
         case X86_VENDOR_AMD:
                 if (c->x86 >= 0x10)
-                        return save_microcode_in_initrd_amd(c->x86);
+                        ret = save_microcode_in_initrd_amd(c->x86);
                 break;
         default:
                 break;
         }
 
-        return -EINVAL;
+        initrd_gone = true;
+
+        return ret;
 }
 
 struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa)
@@ -247,9 +252,16 @@ struct cpio_data find_microcode_in_initrd(const char *path, bool use_pa)
          * has the virtual address of the beginning of the initrd. It also
          * possibly relocates the ramdisk. In either case, initrd_start contains
          * the updated address so use that instead.
+         *
+         * initrd_gone is for the hotplug case where we've thrown out initrd
+         * already.
          */
-        if (!use_pa && initrd_start)
-                start = initrd_start;
+        if (!use_pa) {
+                if (initrd_gone)
+                        return (struct cpio_data){ NULL, 0, "" };
+                if (initrd_start)
+                        start = initrd_start;
+        }
 
         return find_cpio_data(path, (void *)start, size, NULL);
 #else /* !CONFIG_BLK_DEV_INITRD */
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 3f329b74e040..8325d8a09ab0 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -41,7 +41,7 @@
 
 static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin";
 
-/* Current microcode patch used in early patching */
+/* Current microcode patch used in early patching on the APs. */
 struct microcode_intel *intel_ucode_patch;
 
 static inline bool cpu_signatures_match(unsigned int s1, unsigned int p1,
@@ -607,12 +607,6 @@ int __init save_microcode_in_initrd_intel(void)
         struct ucode_cpu_info uci;
         struct cpio_data cp;
 
-        /*
-         * AP loading didn't find any microcode patch, no need to save anything.
-         */
-        if (!intel_ucode_patch || IS_ERR(intel_ucode_patch))
-                return 0;
-
         if (!load_builtin_intel_microcode(&cp))
                 cp = find_microcode_in_initrd(ucode_path, false);
 
@@ -628,7 +622,6 @@ int __init save_microcode_in_initrd_intel(void)
         return 0;
 }
 
-
 /*
  * @res_patch, output: a pointer to the patch we found.
  */
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index e4e97a5355ce..de7234401275 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -9,6 +9,7 @@
 #include <asm/fpu/regset.h>
 #include <asm/fpu/signal.h>
 #include <asm/fpu/types.h>
+#include <asm/fpu/xstate.h>
 #include <asm/traps.h>
 
 #include <linux/hardirq.h>
@@ -183,7 +184,8 @@ void fpstate_init(union fpregs_state *state)
          * it will #GP. Make sure it is replaced after the memset().
          */
         if (static_cpu_has(X86_FEATURE_XSAVES))
-                state->xsave.header.xcomp_bv = XCOMP_BV_COMPACTED_FORMAT;
+                state->xsave.header.xcomp_bv = XCOMP_BV_COMPACTED_FORMAT |
+                                               xfeatures_mask;
 
         if (static_cpu_has(X86_FEATURE_FXSR))
                 fpstate_init_fxstate(&state->fxsave);
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 85e87b46c318..dc6ba5bda9fc 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -352,6 +352,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
         } else {
                 struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
 
+                irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
                 irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
                 disable_irq(hdev->irq);
                 irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 46732dc3b73c..99b920d0e516 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -433,9 +433,15 @@ static bool match_smt(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
                 int cpu1 = c->cpu_index, cpu2 = o->cpu_index;
 
                 if (c->phys_proc_id == o->phys_proc_id &&
-                    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2) &&
-                    c->cpu_core_id == o->cpu_core_id)
-                        return topology_sane(c, o, "smt");
+                    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2)) {
+                        if (c->cpu_core_id == o->cpu_core_id)
+                                return topology_sane(c, o, "smt");
+
+                        if ((c->cu_id != 0xff) &&
+                            (o->cu_id != 0xff) &&
+                            (c->cu_id == o->cu_id))
+                                return topology_sane(c, o, "smt");
+                }
 
         } else if (c->phys_proc_id == o->phys_proc_id &&
                    c->cpu_core_id == o->cpu_core_id) {
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index e41af597aed8..37e7cf544e51 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1356,6 +1356,9 @@ void __init tsc_init(void)
                 (unsigned long)cpu_khz / 1000,
                 (unsigned long)cpu_khz % 1000);
 
+        /* Sanitize TSC ADJUST before cyc2ns gets initialized */
+        tsc_store_and_check_tsc_adjust(true);
+
         /*
          * Secondary CPUs do not run through tsc_init(), so set up
          * all the scale factors for all CPUs, assuming the same
@@ -1386,8 +1389,6 @@ void __init tsc_init(void)
 
         if (unsynchronized_tsc())
                 mark_tsc_unstable("TSCs unsynchronized");
-        else
-                tsc_store_and_check_tsc_adjust(true);
 
         check_system_tsc_reliable();
 
diff --git a/arch/x86/kernel/tsc_sync.c b/arch/x86/kernel/tsc_sync.c
index d0db011051a5..728f75378475 100644
--- a/arch/x86/kernel/tsc_sync.c
+++ b/arch/x86/kernel/tsc_sync.c
@@ -286,13 +286,6 @@ void check_tsc_sync_source(int cpu)
         if (unsynchronized_tsc())
                 return;
 
-        if (tsc_clocksource_reliable) {
-                if (cpu == (nr_cpu_ids-1) || system_state != SYSTEM_BOOTING)
-                        pr_info(
-                        "Skipped synchronization checks as TSC is reliable.\n");
-                return;
-        }
-
         /*
          * Set the maximum number of test runs to
          *  1 if the CPU does not provide the TSC_ADJUST MSR
@@ -380,14 +373,19 @@ void check_tsc_sync_target(void)
         int cpus = 2;
 
         /* Also aborts if there is no TSC. */
-        if (unsynchronized_tsc() || tsc_clocksource_reliable)
+        if (unsynchronized_tsc())
                 return;
 
         /*
          * Store, verify and sanitize the TSC adjust register. If
          * successful skip the test.
+         *
+         * The test is also skipped when the TSC is marked reliable. This
+         * is true for SoCs which have no fallback clocksource. On these
+         * SoCs the TSC is frequency synchronized, but still the TSC ADJUST
+         * register might have been wreckaged by the BIOS..
          */
-        if (tsc_store_and_check_tsc_adjust(false)) {
+        if (tsc_store_and_check_tsc_adjust(false) || tsc_clocksource_reliable) {
                 atomic_inc(&skip_test);
                 return;
         }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d153be8929a6..e52c9088660f 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3182,6 +3182,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
         memcpy(dest, xsave, XSAVE_HDR_OFFSET);
 
         /* Set XSTATE_BV */
+        xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
         *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
 
         /*
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index ea9c49adaa1f..8aa6bea1cd6c 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -15,6 +15,7 @@
 #include <linux/debugfs.h>
 #include <linux/mm.h>
 #include <linux/init.h>
+#include <linux/sched.h>
 #include <linux/seq_file.h>
 
 #include <asm/pgtable.h>
@@ -406,6 +407,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
                 } else
                         note_page(m, &st, __pgprot(0), 1);
 
+                cond_resched();
                 start++;
         }
 
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 319148bd4b05..2f25a363068c 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -269,6 +269,22 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
         efi_scratch.use_pgd = true;
 
         /*
+         * Certain firmware versions are way too sentimential and still believe
+         * they are exclusive and unquestionable owners of the first physical page,
+         * even though they explicitly mark it as EFI_CONVENTIONAL_MEMORY
+         * (but then write-access it later during SetVirtualAddressMap()).
+         *
+         * Create a 1:1 mapping for this page, to avoid triple faults during early
+         * boot with such firmware. We are free to hand this page to the BIOS,
+         * as trim_bios_range() will reserve the first page and isolate it away
+         * from memory allocators anyway.
+         */
+        if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) {
+                pr_err("Failed to create 1:1 mapping for the first page!\n");
+                return 1;
+        }
+
+        /*
          * When making calls to the firmware everything needs to be 1:1
          * mapped and addressable with 32-bit pointers. Map the kernel
          * text and allocate a new stack because we can't rely on the
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 848e8568fb3c..8fd4be610607 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -419,7 +419,7 @@ subsys_initcall(topology_init);
 
 void cpu_reset(void)
 {
-#if XCHAL_HAVE_PTP_MMU
+#if XCHAL_HAVE_PTP_MMU && IS_ENABLED(CONFIG_MMU)
         local_irq_disable();
         /*
          * We have full MMU: all autoload ways, ways 7, 8 and 9 of DTLB must
diff --git a/block/blk-lib.c b/block/blk-lib.c
index f8c82a9b4012..ed1e78e24db0 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -306,11 +306,6 @@ int __blkdev_issue_zeroout(struct block_device *bdev, sector_t sector,
         if (ret == 0 || (ret && ret != -EOPNOTSUPP))
                 goto out;
 
-        ret = __blkdev_issue_write_same(bdev, sector, nr_sects, gfp_mask,
-                        ZERO_PAGE(0), biop);
-        if (ret == 0 || (ret && ret != -EOPNOTSUPP))
-                goto out;
-
         ret = 0;
         while (nr_sects != 0) {
                 bio = next_bio(bio, min(nr_sects, (sector_t)BIO_MAX_PAGES),
@@ -369,6 +364,10 @@ int blkdev_issue_zeroout(struct block_device *bdev, sector_t sector,
                         return 0;
         }
 
+        if (!blkdev_issue_write_same(bdev, sector, nr_sects, gfp_mask,
+                        ZERO_PAGE(0)))
+                return 0;
+
         blk_start_plug(&plug);
         ret = __blkdev_issue_zeroout(bdev, sector, nr_sects, gfp_mask,
                         &bio, discard);
diff --git a/crypto/algapi.c b/crypto/algapi.c
index df939b54b09f..1fad2a6b3bbb 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -356,6 +356,7 @@ int crypto_register_alg(struct crypto_alg *alg)
         struct crypto_larval *larval;
         int err;
 
+        alg->cra_flags &= ~CRYPTO_ALG_DEAD;
         err = crypto_check_alg(alg);
         if (err)
                 return err;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index f849311e9fd4..533265f110e0 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -661,9 +661,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
 unlock:
         list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {
                 af_alg_free_sg(&rsgl->sgl);
+                list_del(&rsgl->list);
                 if (rsgl != &ctx->first_rsgl)
                         sock_kfree_s(sk, rsgl, sizeof(*rsgl));
-                list_del(&rsgl->list);
         }
         INIT_LIST_HEAD(&ctx->list);
         aead_wmem_wakeup(sk);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 2f82b8eba360..7361d00818e2 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
         struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
         struct device *dev = acpi_desc->dev;
         struct acpi_nfit_flush_work flush;
+        int rc;
 
         /* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
         device_lock(dev);
@@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
         INIT_WORK_ONSTACK(&flush.work, flush_probe);
         COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
         queue_work(nfit_wq, &flush.work);
-        return wait_for_completion_interruptible(&flush.cmp);
+
+        rc = wait_for_completion_interruptible(&flush.cmp);
+        cancel_work_sync(&flush.work);
+        return rc;
 }
 
 static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 9cd0a2d41816..c2d3785ec227 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1702,6 +1702,8 @@ unsigned ata_exec_internal_sg(struct ata_device *dev,
 
                 if (qc->err_mask & ~AC_ERR_OTHER)
                         qc->err_mask &= ~AC_ERR_OTHER;
+        } else if (qc->tf.command == ATA_CMD_REQ_SENSE_DATA) {
+                qc->result_tf.command |= ATA_SENSE;
         }
 
         /* finish up */
@@ -4356,10 +4358,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "ST380013AS",         "3.20",         ATA_HORKAGE_MAX_SEC_1024 },
 
         /*
-         * Device times out with higher max sects.
+         * These devices time out with higher max sects.
          * https://bugzilla.kernel.org/show_bug.cgi?id=121671
          */
-        { "LITEON CX1-JB256-HP", NULL,          ATA_HORKAGE_MAX_SEC_1024 },
+        { "LITEON CX1-JB*-HP",  NULL,           ATA_HORKAGE_MAX_SEC_1024 },
 
         /* Devices we expect to fail diagnostics */
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 823e938c9a78..2f32782cea6d 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4132,6 +4132,9 @@ static int mv_platform_probe(struct platform_device *pdev)
         host->iomap = NULL;
         hpriv->base = devm_ioremap(&pdev->dev, res->start,
                                    resource_size(res));
+        if (!hpriv->base)
+                return -ENOMEM;
+
         hpriv->base -= SATAHC0_REG_BASE;
 
         hpriv->clk = clk_get(&pdev->dev, NULL);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 4497d263209f..ac350c518e0c 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -558,9 +558,6 @@ static void fw_load_abort(struct firmware_priv *fw_priv)
         struct firmware_buf *buf = fw_priv->buf;
 
         __fw_load_abort(buf);
-
-        /* avoid user action after loading abort */
-        fw_priv->buf = NULL;
 }
 
 static LIST_HEAD(pending_fw_head);
@@ -713,7 +710,7 @@ static ssize_t firmware_loading_store(struct device *dev,
 
         mutex_lock(&fw_lock);
         fw_buf = fw_priv->buf;
-        if (!fw_buf)
+        if (fw_state_is_aborted(&fw_buf->fw_st))
                 goto out;
 
         switch (loading) {
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index dacb6a8418aa..fa26ffd25fa6 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -389,33 +389,33 @@ static ssize_t show_valid_zones(struct device *dev,
 {
         struct memory_block *mem = to_memory_block(dev);
         unsigned long start_pfn, end_pfn;
+        unsigned long valid_start, valid_end, valid_pages;
         unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
-        struct page *first_page;
         struct zone *zone;
         int zone_shift = 0;
 
         start_pfn = section_nr_to_pfn(mem->start_section_nr);
         end_pfn = start_pfn + nr_pages;
-        first_page = pfn_to_page(start_pfn);
 
         /* The block contains more than one zone can not be offlined. */
-        if (!test_pages_in_a_zone(start_pfn, end_pfn))
+        if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
                 return sprintf(buf, "none\n");
 
-        zone = page_zone(first_page);
+        zone = page_zone(pfn_to_page(valid_start));
+        valid_pages = valid_end - valid_start;
 
         /* MMOP_ONLINE_KEEP */
         sprintf(buf, "%s", zone->name);
 
         /* MMOP_ONLINE_KERNEL */
-        zone_can_shift(start_pfn, nr_pages, ZONE_NORMAL, &zone_shift);
+        zone_can_shift(valid_start, valid_pages, ZONE_NORMAL, &zone_shift);
         if (zone_shift) {
                 strcat(buf, " ");
                 strcat(buf, (zone + zone_shift)->name);
         }
 
         /* MMOP_ONLINE_MOVABLE */
-        zone_can_shift(start_pfn, nr_pages, ZONE_MOVABLE, &zone_shift);
+        zone_can_shift(valid_start, valid_pages, ZONE_MOVABLE, &zone_shift);
         if (zone_shift) {
                 strcat(buf, " ");
                 strcat(buf, (zone + zone_shift)->name);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 872eac4cb1df..a14fac6a01d3 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -966,13 +966,13 @@ int __pm_runtime_idle(struct device *dev, int rpmflags)
         unsigned long flags;
         int retval;
 
-        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
-
         if (rpmflags & RPM_GET_PUT) {
                 if (!atomic_dec_and_test(&dev->power.usage_count))
                         return 0;
         }
 
+        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+
         spin_lock_irqsave(&dev->power.lock, flags);
         retval = rpm_idle(dev, rpmflags);
         spin_unlock_irqrestore(&dev->power.lock, flags);
@@ -998,13 +998,13 @@ int __pm_runtime_suspend(struct device *dev, int rpmflags)
         unsigned long flags;
         int retval;
 
-        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
-
         if (rpmflags & RPM_GET_PUT) {
                 if (!atomic_dec_and_test(&dev->power.usage_count))
                         return 0;
         }
 
+        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+
         spin_lock_irqsave(&dev->power.lock, flags);
         retval = rpm_suspend(dev, rpmflags);
         spin_unlock_irqrestore(&dev->power.lock, flags);
@@ -1029,7 +1029,8 @@ int __pm_runtime_resume(struct device *dev, int rpmflags)
         unsigned long flags;
         int retval;
 
-        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe);
+        might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe &&
+                        dev->power.runtime_status != RPM_ACTIVE);
 
         if (rpmflags & RPM_GET_PUT)
                 atomic_inc(&dev->power.usage_count);
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index f642c4264c27..168fa175d65a 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -45,6 +45,9 @@ int bcma_sprom_get(struct bcma_bus *bus);
 void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
 void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
 void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
+#endif /* CONFIG_BCMA_DRIVER_MIPS */
 
 /* driver_chipcommon_b.c */
 int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb);
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index b4f6520e74f0..62f5bfa5065d 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -15,8 +15,6 @@
 #include <linux/platform_device.h>
 #include <linux/bcma/bcma.h>
 
-static void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
-
 static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
                                          u32 mask, u32 value)
 {
@@ -186,9 +184,6 @@ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
         if (cc->capabilities & BCMA_CC_CAP_PMU)
                 bcma_pmu_early_init(cc);
 
-        if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
-                bcma_chipco_serial_init(cc);
-
         if (bus->hosttype == BCMA_HOSTTYPE_SOC)
                 bcma_core_chipcommon_flash_detect(cc);
 
@@ -378,9 +373,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value)
         return res;
 }
 
-static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
 {
-#if IS_BUILTIN(CONFIG_BCM47XX)
         unsigned int irq;
         u32 baud_base;
         u32 i;
@@ -422,5 +417,5 @@ static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
                 ports[i].baud_base = baud_base;
                 ports[i].reg_shift = 0;
         }
-#endif /* CONFIG_BCM47XX */
 }
+#endif /* CONFIG_BCMA_DRIVER_MIPS */
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index 96f171328200..89af807cf29c 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -278,9 +278,12 @@ static void bcma_core_mips_nvram_init(struct bcma_drv_mips *mcore)
 
 void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
 {
+        struct bcma_bus *bus = mcore->core->bus;
+
         if (mcore->early_setup_done)
                 return;
 
+        bcma_chipco_serial_init(&bus->drv_cc);
         bcma_core_mips_nvram_init(mcore);
 
         mcore->early_setup_done = true;
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 6ce5ce8be2f2..87fba424817e 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -92,7 +92,6 @@ static void add_early_randomness(struct hwrng *rng)
         mutex_unlock(&reading_mutex);
         if (bytes_read > 0)
                 add_device_randomness(rng_buffer, bytes_read);
-        memset(rng_buffer, 0, size);
 }
 
 static inline void cleanup_rng(struct kref *kref)
@@ -288,7 +287,6 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
                 }
         }
 out:
-        memset(rng_buffer, 0, rng_buffer_size());
         return ret ? : err;
 
 out_unlock_reading:
@@ -427,7 +425,6 @@ static int hwrng_fillfn(void *unused)
                 /* Outside lock, sure, but y'know: randomness. */
                 add_hwgenerator_randomness((void *)rng_fillbuf, rc,
                                            rc * current_quality * 8 >> 10);
-                memset(rng_fillbuf, 0, rng_buffer_size());
         }
         hwrng_fill = NULL;
         return 0;
diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 4fda623e55bb..c94360671f41 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -784,8 +784,19 @@ static int brcm_avs_target_index(struct cpufreq_policy *policy,
 static int brcm_avs_suspend(struct cpufreq_policy *policy)
 {
         struct private_data *priv = policy->driver_data;
+        int ret;
+
+        ret = brcm_avs_get_pmap(priv, &priv->pmap);
+        if (ret)
+                return ret;
 
-        return brcm_avs_get_pmap(priv, &priv->pmap);
+        /*
+         * We can't use the P-state returned by brcm_avs_get_pmap(), since
+         * that's the initial P-state from when the P-map was downloaded to the
+         * AVS co-processor, not necessarily the P-state we are running at now.
+         * So, we get the current P-state explicitly.
+         */
+        return brcm_avs_get_pstate(priv, &priv->pmap.state);
 }
 
 static int brcm_avs_resume(struct cpufreq_policy *policy)
@@ -954,9 +965,9 @@ static ssize_t show_brcm_avs_pmap(struct cpufreq_policy *policy, char *buf)
         brcm_avs_parse_p1(pmap.p1, &mdiv_p0, &pdiv, &ndiv);
         brcm_avs_parse_p2(pmap.p2, &mdiv_p1, &mdiv_p2, &mdiv_p3, &mdiv_p4);
 
-        return sprintf(buf, "0x%08x 0x%08x %u %u %u %u %u %u %u\n",
+        return sprintf(buf, "0x%08x 0x%08x %u %u %u %u %u %u %u %u %u\n",
                 pmap.p1, pmap.p2, ndiv, pdiv, mdiv_p0, mdiv_p1, mdiv_p2,
-                mdiv_p3, mdiv_p4);
+                mdiv_p3, mdiv_p4, pmap.mode, pmap.state);
 }
 
 static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index a54d65aa776d..50bd6d987fc3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1235,6 +1235,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
                 cpudata->epp_default = intel_pstate_get_epp(cpudata, 0);
 }
 
+#define MSR_IA32_POWER_CTL_BIT_EE       19
+
+/* Disable energy efficiency optimization */
+static void intel_pstate_disable_ee(int cpu)
+{
+        u64 power_ctl;
+        int ret;
+
+        ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl);
+        if (ret)
+                return;
+
+        if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) {
+                pr_info("Disabling energy efficiency optimization\n");
+                power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE);
+                wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl);
+        }
+}
+
 static int atom_get_min_pstate(void)
 {
         u64 value;
@@ -1845,6 +1864,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
         {}
 };
 
+static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
+        ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
+        {}
+};
+
 static int intel_pstate_init_cpu(unsigned int cpunum)
 {
         struct cpudata *cpu;
@@ -1875,6 +1899,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
         cpu->cpu = cpunum;
 
         if (hwp_active) {
+                const struct x86_cpu_id *id;
+
+                id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids);
+                if (id)
+                        intel_pstate_disable_ee(cpunum);
+
                 intel_pstate_hwp_enable(cpu);
                 pid_params.sample_rate_ms = 50;
                 pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index e2ce8190ecc9..612898b4aaad 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -959,7 +959,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data)
 static void ccp5_config(struct ccp_device *ccp)
 {
         /* Public side */
-        iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
+        iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
 }
 
 static void ccp5other_config(struct ccp_device *ccp)
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 830f35e6005f..649e5610a5ce 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -238,6 +238,7 @@ struct ccp_dma_chan {
         struct ccp_device *ccp;
 
         spinlock_t lock;
+        struct list_head created;
         struct list_head pending;
         struct list_head active;
         struct list_head complete;
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
index 6553912804f7..e5d9278f4019 100644
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan)
         ccp_free_desc_resources(chan->ccp, &chan->complete);
         ccp_free_desc_resources(chan->ccp, &chan->active);
         ccp_free_desc_resources(chan->ccp, &chan->pending);
+        ccp_free_desc_resources(chan->ccp, &chan->created);
 
         spin_unlock_irqrestore(&chan->lock, flags);
 }
@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc)
         spin_lock_irqsave(&chan->lock, flags);
 
         cookie = dma_cookie_assign(tx_desc);
+        list_del(&desc->entry);
         list_add_tail(&desc->entry, &chan->pending);
 
         spin_unlock_irqrestore(&chan->lock, flags);
@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
 
         spin_lock_irqsave(&chan->lock, sflags);
 
-        list_add_tail(&desc->entry, &chan->pending);
+        list_add_tail(&desc->entry, &chan->created);
 
         spin_unlock_irqrestore(&chan->lock, sflags);
 
@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
         /*TODO: Purge the complete list? */
         ccp_free_desc_resources(chan->ccp, &chan->active);
         ccp_free_desc_resources(chan->ccp, &chan->pending);
+        ccp_free_desc_resources(chan->ccp, &chan->created);
 
         spin_unlock_irqrestore(&chan->lock, flags);
 
@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
                 chan->ccp = ccp;
 
                 spin_lock_init(&chan->lock);
+                INIT_LIST_HEAD(&chan->created);
                 INIT_LIST_HEAD(&chan->pending);
                 INIT_LIST_HEAD(&chan->active);
                 INIT_LIST_HEAD(&chan->complete);
diff --git a/drivers/crypto/chelsio/chcr_algo.c b/drivers/crypto/chelsio/chcr_algo.c
index 2ed1e24b44a8..b4b78b37f8a6 100644
--- a/drivers/crypto/chelsio/chcr_algo.c
+++ b/drivers/crypto/chelsio/chcr_algo.c
@@ -158,7 +158,7 @@ int chcr_handle_resp(struct crypto_async_request *req, unsigned char *input,
         case CRYPTO_ALG_TYPE_AEAD:
                 ctx_req.req.aead_req = (struct aead_request *)req;
                 ctx_req.ctx.reqctx = aead_request_ctx(ctx_req.req.aead_req);
-                dma_unmap_sg(&u_ctx->lldi.pdev->dev, ctx_req.req.aead_req->dst,
+                dma_unmap_sg(&u_ctx->lldi.pdev->dev, ctx_req.ctx.reqctx->dst,
                              ctx_req.ctx.reqctx->dst_nents, DMA_FROM_DEVICE);
                 if (ctx_req.ctx.reqctx->skb) {
                         kfree_skb(ctx_req.ctx.reqctx->skb);
@@ -1362,8 +1362,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
         struct chcr_wr *chcr_req;
         struct cpl_rx_phys_dsgl *phys_cpl;
         struct phys_sge_parm sg_param;
-        struct scatterlist *src, *dst;
-        struct scatterlist src_sg[2], dst_sg[2];
+        struct scatterlist *src;
         unsigned int frags = 0, transhdr_len;
         unsigned int ivsize = crypto_aead_ivsize(tfm), dst_size = 0;
         unsigned int   kctx_len = 0;
@@ -1383,19 +1382,21 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
 
         if (sg_nents_for_len(req->src, req->assoclen + req->cryptlen) < 0)
                 goto err;
-        src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
-        dst = src;
+        src = scatterwalk_ffwd(reqctx->srcffwd, req->src, req->assoclen);
+        reqctx->dst = src;
+
         if (req->src != req->dst) {
                 err = chcr_copy_assoc(req, aeadctx);
                 if (err)
                         return ERR_PTR(err);
-                dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
+                reqctx->dst = scatterwalk_ffwd(reqctx->dstffwd, req->dst,
+                                               req->assoclen);
         }
         if (get_aead_subtype(tfm) == CRYPTO_ALG_SUB_TYPE_AEAD_NULL) {
                 null = 1;
                 assoclen = 0;
         }
-        reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
+        reqctx->dst_nents = sg_nents_for_len(reqctx->dst, req->cryptlen +
                                              (op_type ? -authsize : authsize));
         if (reqctx->dst_nents <= 0) {
                 pr_err("AUTHENC:Invalid Destination sg entries\n");
@@ -1460,7 +1461,7 @@ static struct sk_buff *create_authenc_wr(struct aead_request *req,
         sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
         sg_param.qid = qid;
         sg_param.align = 0;
-        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, dst,
+        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, reqctx->dst,
                                   &sg_param))
                 goto dstmap_fail;
 
@@ -1711,8 +1712,7 @@ static struct sk_buff *create_aead_ccm_wr(struct aead_request *req,
         struct chcr_wr *chcr_req;
         struct cpl_rx_phys_dsgl *phys_cpl;
         struct phys_sge_parm sg_param;
-        struct scatterlist *src, *dst;
-        struct scatterlist src_sg[2], dst_sg[2];
+        struct scatterlist *src;
         unsigned int frags = 0, transhdr_len, ivsize = AES_BLOCK_SIZE;
         unsigned int dst_size = 0, kctx_len;
         unsigned int sub_type;
@@ -1728,17 +1728,19 @@ static struct sk_buff *create_aead_ccm_wr(struct aead_request *req,
         if (sg_nents_for_len(req->src, req->assoclen + req->cryptlen) < 0)
                 goto err;
         sub_type = get_aead_subtype(tfm);
-        src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
-        dst = src;
+        src = scatterwalk_ffwd(reqctx->srcffwd, req->src, req->assoclen);
+        reqctx->dst = src;
+
         if (req->src != req->dst) {
                 err = chcr_copy_assoc(req, aeadctx);
                 if (err) {
                         pr_err("AAD copy to destination buffer fails\n");
                         return ERR_PTR(err);
                 }
-                dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
+                reqctx->dst = scatterwalk_ffwd(reqctx->dstffwd, req->dst,
+                                               req->assoclen);
         }
-        reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
+        reqctx->dst_nents = sg_nents_for_len(reqctx->dst, req->cryptlen +
                                              (op_type ? -authsize : authsize));
         if (reqctx->dst_nents <= 0) {
                 pr_err("CCM:Invalid Destination sg entries\n");
@@ -1777,7 +1779,7 @@ static struct sk_buff *create_aead_ccm_wr(struct aead_request *req,
         sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
         sg_param.qid = qid;
         sg_param.align = 0;
-        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, dst,
+        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, reqctx->dst,
                                   &sg_param))
                 goto dstmap_fail;
 
@@ -1809,8 +1811,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
         struct chcr_wr *chcr_req;
         struct cpl_rx_phys_dsgl *phys_cpl;
         struct phys_sge_parm sg_param;
-        struct scatterlist *src, *dst;
-        struct scatterlist src_sg[2], dst_sg[2];
+        struct scatterlist *src;
         unsigned int frags = 0, transhdr_len;
         unsigned int ivsize = AES_BLOCK_SIZE;
         unsigned int dst_size = 0, kctx_len;
@@ -1832,13 +1833,14 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
         if (sg_nents_for_len(req->src, req->assoclen + req->cryptlen) < 0)
                 goto err;
 
-        src = scatterwalk_ffwd(src_sg, req->src, req->assoclen);
-        dst = src;
+        src = scatterwalk_ffwd(reqctx->srcffwd, req->src, req->assoclen);
+        reqctx->dst = src;
         if (req->src != req->dst) {
                 err = chcr_copy_assoc(req, aeadctx);
                 if (err)
                         return  ERR_PTR(err);
-                dst = scatterwalk_ffwd(dst_sg, req->dst, req->assoclen);
+                reqctx->dst = scatterwalk_ffwd(reqctx->dstffwd, req->dst,
+                                               req->assoclen);
         }
 
         if (!req->cryptlen)
@@ -1848,7 +1850,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
                 crypt_len = AES_BLOCK_SIZE;
         else
                 crypt_len = req->cryptlen;
-        reqctx->dst_nents = sg_nents_for_len(dst, req->cryptlen +
+        reqctx->dst_nents = sg_nents_for_len(reqctx->dst, req->cryptlen +
                                              (op_type ? -authsize : authsize));
         if (reqctx->dst_nents <= 0) {
                 pr_err("GCM:Invalid Destination sg entries\n");
@@ -1923,7 +1925,7 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
         sg_param.obsize = req->cryptlen + (op_type ? -authsize : authsize);
         sg_param.qid = qid;
         sg_param.align = 0;
-        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, dst,
+        if (map_writesg_phys_cpl(&u_ctx->lldi.pdev->dev, phys_cpl, reqctx->dst,
                                   &sg_param))
                 goto dstmap_fail;
 
@@ -1937,7 +1939,8 @@ static struct sk_buff *create_gcm_wr(struct aead_request *req,
                 write_sg_to_skb(skb, &frags, src, req->cryptlen);
         } else {
                 aes_gcm_empty_pld_pad(req->dst, authsize - 1);
-                write_sg_to_skb(skb, &frags, dst, crypt_len);
+                write_sg_to_skb(skb, &frags, reqctx->dst, crypt_len);
+
         }
 
         create_wreq(ctx, chcr_req, req, skb, kctx_len, size, 1,
@@ -2189,8 +2192,8 @@ static int chcr_gcm_setkey(struct crypto_aead *aead, const u8 *key,
         unsigned int ck_size;
         int ret = 0, key_ctx_size = 0;
 
-        if (get_aead_subtype(aead) ==
-            CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106) {
+        if (get_aead_subtype(aead) == CRYPTO_ALG_SUB_TYPE_AEAD_RFC4106 &&
+            keylen > 3) {
                 keylen -= 4;  /* nonce/salt is present in the last 4 bytes */
                 memcpy(aeadctx->salt, key + keylen, 4);
         }
diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c
index 918da8e6e2d8..1c65f07e1cc9 100644
--- a/drivers/crypto/chelsio/chcr_core.c
+++ b/drivers/crypto/chelsio/chcr_core.c
@@ -52,6 +52,7 @@ static struct cxgb4_uld_info chcr_uld_info = {
 int assign_chcr_device(struct chcr_dev **dev)
 {
         struct uld_ctx *u_ctx;
+        int ret = -ENXIO;
 
         /*
          * Which device to use if multiple devices are available TODO
@@ -59,15 +60,14 @@ int assign_chcr_device(struct chcr_dev **dev)
          * must go to the same device to maintain the ordering.
          */
         mutex_lock(&dev_mutex); /* TODO ? */
-        u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry);
-        if (!u_ctx) {
-                mutex_unlock(&dev_mutex);
-                return -ENXIO;
+        list_for_each_entry(u_ctx, &uld_ctx_list, entry)
+                if (u_ctx && u_ctx->dev) {
+                        *dev = u_ctx->dev;
+                        ret = 0;
+                        break;
         }
-
-        *dev = u_ctx->dev;
         mutex_unlock(&dev_mutex);
-        return 0;
+        return ret;
 }
 
 static int chcr_dev_add(struct uld_ctx *u_ctx)
@@ -202,10 +202,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state)
 
 static int __init chcr_crypto_init(void)
 {
-        if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) {
+        if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info))
                 pr_err("ULD register fail: No chcr crypto support in cxgb4");
-                return -1;
-        }
 
         return 0;
 }
diff --git a/drivers/crypto/chelsio/chcr_crypto.h b/drivers/crypto/chelsio/chcr_crypto.h
index d5af7d64a763..7ec0a8f12475 100644
--- a/drivers/crypto/chelsio/chcr_crypto.h
+++ b/drivers/crypto/chelsio/chcr_crypto.h
@@ -158,6 +158,9 @@ struct ablk_ctx {
 };
 struct chcr_aead_reqctx {
         struct  sk_buff *skb;
+        struct scatterlist *dst;
+        struct scatterlist srcffwd[2];
+        struct scatterlist dstffwd[2];
         short int dst_nents;
         u16 verify;
         u8 iv[CHCR_MAX_CRYPTO_IV_LEN];
diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
index bc5cbc193aae..5b2d78a5b5aa 100644
--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
+++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                               &hw_data->accel_capabilities_mask);
 
         /* Find and map all the device's BARS */
-        i = 0;
+        i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
         bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
         for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
                          ADF_PCI_MAX_BARS * 2) {
diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index e8822536530b..33f0a6251e38 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -69,6 +69,7 @@
 #define ADF_ERRSOU5 (0x3A000 + 0xD8)
 #define ADF_DEVICE_FUSECTL_OFFSET 0x40
 #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C
+#define ADF_DEVICE_FUSECTL_MASK 0x80000000
 #define ADF_PCI_MAX_BARS 3
 #define ADF_DEVICE_NAME_LENGTH 32
 #define ADF_ETR_MAX_RINGS_PER_BANK 16
diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
index 1e480f140663..8c4fd255a601 100644
--- a/drivers/crypto/qat/qat_common/qat_hal.c
+++ b/drivers/crypto/qat/qat_common/qat_hal.c
@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
         unsigned int csr_val;
         int times = 30;
 
-        if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID)
+        if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID)
                 return 0;
 
         csr_val = ADF_CSR_RD(csr_addr, 0);
@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
                 (void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v +
                                  LOCAL_TO_XFER_REG_OFFSET);
         handle->pci_dev = pci_info->pci_dev;
-        if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) {
+        if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) {
                 sram_bar =
                         &pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)];
                 handle->hal_sram_addr_v = sram_bar->virt_addr;
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index d5ba43a87a68..200828c60db9 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -153,6 +153,8 @@ struct cppi41_dd {
 
         /* context for suspend/resume */
         unsigned int dma_tdfdq;
+
+        bool is_suspended;
 };
 
 #define FIST_COMPLETION_QUEUE   93
@@ -257,6 +259,10 @@ static struct cppi41_channel *desc_to_chan(struct cppi41_dd *cdd, u32 desc)
         BUG_ON(desc_num >= ALLOC_DECS_NUM);
         c = cdd->chan_busy[desc_num];
         cdd->chan_busy[desc_num] = NULL;
+
+        /* Usecount for chan_busy[], paired with push_desc_queue() */
+        pm_runtime_put(cdd->ddev.dev);
+
         return c;
 }
 
@@ -317,12 +323,12 @@ static irqreturn_t cppi41_irq(int irq, void *data)
 
                 while (val) {
                         u32 desc, len;
-                        int error;
 
-                        error = pm_runtime_get(cdd->ddev.dev);
-                        if (error < 0)
-                                dev_err(cdd->ddev.dev, "%s pm runtime get: %i\n",
-                                        __func__, error);
+                        /*
+                         * This should never trigger, see the comments in
+                         * push_desc_queue()
+                         */
+                        WARN_ON(cdd->is_suspended);
 
                         q_num = __fls(val);
                         val &= ~(1 << q_num);
@@ -343,9 +349,6 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                         c->residue = pd_trans_len(c->desc->pd6) - len;
                         dma_cookie_complete(&c->txd);
                         dmaengine_desc_get_callback_invoke(&c->txd, NULL);
-
-                        pm_runtime_mark_last_busy(cdd->ddev.dev);
-                        pm_runtime_put_autosuspend(cdd->ddev.dev);
                 }
         }
         return IRQ_HANDLED;
@@ -447,6 +450,15 @@ static void push_desc_queue(struct cppi41_channel *c)
          */
         __iowmb();
 
+        /*
+         * DMA transfers can take at least 200ms to complete with USB mass
+         * storage connected. To prevent autosuspend timeouts, we must use
+         * pm_runtime_get/put() when chan_busy[] is modified. This will get
+         * cleared in desc_to_chan() or cppi41_stop_chan() depending on the
+         * outcome of the transfer.
+         */
+        pm_runtime_get(cdd->ddev.dev);
+
         desc_phys = lower_32_bits(c->desc_phys);
         desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
         WARN_ON(cdd->chan_busy[desc_num]);
@@ -457,20 +469,26 @@ static void push_desc_queue(struct cppi41_channel *c)
         cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num));
 }
 
-static void pending_desc(struct cppi41_channel *c)
+/*
+ * Caller must hold cdd->lock to prevent push_desc_queue()
+ * getting called out of order. We have both cppi41_dma_issue_pending()
+ * and cppi41_runtime_resume() call this function.
+ */
+static void cppi41_run_queue(struct cppi41_dd *cdd)
 {
-        struct cppi41_dd *cdd = c->cdd;
-        unsigned long flags;
+        struct cppi41_channel *c, *_c;
 
-        spin_lock_irqsave(&cdd->lock, flags);
-        list_add_tail(&c->node, &cdd->pending);
-        spin_unlock_irqrestore(&cdd->lock, flags);
+        list_for_each_entry_safe(c, _c, &cdd->pending, node) {
+                push_desc_queue(c);
+                list_del(&c->node);
+        }
 }
 
 static void cppi41_dma_issue_pending(struct dma_chan *chan)
 {
         struct cppi41_channel *c = to_cpp41_chan(chan);
         struct cppi41_dd *cdd = c->cdd;
+        unsigned long flags;
         int error;
 
         error = pm_runtime_get(cdd->ddev.dev);
@@ -482,10 +500,11 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
                 return;
         }
 
-        if (likely(pm_runtime_active(cdd->ddev.dev)))
-                push_desc_queue(c);
-        else
-                pending_desc(c);
+        spin_lock_irqsave(&cdd->lock, flags);
+        list_add_tail(&c->node, &cdd->pending);
+        if (!cdd->is_suspended)
+                cppi41_run_queue(cdd);
+        spin_unlock_irqrestore(&cdd->lock, flags);
 
         pm_runtime_mark_last_busy(cdd->ddev.dev);
         pm_runtime_put_autosuspend(cdd->ddev.dev);
@@ -705,6 +724,9 @@ static int cppi41_stop_chan(struct dma_chan *chan)
         WARN_ON(!cdd->chan_busy[desc_num]);
         cdd->chan_busy[desc_num] = NULL;
 
+        /* Usecount for chan_busy[], paired with push_desc_queue() */
+        pm_runtime_put(cdd->ddev.dev);
+
         return 0;
 }
 
@@ -1150,8 +1172,12 @@ static int __maybe_unused cppi41_resume(struct device *dev)
 static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
 {
         struct cppi41_dd *cdd = dev_get_drvdata(dev);
+        unsigned long flags;
 
+        spin_lock_irqsave(&cdd->lock, flags);
+        cdd->is_suspended = true;
         WARN_ON(!list_empty(&cdd->pending));
+        spin_unlock_irqrestore(&cdd->lock, flags);
 
         return 0;
 }
@@ -1159,14 +1185,11 @@ static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
 static int __maybe_unused cppi41_runtime_resume(struct device *dev)
 {
         struct cppi41_dd *cdd = dev_get_drvdata(dev);
-        struct cppi41_channel *c, *_c;
         unsigned long flags;
 
         spin_lock_irqsave(&cdd->lock, flags);
-        list_for_each_entry_safe(c, _c, &cdd->pending, node) {
-                push_desc_queue(c);
-                list_del(&c->node);
-        }
+        cdd->is_suspended = false;
+        cppi41_run_queue(cdd);
         spin_unlock_irqrestore(&cdd->lock, flags);
 
         return 0;
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 740bbb942594..7539f73df9e0 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1699,7 +1699,6 @@ static bool _chan_ns(const struct pl330_dmac *pl330, int i)
 static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330)
 {
         struct pl330_thread *thrd = NULL;
-        unsigned long flags;
         int chans, i;
 
         if (pl330->state == DYING)
@@ -1707,8 +1706,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330)
 
         chans = pl330->pcfg.num_chan;
 
-        spin_lock_irqsave(&pl330->lock, flags);
-
         for (i = 0; i < chans; i++) {
                 thrd = &pl330->channels[i];
                 if ((thrd->free) && (!_manager_ns(thrd) ||
@@ -1726,8 +1723,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330)
                 thrd = NULL;
         }
 
-        spin_unlock_irqrestore(&pl330->lock, flags);
-
         return thrd;
 }
 
@@ -1745,7 +1740,6 @@ static inline void _free_event(struct pl330_thread *thrd, int ev)
 static void pl330_release_channel(struct pl330_thread *thrd)
 {
         struct pl330_dmac *pl330;
-        unsigned long flags;
 
         if (!thrd || thrd->free)
                 return;
@@ -1757,10 +1751,8 @@ static void pl330_release_channel(struct pl330_thread *thrd)
 
         pl330 = thrd->dmac;
 
-        spin_lock_irqsave(&pl330->lock, flags);
         _free_event(thrd, thrd->ev);
         thrd->free = true;
-        spin_unlock_irqrestore(&pl330->lock, flags);
 }
 
 /* Initialize the structure for PL330 configuration, that can be used
@@ -2122,20 +2114,20 @@ static int pl330_alloc_chan_resources(struct dma_chan *chan)
         struct pl330_dmac *pl330 = pch->dmac;
         unsigned long flags;
 
-        spin_lock_irqsave(&pch->lock, flags);
+        spin_lock_irqsave(&pl330->lock, flags);
 
         dma_cookie_init(chan);
         pch->cyclic = false;
 
         pch->thread = pl330_request_channel(pl330);
         if (!pch->thread) {
-                spin_unlock_irqrestore(&pch->lock, flags);
+                spin_unlock_irqrestore(&pl330->lock, flags);
                 return -ENOMEM;
         }
 
         tasklet_init(&pch->task, pl330_tasklet, (unsigned long) pch);
 
-        spin_unlock_irqrestore(&pch->lock, flags);
+        spin_unlock_irqrestore(&pl330->lock, flags);
 
         return 1;
 }
@@ -2238,12 +2230,13 @@ static int pl330_pause(struct dma_chan *chan)
 static void pl330_free_chan_resources(struct dma_chan *chan)
 {
         struct dma_pl330_chan *pch = to_pchan(chan);
+        struct pl330_dmac *pl330 = pch->dmac;
         unsigned long flags;
 
         tasklet_kill(&pch->task);
 
         pm_runtime_get_sync(pch->dmac->ddma.dev);
-        spin_lock_irqsave(&pch->lock, flags);
+        spin_lock_irqsave(&pl330->lock, flags);
 
         pl330_release_channel(pch->thread);
         pch->thread = NULL;
@@ -2251,7 +2244,7 @@ static void pl330_free_chan_resources(struct dma_chan *chan)
         if (pch->cyclic)
                 list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool);
 
-        spin_unlock_irqrestore(&pch->lock, flags);
+        spin_unlock_irqrestore(&pl330->lock, flags);
         pm_runtime_mark_last_busy(pch->dmac->ddma.dev);
         pm_runtime_put_autosuspend(pch->dmac->ddma.dev);
 }
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index 921dfa047202..260c4b4b492e 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -187,6 +187,7 @@ static efi_status_t update_fdt_memmap(void *fdt, struct efi_boot_memmap *map)
 struct exit_boot_struct {
         efi_memory_desc_t *runtime_map;
         int *runtime_entry_count;
+        void *new_fdt_addr;
 };
 
 static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
@@ -202,7 +203,7 @@ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
         efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
                         p->runtime_map, p->runtime_entry_count);
 
-        return EFI_SUCCESS;
+        return update_fdt_memmap(p->new_fdt_addr, map);
 }
 
 /*
@@ -300,22 +301,13 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
 
         priv.runtime_map = runtime_map;
         priv.runtime_entry_count = &runtime_entry_count;
+        priv.new_fdt_addr = (void *)*new_fdt_addr;
         status = efi_exit_boot_services(sys_table, handle, &map, &priv,
                                         exit_boot_func);
 
         if (status == EFI_SUCCESS) {
                 efi_set_virtual_address_map_t *svam;
 
-                status = update_fdt_memmap((void *)*new_fdt_addr, &map);
-                if (status != EFI_SUCCESS) {
-                        /*
-                         * The kernel won't get far without the memory map, but
-                         * may still be able to print something meaningful so
-                         * return success here.
-                         */
-                        return EFI_SUCCESS;
-                }
-
                 /* Install the new virtual address map */
                 svam = sys_table->runtime->set_virtual_address_map;
                 status = svam(runtime_entry_count * desc_size, desc_size,
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index e2b0b1646f99..0635829b18cf 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -254,6 +254,9 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
         }
         WREG32(mmHDP_REG_COHERENCY_FLUSH_CNTL, 0);
 
+        if (adev->mode_info.num_crtc)
+                amdgpu_display_set_vga_render_state(adev, false);
+
         gmc_v6_0_mc_stop(adev, &save);
 
         if (gmc_v6_0_wait_for_idle((void *)adev)) {
@@ -283,7 +286,6 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
                 dev_warn(adev->dev, "Wait for MC idle timedout !\n");
         }
         gmc_v6_0_mc_resume(adev, &save);
-        amdgpu_display_set_vga_render_state(adev, false);
 }
 
 static int gmc_v6_0_mc_init(struct amdgpu_device *adev)
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 50f5cf7b69d1..fdfb1ec17e66 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -2032,13 +2032,16 @@ static void complete_crtc_signaling(struct drm_device *dev,
         }
 
         for_each_crtc_in_state(state, crtc, crtc_state, i) {
+                struct drm_pending_vblank_event *event = crtc_state->event;
                 /*
-                 * TEST_ONLY and PAGE_FLIP_EVENT are mutually
-                 * exclusive, if they weren't, this code should be
-                 * called on success for TEST_ONLY too.
+                 * Free the allocated event. drm_atomic_helper_setup_commit
+                 * can allocate an event too, so only free it if it's ours
+                 * to prevent a double free in drm_atomic_state_clear.
                  */
-                if (crtc_state->event)
-                        drm_event_cancel_free(dev, &crtc_state->event->base);
+                if (event && (event->base.fence || event->base.file_priv)) {
+                        drm_event_cancel_free(dev, &event->base);
+                        crtc_state->event = NULL;
+                }
         }
 
         if (!fence_state)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 34f757bcabae..4594477dee00 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1666,9 +1666,6 @@ int drm_atomic_helper_prepare_planes(struct drm_device *dev,
 
                 funcs = plane->helper_private;
 
-                if (!drm_atomic_helper_framebuffer_changed(dev, state, plane_state->crtc))
-                        continue;
-
                 if (funcs->prepare_fb) {
                         ret = funcs->prepare_fb(plane, plane_state);
                         if (ret)
@@ -1685,9 +1682,6 @@ fail:
                 if (j >= i)
                         continue;
 
-                if (!drm_atomic_helper_framebuffer_changed(dev, state, plane_state->crtc))
-                        continue;
-
                 funcs = plane->helper_private;
 
                 if (funcs->cleanup_fb)
@@ -1954,9 +1948,6 @@ void drm_atomic_helper_cleanup_planes(struct drm_device *dev,
         for_each_plane_in_state(old_state, plane, plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
-                if (!drm_atomic_helper_framebuffer_changed(dev, old_state, plane_state->crtc))
-                        continue;
-
                 funcs = plane->helper_private;
 
                 if (funcs->cleanup_fb)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 5a4526289392..7a7019ac9388 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -225,6 +225,7 @@ int drm_connector_init(struct drm_device *dev,
 
         INIT_LIST_HEAD(&connector->probed_modes);
         INIT_LIST_HEAD(&connector->modes);
+        mutex_init(&connector->mutex);
         connector->edid_blob_ptr = NULL;
         connector->status = connector_status_unknown;
 
@@ -359,6 +360,8 @@ void drm_connector_cleanup(struct drm_connector *connector)
                 connector->funcs->atomic_destroy_state(connector,
                                                        connector->state);
 
+        mutex_destroy(&connector->mutex);
+
         memset(connector, 0, sizeof(*connector));
 }
 EXPORT_SYMBOL(drm_connector_cleanup);
@@ -374,14 +377,18 @@ EXPORT_SYMBOL(drm_connector_cleanup);
  */
 int drm_connector_register(struct drm_connector *connector)
 {
-        int ret;
+        int ret = 0;
 
-        if (connector->registered)
+        if (!connector->dev->registered)
                 return 0;
 
+        mutex_lock(&connector->mutex);
+        if (connector->registered)
+                goto unlock;
+
         ret = drm_sysfs_connector_add(connector);
         if (ret)
-                return ret;
+                goto unlock;
 
         ret = drm_debugfs_connector_add(connector);
         if (ret) {
@@ -397,12 +404,14 @@ int drm_connector_register(struct drm_connector *connector)
         drm_mode_object_register(connector->dev, &connector->base);
 
         connector->registered = true;
-        return 0;
+        goto unlock;
 
 err_debugfs:
         drm_debugfs_connector_remove(connector);
 err_sysfs:
         drm_sysfs_connector_remove(connector);
+unlock:
+        mutex_unlock(&connector->mutex);
         return ret;
 }
 EXPORT_SYMBOL(drm_connector_register);
@@ -415,8 +424,11 @@ EXPORT_SYMBOL(drm_connector_register);
  */
 void drm_connector_unregister(struct drm_connector *connector)
 {
-        if (!connector->registered)
+        mutex_lock(&connector->mutex);
+        if (!connector->registered) {
+                mutex_unlock(&connector->mutex);
                 return;
+        }
 
         if (connector->funcs->early_unregister)
                 connector->funcs->early_unregister(connector);
@@ -425,6 +437,7 @@ void drm_connector_unregister(struct drm_connector *connector)
         drm_debugfs_connector_remove(connector);
 
         connector->registered = false;
+        mutex_unlock(&connector->mutex);
 }
 EXPORT_SYMBOL(drm_connector_unregister);
 
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index a525751b4559..6594b4088f11 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -745,6 +745,8 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto err_minors;
 
+        dev->registered = true;
+
         if (dev->driver->load) {
                 ret = dev->driver->load(dev, flags);
                 if (ret)
@@ -785,6 +787,8 @@ void drm_dev_unregister(struct drm_device *dev)
 
         drm_lastclose(dev);
 
+        dev->registered = false;
+
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 drm_modeset_unregister_all(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index b2c4a0b8a627..728ca3ea74d2 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -213,7 +213,8 @@ static void intel_detect_pch(struct drm_device *dev)
                         } else if (id == INTEL_PCH_KBP_DEVICE_ID_TYPE) {
                                 dev_priv->pch_type = PCH_KBP;
                                 DRM_DEBUG_KMS("Found KabyPoint PCH\n");
-                                WARN_ON(!IS_KABYLAKE(dev_priv));
+                                WARN_ON(!IS_SKYLAKE(dev_priv) &&
+                                        !IS_KABYLAKE(dev_priv));
                         } else if ((id == INTEL_PCH_P2X_DEVICE_ID_TYPE) ||
                                    (id == INTEL_PCH_P3X_DEVICE_ID_TYPE) ||
                                    ((id == INTEL_PCH_QEMU_DEVICE_ID_TYPE) &&
@@ -2427,6 +2428,7 @@ static int intel_runtime_resume(struct device *kdev)
          * we can do is to hope that things will still work (and disable RPM).
          */
         i915_gem_init_swizzling(dev_priv);
+        i915_gem_restore_fences(dev_priv);
 
         intel_runtime_pm_enable_interrupts(dev_priv);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 69bc3b0c4390..8493e19b563a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1012,6 +1012,8 @@ struct intel_fbc {
         struct work_struct underrun_work;
 
         struct intel_fbc_state_cache {
+                struct i915_vma *vma;
+
                 struct {
                         unsigned int mode_flags;
                         uint32_t hsw_bdw_pixel_rate;
@@ -1025,15 +1027,14 @@ struct intel_fbc {
                 } plane;
 
                 struct {
-                        u64 ilk_ggtt_offset;
                         uint32_t pixel_format;
                         unsigned int stride;
-                        int fence_reg;
-                        unsigned int tiling_mode;
                 } fb;
         } state_cache;
 
         struct intel_fbc_reg_params {
+                struct i915_vma *vma;
+
                 struct {
                         enum pipe pipe;
                         enum plane plane;
@@ -1041,10 +1042,8 @@ struct intel_fbc {
                 } crtc;
 
                 struct {
-                        u64 ggtt_offset;
                         uint32_t pixel_format;
                         unsigned int stride;
-                        int fence_reg;
                 } fb;
 
                 int cfb_size;
@@ -3168,13 +3167,6 @@ i915_gem_object_to_ggtt(struct drm_i915_gem_object *obj,
         return i915_gem_obj_to_vma(obj, &to_i915(obj->base.dev)->ggtt.base, view);
 }
 
-static inline unsigned long
-i915_gem_object_ggtt_offset(struct drm_i915_gem_object *o,
-                            const struct i915_ggtt_view *view)
-{
-        return i915_ggtt_offset(i915_gem_object_to_ggtt(o, view));
-}
-
 /* i915_gem_fence_reg.c */
 int __must_check i915_vma_get_fence(struct i915_vma *vma);
 int __must_check i915_vma_put_fence(struct i915_vma *vma);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 4b23a7814713..24b5b046754b 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2010,8 +2010,16 @@ void i915_gem_runtime_suspend(struct drm_i915_private *dev_priv)
         for (i = 0; i < dev_priv->num_fence_regs; i++) {
                 struct drm_i915_fence_reg *reg = &dev_priv->fence_regs[i];
 
-                if (WARN_ON(reg->pin_count))
-                        continue;
+                /* Ideally we want to assert that the fence register is not
+                 * live at this point (i.e. that no piece of code will be
+                 * trying to write through fence + GTT, as that both violates
+                 * our tracking of activity and associated locking/barriers,
+                 * but also is illegal given that the hw is powered down).
+                 *
+                 * Previously we used reg->pin_count as a "liveness" indicator.
+                 * That is not sufficient, and we need a more fine-grained
+                 * tool if we want to have a sanity check here.
+                 */
 
                 if (!reg->vma)
                         continue;
@@ -3478,7 +3486,7 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
         vma->display_alignment = max_t(u64, vma->display_alignment, alignment);
 
         /* Treat this as an end-of-frame, like intel_user_framebuffer_dirty() */
-        if (obj->cache_dirty) {
+        if (obj->cache_dirty || obj->base.write_domain == I915_GEM_DOMAIN_CPU) {
                 i915_gem_clflush_object(obj, true);
                 intel_fb_obj_flush(obj, false, ORIGIN_DIRTYFB);
         }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 097d9d8c2315..b8b877c91b0a 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1181,14 +1181,14 @@ validate_exec_list(struct drm_device *dev,
                         if (exec[i].offset !=
                             gen8_canonical_addr(exec[i].offset & PAGE_MASK))
                                 return -EINVAL;
-
-                        /* From drm_mm perspective address space is continuous,
-                         * so from this point we're always using non-canonical
-                         * form internally.
-                         */
-                        exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
                 }
 
+                /* From drm_mm perspective address space is continuous,
+                 * so from this point we're always using non-canonical
+                 * form internally.
+                 */
+                exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
+
                 if (exec[i].alignment && !is_power_of_2(exec[i].alignment))
                         return -EINVAL;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_internal.c b/drivers/gpu/drm/i915/i915_gem_internal.c
index 4b3ff3e5b911..d09c74973cb3 100644
--- a/drivers/gpu/drm/i915/i915_gem_internal.c
+++ b/drivers/gpu/drm/i915/i915_gem_internal.c
@@ -66,8 +66,16 @@ i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
 
         max_order = MAX_ORDER;
 #ifdef CONFIG_SWIOTLB
-        if (swiotlb_nr_tbl()) /* minimum max swiotlb size is IO_TLB_SEGSIZE */
-                max_order = min(max_order, ilog2(IO_TLB_SEGPAGES));
+        if (swiotlb_nr_tbl()) {
+                unsigned int max_segment;
+
+                max_segment = swiotlb_max_segment();
+                if (max_segment) {
+                        max_segment = max_t(unsigned int, max_segment,
+                                            PAGE_SIZE) >> PAGE_SHIFT;
+                        max_order = min(max_order, ilog2(max_segment));
+                }
+        }
 #endif
 
         gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_RECLAIMABLE;
diff --git a/drivers/gpu/drm/i915/intel_atomic_plane.c b/drivers/gpu/drm/i915/intel_atomic_plane.c
index dbe9fb41ae53..8d3e515f27ba 100644
--- a/drivers/gpu/drm/i915/intel_atomic_plane.c
+++ b/drivers/gpu/drm/i915/intel_atomic_plane.c
@@ -85,6 +85,8 @@ intel_plane_duplicate_state(struct drm_plane *plane)
 
         __drm_atomic_helper_plane_duplicate_state(plane, state);
 
+        intel_state->vma = NULL;
+
         return state;
 }
 
@@ -100,6 +102,24 @@ void
 intel_plane_destroy_state(struct drm_plane *plane,
                           struct drm_plane_state *state)
 {
+        struct i915_vma *vma;
+
+        vma = fetch_and_zero(&to_intel_plane_state(state)->vma);
+
+        /*
+         * FIXME: Normally intel_cleanup_plane_fb handles destruction of vma.
+         * We currently don't clear all planes during driver unload, so we have
+         * to be able to unpin vma here for now.
+         *
+         * Normally this can only happen during unload when kmscon is disabled
+         * and userspace doesn't attempt to set a framebuffer at all.
+         */
+        if (vma) {
+                mutex_lock(&plane->dev->struct_mutex);
+                intel_unpin_fb_vma(vma);
+                mutex_unlock(&plane->dev->struct_mutex);
+        }
+
         drm_atomic_helper_plane_destroy_state(plane, state);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 77f7b1d849a4..891c86aef99d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2235,24 +2235,22 @@ intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb, unsigned int rotation)
                         i915_vma_pin_fence(vma);
         }
 
+        i915_vma_get(vma);
 err:
         intel_runtime_pm_put(dev_priv);
         return vma;
 }
 
-void intel_unpin_fb_obj(struct drm_framebuffer *fb, unsigned int rotation)
+void intel_unpin_fb_vma(struct i915_vma *vma)
 {
-        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-        struct i915_ggtt_view view;
-        struct i915_vma *vma;
-
-        WARN_ON(!mutex_is_locked(&obj->base.dev->struct_mutex));
+        lockdep_assert_held(&vma->vm->dev->struct_mutex);
 
-        intel_fill_fb_ggtt_view(&view, fb, rotation);
-        vma = i915_gem_object_to_ggtt(obj, &view);
+        if (WARN_ON_ONCE(!vma))
+                return;
 
         i915_vma_unpin_fence(vma);
         i915_gem_object_unpin_from_display_plane(vma);
+        i915_vma_put(vma);
 }
 
 static int intel_fb_pitch(const struct drm_framebuffer *fb, int plane,
@@ -2747,7 +2745,6 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         struct drm_device *dev = intel_crtc->base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct drm_crtc *c;
-        struct intel_crtc *i;
         struct drm_i915_gem_object *obj;
         struct drm_plane *primary = intel_crtc->base.primary;
         struct drm_plane_state *plane_state = primary->state;
@@ -2772,20 +2769,20 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
          * an fb with another CRTC instead
          */
         for_each_crtc(dev, c) {
-                i = to_intel_crtc(c);
+                struct intel_plane_state *state;
 
                 if (c == &intel_crtc->base)
                         continue;
 
-                if (!i->active)
+                if (!to_intel_crtc(c)->active)
                         continue;
 
-                fb = c->primary->fb;
-                if (!fb)
+                state = to_intel_plane_state(c->primary->state);
+                if (!state->vma)
                         continue;
 
-                obj = intel_fb_obj(fb);
-                if (i915_gem_object_ggtt_offset(obj, NULL) == plane_config->base) {
+                if (intel_plane_ggtt_offset(state) == plane_config->base) {
+                        fb = c->primary->fb;
                         drm_framebuffer_reference(fb);
                         goto valid_fb;
                 }
@@ -2806,6 +2803,19 @@ intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
         return;
 
 valid_fb:
+        mutex_lock(&dev->struct_mutex);
+        intel_state->vma =
+                intel_pin_and_fence_fb_obj(fb, primary->state->rotation);
+        mutex_unlock(&dev->struct_mutex);
+        if (IS_ERR(intel_state->vma)) {
+                DRM_ERROR("failed to pin boot fb on pipe %d: %li\n",
+                          intel_crtc->pipe, PTR_ERR(intel_state->vma));
+
+                intel_state->vma = NULL;
+                drm_framebuffer_unreference(fb);
+                return;
+        }
+
         plane_state->src_x = 0;
         plane_state->src_y = 0;
         plane_state->src_w = fb->width << 16;
@@ -3101,13 +3111,13 @@ static void i9xx_update_primary_plane(struct drm_plane *primary,
         I915_WRITE(DSPSTRIDE(plane), fb->pitches[0]);
         if (INTEL_GEN(dev_priv) >= 4) {
                 I915_WRITE(DSPSURF(plane),
-                           intel_fb_gtt_offset(fb, rotation) +
+                           intel_plane_ggtt_offset(plane_state) +
                            intel_crtc->dspaddr_offset);
                 I915_WRITE(DSPTILEOFF(plane), (y << 16) | x);
                 I915_WRITE(DSPLINOFF(plane), linear_offset);
         } else {
                 I915_WRITE(DSPADDR(plane),
-                           intel_fb_gtt_offset(fb, rotation) +
+                           intel_plane_ggtt_offset(plane_state) +
                            intel_crtc->dspaddr_offset);
         }
         POSTING_READ(reg);
@@ -3204,7 +3214,7 @@ static void ironlake_update_primary_plane(struct drm_plane *primary,
 
         I915_WRITE(DSPSTRIDE(plane), fb->pitches[0]);
         I915_WRITE(DSPSURF(plane),
-                   intel_fb_gtt_offset(fb, rotation) +
+                   intel_plane_ggtt_offset(plane_state) +
                    intel_crtc->dspaddr_offset);
         if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv)) {
                 I915_WRITE(DSPOFFSET(plane), (y << 16) | x);
@@ -3227,23 +3237,6 @@ u32 intel_fb_stride_alignment(const struct drm_i915_private *dev_priv,
         }
 }
 
-u32 intel_fb_gtt_offset(struct drm_framebuffer *fb,
-                        unsigned int rotation)
-{
-        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-        struct i915_ggtt_view view;
-        struct i915_vma *vma;
-
-        intel_fill_fb_ggtt_view(&view, fb, rotation);
-
-        vma = i915_gem_object_to_ggtt(obj, &view);
-        if (WARN(!vma, "ggtt vma for display object not found! (view=%u)\n",
-                 view.type))
-                return -1;
-
-        return i915_ggtt_offset(vma);
-}
-
 static void skl_detach_scaler(struct intel_crtc *intel_crtc, int id)
 {
         struct drm_device *dev = intel_crtc->base.dev;
@@ -3438,7 +3431,7 @@ static void skylake_update_primary_plane(struct drm_plane *plane,
         }
 
         I915_WRITE(PLANE_SURF(pipe, 0),
-                   intel_fb_gtt_offset(fb, rotation) + surf_addr);
+                   intel_plane_ggtt_offset(plane_state) + surf_addr);
 
         POSTING_READ(PLANE_SURF(pipe, 0));
 }
@@ -4269,10 +4262,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc)
         drm_crtc_vblank_put(&intel_crtc->base);
 
         wake_up_all(&dev_priv->pending_flip_queue);
-        queue_work(dev_priv->wq, &work->unpin_work);
-
         trace_i915_flip_complete(intel_crtc->plane,
                                  work->pending_flip_obj);
+
+        queue_work(dev_priv->wq, &work->unpin_work);
 }
 
 static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
@@ -11533,7 +11526,7 @@ static void intel_unpin_work_fn(struct work_struct *__work)
                 flush_work(&work->mmio_work);
 
         mutex_lock(&dev->struct_mutex);
-        intel_unpin_fb_obj(work->old_fb, primary->state->rotation);
+        intel_unpin_fb_vma(work->old_vma);
         i915_gem_object_put(work->pending_flip_obj);
         mutex_unlock(&dev->struct_mutex);
 
@@ -12243,8 +12236,10 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                 goto cleanup_pending;
         }
 
-        work->gtt_offset = intel_fb_gtt_offset(fb, primary->state->rotation);
-        work->gtt_offset += intel_crtc->dspaddr_offset;
+        work->old_vma = to_intel_plane_state(primary->state)->vma;
+        to_intel_plane_state(primary->state)->vma = vma;
+
+        work->gtt_offset = i915_ggtt_offset(vma) + intel_crtc->dspaddr_offset;
         work->rotation = crtc->primary->state->rotation;
 
         /*
@@ -12298,7 +12293,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 cleanup_request:
         i915_add_request_no_flush(request);
 cleanup_unpin:
-        intel_unpin_fb_obj(fb, crtc->primary->state->rotation);
+        to_intel_plane_state(primary->state)->vma = work->old_vma;
+        intel_unpin_fb_vma(vma);
 cleanup_pending:
         atomic_dec(&intel_crtc->unpin_work_count);
 unlock:
@@ -14791,6 +14787,8 @@ intel_prepare_plane_fb(struct drm_plane *plane,
                         DRM_DEBUG_KMS("failed to pin object\n");
                         return PTR_ERR(vma);
                 }
+
+                to_intel_plane_state(new_state)->vma = vma;
         }
 
         return 0;
@@ -14809,19 +14807,12 @@ void
 intel_cleanup_plane_fb(struct drm_plane *plane,
                        struct drm_plane_state *old_state)
 {
-        struct drm_i915_private *dev_priv = to_i915(plane->dev);
-        struct intel_plane_state *old_intel_state;
-        struct drm_i915_gem_object *old_obj = intel_fb_obj(old_state->fb);
-        struct drm_i915_gem_object *obj = intel_fb_obj(plane->state->fb);
-
-        old_intel_state = to_intel_plane_state(old_state);
-
-        if (!obj && !old_obj)
-                return;
+        struct i915_vma *vma;
 
-        if (old_obj && (plane->type != DRM_PLANE_TYPE_CURSOR ||
-            !INTEL_INFO(dev_priv)->cursor_needs_physical))
-                intel_unpin_fb_obj(old_state->fb, old_state->rotation);
+        /* Should only be called after a successful intel_prepare_plane_fb()! */
+        vma = fetch_and_zero(&to_intel_plane_state(old_state)->vma);
+        if (vma)
+                intel_unpin_fb_vma(vma);
 }
 
 int
@@ -15163,7 +15154,7 @@ intel_update_cursor_plane(struct drm_plane *plane,
         if (!obj)
                 addr = 0;
         else if (!INTEL_INFO(dev_priv)->cursor_needs_physical)
-                addr = i915_gem_object_ggtt_offset(obj, NULL);
+                addr = intel_plane_ggtt_offset(state);
         else
                 addr = obj->phys_handle->busaddr;
 
@@ -17063,41 +17054,12 @@ void intel_display_resume(struct drm_device *dev)
 void intel_modeset_gem_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
-        struct drm_crtc *c;
-        struct drm_i915_gem_object *obj;
 
         intel_init_gt_powersave(dev_priv);
 
         intel_modeset_init_hw(dev);
 
         intel_setup_overlay(dev_priv);
-
-        /*
-         * Make sure any fbs we allocated at startup are properly
-         * pinned & fenced.  When we do the allocation it's too early
-         * for this.
-         */
-        for_each_crtc(dev, c) {
-                struct i915_vma *vma;
-
-                obj = intel_fb_obj(c->primary->fb);
-                if (obj == NULL)
-                        continue;
-
-                mutex_lock(&dev->struct_mutex);
-                vma = intel_pin_and_fence_fb_obj(c->primary->fb,
-                                                 c->primary->state->rotation);
-                mutex_unlock(&dev->struct_mutex);
-                if (IS_ERR(vma)) {
-                        DRM_ERROR("failed to pin boot fb on pipe %d\n",
-                                  to_intel_crtc(c)->pipe);
-                        drm_framebuffer_unreference(c->primary->fb);
-                        c->primary->fb = NULL;
-                        c->primary->crtc = c->primary->state->crtc = NULL;
-                        update_state_fb(c->primary);
-                        c->state->plane_mask &= ~(1 << drm_plane_index(c->primary));
-                }
-        }
 }
 
 int intel_connector_register(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
index 58a756f2f224..a2f0e070d38d 100644
--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
+++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
@@ -1730,7 +1730,8 @@ bxt_get_dpll(struct intel_crtc *crtc,
                 return NULL;
 
         if ((encoder->type == INTEL_OUTPUT_DP ||
-             encoder->type == INTEL_OUTPUT_EDP) &&
+             encoder->type == INTEL_OUTPUT_EDP ||
+             encoder->type == INTEL_OUTPUT_DP_MST) &&
             !bxt_ddi_dp_set_dpll_hw_state(clock, &dpll_hw_state))
                 return NULL;
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index cd72ae171eeb..03a2112004f9 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -377,6 +377,7 @@ struct intel_atomic_state {
 struct intel_plane_state {
         struct drm_plane_state base;
         struct drm_rect clip;
+        struct i915_vma *vma;
 
         struct {
                 u32 offset;
@@ -1046,6 +1047,7 @@ struct intel_flip_work {
         struct work_struct mmio_work;
 
         struct drm_crtc *crtc;
+        struct i915_vma *old_vma;
         struct drm_framebuffer *old_fb;
         struct drm_i915_gem_object *pending_flip_obj;
         struct drm_pending_vblank_event *event;
@@ -1273,7 +1275,7 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
                                     struct drm_modeset_acquire_ctx *ctx);
 struct i915_vma *
 intel_pin_and_fence_fb_obj(struct drm_framebuffer *fb, unsigned int rotation);
-void intel_unpin_fb_obj(struct drm_framebuffer *fb, unsigned int rotation);
+void intel_unpin_fb_vma(struct i915_vma *vma);
 struct drm_framebuffer *
 __intel_framebuffer_create(struct drm_device *dev,
                            struct drm_mode_fb_cmd2 *mode_cmd,
@@ -1362,7 +1364,10 @@ void intel_mode_from_pipe_config(struct drm_display_mode *mode,
 int skl_update_scaler_crtc(struct intel_crtc_state *crtc_state);
 int skl_max_scale(struct intel_crtc *crtc, struct intel_crtc_state *crtc_state);
 
-u32 intel_fb_gtt_offset(struct drm_framebuffer *fb, unsigned int rotation);
+static inline u32 intel_plane_ggtt_offset(const struct intel_plane_state *state)
+{
+        return i915_ggtt_offset(state->vma);
+}
 
 u32 skl_plane_ctl_format(uint32_t pixel_format);
 u32 skl_plane_ctl_tiling(uint64_t fb_modifier);
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index 62f215b12eb5..f3a1d6a5cabe 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -173,7 +173,7 @@ static void i8xx_fbc_activate(struct drm_i915_private *dev_priv)
         if (IS_I945GM(dev_priv))
                 fbc_ctl |= FBC_CTL_C3_IDLE; /* 945 needs special SR handling */
         fbc_ctl |= (cfb_pitch & 0xff) << FBC_CTL_STRIDE_SHIFT;
-        fbc_ctl |= params->fb.fence_reg;
+        fbc_ctl |= params->vma->fence->id;
         I915_WRITE(FBC_CONTROL, fbc_ctl);
 }
 
@@ -193,8 +193,8 @@ static void g4x_fbc_activate(struct drm_i915_private *dev_priv)
         else
                 dpfc_ctl |= DPFC_CTL_LIMIT_1X;
 
-        if (params->fb.fence_reg != I915_FENCE_REG_NONE) {
-                dpfc_ctl |= DPFC_CTL_FENCE_EN | params->fb.fence_reg;
+        if (params->vma->fence) {
+                dpfc_ctl |= DPFC_CTL_FENCE_EN | params->vma->fence->id;
                 I915_WRITE(DPFC_FENCE_YOFF, params->crtc.fence_y_offset);
         } else {
                 I915_WRITE(DPFC_FENCE_YOFF, 0);
@@ -251,13 +251,14 @@ static void ilk_fbc_activate(struct drm_i915_private *dev_priv)
                 break;
         }
 
-        if (params->fb.fence_reg != I915_FENCE_REG_NONE) {
+        if (params->vma->fence) {
                 dpfc_ctl |= DPFC_CTL_FENCE_EN;
                 if (IS_GEN5(dev_priv))
-                        dpfc_ctl |= params->fb.fence_reg;
+                        dpfc_ctl |= params->vma->fence->id;
                 if (IS_GEN6(dev_priv)) {
                         I915_WRITE(SNB_DPFC_CTL_SA,
-                                   SNB_CPU_FENCE_ENABLE | params->fb.fence_reg);
+                                   SNB_CPU_FENCE_ENABLE |
+                                   params->vma->fence->id);
                         I915_WRITE(DPFC_CPU_FENCE_OFFSET,
                                    params->crtc.fence_y_offset);
                 }
@@ -269,7 +270,8 @@ static void ilk_fbc_activate(struct drm_i915_private *dev_priv)
         }
 
         I915_WRITE(ILK_DPFC_FENCE_YOFF, params->crtc.fence_y_offset);
-        I915_WRITE(ILK_FBC_RT_BASE, params->fb.ggtt_offset | ILK_FBC_RT_VALID);
+        I915_WRITE(ILK_FBC_RT_BASE,
+                   i915_ggtt_offset(params->vma) | ILK_FBC_RT_VALID);
         /* enable it... */
         I915_WRITE(ILK_DPFC_CONTROL, dpfc_ctl | DPFC_CTL_EN);
 
@@ -319,10 +321,11 @@ static void gen7_fbc_activate(struct drm_i915_private *dev_priv)
                 break;
         }
 
-        if (params->fb.fence_reg != I915_FENCE_REG_NONE) {
+        if (params->vma->fence) {
                 dpfc_ctl |= IVB_DPFC_CTL_FENCE_EN;
                 I915_WRITE(SNB_DPFC_CTL_SA,
-                           SNB_CPU_FENCE_ENABLE | params->fb.fence_reg);
+                           SNB_CPU_FENCE_ENABLE |
+                           params->vma->fence->id);
                 I915_WRITE(DPFC_CPU_FENCE_OFFSET, params->crtc.fence_y_offset);
         } else {
                 I915_WRITE(SNB_DPFC_CTL_SA,0);
@@ -727,14 +730,6 @@ static bool intel_fbc_hw_tracking_covers_screen(struct intel_crtc *crtc)
         return effective_w <= max_w && effective_h <= max_h;
 }
 
-/* XXX replace me when we have VMA tracking for intel_plane_state */
-static int get_fence_id(struct drm_framebuffer *fb)
-{
-        struct i915_vma *vma = i915_gem_object_to_ggtt(intel_fb_obj(fb), NULL);
-
-        return vma && vma->fence ? vma->fence->id : I915_FENCE_REG_NONE;
-}
-
 static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                                          struct intel_crtc_state *crtc_state,
                                          struct intel_plane_state *plane_state)
@@ -743,7 +738,8 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
         struct intel_fbc *fbc = &dev_priv->fbc;
         struct intel_fbc_state_cache *cache = &fbc->state_cache;
         struct drm_framebuffer *fb = plane_state->base.fb;
-        struct drm_i915_gem_object *obj;
+
+        cache->vma = NULL;
 
         cache->crtc.mode_flags = crtc_state->base.adjusted_mode.flags;
         if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv))
@@ -758,16 +754,10 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
         if (!cache->plane.visible)
                 return;
 
-        obj = intel_fb_obj(fb);
-
-        /* FIXME: We lack the proper locking here, so only run this on the
-         * platforms that need. */
-        if (IS_GEN(dev_priv, 5, 6))
-                cache->fb.ilk_ggtt_offset = i915_gem_object_ggtt_offset(obj, NULL);
         cache->fb.pixel_format = fb->pixel_format;
         cache->fb.stride = fb->pitches[0];
-        cache->fb.fence_reg = get_fence_id(fb);
-        cache->fb.tiling_mode = i915_gem_object_get_tiling(obj);
+
+        cache->vma = plane_state->vma;
 }
 
 static bool intel_fbc_can_activate(struct intel_crtc *crtc)
@@ -784,7 +774,7 @@ static bool intel_fbc_can_activate(struct intel_crtc *crtc)
                 return false;
         }
 
-        if (!cache->plane.visible) {
+        if (!cache->vma) {
                 fbc->no_fbc_reason = "primary plane not visible";
                 return false;
         }
@@ -807,8 +797,7 @@ static bool intel_fbc_can_activate(struct intel_crtc *crtc)
          * so have no fence associated with it) due to aperture constaints
          * at the time of pinning.
          */
-        if (cache->fb.tiling_mode != I915_TILING_X ||
-            cache->fb.fence_reg == I915_FENCE_REG_NONE) {
+        if (!cache->vma->fence) {
                 fbc->no_fbc_reason = "framebuffer not tiled or fenced";
                 return false;
         }
@@ -888,17 +877,16 @@ static void intel_fbc_get_reg_params(struct intel_crtc *crtc,
          * zero. */
         memset(params, 0, sizeof(*params));
 
+        params->vma = cache->vma;
+
         params->crtc.pipe = crtc->pipe;
         params->crtc.plane = crtc->plane;
         params->crtc.fence_y_offset = get_crtc_fence_y_offset(crtc);
 
         params->fb.pixel_format = cache->fb.pixel_format;
         params->fb.stride = cache->fb.stride;
-        params->fb.fence_reg = cache->fb.fence_reg;
 
         params->cfb_size = intel_fbc_calculate_cfb_size(dev_priv, cache);
-
-        params->fb.ggtt_offset = cache->fb.ilk_ggtt_offset;
 }
 
 static bool intel_fbc_reg_params_equal(struct intel_fbc_reg_params *params1,
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 8cf2d80f2254..f4a8c4fc57c4 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -284,7 +284,7 @@ static int intelfb_create(struct drm_fb_helper *helper,
 out_destroy_fbi:
         drm_fb_helper_release_fbi(helper);
 out_unpin:
-        intel_unpin_fb_obj(&ifbdev->fb->base, DRM_ROTATE_0);
+        intel_unpin_fb_vma(vma);
 out_unlock:
         mutex_unlock(&dev->struct_mutex);
         return ret;
@@ -549,7 +549,7 @@ static void intel_fbdev_destroy(struct intel_fbdev *ifbdev)
 
         if (ifbdev->fb) {
                 mutex_lock(&ifbdev->helper.dev->struct_mutex);
-                intel_unpin_fb_obj(&ifbdev->fb->base, DRM_ROTATE_0);
+                intel_unpin_fb_vma(ifbdev->vma);
                 mutex_unlock(&ifbdev->helper.dev->struct_mutex);
 
                 drm_framebuffer_remove(&ifbdev->fb->base);
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8f131a08d440..242a73e66d82 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -273,7 +273,7 @@ skl_update_plane(struct drm_plane *drm_plane,
 
         I915_WRITE(PLANE_CTL(pipe, plane), plane_ctl);
         I915_WRITE(PLANE_SURF(pipe, plane),
-                   intel_fb_gtt_offset(fb, rotation) + surf_addr);
+                   intel_plane_ggtt_offset(plane_state) + surf_addr);
         POSTING_READ(PLANE_SURF(pipe, plane));
 }
 
@@ -458,7 +458,7 @@ vlv_update_plane(struct drm_plane *dplane,
         I915_WRITE(SPSIZE(pipe, plane), (crtc_h << 16) | crtc_w);
         I915_WRITE(SPCNTR(pipe, plane), sprctl);
         I915_WRITE(SPSURF(pipe, plane),
-                   intel_fb_gtt_offset(fb, rotation) + sprsurf_offset);
+                   intel_plane_ggtt_offset(plane_state) + sprsurf_offset);
         POSTING_READ(SPSURF(pipe, plane));
 }
 
@@ -594,7 +594,7 @@ ivb_update_plane(struct drm_plane *plane,
                 I915_WRITE(SPRSCALE(pipe), sprscale);
         I915_WRITE(SPRCTL(pipe), sprctl);
         I915_WRITE(SPRSURF(pipe),
-                   intel_fb_gtt_offset(fb, rotation) + sprsurf_offset);
+                   intel_plane_ggtt_offset(plane_state) + sprsurf_offset);
         POSTING_READ(SPRSURF(pipe));
 }
 
@@ -721,7 +721,7 @@ ilk_update_plane(struct drm_plane *plane,
         I915_WRITE(DVSSCALE(pipe), dvsscale);
         I915_WRITE(DVSCNTR(pipe), dvscntr);
         I915_WRITE(DVSSURF(pipe),
-                   intel_fb_gtt_offset(fb, rotation) + dvssurf_offset);
+                   intel_plane_ggtt_offset(plane_state) + dvssurf_offset);
         POSTING_READ(DVSSURF(pipe));
 }
 
diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c
index 74856a8b8f35..e64f52464ecf 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/hw.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c
@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
                 uint32_t mpllP;
 
                 pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP);
+                mpllP = (mpllP >> 8) & 0xf;
                 if (!mpllP)
                         mpllP = 4;
 
@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
                 uint32_t clock;
 
                 pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock);
-                return clock;
+                return clock / 1000;
         }
 
         ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index ccdce1b4eec4..d5e58a38f160 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -99,6 +99,7 @@ struct nv84_fence_priv {
         struct nouveau_bo *bo;
         struct nouveau_bo *bo_gart;
         u32 *suspend;
+        struct mutex mutex;
 };
 
 int  nv84_fence_context_new(struct nouveau_channel *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_led.h b/drivers/gpu/drm/nouveau/nouveau_led.h
index 187ecdb82002..21a5775028cc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_led.h
+++ b/drivers/gpu/drm/nouveau/nouveau_led.h
@@ -42,7 +42,7 @@ nouveau_led(struct drm_device *dev)
 }
 
 /* nouveau_led.c */
-#if IS_ENABLED(CONFIG_LEDS_CLASS)
+#if IS_REACHABLE(CONFIG_LEDS_CLASS)
 int  nouveau_led_init(struct drm_device *dev);
 void nouveau_led_suspend(struct drm_device *dev);
 void nouveau_led_resume(struct drm_device *dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_usif.c b/drivers/gpu/drm/nouveau/nouveau_usif.c
index 08f9c6fa0f7f..1fba38622744 100644
--- a/drivers/gpu/drm/nouveau/nouveau_usif.c
+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c
@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc)
         if (!(ret = nvif_unpack(-ENOSYS, &data, &size, argv->v0, 0, 0, true))) {
                 /* block access to objects not created via this interface */
                 owner = argv->v0.owner;
-                if (argv->v0.object == 0ULL)
+                if (argv->v0.object == 0ULL &&
+                    argv->v0.type != NVIF_IOCTL_V0_DEL)
                         argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
                 else
                         argv->v0.owner = NVDRM_OBJECT_USIF;
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 2c2c64507661..32097fd615fd 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -4052,6 +4052,11 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                 }
         }
 
+        for_each_crtc_in_state(state, crtc, crtc_state, i) {
+                if (crtc->state->event)
+                        drm_crtc_vblank_get(crtc);
+        }
+
         /* Update plane(s). */
         for_each_plane_in_state(state, plane, plane_state, i) {
                 struct nv50_wndw_atom *asyw = nv50_wndw_atom(plane->state);
@@ -4101,6 +4106,7 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
                         drm_crtc_send_vblank_event(crtc, crtc->state->event);
                         spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
                         crtc->state->event = NULL;
+                        drm_crtc_vblank_put(crtc);
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c
index 52b87ae83e7b..f0b322bec7df 100644
--- a/drivers/gpu/drm/nouveau/nv84_fence.c
+++ b/drivers/gpu/drm/nouveau/nv84_fence.c
@@ -107,8 +107,10 @@ nv84_fence_context_del(struct nouveau_channel *chan)
         struct nv84_fence_chan *fctx = chan->fence;
 
         nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence);
+        mutex_lock(&priv->mutex);
         nouveau_bo_vma_del(priv->bo, &fctx->vma_gart);
         nouveau_bo_vma_del(priv->bo, &fctx->vma);
+        mutex_unlock(&priv->mutex);
         nouveau_fence_context_del(&fctx->base);
         chan->fence = NULL;
         nouveau_fence_context_free(&fctx->base);
@@ -134,11 +136,13 @@ nv84_fence_context_new(struct nouveau_channel *chan)
         fctx->base.sync32 = nv84_fence_sync32;
         fctx->base.sequence = nv84_fence_read(chan);
 
+        mutex_lock(&priv->mutex);
         ret = nouveau_bo_vma_add(priv->bo, cli->vm, &fctx->vma);
         if (ret == 0) {
                 ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm,
                                         &fctx->vma_gart);
         }
+        mutex_unlock(&priv->mutex);
 
         if (ret)
                 nv84_fence_context_del(chan);
@@ -212,6 +216,8 @@ nv84_fence_create(struct nouveau_drm *drm)
         priv->base.context_base = dma_fence_context_alloc(priv->base.contexts);
         priv->base.uevent = true;
 
+        mutex_init(&priv->mutex);
+
         /* Use VRAM if there is any ; otherwise fallback to system memory */
         domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM :
                          /*
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
index 6f0436df0219..f8f2f16c22a2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1)
                         );
                 }
                 for (i = 0; i < size; i++)
-                        nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]);
+                        nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]);
                 for (; i < 0x60; i++)
                         nvkm_wr32(device, 0x61c440 + soff, (i << 8));
                 nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
index 567466f93cd5..0db8efbf1c2e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -433,8 +433,6 @@ nv50_disp_dptmds_war(struct nvkm_device *device)
         case 0x94:
         case 0x96:
         case 0x98:
-        case 0xaa:
-        case 0xac:
                 return true;
         default:
                 break;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index e0c143b865f3..30bd4a6a9d46 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -97,9 +97,10 @@
  *   2.46.0 - Add PFP_SYNC_ME support on evergreen
  *   2.47.0 - Add UVD_NO_OP register support
  *   2.48.0 - TA_CS_BC_BASE_ADDR allowed on SI
+ *   2.49.0 - DRM_RADEON_GEM_INFO ioctl returns correct vram_size/visible values
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        48
+#define KMS_DRIVER_MINOR        49
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 0bcffd8a7bd3..96683f5b2b1b 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -220,8 +220,8 @@ int radeon_gem_info_ioctl(struct drm_device *dev, void *data,
 
         man = &rdev->mman.bdev.man[TTM_PL_VRAM];
 
-        args->vram_size = rdev->mc.real_vram_size;
-        args->vram_visible = (u64)man->size << PAGE_SHIFT;
+        args->vram_size = (u64)man->size << PAGE_SHIFT;
+        args->vram_visible = rdev->mc.visible_vram_size;
         args->vram_visible -= rdev->vram_pin_size;
         args->gart_size = rdev->mc.gtt_size;
         args->gart_size -= rdev->gart_pin_size;
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
index 881bf489478b..686cdd3c86f2 100644
--- a/drivers/gpu/drm/vc4/vc4_plane.c
+++ b/drivers/gpu/drm/vc4/vc4_plane.c
@@ -858,7 +858,7 @@ struct drm_plane *vc4_plane_init(struct drm_device *dev,
                 }
         }
         plane = &vc4_plane->base;
-        ret = drm_universal_plane_init(dev, plane, 0xff,
+        ret = drm_universal_plane_init(dev, plane, 0,
                                        &vc4_plane_funcs,
                                        formats, num_formats,
                                        type, NULL);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 723fd763da8e..7a96798b9c0a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -481,8 +481,7 @@ static int vmw_fb_kms_framebuffer(struct fb_info *info)
         mode_cmd.height = var->yres;
         mode_cmd.pitches[0] = ((var->bits_per_pixel + 7) / 8) * mode_cmd.width;
         mode_cmd.pixel_format =
-                drm_mode_legacy_fb_format(var->bits_per_pixel,
-                        ((var->bits_per_pixel + 7) / 8) * mode_cmd.width);
+                drm_mode_legacy_fb_format(var->bits_per_pixel, depth);
 
         cur_fb = par->set_fb;
         if (cur_fb && cur_fb->width == mode_cmd.width &&
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index f31a778b0851..b22d0f83f8e3 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -168,7 +168,7 @@ struct cp2112_device {
         atomic_t xfer_avail;
         struct gpio_chip gc;
         u8 *in_out_buffer;
-        spinlock_t lock;
+        struct mutex lock;
 
         struct gpio_desc *desc[8];
         bool gpio_poll;
@@ -186,10 +186,9 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
                                  CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
@@ -213,8 +212,8 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
         ret = 0;
 
 exit:
-        spin_unlock_irqrestore(&dev->lock, flags);
-        return ret <= 0 ? ret : -EIO;
+        mutex_unlock(&dev->lock);
+        return ret < 0 ? ret : -EIO;
 }
 
 static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
@@ -222,10 +221,9 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         buf[0] = CP2112_GPIO_SET;
         buf[1] = value ? 0xff : 0;
@@ -237,7 +235,7 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
         if (ret < 0)
                 hid_err(hdev, "error setting GPIO values: %d\n", ret);
 
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
 }
 
 static int cp2112_gpio_get_all(struct gpio_chip *chip)
@@ -245,10 +243,9 @@ static int cp2112_gpio_get_all(struct gpio_chip *chip)
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf,
                                  CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT,
@@ -262,7 +259,7 @@ static int cp2112_gpio_get_all(struct gpio_chip *chip)
         ret = buf[1];
 
 exit:
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
 
         return ret;
 }
@@ -284,10 +281,9 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
         struct cp2112_device *dev = gpiochip_get_data(chip);
         struct hid_device *hdev = dev->hdev;
         u8 *buf = dev->in_out_buffer;
-        unsigned long flags;
         int ret;
 
-        spin_lock_irqsave(&dev->lock, flags);
+        mutex_lock(&dev->lock);
 
         ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
                                  CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
@@ -308,7 +304,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
                 goto fail;
         }
 
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
 
         /*
          * Set gpio value when output direction is already set,
@@ -319,7 +315,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
         return 0;
 
 fail:
-        spin_unlock_irqrestore(&dev->lock, flags);
+        mutex_unlock(&dev->lock);
         return ret < 0 ? ret : -EIO;
 }
 
@@ -1235,7 +1231,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
         if (!dev->in_out_buffer)
                 return -ENOMEM;
 
-        spin_lock_init(&dev->lock);
+        mutex_init(&dev->lock);
 
         ret = hid_parse(hdev);
         if (ret) {
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index f46f2c5117fa..350accfee8e8 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -76,6 +76,9 @@
 #define USB_VENDOR_ID_ALPS_JP           0x044E
 #define HID_DEVICE_ID_ALPS_U1_DUAL      0x120B
 
+#define USB_VENDOR_ID_AMI               0x046b
+#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE       0xff10
+
 #define USB_VENDOR_ID_ANTON             0x1130
 #define USB_DEVICE_ID_ANTON_TOUCH_PAD   0x3101
 
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index c5c5fbe9d605..52026dc94d5c 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -872,7 +872,7 @@ static const struct hid_device_id lg_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
                 .driver_data = LG_NOGET | LG_FF4 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
-                .driver_data = LG_FF2 },
+                .driver_data = LG_NOGET | LG_FF2 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940),
                 .driver_data = LG_FF3 },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index e9d6cc7cdfc5..30a2977e2645 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -57,6 +57,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 0884dc9554fd..672145b0d8f5 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -166,19 +166,21 @@ static int wacom_pl_irq(struct wacom_wac *wacom)
                 wacom->id[0] = STYLUS_DEVICE_ID;
         }
 
-        pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
-        if (features->pressure_max > 255)
-                pressure = (pressure << 1) | ((data[4] >> 6) & 1);
-        pressure += (features->pressure_max + 1) / 2;
-
-        input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
-        input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
-        input_report_abs(input, ABS_PRESSURE, pressure);
-
-        input_report_key(input, BTN_TOUCH, data[4] & 0x08);
-        input_report_key(input, BTN_STYLUS, data[4] & 0x10);
-        /* Only allow the stylus2 button to be reported for the pen tool. */
-        input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
+        if (prox) {
+                pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
+                if (features->pressure_max > 255)
+                        pressure = (pressure << 1) | ((data[4] >> 6) & 1);
+                pressure += (features->pressure_max + 1) / 2;
+
+                input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
+                input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
+                input_report_abs(input, ABS_PRESSURE, pressure);
+
+                input_report_key(input, BTN_TOUCH, data[4] & 0x08);
+                input_report_key(input, BTN_STYLUS, data[4] & 0x10);
+                /* Only allow the stylus2 button to be reported for the pen tool. */
+                input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
+        }
 
         if (!prox)
                 wacom->id[0] = 0;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index cd49cb17eb7f..308dbda700eb 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -383,6 +383,7 @@ int hv_ringbuffer_read(struct vmbus_channel *channel,
                 return ret;
         }
 
+        init_cached_read_index(channel);
         next_read_location = hv_get_next_read_location(inring_info);
         next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
                                                     sizeof(desc),
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 686971263bef..45d6771fac8c 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -962,10 +962,6 @@ static int cdns_i2c_probe(struct platform_device *pdev)
                 goto err_clk_dis;
         }
 
-        ret = i2c_add_adapter(&id->adap);
-        if (ret < 0)
-                goto err_clk_dis;
-
         /*
          * Cadence I2C controller has a bug wherein it generates
          * invalid read transaction after HW timeout in master receiver mode.
@@ -975,6 +971,10 @@ static int cdns_i2c_probe(struct platform_device *pdev)
          */
         cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
 
+        ret = i2c_add_adapter(&id->adap);
+        if (ret < 0)
+                goto err_clk_dis;
+
         dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
                  id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
 
diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c
index c62b7cd475f8..3310f2e0dbd3 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -28,6 +28,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -636,12 +637,31 @@ static int lpi2c_imx_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int lpi2c_imx_suspend(struct device *dev)
+{
+        pinctrl_pm_select_sleep_state(dev);
+
+        return 0;
+}
+
+static int lpi2c_imx_resume(struct device *dev)
+{
+        pinctrl_pm_select_default_state(dev);
+
+        return 0;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(imx_lpi2c_pm, lpi2c_imx_suspend, lpi2c_imx_resume);
+
 static struct platform_driver lpi2c_imx_driver = {
         .probe = lpi2c_imx_probe,
         .remove = lpi2c_imx_remove,
         .driver = {
                 .name = DRIVER_NAME,
                 .of_match_table = lpi2c_imx_of_match,
+                .pm = &imx_lpi2c_pm,
         },
 };
 
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index e34d82e79b98..c21ca7bf2efe 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -58,7 +58,7 @@
 #define SMBSLVDAT       (0xC + piix4_smba)
 
 /* count for request_region */
-#define SMBIOSIZE       8
+#define SMBIOSIZE       9
 
 /* PCI Address Constants */
 #define SMBBA           0x090
@@ -592,6 +592,8 @@ static s32 piix4_access_sb800(struct i2c_adapter *adap, u16 addr,
         u8 port;
         int retval;
 
+        mutex_lock(&piix4_mutex_sb800);
+
         /* Request the SMBUS semaphore, avoid conflicts with the IMC */
         smbslvcnt  = inb_p(SMBSLVCNT);
         do {
@@ -605,10 +607,10 @@ static s32 piix4_access_sb800(struct i2c_adapter *adap, u16 addr,
                 usleep_range(1000, 2000);
         } while (--retries);
         /* SMBus is still owned by the IMC, we give up */
-        if (!retries)
+        if (!retries) {
+                mutex_unlock(&piix4_mutex_sb800);
                 return -EBUSY;
-
-        mutex_lock(&piix4_mutex_sb800);
+        }
 
         outb_p(piix4_port_sel_sb800, SB800_PIIX4_SMB_IDX);
         smba_en_lo = inb_p(SB800_PIIX4_SMB_IDX + 1);
@@ -623,11 +625,11 @@ static s32 piix4_access_sb800(struct i2c_adapter *adap, u16 addr,
 
         outb_p(smba_en_lo, SB800_PIIX4_SMB_IDX + 1);
 
-        mutex_unlock(&piix4_mutex_sb800);
-
         /* Release the semaphore */
         outb_p(smbslvcnt | 0x20, SMBSLVCNT);
 
+        mutex_unlock(&piix4_mutex_sb800);
+
         return retval;
 }
 
diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c
index 2bbf0c521beb..7d61b566e148 100644
--- a/drivers/iio/adc/palmas_gpadc.c
+++ b/drivers/iio/adc/palmas_gpadc.c
@@ -775,7 +775,7 @@ static int palmas_adc_wakeup_reset(struct palmas_gpadc *adc)
 
 static int palmas_gpadc_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
         struct palmas_gpadc *adc = iio_priv(indio_dev);
         int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
         int ret;
@@ -798,7 +798,7 @@ static int palmas_gpadc_suspend(struct device *dev)
 
 static int palmas_gpadc_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
         struct palmas_gpadc *adc = iio_priv(indio_dev);
         int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
         int ret;
diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
index 9a081465c42f..6bb23a49e81e 100644
--- a/drivers/iio/health/afe4403.c
+++ b/drivers/iio/health/afe4403.c
@@ -422,7 +422,7 @@ MODULE_DEVICE_TABLE(of, afe4403_of_match);
 
 static int __maybe_unused afe4403_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
         struct afe4403_data *afe = iio_priv(indio_dev);
         int ret;
 
@@ -443,7 +443,7 @@ static int __maybe_unused afe4403_suspend(struct device *dev)
 
 static int __maybe_unused afe4403_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
         struct afe4403_data *afe = iio_priv(indio_dev);
         int ret;
 
diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
index 45266404f7e3..964f5231a831 100644
--- a/drivers/iio/health/afe4404.c
+++ b/drivers/iio/health/afe4404.c
@@ -428,7 +428,7 @@ MODULE_DEVICE_TABLE(of, afe4404_of_match);
 
 static int __maybe_unused afe4404_suspend(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct afe4404_data *afe = iio_priv(indio_dev);
         int ret;
 
@@ -449,7 +449,7 @@ static int __maybe_unused afe4404_suspend(struct device *dev)
 
 static int __maybe_unused afe4404_resume(struct device *dev)
 {
-        struct iio_dev *indio_dev = dev_to_iio_dev(dev);
+        struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
         struct afe4404_data *afe = iio_priv(indio_dev);
         int ret;
 
diff --git a/drivers/iio/health/max30100.c b/drivers/iio/health/max30100.c
index 90ab8a2d2846..183c14329d6e 100644
--- a/drivers/iio/health/max30100.c
+++ b/drivers/iio/health/max30100.c
@@ -238,7 +238,7 @@ static irqreturn_t max30100_interrupt_handler(int irq, void *private)
 
         mutex_lock(&data->lock);
 
-        while (cnt || (cnt = max30100_fifo_count(data) > 0)) {
+        while (cnt || (cnt = max30100_fifo_count(data)) > 0) {
                 ret = max30100_read_measurement(data);
                 if (ret)
                         break;
diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
index 9c47bc98f3ac..2a22ad920333 100644
--- a/drivers/iio/humidity/dht11.c
+++ b/drivers/iio/humidity/dht11.c
@@ -71,7 +71,8 @@
  * a) select an implementation using busy loop polling on those systems
  * b) use the checksum to do some probabilistic decoding
  */
-#define DHT11_START_TRANSMISSION        18  /* ms */
+#define DHT11_START_TRANSMISSION_MIN    18000  /* us */
+#define DHT11_START_TRANSMISSION_MAX    20000  /* us */
 #define DHT11_MIN_TIMERES       34000  /* ns */
 #define DHT11_THRESHOLD         49000  /* ns */
 #define DHT11_AMBIG_LOW         23000  /* ns */
@@ -228,7 +229,8 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
                 ret = gpio_direction_output(dht11->gpio, 0);
                 if (ret)
                         goto err;
-                msleep(DHT11_START_TRANSMISSION);
+                usleep_range(DHT11_START_TRANSMISSION_MIN,
+                             DHT11_START_TRANSMISSION_MAX);
                 ret = gpio_direction_input(dht11->gpio);
                 if (ret)
                         goto err;
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index d0faca294006..86a6585b847d 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)
 
         case RXE_MEM_TYPE_MR:
         case RXE_MEM_TYPE_FMR:
-                return ((iova < mem->iova) ||
-                        ((iova + length) > (mem->iova + mem->length))) ?
-                        -EFAULT : 0;
+                if (iova < mem->iova ||
+                    length > mem->length ||
+                    iova > mem->iova + mem->length - length)
+                        return -EFAULT;
+                return 0;
 
         default:
                 return -EFAULT;
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index 3435efff8799..5bcf07328972 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -479,7 +479,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
                                 goto err2;
                         }
 
-                        resid = mtu;
+                        qp->resp.resid = mtu;
                 } else {
                         if (pktlen != resid) {
                                 state = RESPST_ERR_LENGTH;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 92595b98e7ed..022be0e22eba 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev)
                 return -EINVAL;
         }
 
-        if (test_bit(ABS_MT_SLOT, dev->absbit)) {
-                nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
-                error = input_mt_init_slots(dev, nslot, 0);
-                if (error)
+        if (test_bit(EV_ABS, dev->evbit)) {
+                input_alloc_absinfo(dev);
+                if (!dev->absinfo) {
+                        error = -EINVAL;
                         goto fail1;
-        } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
-                input_set_events_per_packet(dev, 60);
+                }
+
+                if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+                        nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+                        error = input_mt_init_slots(dev, nslot, 0);
+                        if (error)
+                                goto fail1;
+                } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                        input_set_events_per_packet(dev, 60);
+                }
         }
 
         if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
diff --git a/drivers/input/rmi4/Kconfig b/drivers/input/rmi4/Kconfig
index 8993983e3fe4..bb7762bf2879 100644
--- a/drivers/input/rmi4/Kconfig
+++ b/drivers/input/rmi4/Kconfig
@@ -42,13 +42,19 @@ config RMI4_SMB
 config RMI4_F03
         bool "RMI4 Function 03 (PS2 Guest)"
         depends on RMI4_CORE
-        depends on SERIO=y || RMI4_CORE=SERIO
         help
           Say Y here if you want to add support for RMI4 function 03.
 
           Function 03 provides PS2 guest support for RMI4 devices. This
           includes support for TrackPoints on TouchPads.
 
+config RMI4_F03_SERIO
+        tristate
+        depends on RMI4_CORE
+        depends on RMI4_F03
+        default RMI4_CORE
+        select SERIO
+
 config RMI4_2D_SENSOR
         bool
         depends on RMI4_CORE
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 11447ab1055c..bf5c36e229ba 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -901,7 +901,7 @@ void rmi_enable_irq(struct rmi_device *rmi_dev, bool clear_wake)
         data->enabled = true;
         if (clear_wake && device_may_wakeup(rmi_dev->xport->dev)) {
                 retval = disable_irq_wake(irq);
-                if (!retval)
+                if (retval)
                         dev_warn(&rmi_dev->dev,
                                  "Failed to disable irq for wake: %d\n",
                                  retval);
@@ -936,7 +936,7 @@ void rmi_disable_irq(struct rmi_device *rmi_dev, bool enable_wake)
         disable_irq(irq);
         if (enable_wake && device_may_wakeup(rmi_dev->xport->dev)) {
                 retval = enable_irq_wake(irq);
-                if (!retval)
+                if (retval)
                         dev_warn(&rmi_dev->dev,
                                  "Failed to enable irq for wake: %d\n",
                                  retval);
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index 83cf11312fd9..c9d1c91e1887 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -682,7 +682,7 @@ static int wm97xx_probe(struct device *dev)
         }
         platform_set_drvdata(wm->battery_dev, wm);
         wm->battery_dev->dev.parent = dev;
-        wm->battery_dev->dev.platform_data = pdata->batt_pdata;
+        wm->battery_dev->dev.platform_data = pdata ? pdata->batt_pdata : NULL;
         ret = platform_device_add(wm->battery_dev);
         if (ret < 0)
                 goto batt_reg_err;
diff --git a/drivers/irqchip/irq-keystone.c b/drivers/irqchip/irq-keystone.c
index 54a5e870a8f5..efbcf8435185 100644
--- a/drivers/irqchip/irq-keystone.c
+++ b/drivers/irqchip/irq-keystone.c
@@ -19,9 +19,9 @@
 #include <linux/bitops.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/interrupt.h>
 #include <linux/irqdomain.h>
 #include <linux/irqchip.h>
-#include <linux/irqchip/chained_irq.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/mfd/syscon.h>
@@ -39,6 +39,7 @@ struct keystone_irq_device {
         struct irq_domain       *irqd;
         struct regmap           *devctrl_regs;
         u32                     devctrl_offset;
+        raw_spinlock_t          wa_lock;
 };
 
 static inline u32 keystone_irq_readl(struct keystone_irq_device *kirq)
@@ -83,17 +84,15 @@ static void keystone_irq_ack(struct irq_data *d)
         /* nothing to do here */
 }
 
-static void keystone_irq_handler(struct irq_desc *desc)
+static irqreturn_t keystone_irq_handler(int irq, void *keystone_irq)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
-        struct keystone_irq_device *kirq = irq_desc_get_handler_data(desc);
+        struct keystone_irq_device *kirq = keystone_irq;
+        unsigned long wa_lock_flags;
         unsigned long pending;
         int src, virq;
 
         dev_dbg(kirq->dev, "start irq %d\n", irq);
 
-        chained_irq_enter(irq_desc_get_chip(desc), desc);
-
         pending = keystone_irq_readl(kirq);
         keystone_irq_writel(kirq, pending);
 
@@ -111,13 +110,15 @@ static void keystone_irq_handler(struct irq_desc *desc)
                         if (!virq)
                                 dev_warn(kirq->dev, "spurious irq detected hwirq %d, virq %d\n",
                                          src, virq);
+                        raw_spin_lock_irqsave(&kirq->wa_lock, wa_lock_flags);
                         generic_handle_irq(virq);
+                        raw_spin_unlock_irqrestore(&kirq->wa_lock,
+                                                   wa_lock_flags);
                 }
         }
 
-        chained_irq_exit(irq_desc_get_chip(desc), desc);
-
         dev_dbg(kirq->dev, "end irq %d\n", irq);
+        return IRQ_HANDLED;
 }
 
 static int keystone_irq_map(struct irq_domain *h, unsigned int virq,
@@ -182,9 +183,16 @@ static int keystone_irq_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        raw_spin_lock_init(&kirq->wa_lock);
+
         platform_set_drvdata(pdev, kirq);
 
-        irq_set_chained_handler_and_data(kirq->irq, keystone_irq_handler, kirq);
+        ret = request_irq(kirq->irq, keystone_irq_handler,
+                          0, dev_name(dev), kirq);
+        if (ret) {
+                irq_domain_remove(kirq->irqd);
+                return ret;
+        }
 
         /* clear all source bits */
         keystone_irq_writel(kirq, ~0x0);
@@ -199,6 +207,8 @@ static int keystone_irq_remove(struct platform_device *pdev)
         struct keystone_irq_device *kirq = platform_get_drvdata(pdev);
         int hwirq;
 
+        free_irq(kirq->irq, kirq);
+
         for (hwirq = 0; hwirq < KEYSTONE_N_IRQ; hwirq++)
                 irq_dispose_mapping(irq_find_mapping(kirq->irqd, hwirq));
 
diff --git a/drivers/irqchip/irq-mxs.c b/drivers/irqchip/irq-mxs.c
index 17304705f2cf..05fa9f7af53c 100644
--- a/drivers/irqchip/irq-mxs.c
+++ b/drivers/irqchip/irq-mxs.c
@@ -131,12 +131,16 @@ static struct irq_chip mxs_icoll_chip = {
         .irq_ack = icoll_ack_irq,
         .irq_mask = icoll_mask_irq,
         .irq_unmask = icoll_unmask_irq,
+        .flags = IRQCHIP_MASK_ON_SUSPEND |
+                 IRQCHIP_SKIP_SET_WAKE,
 };
 
 static struct irq_chip asm9260_icoll_chip = {
         .irq_ack = icoll_ack_irq,
         .irq_mask = asm9260_mask_irq,
         .irq_unmask = asm9260_unmask_irq,
+        .flags = IRQCHIP_MASK_ON_SUSPEND |
+                 IRQCHIP_SKIP_SET_WAKE,
 };
 
 asmlinkage void __exception_irq_entry icoll_handle_irq(struct pt_regs *regs)
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 7c6c57216bf2..8a9f742d8ed7 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1534,18 +1534,18 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
                 return PTR_ERR(key);
         }
 
-        rcu_read_lock();
+        down_read(&key->sem);
 
         ukp = user_key_payload(key);
         if (!ukp) {
-                rcu_read_unlock();
+                up_read(&key->sem);
                 key_put(key);
                 kzfree(new_key_string);
                 return -EKEYREVOKED;
         }
 
         if (cc->key_size != ukp->datalen) {
-                rcu_read_unlock();
+                up_read(&key->sem);
                 key_put(key);
                 kzfree(new_key_string);
                 return -EINVAL;
@@ -1553,7 +1553,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
 
         memcpy(cc->key, ukp->data, cc->key_size);
 
-        rcu_read_unlock();
+        up_read(&key->sem);
         key_put(key);
 
         /* clear the flag since following operations may invalidate previously valid key */
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 6400cffb986d..3570bcb7a4a4 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -427,7 +427,7 @@ static struct pgpath *choose_pgpath(struct multipath *m, size_t nr_bytes)
         unsigned long flags;
         struct priority_group *pg;
         struct pgpath *pgpath;
-        bool bypassed = true;
+        unsigned bypassed = 1;
 
         if (!atomic_read(&m->nr_valid_paths)) {
                 clear_bit(MPATHF_QUEUE_IO, &m->flags);
@@ -466,7 +466,7 @@ check_current_pg:
          */
         do {
                 list_for_each_entry(pg, &m->priority_groups, list) {
-                        if (pg->bypassed == bypassed)
+                        if (pg->bypassed == !!bypassed)
                                 continue;
                         pgpath = choose_path_in_pg(m, pg, nr_bytes);
                         if (!IS_ERR_OR_NULL(pgpath)) {
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 9d7275fb541a..6e702fc69a83 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -779,6 +779,10 @@ static void dm_old_request_fn(struct request_queue *q)
                 int srcu_idx;
                 struct dm_table *map = dm_get_live_table(md, &srcu_idx);
 
+                if (unlikely(!map)) {
+                        dm_put_live_table(md, srcu_idx);
+                        return;
+                }
                 ti = dm_table_find_target(map, pos);
                 dm_put_live_table(md, srcu_idx);
         }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 82821ee0d57f..01175dac0db6 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5291,6 +5291,11 @@ int md_run(struct mddev *mddev)
         if (start_readonly && mddev->ro == 0)
                 mddev->ro = 2; /* read-only, but switch on first write */
 
+        /*
+         * NOTE: some pers->run(), for example r5l_recovery_log(), wakes
+         * up mddev->thread. It is important to initialize critical
+         * resources for mddev->thread BEFORE calling pers->run().
+         */
         err = pers->run(mddev);
         if (err)
                 pr_warn("md: pers->run() failed ...\n");
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 0e8ed2c327b0..302dea3296ba 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -162,6 +162,8 @@ struct r5l_log {
 
         /* to submit async io_units, to fulfill ordering of flush */
         struct work_struct deferred_io_work;
+        /* to disable write back during in degraded mode */
+        struct work_struct disable_writeback_work;
 };
 
 /*
@@ -611,6 +613,21 @@ static void r5l_submit_io_async(struct work_struct *work)
                 r5l_do_submit_io(log, io);
 }
 
+static void r5c_disable_writeback_async(struct work_struct *work)
+{
+        struct r5l_log *log = container_of(work, struct r5l_log,
+                                           disable_writeback_work);
+        struct mddev *mddev = log->rdev->mddev;
+
+        if (log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_THROUGH)
+                return;
+        pr_info("md/raid:%s: Disabling writeback cache for degraded array.\n",
+                mdname(mddev));
+        mddev_suspend(mddev);
+        log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
+        mddev_resume(mddev);
+}
+
 static void r5l_submit_current_io(struct r5l_log *log)
 {
         struct r5l_io_unit *io = log->current_io;
@@ -1393,8 +1410,6 @@ static void r5l_do_reclaim(struct r5l_log *log)
         next_checkpoint = r5c_calculate_new_cp(conf);
         spin_unlock_irq(&log->io_list_lock);
 
-        BUG_ON(reclaimable < 0);
-
         if (reclaimable == 0 || !write_super)
                 return;
 
@@ -2062,7 +2077,7 @@ static int
 r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                                        struct r5l_recovery_ctx *ctx)
 {
-        struct stripe_head *sh, *next;
+        struct stripe_head *sh;
         struct mddev *mddev = log->rdev->mddev;
         struct page *page;
         sector_t next_checkpoint = MaxSector;
@@ -2076,7 +2091,7 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
 
         WARN_ON(list_empty(&ctx->cached_list));
 
-        list_for_each_entry_safe(sh, next, &ctx->cached_list, lru) {
+        list_for_each_entry(sh, &ctx->cached_list, lru) {
                 struct r5l_meta_block *mb;
                 int i;
                 int offset;
@@ -2126,14 +2141,39 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                 ctx->pos = write_pos;
                 ctx->seq += 1;
                 next_checkpoint = sh->log_start;
-                list_del_init(&sh->lru);
-                raid5_release_stripe(sh);
         }
         log->next_checkpoint = next_checkpoint;
         __free_page(page);
         return 0;
 }
 
+static void r5c_recovery_flush_data_only_stripes(struct r5l_log *log,
+                                                 struct r5l_recovery_ctx *ctx)
+{
+        struct mddev *mddev = log->rdev->mddev;
+        struct r5conf *conf = mddev->private;
+        struct stripe_head *sh, *next;
+
+        if (ctx->data_only_stripes == 0)
+                return;
+
+        log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_BACK;
+
+        list_for_each_entry_safe(sh, next, &ctx->cached_list, lru) {
+                r5c_make_stripe_write_out(sh);
+                set_bit(STRIPE_HANDLE, &sh->state);
+                list_del_init(&sh->lru);
+                raid5_release_stripe(sh);
+        }
+
+        md_wakeup_thread(conf->mddev->thread);
+        /* reuse conf->wait_for_quiescent in recovery */
+        wait_event(conf->wait_for_quiescent,
+                   atomic_read(&conf->active_stripes) == 0);
+
+        log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
+}
+
 static int r5l_recovery_log(struct r5l_log *log)
 {
         struct mddev *mddev = log->rdev->mddev;
@@ -2160,32 +2200,31 @@ static int r5l_recovery_log(struct r5l_log *log)
         pos = ctx.pos;
         ctx.seq += 10000;
 
-        if (ctx.data_only_stripes == 0) {
-                log->next_checkpoint = ctx.pos;
-                r5l_log_write_empty_meta_block(log, ctx.pos, ctx.seq++);
-                ctx.pos = r5l_ring_add(log, ctx.pos, BLOCK_SECTORS);
-        }
 
         if ((ctx.data_only_stripes == 0) && (ctx.data_parity_stripes == 0))
                 pr_debug("md/raid:%s: starting from clean shutdown\n",
                          mdname(mddev));
-        else {
+        else
                 pr_debug("md/raid:%s: recovering %d data-only stripes and %d data-parity stripes\n",
                          mdname(mddev), ctx.data_only_stripes,
                          ctx.data_parity_stripes);
 
-                if (ctx.data_only_stripes > 0)
-                        if (r5c_recovery_rewrite_data_only_stripes(log, &ctx)) {
-                                pr_err("md/raid:%s: failed to rewrite stripes to journal\n",
-                                       mdname(mddev));
-                                return -EIO;
-                        }
+        if (ctx.data_only_stripes == 0) {
+                log->next_checkpoint = ctx.pos;
+                r5l_log_write_empty_meta_block(log, ctx.pos, ctx.seq++);
+                ctx.pos = r5l_ring_add(log, ctx.pos, BLOCK_SECTORS);
+        } else if (r5c_recovery_rewrite_data_only_stripes(log, &ctx)) {
+                pr_err("md/raid:%s: failed to rewrite stripes to journal\n",
+                       mdname(mddev));
+                return -EIO;
         }
 
         log->log_start = ctx.pos;
         log->seq = ctx.seq;
         log->last_checkpoint = pos;
         r5l_write_super(log, pos);
+
+        r5c_recovery_flush_data_only_stripes(log, &ctx);
         return 0;
 }
 
@@ -2247,6 +2286,10 @@ static ssize_t r5c_journal_mode_store(struct mddev *mddev,
             val > R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
 
+        if (raid5_calc_degraded(conf) > 0 &&
+            val == R5C_JOURNAL_MODE_WRITE_BACK)
+                return -EINVAL;
+
         mddev_suspend(mddev);
         conf->log->r5c_journal_mode = val;
         mddev_resume(mddev);
@@ -2301,6 +2344,16 @@ int r5c_try_caching_write(struct r5conf *conf,
                 set_bit(STRIPE_R5C_CACHING, &sh->state);
         }
 
+        /*
+         * When run in degraded mode, array is set to write-through mode.
+         * This check helps drain pending write safely in the transition to
+         * write-through mode.
+         */
+        if (s->failed) {
+                r5c_make_stripe_write_out(sh);
+                return -EAGAIN;
+        }
+
         for (i = disks; i--; ) {
                 dev = &sh->dev[i];
                 /* if non-overwrite, use writing-out phase */
@@ -2351,6 +2404,8 @@ void r5c_release_extra_page(struct stripe_head *sh)
                         struct page *p = sh->dev[i].orig_page;
 
                         sh->dev[i].orig_page = sh->dev[i].page;
+                        clear_bit(R5_OrigPageUPTDODATE, &sh->dev[i].flags);
+
                         if (!using_disk_info_extra_page)
                                 put_page(p);
                 }
@@ -2555,6 +2610,19 @@ ioerr:
         return ret;
 }
 
+void r5c_update_on_rdev_error(struct mddev *mddev)
+{
+        struct r5conf *conf = mddev->private;
+        struct r5l_log *log = conf->log;
+
+        if (!log)
+                return;
+
+        if (raid5_calc_degraded(conf) > 0 &&
+            conf->log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_BACK)
+                schedule_work(&log->disable_writeback_work);
+}
+
 int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
 {
         struct request_queue *q = bdev_get_queue(rdev->bdev);
@@ -2627,6 +2695,7 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
         spin_lock_init(&log->no_space_stripes_lock);
 
         INIT_WORK(&log->deferred_io_work, r5l_submit_io_async);
+        INIT_WORK(&log->disable_writeback_work, r5c_disable_writeback_async);
 
         log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
         INIT_LIST_HEAD(&log->stripe_in_journal_list);
@@ -2659,6 +2728,7 @@ io_kc:
 
 void r5l_exit_log(struct r5l_log *log)
 {
+        flush_work(&log->disable_writeback_work);
         md_unregister_thread(&log->reclaim_thread);
         mempool_destroy(log->meta_pool);
         bioset_free(log->bs);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 36c13e4be9c9..3c7e106c12a2 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -556,7 +556,7 @@ static struct stripe_head *__find_stripe(struct r5conf *conf, sector_t sector,
  * of the two sections, and some non-in_sync devices may
  * be insync in the section most affected by failed devices.
  */
-static int calc_degraded(struct r5conf *conf)
+int raid5_calc_degraded(struct r5conf *conf)
 {
         int degraded, degraded2;
         int i;
@@ -619,7 +619,7 @@ static int has_failed(struct r5conf *conf)
         if (conf->mddev->reshape_position == MaxSector)
                 return conf->mddev->degraded > conf->max_degraded;
 
-        degraded = calc_degraded(conf);
+        degraded = raid5_calc_degraded(conf);
         if (degraded > conf->max_degraded)
                 return 1;
         return 0;
@@ -1015,7 +1015,17 @@ again:
 
                         if (test_bit(R5_SkipCopy, &sh->dev[i].flags))
                                 WARN_ON(test_bit(R5_UPTODATE, &sh->dev[i].flags));
-                        sh->dev[i].vec.bv_page = sh->dev[i].page;
+
+                        if (!op_is_write(op) &&
+                            test_bit(R5_InJournal, &sh->dev[i].flags))
+                                /*
+                                 * issuing read for a page in journal, this
+                                 * must be preparing for prexor in rmw; read
+                                 * the data into orig_page
+                                 */
+                                sh->dev[i].vec.bv_page = sh->dev[i].orig_page;
+                        else
+                                sh->dev[i].vec.bv_page = sh->dev[i].page;
                         bi->bi_vcnt = 1;
                         bi->bi_io_vec[0].bv_len = STRIPE_SIZE;
                         bi->bi_io_vec[0].bv_offset = 0;
@@ -2380,6 +2390,13 @@ static void raid5_end_read_request(struct bio * bi)
                 } else if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
                         clear_bit(R5_ReadNoMerge, &sh->dev[i].flags);
 
+                if (test_bit(R5_InJournal, &sh->dev[i].flags))
+                        /*
+                         * end read for a page in journal, this
+                         * must be preparing for prexor in rmw
+                         */
+                        set_bit(R5_OrigPageUPTDODATE, &sh->dev[i].flags);
+
                 if (atomic_read(&rdev->read_errors))
                         atomic_set(&rdev->read_errors, 0);
         } else {
@@ -2538,7 +2555,7 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
 
         spin_lock_irqsave(&conf->device_lock, flags);
         clear_bit(In_sync, &rdev->flags);
-        mddev->degraded = calc_degraded(conf);
+        mddev->degraded = raid5_calc_degraded(conf);
         spin_unlock_irqrestore(&conf->device_lock, flags);
         set_bit(MD_RECOVERY_INTR, &mddev->recovery);
 
@@ -2552,6 +2569,7 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
                 bdevname(rdev->bdev, b),
                 mdname(mddev),
                 conf->raid_disks - mddev->degraded);
+        r5c_update_on_rdev_error(mddev);
 }
 
 /*
@@ -2880,6 +2898,30 @@ sector_t raid5_compute_blocknr(struct stripe_head *sh, int i, int previous)
         return r_sector;
 }
 
+/*
+ * There are cases where we want handle_stripe_dirtying() and
+ * schedule_reconstruction() to delay towrite to some dev of a stripe.
+ *
+ * This function checks whether we want to delay the towrite. Specifically,
+ * we delay the towrite when:
+ *
+ *   1. degraded stripe has a non-overwrite to the missing dev, AND this
+ *      stripe has data in journal (for other devices).
+ *
+ *      In this case, when reading data for the non-overwrite dev, it is
+ *      necessary to handle complex rmw of write back cache (prexor with
+ *      orig_page, and xor with page). To keep read path simple, we would
+ *      like to flush data in journal to RAID disks first, so complex rmw
+ *      is handled in the write patch (handle_stripe_dirtying).
+ *
+ */
+static inline bool delay_towrite(struct r5dev *dev,
+                                   struct stripe_head_state *s)
+{
+        return !test_bit(R5_OVERWRITE, &dev->flags) &&
+                !test_bit(R5_Insync, &dev->flags) && s->injournal;
+}
+
 static void
 schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                          int rcw, int expand)
@@ -2900,7 +2942,7 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
                 for (i = disks; i--; ) {
                         struct r5dev *dev = &sh->dev[i];
 
-                        if (dev->towrite) {
+                        if (dev->towrite && !delay_towrite(dev, s)) {
                                 set_bit(R5_LOCKED, &dev->flags);
                                 set_bit(R5_Wantdrain, &dev->flags);
                                 if (!expand)
@@ -3295,13 +3337,6 @@ static int want_replace(struct stripe_head *sh, int disk_idx)
         return rv;
 }
 
-/* fetch_block - checks the given member device to see if its data needs
- * to be read or computed to satisfy a request.
- *
- * Returns 1 when no more member devices need to be checked, otherwise returns
- * 0 to tell the loop in handle_stripe_fill to continue
- */
-
 static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
                            int disk_idx, int disks)
 {
@@ -3392,6 +3427,12 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
         return 0;
 }
 
+/* fetch_block - checks the given member device to see if its data needs
+ * to be read or computed to satisfy a request.
+ *
+ * Returns 1 when no more member devices need to be checked, otherwise returns
+ * 0 to tell the loop in handle_stripe_fill to continue
+ */
 static int fetch_block(struct stripe_head *sh, struct stripe_head_state *s,
                        int disk_idx, int disks)
 {
@@ -3478,10 +3519,26 @@ static void handle_stripe_fill(struct stripe_head *sh,
          * midst of changing due to a write
          */
         if (!test_bit(STRIPE_COMPUTE_RUN, &sh->state) && !sh->check_state &&
-            !sh->reconstruct_state)
+            !sh->reconstruct_state) {
+
+                /*
+                 * For degraded stripe with data in journal, do not handle
+                 * read requests yet, instead, flush the stripe to raid
+                 * disks first, this avoids handling complex rmw of write
+                 * back cache (prexor with orig_page, and then xor with
+                 * page) in the read path
+                 */
+                if (s->injournal && s->failed) {
+                        if (test_bit(STRIPE_R5C_CACHING, &sh->state))
+                                r5c_make_stripe_write_out(sh);
+                        goto out;
+                }
+
                 for (i = disks; i--; )
                         if (fetch_block(sh, s, i, disks))
                                 break;
+        }
+out:
         set_bit(STRIPE_HANDLE, &sh->state);
 }
 
@@ -3594,6 +3651,21 @@ unhash:
                 break_stripe_batch_list(head_sh, STRIPE_EXPAND_SYNC_FLAGS);
 }
 
+/*
+ * For RMW in write back cache, we need extra page in prexor to store the
+ * old data. This page is stored in dev->orig_page.
+ *
+ * This function checks whether we have data for prexor. The exact logic
+ * is:
+ *       R5_UPTODATE && (!R5_InJournal || R5_OrigPageUPTDODATE)
+ */
+static inline bool uptodate_for_rmw(struct r5dev *dev)
+{
+        return (test_bit(R5_UPTODATE, &dev->flags)) &&
+                (!test_bit(R5_InJournal, &dev->flags) ||
+                 test_bit(R5_OrigPageUPTDODATE, &dev->flags));
+}
+
 static int handle_stripe_dirtying(struct r5conf *conf,
                                   struct stripe_head *sh,
                                   struct stripe_head_state *s,
@@ -3622,12 +3694,11 @@ static int handle_stripe_dirtying(struct r5conf *conf,
         } else for (i = disks; i--; ) {
                 /* would I have to read this buffer for read_modify_write */
                 struct r5dev *dev = &sh->dev[i];
-                if ((dev->towrite || i == sh->pd_idx || i == sh->qd_idx ||
+                if (((dev->towrite && !delay_towrite(dev, s)) ||
+                     i == sh->pd_idx || i == sh->qd_idx ||
                      test_bit(R5_InJournal, &dev->flags)) &&
                     !test_bit(R5_LOCKED, &dev->flags) &&
-                    !((test_bit(R5_UPTODATE, &dev->flags) &&
-                       (!test_bit(R5_InJournal, &dev->flags) ||
-                        dev->page != dev->orig_page)) ||
+                    !(uptodate_for_rmw(dev) ||
                       test_bit(R5_Wantcompute, &dev->flags))) {
                         if (test_bit(R5_Insync, &dev->flags))
                                 rmw++;
@@ -3639,7 +3710,6 @@ static int handle_stripe_dirtying(struct r5conf *conf,
                     i != sh->pd_idx && i != sh->qd_idx &&
                     !test_bit(R5_LOCKED, &dev->flags) &&
                     !(test_bit(R5_UPTODATE, &dev->flags) ||
-                      test_bit(R5_InJournal, &dev->flags) ||
                       test_bit(R5_Wantcompute, &dev->flags))) {
                         if (test_bit(R5_Insync, &dev->flags))
                                 rcw++;
@@ -3689,13 +3759,11 @@ static int handle_stripe_dirtying(struct r5conf *conf,
 
                 for (i = disks; i--; ) {
                         struct r5dev *dev = &sh->dev[i];
-                        if ((dev->towrite ||
+                        if (((dev->towrite && !delay_towrite(dev, s)) ||
                              i == sh->pd_idx || i == sh->qd_idx ||
                              test_bit(R5_InJournal, &dev->flags)) &&
                             !test_bit(R5_LOCKED, &dev->flags) &&
-                            !((test_bit(R5_UPTODATE, &dev->flags) &&
-                               (!test_bit(R5_InJournal, &dev->flags) ||
-                                dev->page != dev->orig_page)) ||
+                            !(uptodate_for_rmw(dev) ||
                               test_bit(R5_Wantcompute, &dev->flags)) &&
                             test_bit(R5_Insync, &dev->flags)) {
                                 if (test_bit(STRIPE_PREREAD_ACTIVE,
@@ -3722,7 +3790,6 @@ static int handle_stripe_dirtying(struct r5conf *conf,
                             i != sh->pd_idx && i != sh->qd_idx &&
                             !test_bit(R5_LOCKED, &dev->flags) &&
                             !(test_bit(R5_UPTODATE, &dev->flags) ||
-                              test_bit(R5_InJournal, &dev->flags) ||
                               test_bit(R5_Wantcompute, &dev->flags))) {
                                 rcw++;
                                 if (test_bit(R5_Insync, &dev->flags) &&
@@ -7025,7 +7092,7 @@ static int raid5_run(struct mddev *mddev)
         /*
          * 0 for a fully functional array, 1 or 2 for a degraded array.
          */
-        mddev->degraded = calc_degraded(conf);
+        mddev->degraded = raid5_calc_degraded(conf);
 
         if (has_failed(conf)) {
                 pr_crit("md/raid:%s: not enough operational devices (%d/%d failed)\n",
@@ -7272,7 +7339,7 @@ static int raid5_spare_active(struct mddev *mddev)
                 }
         }
         spin_lock_irqsave(&conf->device_lock, flags);
-        mddev->degraded = calc_degraded(conf);
+        mddev->degraded = raid5_calc_degraded(conf);
         spin_unlock_irqrestore(&conf->device_lock, flags);
         print_raid5_conf(conf);
         return count;
@@ -7632,7 +7699,7 @@ static int raid5_start_reshape(struct mddev *mddev)
                  * pre and post number of devices.
                  */
                 spin_lock_irqsave(&conf->device_lock, flags);
-                mddev->degraded = calc_degraded(conf);
+                mddev->degraded = raid5_calc_degraded(conf);
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
         mddev->raid_disks = conf->raid_disks;
@@ -7720,7 +7787,7 @@ static void raid5_finish_reshape(struct mddev *mddev)
                 } else {
                         int d;
                         spin_lock_irq(&conf->device_lock);
-                        mddev->degraded = calc_degraded(conf);
+                        mddev->degraded = raid5_calc_degraded(conf);
                         spin_unlock_irq(&conf->device_lock);
                         for (d = conf->raid_disks ;
                              d < conf->raid_disks - mddev->delta_disks;
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index ed8e1362ab36..1440fa26e296 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -322,6 +322,11 @@ enum r5dev_flags {
                          * data and parity being written are in the journal
                          * device
                          */
+        R5_OrigPageUPTDODATE,   /* with write back cache, we read old data into
+                                 * dev->orig_page for prexor. When this flag is
+                                 * set, orig_page contains latest data in the
+                                 * raid disk.
+                                 */
 };
 
 /*
@@ -753,6 +758,7 @@ extern sector_t raid5_compute_sector(struct r5conf *conf, sector_t r_sector,
 extern struct stripe_head *
 raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
                         int previous, int noblock, int noquiesce);
+extern int raid5_calc_degraded(struct r5conf *conf);
 extern int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev);
 extern void r5l_exit_log(struct r5l_log *log);
 extern int r5l_write_stripe(struct r5l_log *log, struct stripe_head *head_sh);
@@ -781,4 +787,5 @@ extern void r5c_flush_cache(struct r5conf *conf, int num);
 extern void r5c_check_stripe_cache_usage(struct r5conf *conf);
 extern void r5c_check_cached_full_stripe(struct r5conf *conf);
 extern struct md_sysfs_entry r5c_journal_mode;
+extern void r5c_update_on_rdev_error(struct mddev *mddev);
 #endif
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index ebb5e391b800..87a6b65ed3af 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1206,7 +1206,7 @@ static int cec_config_thread_func(void *arg)
                 las->log_addr[i] = CEC_LOG_ADDR_INVALID;
                 if (last_la == CEC_LOG_ADDR_INVALID ||
                     last_la == CEC_LOG_ADDR_UNREGISTERED ||
-                    !(last_la & type2mask[type]))
+                    !((1 << last_la) & type2mask[type]))
                         last_la = la_list[0];
 
                 err = cec_config_log_addr(adap, i, last_la);
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 01a804792f30..b5972440c1bf 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1023,7 +1023,12 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
                 if (!host->busy_status && busy_resp &&
                     !(status & (MCI_CMDCRCFAIL|MCI_CMDTIMEOUT)) &&
                     (readl(base + MMCISTATUS) & host->variant->busy_detect_flag)) {
-                        /* Unmask the busy IRQ */
+
+                        /* Clear the busy start IRQ */
+                        writel(host->variant->busy_detect_mask,
+                               host->base + MMCICLEAR);
+
+                        /* Unmask the busy end IRQ */
                         writel(readl(base + MMCIMASK0) |
                                host->variant->busy_detect_mask,
                                base + MMCIMASK0);
@@ -1038,10 +1043,14 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
 
                 /*
                  * At this point we are not busy with a command, we have
-                 * not received a new busy request, mask the busy IRQ and
-                 * fall through to process the IRQ.
+                 * not received a new busy request, clear and mask the busy
+                 * end IRQ and fall through to process the IRQ.
                  */
                 if (host->busy_status) {
+
+                        writel(host->variant->busy_detect_mask,
+                               host->base + MMCICLEAR);
+
                         writel(readl(base + MMCIMASK0) &
                                ~host->variant->busy_detect_mask,
                                base + MMCIMASK0);
@@ -1283,12 +1292,21 @@ static irqreturn_t mmci_irq(int irq, void *dev_id)
                 }
 
                 /*
-                 * We intentionally clear the MCI_ST_CARDBUSY IRQ here (if it's
-                 * enabled) since the HW seems to be triggering the IRQ on both
-                 * edges while monitoring DAT0 for busy completion.
+                 * We intentionally clear the MCI_ST_CARDBUSY IRQ (if it's
+                 * enabled) in mmci_cmd_irq() function where ST Micro busy
+                 * detection variant is handled. Considering the HW seems to be
+                 * triggering the IRQ on both edges while monitoring DAT0 for
+                 * busy completion and that same status bit is used to monitor
+                 * start and end of busy detection, special care must be taken
+                 * to make sure that both start and end interrupts are always
+                 * cleared one after the other.
                  */
                 status &= readl(host->base + MMCIMASK0);
-                writel(status, host->base + MMCICLEAR);
+                if (host->variant->busy_detect)
+                        writel(status & ~host->variant->busy_detect_mask,
+                               host->base + MMCICLEAR);
+                else
+                        writel(status, host->base + MMCICLEAR);
 
                 dev_dbg(mmc_dev(host->mmc), "irq0 (data+cmd) %08x\n", status);
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 23909804ffb8..0def99590d16 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2733,7 +2733,8 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
                 if (intmask & SDHCI_INT_RETUNE)
                         mmc_retune_needed(host->mmc);
 
-                if (intmask & SDHCI_INT_CARD_INT) {
+                if ((intmask & SDHCI_INT_CARD_INT) &&
+                    (host->ier & SDHCI_INT_CARD_INT)) {
                         sdhci_enable_sdio_irq_nolock(host, false);
                         host->thread_isr |= SDHCI_INT_CARD_INT;
                         result = IRQ_WAKE_THREAD;
diff --git a/drivers/net/ethernet/adaptec/starfire.c b/drivers/net/ethernet/adaptec/starfire.c
index c12d2618eebf..3872ab96b80a 100644
--- a/drivers/net/ethernet/adaptec/starfire.c
+++ b/drivers/net/ethernet/adaptec/starfire.c
@@ -1152,6 +1152,12 @@ static void init_ring(struct net_device *dev)
                 if (skb == NULL)
                         break;
                 np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(np->pci_dev,
+                                          np->rx_info[i].mapping)) {
+                        dev_kfree_skb(skb);
+                        np->rx_info[i].skb = NULL;
+                        break;
+                }
                 /* Grrr, we cannot offset to correctly align the IP header. */
                 np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | RxDescValid);
         }
@@ -1182,8 +1188,9 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
 {
         struct netdev_private *np = netdev_priv(dev);
         unsigned int entry;
+        unsigned int prev_tx;
         u32 status;
-        int i;
+        int i, j;
 
         /*
          * be cautious here, wrapping the queue has weird semantics
@@ -1201,6 +1208,7 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
         }
 #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */
 
+        prev_tx = np->cur_tx;
         entry = np->cur_tx % TX_RING_SIZE;
         for (i = 0; i < skb_num_frags(skb); i++) {
                 int wrap_ring = 0;
@@ -1234,6 +1242,11 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
                                                skb_frag_size(this_frag),
                                                PCI_DMA_TODEVICE);
                 }
+                if (pci_dma_mapping_error(np->pci_dev,
+                                          np->tx_info[entry].mapping)) {
+                        dev->stats.tx_dropped++;
+                        goto err_out;
+                }
 
                 np->tx_ring[entry].addr = cpu_to_dma(np->tx_info[entry].mapping);
                 np->tx_ring[entry].status = cpu_to_le32(status);
@@ -1268,8 +1281,30 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev)
                 netif_stop_queue(dev);
 
         return NETDEV_TX_OK;
-}
 
+err_out:
+        entry = prev_tx % TX_RING_SIZE;
+        np->tx_info[entry].skb = NULL;
+        if (i > 0) {
+                pci_unmap_single(np->pci_dev,
+                                 np->tx_info[entry].mapping,
+                                 skb_first_frag_len(skb),
+                                 PCI_DMA_TODEVICE);
+                np->tx_info[entry].mapping = 0;
+                entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE;
+                for (j = 1; j < i; j++) {
+                        pci_unmap_single(np->pci_dev,
+                                         np->tx_info[entry].mapping,
+                                         skb_frag_size(
+                                                &skb_shinfo(skb)->frags[j-1]),
+                                         PCI_DMA_TODEVICE);
+                        entry++;
+                }
+        }
+        dev_kfree_skb_any(skb);
+        np->cur_tx = prev_tx;
+        return NETDEV_TX_OK;
+}
 
 /* The interrupt handler does all of the Rx thread work and cleans up
    after the Tx thread. */
@@ -1569,6 +1604,12 @@ static void refill_rx_ring(struct net_device *dev)
                                 break;  /* Better luck next round. */
                         np->rx_info[entry].mapping =
                                 pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(np->pci_dev,
+                                                np->rx_info[entry].mapping)) {
+                                dev_kfree_skb(skb);
+                                np->rx_info[entry].skb = NULL;
+                                break;
+                        }
                         np->rx_ring[entry].rxaddr =
                                 cpu_to_dma(np->rx_info[entry].mapping | RxDescValid);
                 }
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index c0fb80acc2da..baba2db9d9c2 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -43,13 +43,13 @@
 #define DEFAULT_RX_RING_SIZE    512 /* must be power of 2 */
 #define MIN_RX_RING_SIZE        64
 #define MAX_RX_RING_SIZE        8192
-#define RX_RING_BYTES(bp)       (sizeof(struct macb_dma_desc)   \
+#define RX_RING_BYTES(bp)       (macb_dma_desc_get_size(bp)     \
                                  * (bp)->rx_ring_size)
 
 #define DEFAULT_TX_RING_SIZE    512 /* must be power of 2 */
 #define MIN_TX_RING_SIZE        64
 #define MAX_TX_RING_SIZE        4096
-#define TX_RING_BYTES(bp)       (sizeof(struct macb_dma_desc)   \
+#define TX_RING_BYTES(bp)       (macb_dma_desc_get_size(bp)     \
                                  * (bp)->tx_ring_size)
 
 /* level of occupied TX descriptors under which we wake up TX process */
@@ -78,6 +78,37 @@
  */
 #define MACB_HALT_TIMEOUT       1230
 
+/* DMA buffer descriptor might be different size
+ * depends on hardware configuration.
+ */
+static unsigned int macb_dma_desc_get_size(struct macb *bp)
+{
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                return sizeof(struct macb_dma_desc) + sizeof(struct macb_dma_desc_64);
+#endif
+        return sizeof(struct macb_dma_desc);
+}
+
+static unsigned int macb_adj_dma_desc_idx(struct macb *bp, unsigned int idx)
+{
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        /* Dma buffer descriptor is 4 words length (instead of 2 words)
+         * for 64b GEM.
+         */
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                idx <<= 1;
+#endif
+        return idx;
+}
+
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+static struct macb_dma_desc_64 *macb_64b_desc(struct macb *bp, struct macb_dma_desc *desc)
+{
+        return (struct macb_dma_desc_64 *)((void *)desc + sizeof(struct macb_dma_desc));
+}
+#endif
+
 /* Ring buffer accessors */
 static unsigned int macb_tx_ring_wrap(struct macb *bp, unsigned int index)
 {
@@ -87,7 +118,9 @@ static unsigned int macb_tx_ring_wrap(struct macb *bp, unsigned int index)
 static struct macb_dma_desc *macb_tx_desc(struct macb_queue *queue,
                                           unsigned int index)
 {
-        return &queue->tx_ring[macb_tx_ring_wrap(queue->bp, index)];
+        index = macb_tx_ring_wrap(queue->bp, index);
+        index = macb_adj_dma_desc_idx(queue->bp, index);
+        return &queue->tx_ring[index];
 }
 
 static struct macb_tx_skb *macb_tx_skb(struct macb_queue *queue,
@@ -101,7 +134,7 @@ static dma_addr_t macb_tx_dma(struct macb_queue *queue, unsigned int index)
         dma_addr_t offset;
 
         offset = macb_tx_ring_wrap(queue->bp, index) *
-                 sizeof(struct macb_dma_desc);
+                        macb_dma_desc_get_size(queue->bp);
 
         return queue->tx_ring_dma + offset;
 }
@@ -113,7 +146,9 @@ static unsigned int macb_rx_ring_wrap(struct macb *bp, unsigned int index)
 
 static struct macb_dma_desc *macb_rx_desc(struct macb *bp, unsigned int index)
 {
-        return &bp->rx_ring[macb_rx_ring_wrap(bp, index)];
+        index = macb_rx_ring_wrap(bp, index);
+        index = macb_adj_dma_desc_idx(bp, index);
+        return &bp->rx_ring[index];
 }
 
 static void *macb_rx_buffer(struct macb *bp, unsigned int index)
@@ -560,12 +595,32 @@ static void macb_tx_unmap(struct macb *bp, struct macb_tx_skb *tx_skb)
         }
 }
 
-static inline void macb_set_addr(struct macb_dma_desc *desc, dma_addr_t addr)
+static void macb_set_addr(struct macb *bp, struct macb_dma_desc *desc, dma_addr_t addr)
 {
-        desc->addr = (u32)addr;
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        desc->addrh = (u32)(addr >> 32);
+        struct macb_dma_desc_64 *desc_64;
+
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B) {
+                desc_64 = macb_64b_desc(bp, desc);
+                desc_64->addrh = upper_32_bits(addr);
+        }
 #endif
+        desc->addr = lower_32_bits(addr);
+}
+
+static dma_addr_t macb_get_addr(struct macb *bp, struct macb_dma_desc *desc)
+{
+        dma_addr_t addr = 0;
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        struct macb_dma_desc_64 *desc_64;
+
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B) {
+                desc_64 = macb_64b_desc(bp, desc);
+                addr = ((u64)(desc_64->addrh) << 32);
+        }
+#endif
+        addr |= MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
+        return addr;
 }
 
 static void macb_tx_error_task(struct work_struct *work)
@@ -649,16 +704,17 @@ static void macb_tx_error_task(struct work_struct *work)
 
         /* Set end of TX queue */
         desc = macb_tx_desc(queue, 0);
-        macb_set_addr(desc, 0);
+        macb_set_addr(bp, desc, 0);
         desc->ctrl = MACB_BIT(TX_USED);
 
         /* Make descriptor updates visible to hardware */
         wmb();
 
         /* Reinitialize the TX desc queue */
-        queue_writel(queue, TBQP, (u32)(queue->tx_ring_dma));
+        queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        queue_writel(queue, TBQPH, (u32)(queue->tx_ring_dma >> 32));
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
 #endif
         /* Make TX ring reflect state of hardware */
         queue->tx_head = 0;
@@ -750,6 +806,7 @@ static void gem_rx_refill(struct macb *bp)
         unsigned int            entry;
         struct sk_buff          *skb;
         dma_addr_t              paddr;
+        struct macb_dma_desc *desc;
 
         while (CIRC_SPACE(bp->rx_prepared_head, bp->rx_tail,
                           bp->rx_ring_size) > 0) {
@@ -759,6 +816,7 @@ static void gem_rx_refill(struct macb *bp)
                 rmb();
 
                 bp->rx_prepared_head++;
+                desc = macb_rx_desc(bp, entry);
 
                 if (!bp->rx_skbuff[entry]) {
                         /* allocate sk_buff for this free entry in ring */
@@ -782,14 +840,14 @@ static void gem_rx_refill(struct macb *bp)
 
                         if (entry == bp->rx_ring_size - 1)
                                 paddr |= MACB_BIT(RX_WRAP);
-                        macb_set_addr(&(bp->rx_ring[entry]), paddr);
-                        bp->rx_ring[entry].ctrl = 0;
+                        macb_set_addr(bp, desc, paddr);
+                        desc->ctrl = 0;
 
                         /* properly align Ethernet header */
                         skb_reserve(skb, NET_IP_ALIGN);
                 } else {
-                        bp->rx_ring[entry].addr &= ~MACB_BIT(RX_USED);
-                        bp->rx_ring[entry].ctrl = 0;
+                        desc->addr &= ~MACB_BIT(RX_USED);
+                        desc->ctrl = 0;
                 }
         }
 
@@ -835,16 +893,13 @@ static int gem_rx(struct macb *bp, int budget)
                 bool rxused;
 
                 entry = macb_rx_ring_wrap(bp, bp->rx_tail);
-                desc = &bp->rx_ring[entry];
+                desc = macb_rx_desc(bp, entry);
 
                 /* Make hw descriptor updates visible to CPU */
                 rmb();
 
                 rxused = (desc->addr & MACB_BIT(RX_USED)) ? true : false;
-                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                addr |= ((u64)(desc->addrh) << 32);
-#endif
+                addr = macb_get_addr(bp, desc);
                 ctrl = desc->ctrl;
 
                 if (!rxused)
@@ -987,15 +1042,17 @@ static int macb_rx_frame(struct macb *bp, unsigned int first_frag,
 static inline void macb_init_rx_ring(struct macb *bp)
 {
         dma_addr_t addr;
+        struct macb_dma_desc *desc = NULL;
         int i;
 
         addr = bp->rx_buffers_dma;
         for (i = 0; i < bp->rx_ring_size; i++) {
-                bp->rx_ring[i].addr = addr;
-                bp->rx_ring[i].ctrl = 0;
+                desc = macb_rx_desc(bp, i);
+                macb_set_addr(bp, desc, addr);
+                desc->ctrl = 0;
                 addr += bp->rx_buffer_size;
         }
-        bp->rx_ring[bp->rx_ring_size - 1].addr |= MACB_BIT(RX_WRAP);
+        desc->addr |= MACB_BIT(RX_WRAP);
         bp->rx_tail = 0;
 }
 
@@ -1008,15 +1065,14 @@ static int macb_rx(struct macb *bp, int budget)
 
         for (tail = bp->rx_tail; budget > 0; tail++) {
                 struct macb_dma_desc *desc = macb_rx_desc(bp, tail);
-                u32 addr, ctrl;
+                u32 ctrl;
 
                 /* Make hw descriptor updates visible to CPU */
                 rmb();
 
-                addr = desc->addr;
                 ctrl = desc->ctrl;
 
-                if (!(addr & MACB_BIT(RX_USED)))
+                if (!(desc->addr & MACB_BIT(RX_USED)))
                         break;
 
                 if (ctrl & MACB_BIT(RX_SOF)) {
@@ -1336,7 +1392,7 @@ static unsigned int macb_tx_map(struct macb *bp,
         i = tx_head;
         entry = macb_tx_ring_wrap(bp, i);
         ctrl = MACB_BIT(TX_USED);
-        desc = &queue->tx_ring[entry];
+        desc = macb_tx_desc(queue, entry);
         desc->ctrl = ctrl;
 
         if (lso_ctrl) {
@@ -1358,7 +1414,7 @@ static unsigned int macb_tx_map(struct macb *bp,
                 i--;
                 entry = macb_tx_ring_wrap(bp, i);
                 tx_skb = &queue->tx_skb[entry];
-                desc = &queue->tx_ring[entry];
+                desc = macb_tx_desc(queue, entry);
 
                 ctrl = (u32)tx_skb->size;
                 if (eof) {
@@ -1379,7 +1435,7 @@ static unsigned int macb_tx_map(struct macb *bp,
                         ctrl |= MACB_BF(MSS_MFS, mss_mfs);
 
                 /* Set TX buffer descriptor */
-                macb_set_addr(desc, tx_skb->mapping);
+                macb_set_addr(bp, desc, tx_skb->mapping);
                 /* desc->addr must be visible to hardware before clearing
                  * 'TX_USED' bit in desc->ctrl.
                  */
@@ -1586,11 +1642,9 @@ static void gem_free_rx_buffers(struct macb *bp)
                 if (!skb)
                         continue;
 
-                desc = &bp->rx_ring[i];
-                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, desc->addr));
-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                addr |= ((u64)(desc->addrh) << 32);
-#endif
+                desc = macb_rx_desc(bp, i);
+                addr = macb_get_addr(bp, desc);
+
                 dma_unmap_single(&bp->pdev->dev, addr, bp->rx_buffer_size,
                                  DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
@@ -1711,15 +1765,17 @@ out_err:
 static void gem_init_rings(struct macb *bp)
 {
         struct macb_queue *queue;
+        struct macb_dma_desc *desc = NULL;
         unsigned int q;
         int i;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
                 for (i = 0; i < bp->tx_ring_size; i++) {
-                        queue->tx_ring[i].addr = 0;
-                        queue->tx_ring[i].ctrl = MACB_BIT(TX_USED);
+                        desc = macb_tx_desc(queue, i);
+                        macb_set_addr(bp, desc, 0);
+                        desc->ctrl = MACB_BIT(TX_USED);
                 }
-                queue->tx_ring[bp->tx_ring_size - 1].ctrl |= MACB_BIT(TX_WRAP);
+                desc->ctrl |= MACB_BIT(TX_WRAP);
                 queue->tx_head = 0;
                 queue->tx_tail = 0;
         }
@@ -1733,16 +1789,18 @@ static void gem_init_rings(struct macb *bp)
 static void macb_init_rings(struct macb *bp)
 {
         int i;
+        struct macb_dma_desc *desc = NULL;
 
         macb_init_rx_ring(bp);
 
         for (i = 0; i < bp->tx_ring_size; i++) {
-                bp->queues[0].tx_ring[i].addr = 0;
-                bp->queues[0].tx_ring[i].ctrl = MACB_BIT(TX_USED);
+                desc = macb_tx_desc(&bp->queues[0], i);
+                macb_set_addr(bp, desc, 0);
+                desc->ctrl = MACB_BIT(TX_USED);
         }
         bp->queues[0].tx_head = 0;
         bp->queues[0].tx_tail = 0;
-        bp->queues[0].tx_ring[bp->tx_ring_size - 1].ctrl |= MACB_BIT(TX_WRAP);
+        desc->ctrl |= MACB_BIT(TX_WRAP);
 }
 
 static void macb_reset_hw(struct macb *bp)
@@ -1863,7 +1921,8 @@ static void macb_configure_dma(struct macb *bp)
                         dmacfg &= ~GEM_BIT(TXCOEN);
 
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                dmacfg |= GEM_BIT(ADDR64);
+                if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                        dmacfg |= GEM_BIT(ADDR64);
 #endif
                 netdev_dbg(bp->dev, "Cadence configure DMA with 0x%08x\n",
                            dmacfg);
@@ -1910,14 +1969,16 @@ static void macb_init_hw(struct macb *bp)
         macb_configure_dma(bp);
 
         /* Initialize TX and RX buffers */
-        macb_writel(bp, RBQP, (u32)(bp->rx_ring_dma));
+        macb_writel(bp, RBQP, lower_32_bits(bp->rx_ring_dma));
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        macb_writel(bp, RBQPH, (u32)(bp->rx_ring_dma >> 32));
+        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                macb_writel(bp, RBQPH, upper_32_bits(bp->rx_ring_dma));
 #endif
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                queue_writel(queue, TBQP, (u32)(queue->tx_ring_dma));
+                queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                queue_writel(queue, TBQPH, (u32)(queue->tx_ring_dma >> 32));
+                if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                        queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
 #endif
 
                 /* Enable interrupts */
@@ -2627,7 +2688,8 @@ static int macb_init(struct platform_device *pdev)
                         queue->IMR  = GEM_IMR(hw_q - 1);
                         queue->TBQP = GEM_TBQP(hw_q - 1);
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                        queue->TBQPH = GEM_TBQPH(hw_q -1);
+                        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                                queue->TBQPH = GEM_TBQPH(hw_q - 1);
 #endif
                 } else {
                         /* queue0 uses legacy registers */
@@ -2637,7 +2699,8 @@ static int macb_init(struct platform_device *pdev)
                         queue->IMR  = MACB_IMR;
                         queue->TBQP = MACB_TBQP;
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-                        queue->TBQPH = MACB_TBQPH;
+                        if (bp->hw_dma_cap == HW_DMA_CAP_64B)
+                                queue->TBQPH = MACB_TBQPH;
 #endif
                 }
 
@@ -2730,13 +2793,14 @@ static int macb_init(struct platform_device *pdev)
 static int at91ether_start(struct net_device *dev)
 {
         struct macb *lp = netdev_priv(dev);
+        struct macb_dma_desc *desc;
         dma_addr_t addr;
         u32 ctl;
         int i;
 
         lp->rx_ring = dma_alloc_coherent(&lp->pdev->dev,
                                          (AT91ETHER_MAX_RX_DESCR *
-                                          sizeof(struct macb_dma_desc)),
+                                          macb_dma_desc_get_size(lp)),
                                          &lp->rx_ring_dma, GFP_KERNEL);
         if (!lp->rx_ring)
                 return -ENOMEM;
@@ -2748,7 +2812,7 @@ static int at91ether_start(struct net_device *dev)
         if (!lp->rx_buffers) {
                 dma_free_coherent(&lp->pdev->dev,
                                   AT91ETHER_MAX_RX_DESCR *
-                                  sizeof(struct macb_dma_desc),
+                                  macb_dma_desc_get_size(lp),
                                   lp->rx_ring, lp->rx_ring_dma);
                 lp->rx_ring = NULL;
                 return -ENOMEM;
@@ -2756,13 +2820,14 @@ static int at91ether_start(struct net_device *dev)
 
         addr = lp->rx_buffers_dma;
         for (i = 0; i < AT91ETHER_MAX_RX_DESCR; i++) {
-                lp->rx_ring[i].addr = addr;
-                lp->rx_ring[i].ctrl = 0;
+                desc = macb_rx_desc(lp, i);
+                macb_set_addr(lp, desc, addr);
+                desc->ctrl = 0;
                 addr += AT91ETHER_MAX_RBUFF_SZ;
         }
 
         /* Set the Wrap bit on the last descriptor */
-        lp->rx_ring[AT91ETHER_MAX_RX_DESCR - 1].addr |= MACB_BIT(RX_WRAP);
+        desc->addr |= MACB_BIT(RX_WRAP);
 
         /* Reset buffer index */
         lp->rx_tail = 0;
@@ -2834,7 +2899,7 @@ static int at91ether_close(struct net_device *dev)
 
         dma_free_coherent(&lp->pdev->dev,
                           AT91ETHER_MAX_RX_DESCR *
-                          sizeof(struct macb_dma_desc),
+                          macb_dma_desc_get_size(lp),
                           lp->rx_ring, lp->rx_ring_dma);
         lp->rx_ring = NULL;
 
@@ -2885,13 +2950,15 @@ static int at91ether_start_xmit(struct sk_buff *skb, struct net_device *dev)
 static void at91ether_rx(struct net_device *dev)
 {
         struct macb *lp = netdev_priv(dev);
+        struct macb_dma_desc *desc;
         unsigned char *p_recv;
         struct sk_buff *skb;
         unsigned int pktlen;
 
-        while (lp->rx_ring[lp->rx_tail].addr & MACB_BIT(RX_USED)) {
+        desc = macb_rx_desc(lp, lp->rx_tail);
+        while (desc->addr & MACB_BIT(RX_USED)) {
                 p_recv = lp->rx_buffers + lp->rx_tail * AT91ETHER_MAX_RBUFF_SZ;
-                pktlen = MACB_BF(RX_FRMLEN, lp->rx_ring[lp->rx_tail].ctrl);
+                pktlen = MACB_BF(RX_FRMLEN, desc->ctrl);
                 skb = netdev_alloc_skb(dev, pktlen + 2);
                 if (skb) {
                         skb_reserve(skb, 2);
@@ -2905,17 +2972,19 @@ static void at91ether_rx(struct net_device *dev)
                         lp->stats.rx_dropped++;
                 }
 
-                if (lp->rx_ring[lp->rx_tail].ctrl & MACB_BIT(RX_MHASH_MATCH))
+                if (desc->ctrl & MACB_BIT(RX_MHASH_MATCH))
                         lp->stats.multicast++;
 
                 /* reset ownership bit */
-                lp->rx_ring[lp->rx_tail].addr &= ~MACB_BIT(RX_USED);
+                desc->addr &= ~MACB_BIT(RX_USED);
 
                 /* wrap after last buffer */
                 if (lp->rx_tail == AT91ETHER_MAX_RX_DESCR - 1)
                         lp->rx_tail = 0;
                 else
                         lp->rx_tail++;
+
+                desc = macb_rx_desc(lp, lp->rx_tail);
         }
 }
 
@@ -3211,8 +3280,11 @@ static int macb_probe(struct platform_device *pdev)
         device_init_wakeup(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET);
 
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        if (GEM_BFEXT(DBWDEF, gem_readl(bp, DCFG1)) > GEM_DBW32)
+        if (GEM_BFEXT(DAW64, gem_readl(bp, DCFG6))) {
                 dma_set_mask(&pdev->dev, DMA_BIT_MASK(44));
+                bp->hw_dma_cap = HW_DMA_CAP_64B;
+        } else
+                bp->hw_dma_cap = HW_DMA_CAP_32B;
 #endif
 
         spin_lock_init(&bp->lock);
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index d67adad67be1..fc8550a5d47f 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -385,6 +385,8 @@
 /* Bitfields in DCFG6. */
 #define GEM_PBUF_LSO_OFFSET                     27
 #define GEM_PBUF_LSO_SIZE                       1
+#define GEM_DAW64_OFFSET                        23
+#define GEM_DAW64_SIZE                          1
 
 /* Constants for CLK */
 #define MACB_CLK_DIV8                           0
@@ -487,12 +489,20 @@
 struct macb_dma_desc {
         u32     addr;
         u32     ctrl;
+};
+
 #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
-        u32     addrh;
-        u32     resvd;
-#endif
+enum macb_hw_dma_cap {
+        HW_DMA_CAP_32B,
+        HW_DMA_CAP_64B,
 };
 
+struct macb_dma_desc_64 {
+        u32 addrh;
+        u32 resvd;
+};
+#endif
+
 /* DMA descriptor bitfields */
 #define MACB_RX_USED_OFFSET                     0
 #define MACB_RX_USED_SIZE                       1
@@ -874,6 +884,10 @@ struct macb {
         unsigned int            jumbo_max_len;
 
         u32                     wol;
+
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+        enum macb_hw_dma_cap hw_dma_cap;
+#endif
 };
 
 static inline bool macb_is_gem(struct macb *bp)
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 2f85b64f01fa..1e4695270da6 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -31,6 +31,7 @@ struct lmac {
         u8                      lmac_type;
         u8                      lane_to_sds;
         bool                    use_training;
+        bool                    autoneg;
         bool                    link_up;
         int                     lmacid; /* ID within BGX */
         int                     lmacid_bd; /* ID on board */
@@ -461,7 +462,17 @@ static int bgx_lmac_sgmii_init(struct bgx *bgx, struct lmac *lmac)
         /* power down, reset autoneg, autoneg enable */
         cfg = bgx_reg_read(bgx, lmacid, BGX_GMP_PCS_MRX_CTL);
         cfg &= ~PCS_MRX_CTL_PWR_DN;
-        cfg |= (PCS_MRX_CTL_RST_AN | PCS_MRX_CTL_AN_EN);
+        cfg |= PCS_MRX_CTL_RST_AN;
+        if (lmac->phydev) {
+                cfg |= PCS_MRX_CTL_AN_EN;
+        } else {
+                /* In scenarios where PHY driver is not present or it's a
+                 * non-standard PHY, FW sets AN_EN to inform Linux driver
+                 * to do auto-neg and link polling or not.
+                 */
+                if (cfg & PCS_MRX_CTL_AN_EN)
+                        lmac->autoneg = true;
+        }
         bgx_reg_write(bgx, lmacid, BGX_GMP_PCS_MRX_CTL, cfg);
 
         if (lmac->lmac_type == BGX_MODE_QSGMII) {
@@ -472,7 +483,7 @@ static int bgx_lmac_sgmii_init(struct bgx *bgx, struct lmac *lmac)
                 return 0;
         }
 
-        if (lmac->lmac_type == BGX_MODE_SGMII) {
+        if ((lmac->lmac_type == BGX_MODE_SGMII) && lmac->phydev) {
                 if (bgx_poll_reg(bgx, lmacid, BGX_GMP_PCS_MRX_STATUS,
                                  PCS_MRX_STATUS_AN_CPT, false)) {
                         dev_err(&bgx->pdev->dev, "BGX AN_CPT not completed\n");
@@ -678,12 +689,71 @@ static int bgx_xaui_check_link(struct lmac *lmac)
         return -1;
 }
 
+static void bgx_poll_for_sgmii_link(struct lmac *lmac)
+{
+        u64 pcs_link, an_result;
+        u8 speed;
+
+        pcs_link = bgx_reg_read(lmac->bgx, lmac->lmacid,
+                                BGX_GMP_PCS_MRX_STATUS);
+
+        /*Link state bit is sticky, read it again*/
+        if (!(pcs_link & PCS_MRX_STATUS_LINK))
+                pcs_link = bgx_reg_read(lmac->bgx, lmac->lmacid,
+                                        BGX_GMP_PCS_MRX_STATUS);
+
+        if (bgx_poll_reg(lmac->bgx, lmac->lmacid, BGX_GMP_PCS_MRX_STATUS,
+                         PCS_MRX_STATUS_AN_CPT, false)) {
+                lmac->link_up = false;
+                lmac->last_speed = SPEED_UNKNOWN;
+                lmac->last_duplex = DUPLEX_UNKNOWN;
+                goto next_poll;
+        }
+
+        lmac->link_up = ((pcs_link & PCS_MRX_STATUS_LINK) != 0) ? true : false;
+        an_result = bgx_reg_read(lmac->bgx, lmac->lmacid,
+                                 BGX_GMP_PCS_ANX_AN_RESULTS);
+
+        speed = (an_result >> 3) & 0x3;
+        lmac->last_duplex = (an_result >> 1) & 0x1;
+        switch (speed) {
+        case 0:
+                lmac->last_speed = 10;
+                break;
+        case 1:
+                lmac->last_speed = 100;
+                break;
+        case 2:
+                lmac->last_speed = 1000;
+                break;
+        default:
+                lmac->link_up = false;
+                lmac->last_speed = SPEED_UNKNOWN;
+                lmac->last_duplex = DUPLEX_UNKNOWN;
+                break;
+        }
+
+next_poll:
+
+        if (lmac->last_link != lmac->link_up) {
+                if (lmac->link_up)
+                        bgx_sgmii_change_link_state(lmac);
+                lmac->last_link = lmac->link_up;
+        }
+
+        queue_delayed_work(lmac->check_link, &lmac->dwork, HZ * 3);
+}
+
 static void bgx_poll_for_link(struct work_struct *work)
 {
         struct lmac *lmac;
         u64 spu_link, smu_link;
 
         lmac = container_of(work, struct lmac, dwork.work);
+        if (lmac->is_sgmii) {
+                bgx_poll_for_sgmii_link(lmac);
+                return;
+        }
 
         /* Receive link is latching low. Force it high and verify it */
         bgx_reg_modify(lmac->bgx, lmac->lmacid,
@@ -775,9 +845,21 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
             (lmac->lmac_type != BGX_MODE_XLAUI) &&
             (lmac->lmac_type != BGX_MODE_40G_KR) &&
             (lmac->lmac_type != BGX_MODE_10G_KR)) {
-                if (!lmac->phydev)
-                        return -ENODEV;
-
+                if (!lmac->phydev) {
+                        if (lmac->autoneg) {
+                                bgx_reg_write(bgx, lmacid,
+                                              BGX_GMP_PCS_LINKX_TIMER,
+                                              PCS_LINKX_TIMER_COUNT);
+                                goto poll;
+                        } else {
+                                /* Default to below link speed and duplex */
+                                lmac->link_up = true;
+                                lmac->last_speed = 1000;
+                                lmac->last_duplex = 1;
+                                bgx_sgmii_change_link_state(lmac);
+                                return 0;
+                        }
+                }
                 lmac->phydev->dev_flags = 0;
 
                 if (phy_connect_direct(&lmac->netdev, lmac->phydev,
@@ -786,15 +868,17 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
                         return -ENODEV;
 
                 phy_start_aneg(lmac->phydev);
-        } else {
-                lmac->check_link = alloc_workqueue("check_link", WQ_UNBOUND |
-                                                   WQ_MEM_RECLAIM, 1);
-                if (!lmac->check_link)
-                        return -ENOMEM;
-                INIT_DELAYED_WORK(&lmac->dwork, bgx_poll_for_link);
-                queue_delayed_work(lmac->check_link, &lmac->dwork, 0);
+                return 0;
         }
 
+poll:
+        lmac->check_link = alloc_workqueue("check_link", WQ_UNBOUND |
+                                           WQ_MEM_RECLAIM, 1);
+        if (!lmac->check_link)
+                return -ENOMEM;
+        INIT_DELAYED_WORK(&lmac->dwork, bgx_poll_for_link);
+        queue_delayed_work(lmac->check_link, &lmac->dwork, 0);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index c18ebfeb2039..a60f189429bb 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -153,10 +153,15 @@
 #define  PCS_MRX_CTL_LOOPBACK1                  BIT_ULL(14)
 #define  PCS_MRX_CTL_RESET                      BIT_ULL(15)
 #define BGX_GMP_PCS_MRX_STATUS          0x30008
+#define  PCS_MRX_STATUS_LINK                    BIT_ULL(2)
 #define  PCS_MRX_STATUS_AN_CPT                  BIT_ULL(5)
+#define BGX_GMP_PCS_ANX_ADV             0x30010
 #define BGX_GMP_PCS_ANX_AN_RESULTS      0x30020
+#define BGX_GMP_PCS_LINKX_TIMER         0x30040
+#define PCS_LINKX_TIMER_COUNT                   0x1E84
 #define BGX_GMP_PCS_SGM_AN_ADV          0x30068
 #define BGX_GMP_PCS_MISCX_CTL           0x30078
+#define  PCS_MISC_CTL_MODE                      BIT_ULL(8)
 #define  PCS_MISC_CTL_DISP_EN                   BIT_ULL(13)
 #define  PCS_MISC_CTL_GMX_ENO                   BIT_ULL(11)
 #define  PCS_MISC_CTL_SAMP_PT_MASK      0x7Full
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_xcv.c b/drivers/net/ethernet/cavium/thunder/thunder_xcv.c
index 67befedef709..578c7f8f11bf 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_xcv.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_xcv.c
@@ -116,8 +116,7 @@ void xcv_setup_link(bool link_up, int link_speed)
         int speed = 2;
 
         if (!xcv) {
-                dev_err(&xcv->pdev->dev,
-                        "XCV init not done, probe may have failed\n");
+                pr_err("XCV init not done, probe may have failed\n");
                 return;
         }
 
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 1a7f8ad7b9c6..cd49a54c538d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -362,8 +362,10 @@ static int be_mac_addr_set(struct net_device *netdev, void *p)
                 status = -EPERM;
                 goto err;
         }
-done:
+
+        /* Remember currently programmed MAC */
         ether_addr_copy(adapter->dev_mac, addr->sa_data);
+done:
         ether_addr_copy(netdev->dev_addr, addr->sa_data);
         dev_info(dev, "MAC address changed to %pM\n", addr->sa_data);
         return 0;
@@ -3618,8 +3620,10 @@ static void be_disable_if_filters(struct be_adapter *adapter)
 {
         /* Don't delete MAC on BE3 VFs without FILTMGMT privilege  */
         if (!BEx_chip(adapter) || !be_virtfn(adapter) ||
-            check_privilege(adapter, BE_PRIV_FILTMGMT))
+            check_privilege(adapter, BE_PRIV_FILTMGMT)) {
                 be_dev_mac_del(adapter, adapter->pmac_id[0]);
+                eth_zero_addr(adapter->dev_mac);
+        }
 
         be_clear_uc_list(adapter);
         be_clear_mc_list(adapter);
@@ -3773,12 +3777,27 @@ static int be_enable_if_filters(struct be_adapter *adapter)
         if (status)
                 return status;
 
-        /* Don't add MAC on BE3 VFs without FILTMGMT privilege */
-        if (!BEx_chip(adapter) || !be_virtfn(adapter) ||
-            check_privilege(adapter, BE_PRIV_FILTMGMT)) {
+        /* Normally this condition usually true as the ->dev_mac is zeroed.
+         * But on BE3 VFs the initial MAC is pre-programmed by PF and
+         * subsequent be_dev_mac_add() can fail (after fresh boot)
+         */
+        if (!ether_addr_equal(adapter->dev_mac, adapter->netdev->dev_addr)) {
+                int old_pmac_id = -1;
+
+                /* Remember old programmed MAC if any - can happen on BE3 VF */
+                if (!is_zero_ether_addr(adapter->dev_mac))
+                        old_pmac_id = adapter->pmac_id[0];
+
                 status = be_dev_mac_add(adapter, adapter->netdev->dev_addr);
                 if (status)
                         return status;
+
+                /* Delete the old programmed MAC as we successfully programmed
+                 * a new MAC
+                 */
+                if (old_pmac_id >= 0 && old_pmac_id != adapter->pmac_id[0])
+                        be_dev_mac_del(adapter, old_pmac_id);
+
                 ether_addr_copy(adapter->dev_mac, adapter->netdev->dev_addr);
         }
 
@@ -4552,6 +4571,10 @@ static int be_mac_setup(struct be_adapter *adapter)
 
                 memcpy(adapter->netdev->dev_addr, mac, ETH_ALEN);
                 memcpy(adapter->netdev->perm_addr, mac, ETH_ALEN);
+
+                /* Initial MAC for BE3 VFs is already programmed by PF */
+                if (BEx_chip(adapter) && be_virtfn(adapter))
+                        memcpy(adapter->dev_mac, mac, ETH_ALEN);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index c1b671667920..957bfc220978 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2010,8 +2010,8 @@ static void free_skb_rx_queue(struct gfar_priv_rx_q *rx_queue)
                 if (!rxb->page)
                         continue;
 
-                dma_unmap_single(rx_queue->dev, rxb->dma,
-                                 PAGE_SIZE, DMA_FROM_DEVICE);
+                dma_unmap_page(rx_queue->dev, rxb->dma,
+                               PAGE_SIZE, DMA_FROM_DEVICE);
                 __free_page(rxb->page);
 
                 rxb->page = NULL;
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
index 87226685f742..8fa18fc17cd2 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -1014,9 +1014,7 @@
 
 static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
 {
-        u8 __iomem *reg_addr = ACCESS_ONCE(base);
-
-        writel(value, reg_addr + reg);
+        writel(value, base + reg);
 }
 
 #define dsaf_write_dev(a, reg, value) \
@@ -1024,9 +1022,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
 
 static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
 {
-        u8 __iomem *reg_addr = ACCESS_ONCE(base);
-
-        return readl(reg_addr + reg);
+        return readl(base + reg);
 }
 
 static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 672b64606321..8aed72860e7c 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -305,8 +305,8 @@ int hns_nic_net_xmit_hw(struct net_device *ndev,
                         struct hns_nic_ring_data *ring_data)
 {
         struct hns_nic_priv *priv = netdev_priv(ndev);
-        struct device *dev = priv->dev;
         struct hnae_ring *ring = ring_data->ring;
+        struct device *dev = ring_to_dev(ring);
         struct netdev_queue *dev_queue;
         struct skb_frag_struct *frag;
         int buf_num;
diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c
index c7e939945259..53daa6ca5d83 100644
--- a/drivers/net/ethernet/mellanox/mlx4/catas.c
+++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
@@ -158,7 +158,7 @@ static int mlx4_reset_slave(struct mlx4_dev *dev)
         return -ETIMEDOUT;
 }
 
-static int mlx4_comm_internal_err(u32 slave_read)
+int mlx4_comm_internal_err(u32 slave_read)
 {
         return (u32)COMM_CHAN_EVENT_INTERNAL_ERR ==
                 (slave_read & (u32)COMM_CHAN_EVENT_INTERNAL_ERR) ? 1 : 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index d5a9372ed84d..9aa422691954 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1099,7 +1099,7 @@ static int mlx4_en_set_ringparam(struct net_device *dev,
         memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
         new_prof.tx_ring_size = tx_size;
         new_prof.rx_ring_size = rx_size;
-        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
         if (err)
                 goto out;
 
@@ -1774,7 +1774,7 @@ static int mlx4_en_set_channels(struct net_device *dev,
         new_prof.tx_ring_num[TX_XDP] = xdp_count;
         new_prof.rx_ring_num = channel->rx_count;
 
-        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
         if (err)
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 761f8b12399c..3b4961a8e8e4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2042,6 +2042,8 @@ static void mlx4_en_free_resources(struct mlx4_en_priv *priv)
                         if (priv->tx_cq[t] && priv->tx_cq[t][i])
                                 mlx4_en_destroy_cq(priv, &priv->tx_cq[t][i]);
                 }
+                kfree(priv->tx_ring[t]);
+                kfree(priv->tx_cq[t]);
         }
 
         for (i = 0; i < priv->rx_ring_num; i++) {
@@ -2184,9 +2186,11 @@ static void mlx4_en_update_priv(struct mlx4_en_priv *dst,
 
 int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
                                 struct mlx4_en_priv *tmp,
-                                struct mlx4_en_port_profile *prof)
+                                struct mlx4_en_port_profile *prof,
+                                bool carry_xdp_prog)
 {
-        int t;
+        struct bpf_prog *xdp_prog;
+        int i, t;
 
         mlx4_en_copy_priv(tmp, priv, prof);
 
@@ -2200,6 +2204,23 @@ int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
                 }
                 return -ENOMEM;
         }
+
+        /* All rx_rings has the same xdp_prog.  Pick the first one. */
+        xdp_prog = rcu_dereference_protected(
+                priv->rx_ring[0]->xdp_prog,
+                lockdep_is_held(&priv->mdev->state_lock));
+
+        if (xdp_prog && carry_xdp_prog) {
+                xdp_prog = bpf_prog_add(xdp_prog, tmp->rx_ring_num);
+                if (IS_ERR(xdp_prog)) {
+                        mlx4_en_free_resources(tmp);
+                        return PTR_ERR(xdp_prog);
+                }
+                for (i = 0; i < tmp->rx_ring_num; i++)
+                        rcu_assign_pointer(tmp->rx_ring[i]->xdp_prog,
+                                           xdp_prog);
+        }
+
         return 0;
 }
 
@@ -2214,7 +2235,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        int t;
 
         en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
 
@@ -2248,11 +2268,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         mlx4_en_free_resources(priv);
         mutex_unlock(&mdev->state_lock);
 
-        for (t = 0; t < MLX4_EN_NUM_TX_TYPES; t++) {
-                kfree(priv->tx_ring[t]);
-                kfree(priv->tx_cq[t]);
-        }
-
         free_netdev(dev);
 }
 
@@ -2755,7 +2770,7 @@ static int mlx4_xdp_set(struct net_device *dev, struct bpf_prog *prog)
                 en_warn(priv, "Reducing the number of TX rings, to not exceed the max total rings number.\n");
         }
 
-        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, false);
         if (err) {
                 if (prog)
                         bpf_prog_sub(prog, priv->rx_ring_num - 1);
@@ -3499,7 +3514,7 @@ int mlx4_en_reset_config(struct net_device *dev,
         memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
         memcpy(&new_prof.hwtstamp_config, &ts_config, sizeof(ts_config));
 
-        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof, true);
         if (err)
                 goto out;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index eac527e25ec9..cc003fdf0ed9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -514,8 +514,11 @@ void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv)
                 return;
 
         for (ring = 0; ring < priv->rx_ring_num; ring++) {
-                if (mlx4_en_is_ring_empty(priv->rx_ring[ring]))
+                if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) {
+                        local_bh_disable();
                         napi_reschedule(&priv->rx_cq[ring]->napi);
+                        local_bh_enable();
+                }
         }
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/intf.c b/drivers/net/ethernet/mellanox/mlx4/intf.c
index 0e8b7c44931f..8258d08acd8c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/intf.c
+++ b/drivers/net/ethernet/mellanox/mlx4/intf.c
@@ -222,6 +222,18 @@ void mlx4_unregister_device(struct mlx4_dev *dev)
                 return;
 
         mlx4_stop_catas_poll(dev);
+        if (dev->persist->interface_state & MLX4_INTERFACE_STATE_DELETION &&
+            mlx4_is_slave(dev)) {
+                /* In mlx4_remove_one on a VF */
+                u32 slave_read =
+                        swab32(readl(&mlx4_priv(dev)->mfunc.comm->slave_read));
+
+                if (mlx4_comm_internal_err(slave_read)) {
+                        mlx4_dbg(dev, "%s: comm channel is down, entering error state.\n",
+                                 __func__);
+                        mlx4_enter_error_state(dev->persist);
+                }
+        }
         mutex_lock(&intf_mutex);
 
         list_for_each_entry(intf, &intf_list, list)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 88ee7d8a5923..086920b615af 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -1220,6 +1220,7 @@ void mlx4_qp_event(struct mlx4_dev *dev, u32 qpn, int event_type);
 void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type);
 
 void mlx4_enter_error_state(struct mlx4_dev_persistent *persist);
+int mlx4_comm_internal_err(u32 slave_read);
 
 int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
                     enum mlx4_port_type *type);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index ba1c6cd0cc79..cec59bc264c9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -679,7 +679,8 @@ void mlx4_en_set_stats_bitmap(struct mlx4_dev *dev,
 
 int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
                                 struct mlx4_en_priv *tmp,
-                                struct mlx4_en_port_profile *prof);
+                                struct mlx4_en_port_profile *prof,
+                                bool carry_xdp_prog);
 void mlx4_en_safe_replace_resources(struct mlx4_en_priv *priv,
                                     struct mlx4_en_priv *tmp);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 3797cc7c1288..caa837e5e2b9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -1728,7 +1728,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
         if (cmd->cmdif_rev > CMD_IF_REV) {
                 dev_err(&dev->pdev->dev, "driver does not support command interface version. driver %d, firmware %d\n",
                         CMD_IF_REV, cmd->cmdif_rev);
-                err = -ENOTSUPP;
+                err = -EOPNOTSUPP;
                 goto err_free_page;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 951dbd58594d..d5ecb8f53fd4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -791,7 +791,8 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv);
 int mlx5e_modify_rqs_vsd(struct mlx5e_priv *priv, bool vsd);
 
 int mlx5e_redirect_rqt(struct mlx5e_priv *priv, u32 rqtn, int sz, int ix);
-void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv);
+void mlx5e_build_indir_tir_ctx_hash(struct mlx5e_priv *priv, void *tirc,
+                                    enum mlx5e_traffic_types tt);
 
 int mlx5e_open_locked(struct net_device *netdev);
 int mlx5e_close_locked(struct net_device *netdev);
@@ -863,12 +864,12 @@ static inline void mlx5e_arfs_destroy_tables(struct mlx5e_priv *priv) {}
 
 static inline int mlx5e_arfs_enable(struct mlx5e_priv *priv)
 {
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 
 static inline int mlx5e_arfs_disable(struct mlx5e_priv *priv)
 {
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 #else
 int mlx5e_arfs_create_tables(struct mlx5e_priv *priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index f0b460f47f29..0523ed47f597 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -89,7 +89,7 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
         int i;
 
         if (!MLX5_CAP_GEN(priv->mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         ets->ets_cap = mlx5_max_tc(priv->mdev) + 1;
         for (i = 0; i < ets->ets_cap; i++) {
@@ -236,7 +236,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         int err;
 
         if (!MLX5_CAP_GEN(priv->mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         err = mlx5e_dbcnl_validate_ets(netdev, ets);
         if (err)
@@ -402,7 +402,7 @@ static u8 mlx5e_dcbnl_setall(struct net_device *netdev)
         struct mlx5_core_dev *mdev = priv->mdev;
         struct ieee_ets ets;
         struct ieee_pfc pfc;
-        int err = -ENOTSUPP;
+        int err = -EOPNOTSUPP;
         int i;
 
         if (!MLX5_CAP_GEN(mdev, ets))
@@ -511,6 +511,11 @@ static void mlx5e_dcbnl_getpgtccfgtx(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
 
+        if (!MLX5_CAP_GEN(priv->mdev, ets)) {
+                netdev_err(netdev, "%s, ets is not supported\n", __func__);
+                return;
+        }
+
         if (priority >= CEE_DCBX_MAX_PRIO) {
                 netdev_err(netdev,
                            "%s, priority is out of range\n", __func__);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 5197817e4b2f..bb67863aa361 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -595,7 +595,7 @@ static int mlx5e_get_coalesce(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
         if (!MLX5_CAP_GEN(priv->mdev, cq_moderation))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         coal->rx_coalesce_usecs       = priv->params.rx_cq_moderation.usec;
         coal->rx_max_coalesced_frames = priv->params.rx_cq_moderation.pkts;
@@ -620,7 +620,7 @@ static int mlx5e_set_coalesce(struct net_device *netdev,
         int i;
 
         if (!MLX5_CAP_GEN(mdev, cq_moderation))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         mutex_lock(&priv->state_lock);
 
@@ -980,15 +980,18 @@ static int mlx5e_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
 
 static void mlx5e_modify_tirs_hash(struct mlx5e_priv *priv, void *in, int inlen)
 {
-        struct mlx5_core_dev *mdev = priv->mdev;
         void *tirc = MLX5_ADDR_OF(modify_tir_in, in, ctx);
-        int i;
+        struct mlx5_core_dev *mdev = priv->mdev;
+        int ctxlen = MLX5_ST_SZ_BYTES(tirc);
+        int tt;
 
         MLX5_SET(modify_tir_in, in, bitmask.hash, 1);
-        mlx5e_build_tir_ctx_hash(tirc, priv);
 
-        for (i = 0; i < MLX5E_NUM_INDIR_TIRS; i++)
-                mlx5_core_modify_tir(mdev, priv->indir_tir[i].tirn, in, inlen);
+        for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) {
+                memset(tirc, 0, ctxlen);
+                mlx5e_build_indir_tir_ctx_hash(priv, tirc, tt);
+                mlx5_core_modify_tir(mdev, priv->indir_tir[tt].tirn, in, inlen);
+        }
 }
 
 static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
@@ -996,6 +999,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
         int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
+        bool hash_changed = false;
         void *in;
 
         if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
@@ -1017,14 +1021,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
                 mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0);
         }
 
-        if (key)
+        if (hfunc != ETH_RSS_HASH_NO_CHANGE &&
+            hfunc != priv->params.rss_hfunc) {
+                priv->params.rss_hfunc = hfunc;
+                hash_changed = true;
+        }
+
+        if (key) {
                 memcpy(priv->params.toeplitz_hash_key, key,
                        sizeof(priv->params.toeplitz_hash_key));
+                hash_changed = hash_changed ||
+                               priv->params.rss_hfunc == ETH_RSS_HASH_TOP;
+        }
 
-        if (hfunc != ETH_RSS_HASH_NO_CHANGE)
-                priv->params.rss_hfunc = hfunc;
-
-        mlx5e_modify_tirs_hash(priv, in, inlen);
+        if (hash_changed)
+                mlx5e_modify_tirs_hash(priv, in, inlen);
 
         mutex_unlock(&priv->state_lock);
 
@@ -1296,7 +1307,7 @@ static int mlx5e_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         u32 mlx5_wol_mode;
 
         if (!wol_supported)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (wol->wolopts & ~wol_supported)
                 return -EINVAL;
@@ -1426,7 +1437,7 @@ static int set_pflag_rx_cqe_based_moder(struct net_device *netdev, bool enable)
 
         if (rx_cq_period_mode == MLX5_CQ_PERIOD_MODE_START_FROM_CQE &&
             !MLX5_CAP_GEN(mdev, cq_period_start_from_cqe))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (!rx_mode_changed)
                 return 0;
@@ -1452,7 +1463,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,
         bool reset;
 
         if (!MLX5_CAP_GEN(mdev, cqe_compression))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         if (enable && priv->tstamp.hwtstamp_config.rx_filter != HWTSTAMP_FILTER_NONE) {
                 netdev_err(netdev, "Can't enable cqe compression while timestamping is enabled.\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 1fe80de5d68f..a0e5a69402b3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -1089,7 +1089,7 @@ int mlx5e_create_flow_steering(struct mlx5e_priv *priv)
                                                MLX5_FLOW_NAMESPACE_KERNEL);
 
         if (!priv->fs.ns)
-                return -EINVAL;
+                return -EOPNOTSUPP;
 
         err = mlx5e_arfs_create_tables(priv);
         if (err) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
index d088effd7160..f33f72d0237c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
@@ -92,7 +92,7 @@ static struct mlx5e_ethtool_table *get_flow_table(struct mlx5e_priv *priv,
         ns = mlx5_get_flow_namespace(priv->mdev,
                                      MLX5_FLOW_NAMESPACE_ETHTOOL);
         if (!ns)
-                return ERR_PTR(-ENOTSUPP);
+                return ERR_PTR(-EOPNOTSUPP);
 
         table_size = min_t(u32, BIT(MLX5_CAP_FLOWTABLE(priv->mdev,
                                                        flow_table_properties_nic_receive.log_max_ft_size)),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 2b7dd315020c..f14ca3385fdd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2022,8 +2022,23 @@ static void mlx5e_build_tir_ctx_lro(void *tirc, struct mlx5e_priv *priv)
         MLX5_SET(tirc, tirc, lro_timeout_period_usecs, priv->params.lro_timeout);
 }
 
-void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
+void mlx5e_build_indir_tir_ctx_hash(struct mlx5e_priv *priv, void *tirc,
+                                    enum mlx5e_traffic_types tt)
 {
+        void *hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
+
+#define MLX5_HASH_IP            (MLX5_HASH_FIELD_SEL_SRC_IP   |\
+                                 MLX5_HASH_FIELD_SEL_DST_IP)
+
+#define MLX5_HASH_IP_L4PORTS    (MLX5_HASH_FIELD_SEL_SRC_IP   |\
+                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
+                                 MLX5_HASH_FIELD_SEL_L4_SPORT |\
+                                 MLX5_HASH_FIELD_SEL_L4_DPORT)
+
+#define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
+                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
+                                 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
+
         MLX5_SET(tirc, tirc, rx_hash_fn,
                  mlx5e_rx_hash_fn(priv->params.rss_hfunc));
         if (priv->params.rss_hfunc == ETH_RSS_HASH_TOP) {
@@ -2035,6 +2050,88 @@ void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
                 MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
                 memcpy(rss_key, priv->params.toeplitz_hash_key, len);
         }
+
+        switch (tt) {
+        case MLX5E_TT_IPV4_TCP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_TCP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV6_TCP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_TCP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV4_UDP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_UDP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV6_UDP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
+                         MLX5_L4_PROT_TYPE_UDP);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_L4PORTS);
+                break;
+
+        case MLX5E_TT_IPV4_IPSEC_AH:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV6_IPSEC_AH:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV4_IPSEC_ESP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV6_IPSEC_ESP:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP_IPSEC_SPI);
+                break;
+
+        case MLX5E_TT_IPV4:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV4);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP);
+                break;
+
+        case MLX5E_TT_IPV6:
+                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
+                         MLX5_L3_PROT_TYPE_IPV6);
+                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
+                         MLX5_HASH_IP);
+                break;
+        default:
+                WARN_ONCE(true, "%s: bad traffic type!\n", __func__);
+        }
 }
 
 static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
@@ -2404,110 +2501,13 @@ void mlx5e_cleanup_nic_tx(struct mlx5e_priv *priv)
 static void mlx5e_build_indir_tir_ctx(struct mlx5e_priv *priv, u32 *tirc,
                                       enum mlx5e_traffic_types tt)
 {
-        void *hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
-
         MLX5_SET(tirc, tirc, transport_domain, priv->mdev->mlx5e_res.td.tdn);
 
-#define MLX5_HASH_IP            (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-                                 MLX5_HASH_FIELD_SEL_DST_IP)
-
-#define MLX5_HASH_IP_L4PORTS    (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
-                                 MLX5_HASH_FIELD_SEL_L4_SPORT |\
-                                 MLX5_HASH_FIELD_SEL_L4_DPORT)
-
-#define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-                                 MLX5_HASH_FIELD_SEL_DST_IP   |\
-                                 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
-
         mlx5e_build_tir_ctx_lro(tirc, priv);
 
         MLX5_SET(tirc, tirc, disp_type, MLX5_TIRC_DISP_TYPE_INDIRECT);
         MLX5_SET(tirc, tirc, indirect_table, priv->indir_rqt.rqtn);
-        mlx5e_build_tir_ctx_hash(tirc, priv);
-
-        switch (tt) {
-        case MLX5E_TT_IPV4_TCP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_TCP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV6_TCP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_TCP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV4_UDP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_UDP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV6_UDP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-                         MLX5_L4_PROT_TYPE_UDP);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_L4PORTS);
-                break;
-
-        case MLX5E_TT_IPV4_IPSEC_AH:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV6_IPSEC_AH:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV4_IPSEC_ESP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV6_IPSEC_ESP:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP_IPSEC_SPI);
-                break;
-
-        case MLX5E_TT_IPV4:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV4);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP);
-                break;
-
-        case MLX5E_TT_IPV6:
-                MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-                         MLX5_L3_PROT_TYPE_IPV6);
-                MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-                         MLX5_HASH_IP);
-                break;
-        default:
-                WARN_ONCE(true,
-                          "mlx5e_build_indir_tir_ctx: bad traffic type!\n");
-        }
+        mlx5e_build_indir_tir_ctx_hash(priv, tirc, tt);
 }
 
 static void mlx5e_build_direct_tir_ctx(struct mlx5e_priv *priv, u32 *tirc,
@@ -3331,7 +3331,7 @@ static const struct net_device_ops mlx5e_netdev_ops_sriov = {
 static int mlx5e_check_required_hca_cap(struct mlx5_core_dev *mdev)
 {
         if (MLX5_CAP_GEN(mdev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         if (!MLX5_CAP_GEN(mdev, eth_net_offloads) ||
             !MLX5_CAP_GEN(mdev, nic_flow_table) ||
             !MLX5_CAP_ETH(mdev, csum_cap) ||
@@ -3343,7 +3343,7 @@ static int mlx5e_check_required_hca_cap(struct mlx5_core_dev *mdev)
                                < 3) {
                 mlx5_core_warn(mdev,
                                "Not creating net device, some required device capabilities are missing\n");
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         }
         if (!MLX5_CAP_ETH(mdev, self_lb_en_modifiable))
                 mlx5_core_warn(mdev, "Self loop back prevention is not supported\n");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 46bef6a26a8c..c5282b6aba8b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -663,6 +663,7 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
                                    __be32 *saddr,
                                    int *out_ttl)
 {
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         struct rtable *rt;
         struct neighbour *n = NULL;
         int ttl;
@@ -677,12 +678,11 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
 #else
         return -EOPNOTSUPP;
 #endif
-
-        if (!switchdev_port_same_parent_id(priv->netdev, rt->dst.dev)) {
-                pr_warn("%s: can't offload, devices not on same HW e-switch\n", __func__);
-                ip_rt_put(rt);
-                return -EOPNOTSUPP;
-        }
+        /* if the egress device isn't on the same HW e-switch, we use the uplink */
+        if (!switchdev_port_same_parent_id(priv->netdev, rt->dst.dev))
+                *out_dev = mlx5_eswitch_get_uplink_netdev(esw);
+        else
+                *out_dev = rt->dst.dev;
 
         ttl = ip4_dst_hoplimit(&rt->dst);
         n = dst_neigh_lookup(&rt->dst, &fl4->daddr);
@@ -693,7 +693,6 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
         *out_n = n;
         *saddr = fl4->saddr;
         *out_ttl = ttl;
-        *out_dev = rt->dst.dev;
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f14d9c9ba773..d0c8bf014453 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -133,7 +133,7 @@ static int modify_esw_vport_cvlan(struct mlx5_core_dev *dev, u32 vport,
 
         if (!MLX5_CAP_ESW(dev, vport_cvlan_strip) ||
             !MLX5_CAP_ESW(dev, vport_cvlan_insert_if_not_exist))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         esw_debug(dev, "Set Vport[%d] VLAN %d qos %d set=%x\n",
                   vport, vlan, qos, set_flags);
@@ -353,7 +353,7 @@ static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw, int nvports)
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_FDB);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get FDB flow namespace\n");
-                return -ENOMEM;
+                return -EOPNOTSUPP;
         }
 
         flow_group_in = mlx5_vzalloc(inlen);
@@ -962,7 +962,7 @@ static int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_EGRESS);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get E-Switch egress flow namespace\n");
-                return -EIO;
+                return -EOPNOTSUPP;
         }
 
         flow_group_in = mlx5_vzalloc(inlen);
@@ -1079,7 +1079,7 @@ static int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_INGRESS);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get E-Switch ingress flow namespace\n");
-                return -EIO;
+                return -EOPNOTSUPP;
         }
 
         flow_group_in = mlx5_vzalloc(inlen);
@@ -1630,7 +1630,7 @@ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
         if (!MLX5_CAP_GEN(esw->dev, eswitch_flow_table) ||
             !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) {
                 esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n");
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         }
 
         if (!MLX5_CAP_ESW_INGRESS_ACL(esw->dev, ft_support))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 03293ed1cc22..595f7c7383b3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -166,7 +166,7 @@ static int esw_add_vlan_action_check(struct mlx5_esw_flow_attr *attr,
         return 0;
 
 out_notsupp:
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 
 int mlx5_eswitch_add_vlan_action(struct mlx5_eswitch *esw,
@@ -424,6 +424,7 @@ static int esw_create_offloads_fdb_table(struct mlx5_eswitch *esw, int nvports)
         root_ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_FDB);
         if (!root_ns) {
                 esw_warn(dev, "Failed to get FDB flow namespace\n");
+                err = -EOPNOTSUPP;
                 goto ns_err;
         }
 
@@ -535,7 +536,7 @@ static int esw_create_offloads_table(struct mlx5_eswitch *esw)
         ns = mlx5_get_flow_namespace(dev, MLX5_FLOW_NAMESPACE_OFFLOADS);
         if (!ns) {
                 esw_warn(esw->dev, "Failed to get offloads flow namespace\n");
-                return -ENOMEM;
+                return -EOPNOTSUPP;
         }
 
         ft_offloads = mlx5_create_flow_table(ns, 0, dev->priv.sriov.num_vfs + 2, 0, 0);
@@ -655,7 +656,7 @@ static int esw_offloads_start(struct mlx5_eswitch *esw)
                 esw_warn(esw->dev, "Failed setting eswitch to offloads, err %d\n", err);
                 err1 = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
                 if (err1)
-                        esw_warn(esw->dev, "Failed setting eswitch back to legacy, err %d\n", err);
+                        esw_warn(esw->dev, "Failed setting eswitch back to legacy, err %d\n", err1);
         }
         if (esw->offloads.inline_mode == MLX5_INLINE_MODE_NONE) {
                 if (mlx5_eswitch_inline_mode_get(esw,
@@ -674,9 +675,14 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
         int vport;
         int err;
 
+        /* disable PF RoCE so missed packets don't go through RoCE steering */
+        mlx5_dev_list_lock();
+        mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+        mlx5_dev_list_unlock();
+
         err = esw_create_offloads_fdb_table(esw, nvports);
         if (err)
-                return err;
+                goto create_fdb_err;
 
         err = esw_create_offloads_table(esw);
         if (err)
@@ -696,11 +702,6 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
                         goto err_reps;
         }
 
-        /* disable PF RoCE so missed packets don't go through RoCE steering */
-        mlx5_dev_list_lock();
-        mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
-        mlx5_dev_list_unlock();
-
         return 0;
 
 err_reps:
@@ -717,6 +718,13 @@ create_fg_err:
 
 create_ft_err:
         esw_destroy_offloads_fdb_table(esw);
+
+create_fdb_err:
+        /* enable back PF RoCE */
+        mlx5_dev_list_lock();
+        mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+        mlx5_dev_list_unlock();
+
         return err;
 }
 
@@ -724,11 +732,6 @@ static int esw_offloads_stop(struct mlx5_eswitch *esw)
 {
         int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
 
-        /* enable back PF RoCE */
-        mlx5_dev_list_lock();
-        mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
-        mlx5_dev_list_unlock();
-
         mlx5_eswitch_disable_sriov(esw);
         err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
         if (err) {
@@ -738,6 +741,11 @@ static int esw_offloads_stop(struct mlx5_eswitch *esw)
                         esw_warn(esw->dev, "Failed setting eswitch back to offloads, err %d\n", err);
         }
 
+        /* enable back PF RoCE */
+        mlx5_dev_list_lock();
+        mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+        mlx5_dev_list_unlock();
+
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index c4478ecd8056..b53fc85a2375 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -322,7 +322,7 @@ int mlx5_cmd_update_fte(struct mlx5_core_dev *dev,
                                                 flow_table_properties_nic_receive.
                                                 flow_modify_en);
         if (!atomic_mod_cap)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
         opmod = 1;
 
         return  mlx5_cmd_set_fte(dev, opmod, modify_mask, ft, group_id, fte);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 0ac7a2fc916c..6346a8f5883b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1822,7 +1822,7 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering)
         struct mlx5_flow_table *ft;
 
         ns = mlx5_get_flow_namespace(steering->dev, MLX5_FLOW_NAMESPACE_ANCHOR);
-        if (!ns)
+        if (WARN_ON(!ns))
                 return -EINVAL;
         ft = mlx5_create_flow_table(ns, ANCHOR_PRIO, ANCHOR_SIZE, ANCHOR_LEVEL, 0);
         if (IS_ERR(ft)) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index d01e9f21d469..3c315eb8d270 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -807,7 +807,7 @@ static int mlx5_core_set_issi(struct mlx5_core_dev *dev)
                 return 0;
         }
 
-        return -ENOTSUPP;
+        return -EOPNOTSUPP;
 }
 
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index d2ec9d232a70..fd12e0a377a5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -620,7 +620,7 @@ static int mlx5_set_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *in,
         u32 out[MLX5_ST_SZ_DW(qtct_reg)];
 
         if (!MLX5_CAP_GEN(mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         return mlx5_core_access_reg(mdev, in, inlen, out, sizeof(out),
                                     MLX5_REG_QETCR, 0, 1);
@@ -632,7 +632,7 @@ static int mlx5_query_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *out,
         u32 in[MLX5_ST_SZ_DW(qtct_reg)];
 
         if (!MLX5_CAP_GEN(mdev, ets))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         memset(in, 0, sizeof(in));
         return mlx5_core_access_reg(mdev, in, sizeof(in), out, outlen,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index 269e4401c342..7129c30a2ab4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -532,7 +532,7 @@ int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
         if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                 return -EACCES;
         if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         in = mlx5_vzalloc(inlen);
         if (!in)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index be3c91c7f211..5484fd726d5a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -305,8 +305,12 @@ static int dwmac1000_irq_status(struct mac_device_info *hw,
 {
         void __iomem *ioaddr = hw->pcsr;
         u32 intr_status = readl(ioaddr + GMAC_INT_STATUS);
+        u32 intr_mask = readl(ioaddr + GMAC_INT_MASK);
         int ret = 0;
 
+        /* Discard masked bits */
+        intr_status &= ~intr_mask;
+
         /* Not used events (e.g. MMC interrupts) are not handled. */
         if ((intr_status & GMAC_INT_STATUS_MMCTIS))
                 x->mmc_tx_irq_n++;
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index ece59c54a653..4a40a3d825b4 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -648,8 +648,8 @@ static void ax_setup(struct net_device *dev)
 {
         /* Finish setting up the DEVICE info. */
         dev->mtu             = AX_MTU;
-        dev->hard_header_len = 0;
-        dev->addr_len        = 0;
+        dev->hard_header_len = AX25_MAX_HEADER_LEN;
+        dev->addr_len        = AX25_ADDR_LEN;
         dev->type            = ARPHRD_AX25;
         dev->tx_queue_len    = 10;
         dev->header_ops      = &ax25_header_ops;
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 5a1cc089acb7..86e5749226ef 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1295,6 +1295,9 @@ void netvsc_channel_cb(void *context)
         ndev = hv_get_drvdata(device);
         buffer = get_per_channel_state(channel);
 
+        /* commit_rd_index() -> hv_signal_on_read() needs this. */
+        init_cached_read_index(channel);
+
         do {
                 desc = get_next_pkt_raw(channel);
                 if (desc != NULL) {
@@ -1347,6 +1350,9 @@ void netvsc_channel_cb(void *context)
 
                         bufferlen = bytes_recvd;
                 }
+
+                init_cached_read_index(channel);
+
         } while (1);
 
         if (bufferlen > NETVSC_PACKET_SIZE)
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 1e05b7c2d157..0844f8496413 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -164,6 +164,7 @@ static void loopback_setup(struct net_device *dev)
 {
         dev->mtu                = 64 * 1024;
         dev->hard_header_len    = ETH_HLEN;     /* 14   */
+        dev->min_header_len     = ETH_HLEN;     /* 14   */
         dev->addr_len           = ETH_ALEN;     /* 6    */
         dev->type               = ARPHRD_LOOPBACK;      /* 0x0001*/
         dev->flags              = IFF_LOOPBACK;
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 402618565838..c27011bbe30c 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -681,7 +681,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
         size_t linear;
 
         if (q->flags & IFF_VNET_HDR) {
-                vnet_hdr_len = q->vnet_hdr_sz;
+                vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz);
 
                 err = -EINVAL;
                 if (len < vnet_hdr_len)
@@ -820,7 +820,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 
         if (q->flags & IFF_VNET_HDR) {
                 struct virtio_net_hdr vnet_hdr;
-                vnet_hdr_len = q->vnet_hdr_sz;
+                vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz);
                 if (iov_iter_count(iter) < vnet_hdr_len)
                         return -EINVAL;
 
diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c
index c0b4e65267af..46fe1ae919a3 100644
--- a/drivers/net/phy/mdio-bcm-iproc.c
+++ b/drivers/net/phy/mdio-bcm-iproc.c
@@ -81,8 +81,6 @@ static int iproc_mdio_read(struct mii_bus *bus, int phy_id, int reg)
         if (rc)
                 return rc;
 
-        iproc_mdio_config_clk(priv->base);
-
         /* Prepare the read operation */
         cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) |
                 (reg << MII_DATA_RA_SHIFT) |
@@ -112,8 +110,6 @@ static int iproc_mdio_write(struct mii_bus *bus, int phy_id,
         if (rc)
                 return rc;
 
-        iproc_mdio_config_clk(priv->base);
-
         /* Prepare the write operation */
         cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) |
                 (reg << MII_DATA_RA_SHIFT) |
@@ -163,6 +159,8 @@ static int iproc_mdio_probe(struct platform_device *pdev)
         bus->read = iproc_mdio_read;
         bus->write = iproc_mdio_write;
 
+        iproc_mdio_config_clk(priv->base);
+
         rc = of_mdiobus_register(bus, pdev->dev.of_node);
         if (rc) {
                 dev_err(&pdev->dev, "MDIO bus registration failed\n");
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index e55809c5beb7..6742070ca676 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -1012,7 +1012,7 @@ static struct phy_driver ksphy_driver[] = {
         .phy_id         = PHY_ID_KSZ8795,
         .phy_id_mask    = MICREL_PHY_ID_MASK,
         .name           = "Micrel KSZ8795",
-        .features       = (SUPPORTED_Pause | SUPPORTED_Asym_Pause),
+        .features       = PHY_BASIC_FEATURES,
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .config_init    = kszphy_config_init,
         .config_aneg    = ksz8873mll_config_aneg,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 92b08383cafa..8c8e15b8739d 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -908,6 +908,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         struct module *ndev_owner = dev->dev.parent->driver->owner;
         struct mii_bus *bus = phydev->mdio.bus;
         struct device *d = &phydev->mdio.dev;
+        bool using_genphy = false;
         int err;
 
         /* For Ethernet device drivers that register their own MDIO bus, we
@@ -933,12 +934,22 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                         d->driver =
                                 &genphy_driver[GENPHY_DRV_1G].mdiodrv.driver;
 
+                using_genphy = true;
+        }
+
+        if (!try_module_get(d->driver->owner)) {
+                dev_err(&dev->dev, "failed to get the device driver module\n");
+                err = -EIO;
+                goto error_put_device;
+        }
+
+        if (using_genphy) {
                 err = d->driver->probe(d);
                 if (err >= 0)
                         err = device_bind_driver(d);
 
                 if (err)
-                        goto error;
+                        goto error_module_put;
         }
 
         if (phydev->attached_dev) {
@@ -975,7 +986,13 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         return err;
 
 error:
+        /* phy_detach() does all of the cleanup below */
         phy_detach(phydev);
+        return err;
+
+error_module_put:
+        module_put(d->driver->owner);
+error_put_device:
         put_device(d);
         if (ndev_owner != bus->owner)
                 module_put(bus->owner);
@@ -1039,6 +1056,8 @@ void phy_detach(struct phy_device *phydev)
 
         phy_led_triggers_unregister(phydev);
 
+        module_put(phydev->mdio.dev.driver->owner);
+
         /* If the device had no specific driver before (i.e. - it
          * was using the generic driver), we unbind the device
          * from the generic driver so that there's a chance a
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 2cd10b26b650..bfabe180053e 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1170,9 +1170,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         }
 
         if (tun->flags & IFF_VNET_HDR) {
-                if (len < tun->vnet_hdr_sz)
+                int vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz);
+
+                if (len < vnet_hdr_sz)
                         return -EINVAL;
-                len -= tun->vnet_hdr_sz;
+                len -= vnet_hdr_sz;
 
                 if (!copy_from_iter_full(&gso, sizeof(gso), from))
                         return -EFAULT;
@@ -1183,7 +1185,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 
                 if (tun16_to_cpu(tun, gso.hdr_len) > len)
                         return -EINVAL;
-                iov_iter_advance(from, tun->vnet_hdr_sz - sizeof(gso));
+                iov_iter_advance(from, vnet_hdr_sz - sizeof(gso));
         }
 
         if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP) {
@@ -1335,7 +1337,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 vlan_hlen = VLAN_HLEN;
 
         if (tun->flags & IFF_VNET_HDR)
-                vnet_hdr_sz = tun->vnet_hdr_sz;
+                vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz);
 
         total = skb->len + vlan_hlen + vnet_hdr_sz;
 
diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index 3daa41bdd4ea..0acc9b640419 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -776,7 +776,7 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct net_device *netdev;
         struct catc *catc;
         u8 broadcast[ETH_ALEN];
-        int i, pktsz;
+        int pktsz, ret;
 
         if (usb_set_interface(usbdev,
                         intf->altsetting->desc.bInterfaceNumber, 1)) {
@@ -811,12 +811,8 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
         if ((!catc->ctrl_urb) || (!catc->tx_urb) || 
             (!catc->rx_urb) || (!catc->irq_urb)) {
                 dev_err(&intf->dev, "No free urbs available.\n");
-                usb_free_urb(catc->ctrl_urb);
-                usb_free_urb(catc->tx_urb);
-                usb_free_urb(catc->rx_urb);
-                usb_free_urb(catc->irq_urb);
-                free_netdev(netdev);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail_free;
         }
 
         /* The F5U011 has the same vendor/product as the netmate but a device version of 0x130 */
@@ -844,15 +840,24 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
                 catc->irq_buf, 2, catc_irq_done, catc, 1);
 
         if (!catc->is_f5u011) {
+                u32 *buf;
+                int i;
+
                 dev_dbg(dev, "Checking memory size\n");
 
-                i = 0x12345678;
-                catc_write_mem(catc, 0x7a80, &i, 4);
-                i = 0x87654321; 
-                catc_write_mem(catc, 0xfa80, &i, 4);
-                catc_read_mem(catc, 0x7a80, &i, 4);
+                buf = kmalloc(4, GFP_KERNEL);
+                if (!buf) {
+                        ret = -ENOMEM;
+                        goto fail_free;
+                }
+
+                *buf = 0x12345678;
+                catc_write_mem(catc, 0x7a80, buf, 4);
+                *buf = 0x87654321;
+                catc_write_mem(catc, 0xfa80, buf, 4);
+                catc_read_mem(catc, 0x7a80, buf, 4);
           
-                switch (i) {
+                switch (*buf) {
                 case 0x12345678:
                         catc_set_reg(catc, TxBufCount, 8);
                         catc_set_reg(catc, RxBufCount, 32);
@@ -867,6 +872,8 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
                         dev_dbg(dev, "32k Memory\n");
                         break;
                 }
+
+                kfree(buf);
           
                 dev_dbg(dev, "Getting MAC from SEEROM.\n");
           
@@ -913,16 +920,21 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
         usb_set_intfdata(intf, catc);
 
         SET_NETDEV_DEV(netdev, &intf->dev);
-        if (register_netdev(netdev) != 0) {
-                usb_set_intfdata(intf, NULL);
-                usb_free_urb(catc->ctrl_urb);
-                usb_free_urb(catc->tx_urb);
-                usb_free_urb(catc->rx_urb);
-                usb_free_urb(catc->irq_urb);
-                free_netdev(netdev);
-                return -EIO;
-        }
+        ret = register_netdev(netdev);
+        if (ret)
+                goto fail_clear_intfdata;
+
         return 0;
+
+fail_clear_intfdata:
+        usb_set_intfdata(intf, NULL);
+fail_free:
+        usb_free_urb(catc->ctrl_urb);
+        usb_free_urb(catc->tx_urb);
+        usb_free_urb(catc->rx_urb);
+        usb_free_urb(catc->irq_urb);
+        free_netdev(netdev);
+        return ret;
 }
 
 static void catc_disconnect(struct usb_interface *intf)
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 24e803fe9a53..36674484c6fb 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -126,40 +126,61 @@ static void async_ctrl_callback(struct urb *urb)
 
 static int get_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
 {
+        u8 *buf;
         int ret;
 
+        buf = kmalloc(size, GFP_NOIO);
+        if (!buf)
+                return -ENOMEM;
+
         ret = usb_control_msg(pegasus->usb, usb_rcvctrlpipe(pegasus->usb, 0),
                               PEGASUS_REQ_GET_REGS, PEGASUS_REQT_READ, 0,
-                              indx, data, size, 1000);
+                              indx, buf, size, 1000);
         if (ret < 0)
                 netif_dbg(pegasus, drv, pegasus->net,
                           "%s returned %d\n", __func__, ret);
+        else if (ret <= size)
+                memcpy(data, buf, ret);
+        kfree(buf);
         return ret;
 }
 
-static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
+static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size,
+                         const void *data)
 {
+        u8 *buf;
         int ret;
 
+        buf = kmemdup(data, size, GFP_NOIO);
+        if (!buf)
+                return -ENOMEM;
+
         ret = usb_control_msg(pegasus->usb, usb_sndctrlpipe(pegasus->usb, 0),
                               PEGASUS_REQ_SET_REGS, PEGASUS_REQT_WRITE, 0,
-                              indx, data, size, 100);
+                              indx, buf, size, 100);
         if (ret < 0)
                 netif_dbg(pegasus, drv, pegasus->net,
                           "%s returned %d\n", __func__, ret);
+        kfree(buf);
         return ret;
 }
 
 static int set_register(pegasus_t *pegasus, __u16 indx, __u8 data)
 {
+        u8 *buf;
         int ret;
 
+        buf = kmemdup(&data, 1, GFP_NOIO);
+        if (!buf)
+                return -ENOMEM;
+
         ret = usb_control_msg(pegasus->usb, usb_sndctrlpipe(pegasus->usb, 0),
                               PEGASUS_REQ_SET_REG, PEGASUS_REQT_WRITE, data,
-                              indx, &data, 1, 1000);
+                              indx, buf, 1, 1000);
         if (ret < 0)
                 netif_dbg(pegasus, drv, pegasus->net,
                           "%s returned %d\n", __func__, ret);
+        kfree(buf);
         return ret;
 }
 
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 95b7bd0d7abc..c81c79110cef 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -155,16 +155,36 @@ static const char driver_name [] = "rtl8150";
 */
 static int get_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
 {
-        return usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
-                               RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
-                               indx, 0, data, size, 500);
+        void *buf;
+        int ret;
+
+        buf = kmalloc(size, GFP_NOIO);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                              RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
+                              indx, 0, buf, size, 500);
+        if (ret > 0 && ret <= size)
+                memcpy(data, buf, ret);
+        kfree(buf);
+        return ret;
 }
 
-static int set_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
+static int set_registers(rtl8150_t * dev, u16 indx, u16 size, const void *data)
 {
-        return usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
-                               RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
-                               indx, 0, data, size, 500);
+        void *buf;
+        int ret;
+
+        buf = kmemdup(data, size, GFP_NOIO);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                              RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
+                              indx, 0, buf, size, 500);
+        kfree(buf);
+        return ret;
 }
 
 static void async_set_reg_cb(struct urb *urb)
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index 12071f1582df..d9440bc022f2 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -73,8 +73,6 @@ static	atomic_t iface_counter = ATOMIC_INIT(0);
 /* Private data structure */
 struct sierra_net_data {
 
-        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
-
         u16 link_up;            /* air link up or down */
         u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
 
@@ -122,6 +120,7 @@ struct param {
 
 /* LSI Protocol types */
 #define SIERRA_NET_PROTOCOL_UMTS      0x01
+#define SIERRA_NET_PROTOCOL_UMTS_DS   0x04
 /* LSI Coverage */
 #define SIERRA_NET_COVERAGE_NONE      0x00
 #define SIERRA_NET_COVERAGE_NOPACKET  0x01
@@ -129,7 +128,8 @@ struct param {
 /* LSI Session */
 #define SIERRA_NET_SESSION_IDLE       0x00
 /* LSI Link types */
-#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+#define SIERRA_NET_AS_LINK_TYPE_IPV4  0x00
+#define SIERRA_NET_AS_LINK_TYPE_IPV6  0x02
 
 struct lsi_umts {
         u8 protocol;
@@ -137,9 +137,14 @@ struct lsi_umts {
         __be16 length;
         /* eventually use a union for the rest - assume umts for now */
         u8 coverage;
-        u8 unused2[41];
+        u8 network_len; /* network name len */
+        u8 network[40]; /* network name (UCS2, bigendian) */
         u8 session_state;
         u8 unused3[33];
+} __packed;
+
+struct lsi_umts_single {
+        struct lsi_umts lsi;
         u8 link_type;
         u8 pdp_addr_len; /* NW-supplied PDP address len */
         u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
@@ -158,10 +163,31 @@ struct lsi_umts {
         u8 reserved[8];
 } __packed;
 
+struct lsi_umts_dual {
+        struct lsi_umts lsi;
+        u8 pdp_addr4_len; /* NW-supplied PDP IPv4 address len */
+        u8 pdp_addr4[4];  /* NW-supplied PDP IPv4 address (bigendian)) */
+        u8 pdp_addr6_len; /* NW-supplied PDP IPv6 address len */
+        u8 pdp_addr6[16]; /* NW-supplied PDP IPv6 address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr4_len; /* NW-supplied 1st DNS v4 address len (bigendian) */
+        u8 dns1_addr4[4];  /* NW-supplied 1st DNS v4 address */
+        u8 dns1_addr6_len; /* NW-supplied 1st DNS v6 address len */
+        u8 dns1_addr6[16]; /* NW-supplied 1st DNS v6 address (bigendian)*/
+        u8 dns2_addr4_len; /* NW-supplied 2nd DNS v4 address len (bigendian) */
+        u8 dns2_addr4[4];  /* NW-supplied 2nd DNS v4 address */
+        u8 dns2_addr6_len; /* NW-supplied 2nd DNS v6 address len */
+        u8 dns2_addr6[16]; /* NW-supplied 2nd DNS v6 address (bigendian)*/
+        u8 unused5[68];
+} __packed;
+
 #define SIERRA_NET_LSI_COMMON_LEN      4
-#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts_single))
 #define SIERRA_NET_LSI_UMTS_STATUS_LEN \
         (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+#define SIERRA_NET_LSI_UMTS_DS_LEN     (sizeof(struct lsi_umts_dual))
+#define SIERRA_NET_LSI_UMTS_DS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_DS_LEN - SIERRA_NET_LSI_COMMON_LEN)
 
 /* Forward definitions */
 static void sierra_sync_timer(unsigned long syncdata);
@@ -190,10 +216,11 @@ static inline void sierra_net_set_private(struct usbnet *dev,
         dev->data[0] = (unsigned long)priv;
 }
 
-/* is packet IPv4 */
+/* is packet IPv4/IPv6 */
 static inline int is_ip(struct sk_buff *skb)
 {
-        return skb->protocol == cpu_to_be16(ETH_P_IP);
+        return skb->protocol == cpu_to_be16(ETH_P_IP) ||
+               skb->protocol == cpu_to_be16(ETH_P_IPV6);
 }
 
 /*
@@ -349,49 +376,54 @@ static inline int sierra_net_is_valid_addrlen(u8 len)
 static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
 {
         struct lsi_umts *lsi = (struct lsi_umts *)data;
+        u32 expected_length;
 
-        if (datalen < sizeof(struct lsi_umts)) {
-                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
-                                __func__, datalen,
-                                sizeof(struct lsi_umts));
+        if (datalen < sizeof(struct lsi_umts_single)) {
+                netdev_err(dev->net, "%s: Data length %d, exp >= %Zu\n",
+                           __func__, datalen, sizeof(struct lsi_umts_single));
                 return -1;
         }
 
-        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
-                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
-                                __func__, be16_to_cpu(lsi->length),
-                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
-                return -1;
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                           lsi->session_state);
+                return 0;
         }
 
         /* Validate the protocol  - only support UMTS for now */
-        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+        if (lsi->protocol == SIERRA_NET_PROTOCOL_UMTS) {
+                struct lsi_umts_single *single = (struct lsi_umts_single *)lsi;
+
+                /* Validate the link type */
+                if (single->link_type != SIERRA_NET_AS_LINK_TYPE_IPV4 &&
+                    single->link_type != SIERRA_NET_AS_LINK_TYPE_IPV6) {
+                        netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                                   single->link_type);
+                        return -1;
+                }
+                expected_length = SIERRA_NET_LSI_UMTS_STATUS_LEN;
+        } else if (lsi->protocol == SIERRA_NET_PROTOCOL_UMTS_DS) {
+                expected_length = SIERRA_NET_LSI_UMTS_DS_STATUS_LEN;
+        } else {
                 netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
-                        lsi->protocol);
+                           lsi->protocol);
                 return -1;
         }
 
-        /* Validate the link type */
-        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
-                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
-                        lsi->link_type);
+        if (be16_to_cpu(lsi->length) != expected_length) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                           __func__, be16_to_cpu(lsi->length), expected_length);
                 return -1;
         }
 
         /* Validate the coverage */
-        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
-           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE ||
+            lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
                 netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
                 return 0;
         }
 
-        /* Validate the session state */
-        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
-                netdev_err(dev->net, "Session idle, 0x%02x\n",
-                        lsi->session_state);
-                return 0;
-        }
-
         /* Set link_sense true */
         return 1;
 }
@@ -652,7 +684,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
         u8      numendpoints;
         u16     fwattr = 0;
         int     status;
-        struct ethhdr *eth;
         struct sierra_net_data *priv;
         static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
                 0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
@@ -690,11 +721,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
         dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
 
-        /* we will have to manufacture ethernet headers, prepare template */
-        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
-        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
-        eth->h_proto = cpu_to_be16(ETH_P_IP);
-
         /* prepare shutdown message template */
         memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
         /* set context index initially to 0 - prepares tx hdr template */
@@ -824,9 +850,14 @@ static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 
                 skb_pull(skb, hh.hdrlen);
 
-                /* We are going to accept this packet, prepare it */
-                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
-                        ETH_HLEN);
+                /* We are going to accept this packet, prepare it.
+                 * In case protocol is IPv6, keep it, otherwise force IPv4.
+                 */
+                skb_reset_mac_header(skb);
+                if (eth_hdr(skb)->h_proto != cpu_to_be16(ETH_P_IPV6))
+                        eth_hdr(skb)->h_proto = cpu_to_be16(ETH_P_IP);
+                eth_zero_addr(eth_hdr(skb)->h_source);
+                memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN);
 
                 /* Last packet in batch handled by usbnet */
                 if (hh.payload_len.word == skb->len)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index d02ca1491d16..8d3e53fac1da 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -91,7 +91,7 @@
 
 #define IWL8000_FW_PRE "iwlwifi-8000C-"
 #define IWL8000_MODULE_FIRMWARE(api) \
-        IWL8000_FW_PRE "-" __stringify(api) ".ucode"
+        IWL8000_FW_PRE __stringify(api) ".ucode"
 
 #define IWL8265_FW_PRE "iwlwifi-8265-"
 #define IWL8265_MODULE_FIRMWARE(api) \
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 636c8b03e318..09e9e2e3ed04 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1164,9 +1164,10 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm,
                 .frame_limit = IWL_FRAME_LIMIT,
         };
 
-        /* Make sure reserved queue is still marked as such (or allocated) */
-        mvm->queue_info[mvm_sta->reserved_queue].status =
-                IWL_MVM_QUEUE_RESERVED;
+        /* Make sure reserved queue is still marked as such (if allocated) */
+        if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE)
+                mvm->queue_info[mvm_sta->reserved_queue].status =
+                        IWL_MVM_QUEUE_RESERVED;
 
         for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                 struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i];
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index 63a051be832e..bec7d9c46087 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -843,8 +843,10 @@ static void iwl_mvm_thermal_zone_unregister(struct iwl_mvm *mvm)
                 return;
 
         IWL_DEBUG_TEMP(mvm, "Thermal zone device unregister\n");
-        thermal_zone_device_unregister(mvm->tz_device.tzone);
-        mvm->tz_device.tzone = NULL;
+        if (mvm->tz_device.tzone) {
+                thermal_zone_device_unregister(mvm->tz_device.tzone);
+                mvm->tz_device.tzone = NULL;
+        }
 }
 
 static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
@@ -853,8 +855,10 @@ static void iwl_mvm_cooling_device_unregister(struct iwl_mvm *mvm)
                 return;
 
         IWL_DEBUG_TEMP(mvm, "Cooling device unregister\n");
-        thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
-        mvm->cooling_dev.cdev = NULL;
+        if (mvm->cooling_dev.cdev) {
+                thermal_cooling_device_unregister(mvm->cooling_dev.cdev);
+                mvm->cooling_dev.cdev = NULL;
+        }
 }
 #endif /* CONFIG_THERMAL */
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
index 691ddef1ae28..a33a06d58a9a 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
@@ -92,7 +92,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        char *fw_name = "rtlwifi/rtl8192cfwU.bin";
+        char *fw_name;
 
         rtl8192ce_bt_reg_init(hw);
 
@@ -164,8 +164,13 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
         }
 
         /* request fw */
-        if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
+        if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
+            !IS_92C_SERIAL(rtlhal->version))
+                fw_name = "rtlwifi/rtl8192cfwU.bin";
+        else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
                 fw_name = "rtlwifi/rtl8192cfwU_B.bin";
+        else
+                fw_name = "rtlwifi/rtl8192cfw.bin";
 
         rtlpriv->max_fw_size = 0x4000;
         pr_info("Using firmware %s\n", fw_name);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 8315fe73ecd0..1e4125a98291 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -281,6 +281,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
 {
         RING_IDX req_prod = queue->rx.req_prod_pvt;
         int notify;
+        int err = 0;
 
         if (unlikely(!netif_carrier_ok(queue->info->netdev)))
                 return;
@@ -295,8 +296,10 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
                 struct xen_netif_rx_request *req;
 
                 skb = xennet_alloc_one_rx_buffer(queue);
-                if (!skb)
+                if (!skb) {
+                        err = -ENOMEM;
                         break;
+                }
 
                 id = xennet_rxidx(req_prod);
 
@@ -320,8 +323,13 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
 
         queue->rx.req_prod_pvt = req_prod;
 
-        /* Not enough requests? Try again later. */
-        if (req_prod - queue->rx.sring->req_prod < NET_RX_SLOTS_MIN) {
+        /* Try again later if there are not enough requests or skb allocation
+         * failed.
+         * Enough requests is quantified as the sum of newly created slots and
+         * the unconsumed slots at the backend.
+         */
+        if (req_prod - queue->rx.rsp_cons < NET_RX_SLOTS_MIN ||
+            unlikely(err)) {
                 mod_timer(&queue->rx_refill_timer, jiffies + (HZ/10));
                 return;
         }
@@ -1379,6 +1387,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
         for (i = 0; i < num_queues && info->queues; ++i) {
                 struct netfront_queue *queue = &info->queues[i];
 
+                del_timer_sync(&queue->rx_refill_timer);
+
                 if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
                         unbind_from_irqhandler(queue->tx_irq, queue);
                 if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) {
@@ -1733,7 +1743,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
 
                 if (netif_running(info->netdev))
                         napi_disable(&queue->napi);
-                del_timer_sync(&queue->rx_refill_timer);
                 netif_napi_del(&queue->napi);
         }
 
@@ -1822,27 +1831,19 @@ static int talk_to_netback(struct xenbus_device *dev,
                 xennet_destroy_queues(info);
 
         err = xennet_create_queues(info, &num_queues);
-        if (err < 0)
-                goto destroy_ring;
+        if (err < 0) {
+                xenbus_dev_fatal(dev, err, "creating queues");
+                kfree(info->queues);
+                info->queues = NULL;
+                goto out;
+        }
 
         /* Create shared ring, alloc event channel -- for each queue */
         for (i = 0; i < num_queues; ++i) {
                 queue = &info->queues[i];
                 err = setup_netfront(dev, queue, feature_split_evtchn);
-                if (err) {
-                        /* setup_netfront() will tidy up the current
-                         * queue on error, but we need to clean up
-                         * those already allocated.
-                         */
-                        if (i > 0) {
-                                rtnl_lock();
-                                netif_set_real_num_tx_queues(info->netdev, i);
-                                rtnl_unlock();
-                                goto destroy_ring;
-                        } else {
-                                goto out;
-                        }
-                }
+                if (err)
+                        goto destroy_ring;
         }
 
 again:
@@ -1932,9 +1933,10 @@ abort_transaction_no_dev_fatal:
         xenbus_transaction_end(xbt, 1);
  destroy_ring:
         xennet_disconnect_backend(info);
-        kfree(info->queues);
-        info->queues = NULL;
+        xennet_destroy_queues(info);
  out:
+        unregister_netdev(info->netdev);
+        xennet_free_netdev(info->netdev);
         return err;
 }
 
diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
index a518cb1b59d4..ce3e8dfa10ad 100644
--- a/drivers/nvdimm/namespace_devs.c
+++ b/drivers/nvdimm/namespace_devs.c
@@ -52,17 +52,17 @@ static void namespace_blk_release(struct device *dev)
         kfree(nsblk);
 }
 
-static struct device_type namespace_io_device_type = {
+static const struct device_type namespace_io_device_type = {
         .name = "nd_namespace_io",
         .release = namespace_io_release,
 };
 
-static struct device_type namespace_pmem_device_type = {
+static const struct device_type namespace_pmem_device_type = {
         .name = "nd_namespace_pmem",
         .release = namespace_pmem_release,
 };
 
-static struct device_type namespace_blk_device_type = {
+static const struct device_type namespace_blk_device_type = {
         .name = "nd_namespace_blk",
         .release = namespace_blk_release,
 };
@@ -962,8 +962,8 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
         struct nvdimm_drvdata *ndd;
         struct nd_label_id label_id;
         u32 flags = 0, remainder;
+        int rc, i, id = -1;
         u8 *uuid = NULL;
-        int rc, i;
 
         if (dev->driver || ndns->claim)
                 return -EBUSY;
@@ -972,11 +972,13 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
                 struct nd_namespace_pmem *nspm = to_nd_namespace_pmem(dev);
 
                 uuid = nspm->uuid;
+                id = nspm->id;
         } else if (is_namespace_blk(dev)) {
                 struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev);
 
                 uuid = nsblk->uuid;
                 flags = NSLABEL_FLAG_LOCAL;
+                id = nsblk->id;
         }
 
         /*
@@ -1039,10 +1041,11 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
 
         /*
          * Try to delete the namespace if we deleted all of its
-         * allocation, this is not the seed device for the region, and
-         * it is not actively claimed by a btt instance.
+         * allocation, this is not the seed or 0th device for the
+         * region, and it is not actively claimed by a btt, pfn, or dax
+         * instance.
          */
-        if (val == 0 && nd_region->ns_seed != dev && !ndns->claim)
+        if (val == 0 && id != 0 && nd_region->ns_seed != dev && !ndns->claim)
                 nd_device_unregister(dev, ND_ASYNC);
 
         return rc;
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index a2ac9e641aa9..6c033c9a2f06 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -627,15 +627,12 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
         size = resource_size(&nsio->res);
         npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K;
         if (nd_pfn->mode == PFN_MODE_PMEM) {
-                unsigned long memmap_size;
-
                 /*
                  * vmemmap_populate_hugepages() allocates the memmap array in
                  * HPAGE_SIZE chunks.
                  */
-                memmap_size = ALIGN(64 * npfns, HPAGE_SIZE);
-                offset = ALIGN(start + SZ_8K + memmap_size + dax_label_reserve,
-                                nd_pfn->align) - start;
+                offset = ALIGN(start + SZ_8K + 64 * npfns + dax_label_reserve,
+                                max(nd_pfn->align, HPAGE_SIZE)) - start;
         } else if (nd_pfn->mode == PFN_MODE_RAM)
                 offset = ALIGN(start + SZ_8K + dax_label_reserve,
                                 nd_pfn->align) - start;
diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c
index dd6d4ccb41e4..3858b87fd0bb 100644
--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -293,7 +293,7 @@ struct parport *parport_gsc_probe_port(unsigned long base,
                 p->irq = PARPORT_IRQ_NONE;
         }
         if (p->irq != PARPORT_IRQ_NONE) {
-                printk(", irq %d", p->irq);
+                pr_cont(", irq %d", p->irq);
 
                 if (p->dma == PARPORT_DMA_AUTO) {
                         p->dma = PARPORT_DMA_NONE;
@@ -303,8 +303,8 @@ struct parport *parport_gsc_probe_port(unsigned long base,
                                            is mandatory (see above) */
                 p->dma = PARPORT_DMA_NONE;
 
-        printk(" [");
-#define printmode(x) {if(p->modes&PARPORT_MODE_##x){printk("%s%s",f?",":"",#x);f++;}}
+        pr_cont(" [");
+#define printmode(x) {if(p->modes&PARPORT_MODE_##x){pr_cont("%s%s",f?",":"",#x);f++;}}
         {
                 int f = 0;
                 printmode(PCSPP);
@@ -315,7 +315,7 @@ struct parport *parport_gsc_probe_port(unsigned long base,
 //              printmode(DMA);
         }
 #undef printmode
-        printk("]\n");
+        pr_cont("]\n");
 
         if (p->irq != PARPORT_IRQ_NONE) {
                 if (request_irq (p->irq, parport_irq_handler,
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 10c9c0ba8ff2..ec0b4c11ccd9 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -31,7 +31,6 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/slab.h>
-#include <linux/pm_runtime.h>
 #include <linux/pci.h>
 #include "../pci.h"
 #include "pciehp.h"
@@ -99,7 +98,6 @@ static int board_added(struct slot *p_slot)
         pciehp_green_led_blink(p_slot);
 
         /* Check link training status */
-        pm_runtime_get_sync(&ctrl->pcie->port->dev);
         retval = pciehp_check_link_status(ctrl);
         if (retval) {
                 ctrl_err(ctrl, "Failed to check link status\n");
@@ -120,14 +118,12 @@ static int board_added(struct slot *p_slot)
                 if (retval != -EEXIST)
                         goto err_exit;
         }
-        pm_runtime_put(&ctrl->pcie->port->dev);
 
         pciehp_green_led_on(p_slot);
         pciehp_set_attention_status(p_slot, 0);
         return 0;
 
 err_exit:
-        pm_runtime_put(&ctrl->pcie->port->dev);
         set_slot_off(ctrl, p_slot);
         return retval;
 }
@@ -141,9 +137,7 @@ static int remove_board(struct slot *p_slot)
         int retval;
         struct controller *ctrl = p_slot->ctrl;
 
-        pm_runtime_get_sync(&ctrl->pcie->port->dev);
         retval = pciehp_unconfigure_device(p_slot);
-        pm_runtime_put(&ctrl->pcie->port->dev);
         if (retval)
                 return retval;
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 50c5003295ca..7f73bacf13ed 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1206,6 +1206,16 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
         if (flags & PCI_IRQ_AFFINITY) {
                 if (!affd)
                         affd = &msi_default_affd;
+
+                if (affd->pre_vectors + affd->post_vectors > min_vecs)
+                        return -EINVAL;
+
+                /*
+                 * If there aren't any vectors left after applying the pre/post
+                 * vectors don't bother with assigning affinity.
+                 */
+                if (affd->pre_vectors + affd->post_vectors == min_vecs)
+                        affd = NULL;
         } else {
                 if (WARN_ON(affd))
                         affd = NULL;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a881c0d3d2e8..7904d02ffdb9 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2241,10 +2241,13 @@ bool pci_bridge_d3_possible(struct pci_dev *bridge)
                         return false;
 
                 /*
-                 * Hotplug ports handled by firmware in System Management Mode
+                 * Hotplug interrupts cannot be delivered if the link is down,
+                 * so parents of a hotplug port must stay awake. In addition,
+                 * hotplug ports handled by firmware in System Management Mode
                  * may not be put into D3 by the OS (Thunderbolt on non-Macs).
+                 * For simplicity, disallow in general for now.
                  */
-                if (bridge->is_hotplug_bridge && !pciehp_is_native(bridge))
+                if (bridge->is_hotplug_bridge)
                         return false;
 
                 if (pci_bridge_d3_force)
@@ -2276,10 +2279,7 @@ static int pci_dev_check_d3cold(struct pci_dev *dev, void *data)
              !pci_pme_capable(dev, PCI_D3cold)) ||
 
             /* If it is a bridge it must be allowed to go to D3. */
-            !pci_power_manageable(dev) ||
-
-            /* Hotplug interrupts cannot be delivered if the link is down. */
-            dev->is_hotplug_bridge)
+            !pci_power_manageable(dev))
 
                 *d3cold_ok = false;
 
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 17ac1dce3286..3dd8bcbb3011 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -532,25 +532,32 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
         link = kzalloc(sizeof(*link), GFP_KERNEL);
         if (!link)
                 return NULL;
+
         INIT_LIST_HEAD(&link->sibling);
         INIT_LIST_HEAD(&link->children);
         INIT_LIST_HEAD(&link->link);
         link->pdev = pdev;
-        if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT) {
+
+        /*
+         * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
+         * hierarchies.
+         */
+        if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT ||
+            pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) {
+                link->root = link;
+        } else {
                 struct pcie_link_state *parent;
+
                 parent = pdev->bus->parent->self->link_state;
                 if (!parent) {
                         kfree(link);
                         return NULL;
                 }
+
                 link->parent = parent;
+                link->root = link->parent->root;
                 list_add(&link->link, &parent->children);
         }
-        /* Setup a pointer to the root port link */
-        if (!link->parent)
-                link->root = link;
-        else
-                link->root = link->parent->root;
 
         list_add(&link->sibling, &link_list);
         pdev->link_state = link;
diff --git a/drivers/pinctrl/berlin/berlin-bg4ct.c b/drivers/pinctrl/berlin/berlin-bg4ct.c
index 09172043d589..c617ec49e9ed 100644
--- a/drivers/pinctrl/berlin/berlin-bg4ct.c
+++ b/drivers/pinctrl/berlin/berlin-bg4ct.c
@@ -217,7 +217,7 @@ static const struct berlin_desc_group berlin4ct_soc_pinctrl_groups[] = {
         BERLIN_PINCTRL_GROUP("SCRD0_CRD_PRES", 0xc, 0x3, 0x15,
                         BERLIN_PINCTRL_FUNCTION(0x0, "gpio"), /* GPIO20 */
                         BERLIN_PINCTRL_FUNCTION(0x1, "scrd0"), /* crd pres */
-                        BERLIN_PINCTRL_FUNCTION(0x1, "sd1a")), /* DAT3 */
+                        BERLIN_PINCTRL_FUNCTION(0x3, "sd1a")), /* DAT3 */
         BERLIN_PINCTRL_GROUP("SPI1_SS0n", 0xc, 0x3, 0x18,
                         BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */
                         BERLIN_PINCTRL_FUNCTION(0x1, "gpio"), /* GPIO37 */
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index c123488266ce..d94aef17348b 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct byt_gpio *vg, unsigned int offset,
                                   int reg)
 {
         struct byt_community *comm = byt_get_community(vg, offset);
-        u32 reg_offset = 0;
+        u32 reg_offset;
 
         if (!comm)
                 return NULL;
 
         offset -= comm->pin_base;
-        if (reg == BYT_INT_STAT_REG)
+        switch (reg) {
+        case BYT_INT_STAT_REG:
                 reg_offset = (offset / 32) * 4;
-        else
+                break;
+        case BYT_DEBOUNCE_REG:
+                reg_offset = 0;
+                break;
+        default:
                 reg_offset = comm->pad_map[offset] * 16;
+                break;
+        }
 
         return comm->reg_base + reg_offset + reg;
 }
@@ -1243,10 +1250,12 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
                         debounce = readl(db_reg);
                         debounce &= ~BYT_DEBOUNCE_PULSE_MASK;
 
+                        if (arg)
+                                conf |= BYT_DEBOUNCE_EN;
+                        else
+                                conf &= ~BYT_DEBOUNCE_EN;
+
                         switch (arg) {
-                        case 0:
-                                conf &= BYT_DEBOUNCE_EN;
-                                break;
                         case 375:
                                 debounce |= BYT_DEBOUNCE_PULSE_375US;
                                 break;
@@ -1269,7 +1278,9 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev,
                                 debounce |= BYT_DEBOUNCE_PULSE_24MS;
                                 break;
                         default:
-                                ret = -EINVAL;
+                                if (arg)
+                                        ret = -EINVAL;
+                                break;
                         }
 
                         if (!ret)
@@ -1612,7 +1623,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
                         continue;
                 }
 
+                raw_spin_lock(&vg->lock);
                 pending = readl(reg);
+                raw_spin_unlock(&vg->lock);
                 for_each_set_bit(pin, &pending, 32) {
                         virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                         generic_handle_irq(virq);
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index b21896126f76..4d4ef42a39b5 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
         unsigned int i;
         int ret;
 
+        if (!mrfld_buf_available(mp, pin))
+                return -ENOTSUPP;
+
         for (i = 0; i < nconfigs; i++) {
                 switch (pinconf_to_config_param(configs[i])) {
                 case PIN_CONFIG_BIAS_DISABLE:
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 0eb51e33cb1b..207a8de4e1ed 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -564,8 +564,7 @@ static int sunxi_pconf_group_set(struct pinctrl_dev *pctldev,
                         val = arg / 10 - 1;
                         break;
                 case PIN_CONFIG_BIAS_DISABLE:
-                        val = 0;
-                        break;
+                        continue;
                 case PIN_CONFIG_BIAS_PULL_UP:
                         if (arg == 0)
                                 return -EINVAL;
diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
index e6a512ebeae2..a3ade9e4ef47 100644
--- a/drivers/regulator/axp20x-regulator.c
+++ b/drivers/regulator/axp20x-regulator.c
@@ -272,7 +272,7 @@ static const struct regulator_desc axp806_regulators[] = {
                         64, AXP806_DCDCD_V_CTRL, 0x3f, AXP806_PWR_OUT_CTRL1,
                         BIT(3)),
         AXP_DESC(AXP806, DCDCE, "dcdce", "vine", 1100, 3400, 100,
-                 AXP806_DCDCB_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
+                 AXP806_DCDCE_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
         AXP_DESC(AXP806, ALDO1, "aldo1", "aldoin", 700, 3300, 100,
                  AXP806_ALDO1_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(5)),
         AXP_DESC(AXP806, ALDO2, "aldo2", "aldoin", 700, 3400, 100,
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index a43b0e8a438d..988a7472c2ab 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -30,9 +30,6 @@
 #include <linux/of_gpio.h>
 #include <linux/regulator/of_regulator.h>
 #include <linux/regulator/machine.h>
-#include <linux/acpi.h>
-#include <linux/property.h>
-#include <linux/gpio/consumer.h>
 
 struct fixed_voltage_data {
         struct regulator_desc desc;
@@ -97,44 +94,6 @@ of_get_fixed_voltage_config(struct device *dev,
         return config;
 }
 
-/**
- * acpi_get_fixed_voltage_config - extract fixed_voltage_config structure info
- * @dev: device requesting for fixed_voltage_config
- * @desc: regulator description
- *
- * Populates fixed_voltage_config structure by extracting data through ACPI
- * interface, returns a pointer to the populated structure of NULL if memory
- * alloc fails.
- */
-static struct fixed_voltage_config *
-acpi_get_fixed_voltage_config(struct device *dev,
-                              const struct regulator_desc *desc)
-{
-        struct fixed_voltage_config *config;
-        const char *supply_name;
-        struct gpio_desc *gpiod;
-        int ret;
-
-        config = devm_kzalloc(dev, sizeof(*config), GFP_KERNEL);
-        if (!config)
-                return ERR_PTR(-ENOMEM);
-
-        ret = device_property_read_string(dev, "supply-name", &supply_name);
-        if (!ret)
-                config->supply_name = supply_name;
-
-        gpiod = gpiod_get(dev, "gpio", GPIOD_ASIS);
-        if (IS_ERR(gpiod))
-                return ERR_PTR(-ENODEV);
-
-        config->gpio = desc_to_gpio(gpiod);
-        config->enable_high = device_property_read_bool(dev,
-                                                        "enable-active-high");
-        gpiod_put(gpiod);
-
-        return config;
-}
-
 static struct regulator_ops fixed_voltage_ops = {
 };
 
@@ -155,11 +114,6 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
                                                      &drvdata->desc);
                 if (IS_ERR(config))
                         return PTR_ERR(config);
-        } else if (ACPI_HANDLE(&pdev->dev)) {
-                config = acpi_get_fixed_voltage_config(&pdev->dev,
-                                                       &drvdata->desc);
-                if (IS_ERR(config))
-                        return PTR_ERR(config);
         } else {
                 config = dev_get_platdata(&pdev->dev);
         }
diff --git a/drivers/regulator/twl6030-regulator.c b/drivers/regulator/twl6030-regulator.c
index 4864b9d742c0..716191046a70 100644
--- a/drivers/regulator/twl6030-regulator.c
+++ b/drivers/regulator/twl6030-regulator.c
@@ -452,7 +452,7 @@ static int twl6030smps_map_voltage(struct regulator_dev *rdev, int min_uV,
                         vsel = 62;
                 else if ((min_uV > 1800000) && (min_uV <= 1900000))
                         vsel = 61;
-                else if ((min_uV > 1350000) && (min_uV <= 1800000))
+                else if ((min_uV > 1500000) && (min_uV <= 1800000))
                         vsel = 60;
                 else if ((min_uV > 1350000) && (min_uV <= 1500000))
                         vsel = 59;
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index c93c5a8fba32..5dc673dc9487 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -1551,12 +1551,15 @@ config RTC_DRV_MPC5121
           will be called rtc-mpc5121.
 
 config RTC_DRV_JZ4740
-        bool "Ingenic JZ4740 SoC"
+        tristate "Ingenic JZ4740 SoC"
         depends on MACH_INGENIC || COMPILE_TEST
         help
           If you say yes here you get support for the Ingenic JZ47xx SoCs RTC
           controllers.
 
+          This driver can also be buillt as a module. If so, the module
+          will be called rtc-jz4740.
+
 config RTC_DRV_LPC24XX
         tristate "NXP RTC for LPC178x/18xx/408x/43xx"
         depends on ARCH_LPC18XX || COMPILE_TEST
diff --git a/drivers/rtc/rtc-jz4740.c b/drivers/rtc/rtc-jz4740.c
index 72918c1ba092..64989afffa3d 100644
--- a/drivers/rtc/rtc-jz4740.c
+++ b/drivers/rtc/rtc-jz4740.c
@@ -17,6 +17,7 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/reboot.h>
@@ -294,7 +295,7 @@ static void jz4740_rtc_power_off(void)
                              JZ_REG_RTC_RESET_COUNTER, reset_counter_ticks);
 
         jz4740_rtc_poweroff(dev_for_power_off);
-        machine_halt();
+        kernel_halt();
 }
 
 static const struct of_device_id jz4740_rtc_of_match[] = {
@@ -302,6 +303,7 @@ static const struct of_device_id jz4740_rtc_of_match[] = {
         { .compatible = "ingenic,jz4780-rtc", .data = (void *)ID_JZ4780 },
         {},
 };
+MODULE_DEVICE_TABLE(of, jz4740_rtc_of_match);
 
 static int jz4740_rtc_probe(struct platform_device *pdev)
 {
@@ -429,6 +431,7 @@ static const struct platform_device_id jz4740_rtc_ids[] = {
         { "jz4780-rtc", ID_JZ4780 },
         {}
 };
+MODULE_DEVICE_TABLE(platform, jz4740_rtc_ids);
 
 static struct platform_driver jz4740_rtc_driver = {
         .probe   = jz4740_rtc_probe,
@@ -440,4 +443,9 @@ static struct platform_driver jz4740_rtc_driver = {
         .id_table = jz4740_rtc_ids,
 };
 
-builtin_platform_driver(jz4740_rtc_driver);
+module_platform_driver(jz4740_rtc_driver);
+
+MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RTC driver for the JZ4740 SoC\n");
+MODULE_ALIAS("platform:jz4740-rtc");
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 75f820ca17b7..27ff38f839fc 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -1583,7 +1583,7 @@ out:
 int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
 {
         struct zfcp_qdio *qdio = wka_port->adapter->qdio;
-        struct zfcp_fsf_req *req = NULL;
+        struct zfcp_fsf_req *req;
         int retval = -EIO;
 
         spin_lock_irq(&qdio->req_q_lock);
@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
                 zfcp_fsf_req_free(req);
 out:
         spin_unlock_irq(&qdio->req_q_lock);
-        if (req && !IS_ERR(req))
+        if (!retval)
                 zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
         return retval;
 }
@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
 int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
 {
         struct zfcp_qdio *qdio = wka_port->adapter->qdio;
-        struct zfcp_fsf_req *req = NULL;
+        struct zfcp_fsf_req *req;
         int retval = -EIO;
 
         spin_lock_irq(&qdio->req_q_lock);
@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
                 zfcp_fsf_req_free(req);
 out:
         spin_unlock_irq(&qdio->req_q_lock);
-        if (req && !IS_ERR(req))
+        if (!retval)
                 zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
         return retval;
 }
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 4f56b1003cc7..5b48bedd7c38 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -50,9 +50,13 @@ struct aac_common aac_config = {
 
 static inline int aac_is_msix_mode(struct aac_dev *dev)
 {
-        u32 status;
+        u32 status = 0;
 
-        status = src_readl(dev, MUnit.OMR);
+        if (dev->pdev->device == PMC_DEVICE_S6 ||
+                dev->pdev->device == PMC_DEVICE_S7 ||
+                dev->pdev->device == PMC_DEVICE_S8) {
+                status = src_readl(dev, MUnit.OMR);
+        }
         return (status & AAC_INT_MODE_MSIX);
 }
 
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index 99b747cedbeb..0f807798c624 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -3816,6 +3816,7 @@ static struct configfs_attribute *ibmvscsis_tpg_attrs[] = {
 static const struct target_core_fabric_ops ibmvscsis_ops = {
         .module                         = THIS_MODULE,
         .name                           = "ibmvscsis",
+        .max_data_sg_nents              = MAX_TXU / PAGE_SIZE,
         .get_fabric_name                = ibmvscsis_get_fabric_name,
         .tpg_get_wwn                    = ibmvscsis_get_fabric_wwn,
         .tpg_get_tag                    = ibmvscsis_get_tag,
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 75f3fce1c867..0b5b423b1db0 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -51,6 +51,7 @@
 #include <linux/workqueue.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 #include <linux/interrupt.h>
 #include <linux/aer.h>
 #include <linux/raid_class.h>
@@ -4657,6 +4658,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         struct MPT3SAS_DEVICE *sas_device_priv_data;
         u32 response_code = 0;
         unsigned long flags;
+        unsigned int sector_sz;
 
         mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
         scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
@@ -4715,6 +4717,20 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         }
 
         xfer_cnt = le32_to_cpu(mpi_reply->TransferCount);
+
+        /* In case of bogus fw or device, we could end up having
+         * unaligned partial completion. We can force alignment here,
+         * then scsi-ml does not need to handle this misbehavior.
+         */
+        sector_sz = scmd->device->sector_size;
+        if (unlikely(scmd->request->cmd_type == REQ_TYPE_FS && sector_sz &&
+                     xfer_cnt % sector_sz)) {
+                sdev_printk(KERN_INFO, scmd->device,
+                    "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n",
+                            xfer_cnt, sector_sz);
+                xfer_cnt = round_down(xfer_cnt, sector_sz);
+        }
+
         scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt);
         if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE)
                 log_info =  le32_to_cpu(mpi_reply->IOCLogInfo);
@@ -8746,6 +8762,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         switch (hba_mpi_version) {
         case MPI2_VERSION:
+                pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S |
+                        PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
                 /* Use mpt2sas driver host template for SAS 2.0 HBA's */
                 shost = scsi_host_alloc(&mpt2sas_driver_template,
                   sizeof(struct MPT3SAS_ADAPTER));
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index dc88a09f9043..a94b0b6bd030 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3242,7 +3242,7 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
          * from a probe failure context.
          */
         if (!ha->rsp_q_map || !ha->rsp_q_map[0])
-                return;
+                goto free_irqs;
         rsp = ha->rsp_q_map[0];
 
         if (ha->flags.msix_enabled) {
@@ -3262,6 +3262,7 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
                 free_irq(pci_irq_vector(ha->pdev, 0), rsp);
         }
 
+free_irqs:
         pci_free_irq_vectors(ha->pdev);
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 0a000ecf0881..40660461a4b5 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1616,7 +1616,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                 /* Don't abort commands in adapter during EEH
                                  * recovery as it's not accessible/responding.
                                  */
-                                if (!ha->flags.eeh_busy) {
+                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
                                         /* Get a reference to the sp and drop the lock.
                                          * The reference ensures this sp->done() call
                                          * - and not the call in qla2xxx_eh_abort() -
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index ec91bd07f00a..c680d7641311 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -534,7 +534,9 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
 {
         struct Scsi_Host *shost = virtio_scsi_host(vscsi->vdev);
         struct virtio_scsi_cmd *cmd = scsi_cmd_priv(sc);
+        unsigned long flags;
         int req_size;
+        int ret;
 
         BUG_ON(scsi_sg_count(sc) > shost->sg_tablesize);
 
@@ -562,8 +564,15 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi,
                 req_size = sizeof(cmd->req.cmd);
         }
 
-        if (virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd)) != 0)
+        ret = virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd));
+        if (ret == -EIO) {
+                cmd->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
+                spin_lock_irqsave(&req_vq->vq_lock, flags);
+                virtscsi_complete_cmd(vscsi, cmd);
+                spin_unlock_irqrestore(&req_vq->vq_lock, flags);
+        } else if (ret != 0) {
                 return SCSI_MLQUEUE_HOST_BUSY;
+        }
         return 0;
 }
 
diff --git a/drivers/staging/greybus/timesync_platform.c b/drivers/staging/greybus/timesync_platform.c
index 113f3d6c4b3a..27f75b17679b 100644
--- a/drivers/staging/greybus/timesync_platform.c
+++ b/drivers/staging/greybus/timesync_platform.c
@@ -45,12 +45,18 @@ u32 gb_timesync_platform_get_clock_rate(void)
 
 int gb_timesync_platform_lock_bus(struct gb_timesync_svc *pdata)
 {
+        if (!arche_platform_change_state_cb)
+                return 0;
+
         return arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_TIME_SYNC,
                                               pdata);
 }
 
 void gb_timesync_platform_unlock_bus(void)
 {
+        if (!arche_platform_change_state_cb)
+                return;
+
         arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, NULL);
 }
 
diff --git a/drivers/staging/lustre/lustre/llite/llite_mmap.c b/drivers/staging/lustre/lustre/llite/llite_mmap.c
index ee01f20d8b11..9afa6bec3e6f 100644
--- a/drivers/staging/lustre/lustre/llite/llite_mmap.c
+++ b/drivers/staging/lustre/lustre/llite/llite_mmap.c
@@ -390,15 +390,13 @@ static int ll_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
                 result = VM_FAULT_LOCKED;
                 break;
         case -ENODATA:
+        case -EAGAIN:
         case -EFAULT:
                 result = VM_FAULT_NOPAGE;
                 break;
         case -ENOMEM:
                 result = VM_FAULT_OOM;
                 break;
-        case -EAGAIN:
-                result = VM_FAULT_RETRY;
-                break;
         default:
                 result = VM_FAULT_SIGBUS;
                 break;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 1ebd13ef7bd3..26929c44d703 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -352,7 +352,15 @@ int core_enable_device_list_for_node(
                         kfree(new);
                         return -EINVAL;
                 }
-                BUG_ON(orig->se_lun_acl != NULL);
+                if (orig->se_lun_acl != NULL) {
+                        pr_warn_ratelimited("Detected existing explicit"
+                                " se_lun_acl->se_lun_group reference for %s"
+                                " mapped_lun: %llu, failing\n",
+                                 nacl->initiatorname, mapped_lun);
+                        mutex_unlock(&nacl->lun_entry_mutex);
+                        kfree(new);
+                        return -EINVAL;
+                }
 
                 rcu_assign_pointer(new->se_lun, lun);
                 rcu_assign_pointer(new->se_lun_acl, lun_acl);
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 4879e70e2eef..df7b6e95c019 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -451,6 +451,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
                                              int *post_ret)
 {
         struct se_device *dev = cmd->se_dev;
+        sense_reason_t ret = TCM_NO_SENSE;
 
         /*
          * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
@@ -458,9 +459,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
          * sent to the backend driver.
          */
         spin_lock_irq(&cmd->t_state_lock);
-        if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
+        if (cmd->transport_state & CMD_T_SENT) {
                 cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
                 *post_ret = 1;
+
+                if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
+                        ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
         }
         spin_unlock_irq(&cmd->t_state_lock);
 
@@ -470,7 +474,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
          */
         up(&dev->caw_sem);
 
-        return TCM_NO_SENSE;
+        return ret;
 }
 
 static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 1cadc9eefa21..437591bc7c08 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -457,8 +457,20 @@ static void target_complete_nacl(struct kref *kref)
 {
         struct se_node_acl *nacl = container_of(kref,
                                 struct se_node_acl, acl_kref);
+        struct se_portal_group *se_tpg = nacl->se_tpg;
 
-        complete(&nacl->acl_free_comp);
+        if (!nacl->dynamic_stop) {
+                complete(&nacl->acl_free_comp);
+                return;
+        }
+
+        mutex_lock(&se_tpg->acl_node_mutex);
+        list_del(&nacl->acl_list);
+        mutex_unlock(&se_tpg->acl_node_mutex);
+
+        core_tpg_wait_for_nacl_pr_ref(nacl);
+        core_free_device_list_for_node(nacl, se_tpg);
+        kfree(nacl);
 }
 
 void target_put_nacl(struct se_node_acl *nacl)
@@ -499,12 +511,39 @@ EXPORT_SYMBOL(transport_deregister_session_configfs);
 void transport_free_session(struct se_session *se_sess)
 {
         struct se_node_acl *se_nacl = se_sess->se_node_acl;
+
         /*
          * Drop the se_node_acl->nacl_kref obtained from within
          * core_tpg_get_initiator_node_acl().
          */
         if (se_nacl) {
+                struct se_portal_group *se_tpg = se_nacl->se_tpg;
+                const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
+                unsigned long flags;
+
                 se_sess->se_node_acl = NULL;
+
+                /*
+                 * Also determine if we need to drop the extra ->cmd_kref if
+                 * it had been previously dynamically generated, and
+                 * the endpoint is not caching dynamic ACLs.
+                 */
+                mutex_lock(&se_tpg->acl_node_mutex);
+                if (se_nacl->dynamic_node_acl &&
+                    !se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
+                        spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
+                        if (list_empty(&se_nacl->acl_sess_list))
+                                se_nacl->dynamic_stop = true;
+                        spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
+
+                        if (se_nacl->dynamic_stop)
+                                list_del(&se_nacl->acl_list);
+                }
+                mutex_unlock(&se_tpg->acl_node_mutex);
+
+                if (se_nacl->dynamic_stop)
+                        target_put_nacl(se_nacl);
+
                 target_put_nacl(se_nacl);
         }
         if (se_sess->sess_cmd_map) {
@@ -518,16 +557,12 @@ EXPORT_SYMBOL(transport_free_session);
 void transport_deregister_session(struct se_session *se_sess)
 {
         struct se_portal_group *se_tpg = se_sess->se_tpg;
-        const struct target_core_fabric_ops *se_tfo;
-        struct se_node_acl *se_nacl;
         unsigned long flags;
-        bool drop_nacl = false;
 
         if (!se_tpg) {
                 transport_free_session(se_sess);
                 return;
         }
-        se_tfo = se_tpg->se_tpg_tfo;
 
         spin_lock_irqsave(&se_tpg->session_lock, flags);
         list_del(&se_sess->sess_list);
@@ -535,33 +570,15 @@ void transport_deregister_session(struct se_session *se_sess)
         se_sess->fabric_sess_ptr = NULL;
         spin_unlock_irqrestore(&se_tpg->session_lock, flags);
 
-        /*
-         * Determine if we need to do extra work for this initiator node's
-         * struct se_node_acl if it had been previously dynamically generated.
-         */
-        se_nacl = se_sess->se_node_acl;
-
-        mutex_lock(&se_tpg->acl_node_mutex);
-        if (se_nacl && se_nacl->dynamic_node_acl) {
-                if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
-                        list_del(&se_nacl->acl_list);
-                        drop_nacl = true;
-                }
-        }
-        mutex_unlock(&se_tpg->acl_node_mutex);
-
-        if (drop_nacl) {
-                core_tpg_wait_for_nacl_pr_ref(se_nacl);
-                core_free_device_list_for_node(se_nacl, se_tpg);
-                se_sess->se_node_acl = NULL;
-                kfree(se_nacl);
-        }
         pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
                 se_tpg->se_tpg_tfo->get_fabric_name());
         /*
          * If last kref is dropping now for an explicit NodeACL, awake sleeping
          * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
          * removal context from within transport_free_session() code.
+         *
+         * For dynamic ACL, target_put_nacl() uses target_complete_nacl()
+         * to release all remaining generate_node_acl=1 created ACL resources.
          */
 
         transport_free_session(se_sess);
@@ -3110,7 +3127,6 @@ static void target_tmr_work(struct work_struct *work)
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 goto check_stop;
         }
-        cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
         cmd->se_tfo->queue_tm_rsp(cmd);
@@ -3123,11 +3139,25 @@ int transport_generic_handle_tmr(
         struct se_cmd *cmd)
 {
         unsigned long flags;
+        bool aborted = false;
 
         spin_lock_irqsave(&cmd->t_state_lock, flags);
-        cmd->transport_state |= CMD_T_ACTIVE;
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                aborted = true;
+        } else {
+                cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+                cmd->transport_state |= CMD_T_ACTIVE;
+        }
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
+        if (aborted) {
+                pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
+                        "ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
+                        cmd->se_tmr_req->ref_task_tag, cmd->tag);
+                transport_cmd_check_stop_to_fabric(cmd);
+                return 0;
+        }
+
         INIT_WORK(&cmd->work, target_tmr_work);
         queue_work(cmd->se_dev->tmr_wq, &cmd->work);
         return 0;
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index d828b3b5000b..cac5a20a4de0 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -864,7 +864,7 @@ out:
                         " CHECK_CONDITION -> sending response\n", rc);
                 ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
         }
-        target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
+        target_complete_cmd(ec_cmd, ec_cmd->scsi_status);
 }
 
 sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index d2e50a27140c..24f9f98968a5 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* CBM - Flash disk */
         { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* WORLDE easy key (easykey.25) MIDI controller  */
+        { USB_DEVICE(0x0218, 0x0401), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
+
         /* HP 5300/5370C scanner */
         { USB_DEVICE(0x03f0, 0x0701), .driver_info =
                         USB_QUIRK_STRING_FETCH_255 },
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 5490fc51638e..fd80c1b9c823 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2269,6 +2269,8 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
                 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
                         return -EINVAL;
                 length = le32_to_cpu(d->dwSize);
+                if (len < length)
+                        return -EINVAL;
                 type = le32_to_cpu(d->dwPropertyDataType);
                 if (type < USB_EXT_PROP_UNICODE ||
                     type > USB_EXT_PROP_UNICODE_MULTI) {
@@ -2277,6 +2279,11 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
                         return -EINVAL;
                 }
                 pnl = le16_to_cpu(d->wPropertyNameLength);
+                if (length < 14 + pnl) {
+                        pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
+                                  length, pnl, type);
+                        return -EINVAL;
+                }
                 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
                 if (length != 14 + pnl + pdl) {
                         pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
@@ -2363,6 +2370,9 @@ static int __ffs_data_got_descs(struct ffs_data *ffs,
                 }
         }
         if (flags & (1 << i)) {
+                if (len < 4) {
+                        goto error;
+                }
                 os_descs_count = get_unaligned_le32(data);
                 data += 4;
                 len -= 4;
@@ -2435,7 +2445,8 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
 
         ENTER();
 
-        if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
+        if (unlikely(len < 16 ||
+                     get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
                      get_unaligned_le32(data + 4) != len))
                 goto error;
         str_count  = get_unaligned_le32(data + 8);
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fca288bbc800..772f15821242 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -594,11 +594,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                                 | MUSB_PORT_STAT_RESUME;
                                 musb->rh_timer = jiffies
                                         + msecs_to_jiffies(USB_RESUME_TIMEOUT);
-                                musb->need_finish_resume = 1;
-
                                 musb->xceiv->otg->state = OTG_STATE_A_HOST;
                                 musb->is_active = 1;
                                 musb_host_resume_root_hub(musb);
+                                schedule_delayed_work(&musb->finish_resume_work,
+                                        msecs_to_jiffies(USB_RESUME_TIMEOUT));
                                 break;
                         case OTG_STATE_B_WAIT_ACON:
                                 musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
@@ -1925,6 +1925,14 @@ static void musb_pm_runtime_check_session(struct musb *musb)
 static void musb_irq_work(struct work_struct *data)
 {
         struct musb *musb = container_of(data, struct musb, irq_work.work);
+        int error;
+
+        error = pm_runtime_get_sync(musb->controller);
+        if (error < 0) {
+                dev_err(musb->controller, "Could not enable: %i\n", error);
+
+                return;
+        }
 
         musb_pm_runtime_check_session(musb);
 
@@ -1932,6 +1940,9 @@ static void musb_irq_work(struct work_struct *data)
                 musb->xceiv_old_state = musb->xceiv->otg->state;
                 sysfs_notify(&musb->controller->kobj, NULL, "mode");
         }
+
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
 }
 
 static void musb_recover_from_babble(struct musb *musb)
@@ -2710,11 +2721,6 @@ static int musb_resume(struct device *dev)
         mask = MUSB_DEVCTL_BDEVICE | MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV;
         if ((devctl & mask) != (musb->context.devctl & mask))
                 musb->port1_status = 0;
-        if (musb->need_finish_resume) {
-                musb->need_finish_resume = 0;
-                schedule_delayed_work(&musb->finish_resume_work,
-                                      msecs_to_jiffies(USB_RESUME_TIMEOUT));
-        }
 
         /*
          * The USB HUB code expects the device to be in RPM_ACTIVE once it came
@@ -2766,12 +2772,6 @@ static int musb_runtime_resume(struct device *dev)
 
         musb_restore_context(musb);
 
-        if (musb->need_finish_resume) {
-                musb->need_finish_resume = 0;
-                schedule_delayed_work(&musb->finish_resume_work,
-                                msecs_to_jiffies(USB_RESUME_TIMEOUT));
-        }
-
         spin_lock_irqsave(&musb->lock, flags);
         error = musb_run_resume_work(musb);
         if (error)
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index ade902ea1221..ce5a18c98c6d 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -410,7 +410,6 @@ struct musb {
 
         /* is_suspended means USB B_PERIPHERAL suspend */
         unsigned                is_suspended:1;
-        unsigned                need_finish_resume :1;
 
         /* may_wakeup means remote wakeup is enabled */
         unsigned                may_wakeup:1;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 7ce31a4c7e7f..42cc72e54c05 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2007,6 +2007,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 46fca6b75846..1db4b61bdf7b 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
         { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index e3b7af8adfb7..09d9be88209e 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
+#define ATEN_PRODUCT_ID2        0x2118
 
 #define IODATA_VENDOR_ID        0x04bb
 #define IODATA_PRODUCT_ID       0x0a03
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 1bc6089b9008..696458db7e3c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x1410, 0xa021)},   /* Novatel Gobi 3000 Composite */
         {USB_DEVICE(0x413c, 0x8193)},   /* Dell Gobi 3000 QDL */
         {USB_DEVICE(0x413c, 0x8194)},   /* Dell Gobi 3000 Composite */
+        {USB_DEVICE(0x413c, 0x81a6)},   /* Dell DW5570 QDL (MC8805) */
         {USB_DEVICE(0x1199, 0x68a4)},   /* Sierra Wireless QDL */
         {USB_DEVICE(0x1199, 0x68a5)},   /* Sierra Wireless Modem */
         {USB_DEVICE(0x1199, 0x68a8)},   /* Sierra Wireless QDL */
diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
index 128d10282d16..59b3f62a2d64 100644
--- a/drivers/vfio/vfio_iommu_spapr_tce.c
+++ b/drivers/vfio/vfio_iommu_spapr_tce.c
@@ -1123,12 +1123,11 @@ static long tce_iommu_ioctl(void *iommu_data,
                 mutex_lock(&container->lock);
 
                 ret = tce_iommu_create_default_window(container);
-                if (ret)
-                        return ret;
-
-                ret = tce_iommu_create_window(container, create.page_shift,
-                                create.window_size, create.levels,
-                                &create.start_addr);
+                if (!ret)
+                        ret = tce_iommu_create_window(container,
+                                        create.page_shift,
+                                        create.window_size, create.levels,
+                                        &create.start_addr);
 
                 mutex_unlock(&container->lock);
 
@@ -1246,6 +1245,8 @@ static void tce_iommu_release_ownership_ddw(struct tce_container *container,
 static long tce_iommu_take_ownership_ddw(struct tce_container *container,
                 struct iommu_table_group *table_group)
 {
+        long i, ret = 0;
+
         if (!table_group->ops->create_table || !table_group->ops->set_window ||
                         !table_group->ops->release_ownership) {
                 WARN_ON_ONCE(1);
@@ -1254,7 +1255,27 @@ static long tce_iommu_take_ownership_ddw(struct tce_container *container,
 
         table_group->ops->take_ownership(table_group);
 
+        /* Set all windows to the new group */
+        for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) {
+                struct iommu_table *tbl = container->tables[i];
+
+                if (!tbl)
+                        continue;
+
+                ret = table_group->ops->set_window(table_group, i, tbl);
+                if (ret)
+                        goto release_exit;
+        }
+
         return 0;
+
+release_exit:
+        for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i)
+                table_group->ops->unset_window(table_group, i);
+
+        table_group->ops->release_ownership(table_group);
+
+        return ret;
 }
 
 static int tce_iommu_attach_group(void *iommu_data,
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index d6432603880c..8f99fe08de02 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -130,14 +130,14 @@ static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx,
 
 static void vhost_init_is_le(struct vhost_virtqueue *vq)
 {
-        if (vhost_has_feature(vq, VIRTIO_F_VERSION_1))
-                vq->is_le = true;
+        vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1)
+                || virtio_legacy_is_little_endian();
 }
 #endif /* CONFIG_VHOST_CROSS_ENDIAN_LEGACY */
 
 static void vhost_reset_is_le(struct vhost_virtqueue *vq)
 {
-        vq->is_le = virtio_legacy_is_little_endian();
+        vhost_init_is_le(vq);
 }
 
 struct vhost_flush_struct {
@@ -1714,10 +1714,8 @@ int vhost_vq_init_access(struct vhost_virtqueue *vq)
         int r;
         bool is_le = vq->is_le;
 
-        if (!vq->private_data) {
-                vhost_reset_is_le(vq);
+        if (!vq->private_data)
                 return 0;
-        }
 
         vhost_init_is_le(vq);
 
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 7e38ed79c3fc..409aeaa49246 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -159,13 +159,6 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
         if (xen_domain())
                 return true;
 
-        /*
-         * On ARM-based machines, the DMA ops will do the right thing,
-         * so always use them with legacy devices.
-         */
-        if (IS_ENABLED(CONFIG_ARM) || IS_ENABLED(CONFIG_ARM64))
-                return !virtio_has_feature(vdev, VIRTIO_F_VERSION_1);
-
         return false;
 }
 
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 7f390849343b..c4444d6f439f 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -1024,6 +1024,7 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
         unsigned long buf_offset;
         unsigned long current_buf_start;
         unsigned long start_byte;
+        unsigned long prev_start_byte;
         unsigned long working_bytes = total_out - buf_start;
         unsigned long bytes;
         char *kaddr;
@@ -1071,26 +1072,34 @@ int btrfs_decompress_buf2page(char *buf, unsigned long buf_start,
                 if (!bio->bi_iter.bi_size)
                         return 0;
                 bvec = bio_iter_iovec(bio, bio->bi_iter);
-
+                prev_start_byte = start_byte;
                 start_byte = page_offset(bvec.bv_page) - disk_start;
 
                 /*
-                 * make sure our new page is covered by this
-                 * working buffer
+                 * We need to make sure we're only adjusting
+                 * our offset into compression working buffer when
+                 * we're switching pages.  Otherwise we can incorrectly
+                 * keep copying when we were actually done.
                  */
-                if (total_out <= start_byte)
-                        return 1;
+                if (start_byte != prev_start_byte) {
+                        /*
+                         * make sure our new page is covered by this
+                         * working buffer
+                         */
+                        if (total_out <= start_byte)
+                                return 1;
 
-                /*
-                 * the next page in the biovec might not be adjacent
-                 * to the last page, but it might still be found
-                 * inside this working buffer. bump our offset pointer
-                 */
-                if (total_out > start_byte &&
-                    current_buf_start < start_byte) {
-                        buf_offset = start_byte - buf_start;
-                        working_bytes = total_out - start_byte;
-                        current_buf_start = buf_start + buf_offset;
+                        /*
+                         * the next page in the biovec might not be adjacent
+                         * to the last page, but it might still be found
+                         * inside this working buffer. bump our offset pointer
+                         */
+                        if (total_out > start_byte &&
+                            current_buf_start < start_byte) {
+                                buf_offset = start_byte - buf_start;
+                                working_bytes = total_out - start_byte;
+                                current_buf_start = buf_start + buf_offset;
+                        }
                 }
         }
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 33f967d30b2a..21e51b0ba188 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -5653,6 +5653,10 @@ long btrfs_ioctl(struct file *file, unsigned int
 #ifdef CONFIG_COMPAT
 long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
+        /*
+         * These all access 32-bit values anyway so no further
+         * handling is necessary.
+         */
         switch (cmd) {
         case FS_IOC32_GETFLAGS:
                 cmd = FS_IOC_GETFLAGS;
@@ -5663,8 +5667,6 @@ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case FS_IOC32_GETVERSION:
                 cmd = FS_IOC_GETVERSION;
                 break;
-        default:
-                return -ENOIOCTLCMD;
         }
 
         return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 8f6a2a5863b9..a27fc8791551 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -285,6 +285,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file)
                         rc = -ENOMEM;
                         goto error_exit;
                 }
+                spin_lock_init(&cifsFile->file_info_lock);
                 file->private_data = cifsFile;
                 cifsFile->tlink = cifs_get_tlink(tlink);
                 tcon = tlink_tcon(tlink);
diff --git a/fs/dax.c b/fs/dax.c
index 3af2da5e64ce..c45598b912e1 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -1031,6 +1031,11 @@ dax_iomap_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
                 struct blk_dax_ctl dax = { 0 };
                 ssize_t map_len;
 
+                if (fatal_signal_pending(current)) {
+                        ret = -EINTR;
+                        break;
+                }
+
                 dax.sector = dax_iomap_sector(iomap, pos);
                 dax.size = (length + offset + PAGE_SIZE - 1) & PAGE_MASK;
                 map_len = dax_map_atomic(iomap->bdev, &dax);
diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 4304072161aa..40d61077bead 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
                 hlist_for_each_entry(object, &cookie->backing_objects, cookie_link) {
                         if (invalidate)
                                 set_bit(FSCACHE_OBJECT_RETIRED, &object->flags);
+                        clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
                         fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL);
                 }
         } else {
@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate)
                 wait_on_atomic_t(&cookie->n_active, fscache_wait_atomic_t,
                                  TASK_UNINTERRUPTIBLE);
 
+        /* Make sure any pending writes are cancelled. */
+        if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX)
+                fscache_invalidate_writes(cookie);
+
         /* Reset the cookie state if it wasn't relinquished */
         if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, &cookie->flags)) {
                 atomic_inc(&cookie->n_active);
diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
index 9b28649df3a1..a8aa00be4444 100644
--- a/fs/fscache/netfs.c
+++ b/fs/fscache/netfs.c
@@ -48,6 +48,7 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
         cookie->flags           = 1 << FSCACHE_COOKIE_ENABLED;
 
         spin_lock_init(&cookie->lock);
+        spin_lock_init(&cookie->stores_lock);
         INIT_HLIST_HEAD(&cookie->backing_objects);
 
         /* check the netfs type is not already present */
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index 9e792e30f4db..7a182c87f378 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -30,6 +30,7 @@ static const struct fscache_state *fscache_look_up_object(struct fscache_object
 static const struct fscache_state *fscache_object_available(struct fscache_object *, int);
 static const struct fscache_state *fscache_parent_ready(struct fscache_object *, int);
 static const struct fscache_state *fscache_update_object(struct fscache_object *, int);
+static const struct fscache_state *fscache_object_dead(struct fscache_object *, int);
 
 #define __STATE_NAME(n) fscache_osm_##n
 #define STATE(n) (&__STATE_NAME(n))
@@ -91,7 +92,7 @@ static WORK_STATE(LOOKUP_FAILURE,	"LCFL", fscache_lookup_failure);
 static WORK_STATE(KILL_OBJECT,          "KILL", fscache_kill_object);
 static WORK_STATE(KILL_DEPENDENTS,      "KDEP", fscache_kill_dependents);
 static WORK_STATE(DROP_OBJECT,          "DROP", fscache_drop_object);
-static WORK_STATE(OBJECT_DEAD,          "DEAD", (void*)2UL);
+static WORK_STATE(OBJECT_DEAD,          "DEAD", fscache_object_dead);
 
 static WAIT_STATE(WAIT_FOR_INIT,        "?INI",
                   TRANSIT_TO(INIT_OBJECT,       1 << FSCACHE_OBJECT_EV_NEW_CHILD));
@@ -229,6 +230,10 @@ execute_work_state:
         event = -1;
         if (new_state == NO_TRANSIT) {
                 _debug("{OBJ%x} %s notrans", object->debug_id, state->name);
+                if (unlikely(state == STATE(OBJECT_DEAD))) {
+                        _leave(" [dead]");
+                        return;
+                }
                 fscache_enqueue_object(object);
                 event_mask = object->oob_event_mask;
                 goto unmask_events;
@@ -239,7 +244,7 @@ execute_work_state:
         object->state = state = new_state;
 
         if (state->work) {
-                if (unlikely(state->work == ((void *)2UL))) {
+                if (unlikely(state == STATE(OBJECT_DEAD))) {
                         _leave(" [dead]");
                         return;
                 }
@@ -645,6 +650,12 @@ static const struct fscache_state *fscache_kill_object(struct fscache_object *ob
         fscache_mark_object_dead(object);
         object->oob_event_mask = 0;
 
+        if (test_bit(FSCACHE_OBJECT_RETIRED, &object->flags)) {
+                /* Reject any new read/write ops and abort any that are pending. */
+                clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags);
+                fscache_cancel_all_ops(object);
+        }
+
         if (list_empty(&object->dependents) &&
             object->n_ops == 0 &&
             object->n_children == 0)
@@ -1077,3 +1088,20 @@ void fscache_object_mark_killed(struct fscache_object *object,
         }
 }
 EXPORT_SYMBOL(fscache_object_mark_killed);
+
+/*
+ * The object is dead.  We can get here if an object gets queued by an event
+ * that would lead to its death (such as EV_KILL) when the dispatcher is
+ * already running (and so can be requeued) but hasn't yet cleared the event
+ * mask.
+ */
+static const struct fscache_state *fscache_object_dead(struct fscache_object *object,
+                                                       int event)
+{
+        if (!test_and_set_bit(FSCACHE_OBJECT_RUN_AFTER_DEAD,
+                              &object->flags))
+                return NO_TRANSIT;
+
+        WARN(true, "FS-Cache object redispatched after death");
+        return NO_TRANSIT;
+}
diff --git a/fs/iomap.c b/fs/iomap.c
index 354a123f170e..a51cb4c07d4d 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -114,6 +114,9 @@ iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, unsigned flags,
 
         BUG_ON(pos + len > iomap->offset + iomap->length);
 
+        if (fatal_signal_pending(current))
+                return -EINTR;
+
         page = grab_cache_page_write_begin(inode->i_mapping, index, flags);
         if (!page)
                 return -ENOMEM;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ecc151697fd4..0a0eaecf9676 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2700,7 +2700,8 @@ static inline void nfs4_exclusive_attrset(struct nfs4_opendata *opendata,
                 sattr->ia_valid |= ATTR_MTIME;
 
         /* Except MODE, it seems harmless of setting twice. */
-        if ((attrset[1] & FATTR4_WORD1_MODE))
+        if (opendata->o_arg.createmode != NFS4_CREATE_EXCLUSIVE &&
+                attrset[1] & FATTR4_WORD1_MODE)
                 sattr->ia_valid &= ~ATTR_MODE;
 
         if (attrset[2] & FATTR4_WORD2_SECURITY_LABEL)
@@ -8490,6 +8491,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                 goto out;
         }
 
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
         err = nfs4_handle_exception(server, nfs4err, exception);
         if (!status) {
                 if (exception->retry)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 90e6193ce6be..daeb94e3acd4 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1091,6 +1091,7 @@ static void nfs_increment_seqid(int status, struct nfs_seqid *seqid)
                 case -NFS4ERR_BADXDR:
                 case -NFS4ERR_RESOURCE:
                 case -NFS4ERR_NOFILEHANDLE:
+                case -NFS4ERR_MOVED:
                         /* Non-seqid mutating errors */
                         return;
         };
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 59554f3adf29..dd042498ce7c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1200,10 +1200,10 @@ _pnfs_return_layout(struct inode *ino)
 
         send = pnfs_prepare_layoutreturn(lo, &stateid, NULL);
         spin_unlock(&ino->i_lock);
-        pnfs_free_lseg_list(&tmp_list);
         if (send)
                 status = pnfs_send_layoutreturn(lo, &stateid, IOMODE_ANY, true);
 out_put_layout_hdr:
+        pnfs_free_lseg_list(&tmp_list);
         pnfs_put_layout_hdr(lo);
 out:
         dprintk("<-- %s status: %d\n", __func__, status);
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 596205d939a1..1fc07a9c70e9 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -223,10 +223,11 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
         struct nfs4_layout_stateid *ls;
         struct nfs4_stid *stp;
 
-        stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache);
+        stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache,
+                                        nfsd4_free_layout_stateid);
         if (!stp)
                 return NULL;
-        stp->sc_free = nfsd4_free_layout_stateid;
+
         get_nfs4_file(fp);
         stp->sc_file = fp;
 
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 4b4beaaa4eaa..a0dee8ae9f97 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -633,8 +633,8 @@ out:
         return co;
 }
 
-struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
-                                         struct kmem_cache *slab)
+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
+                                  void (*sc_free)(struct nfs4_stid *))
 {
         struct nfs4_stid *stid;
         int new_id;
@@ -650,6 +650,8 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
         idr_preload_end();
         if (new_id < 0)
                 goto out_free;
+
+        stid->sc_free = sc_free;
         stid->sc_client = cl;
         stid->sc_stateid.si_opaque.so_id = new_id;
         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
@@ -675,15 +677,12 @@ out_free:
 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
 {
         struct nfs4_stid *stid;
-        struct nfs4_ol_stateid *stp;
 
-        stid = nfs4_alloc_stid(clp, stateid_slab);
+        stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
         if (!stid)
                 return NULL;
 
-        stp = openlockstateid(stid);
-        stp->st_stid.sc_free = nfs4_free_ol_stateid;
-        return stp;
+        return openlockstateid(stid);
 }
 
 static void nfs4_free_deleg(struct nfs4_stid *stid)
@@ -781,11 +780,10 @@ alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh,
                 goto out_dec;
         if (delegation_blocked(&current_fh->fh_handle))
                 goto out_dec;
-        dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
+        dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
         if (dp == NULL)
                 goto out_dec;
 
-        dp->dl_stid.sc_free = nfs4_free_deleg;
         /*
          * delegation seqid's are never incremented.  The 4.1 special
          * meaning of seqid 0 isn't meaningful, really, but let's avoid
@@ -5580,7 +5578,6 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
         get_nfs4_file(fp);
         stp->st_stid.sc_file = fp;
-        stp->st_stid.sc_free = nfs4_free_lock_stateid;
         stp->st_access_bmap = 0;
         stp->st_deny_bmap = open_stp->st_deny_bmap;
         stp->st_openstp = open_stp;
@@ -5623,7 +5620,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
         lst = find_lock_stateid(lo, fi);
         if (lst == NULL) {
                 spin_unlock(&clp->cl_lock);
-                ns = nfs4_alloc_stid(clp, stateid_slab);
+                ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
                 if (ns == NULL)
                         return NULL;
 
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index c9399366f9df..4516e8b7d776 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -603,8 +603,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
 __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
                      stateid_t *stateid, unsigned char typemask,
                      struct nfs4_stid **s, struct nfsd_net *nn);
-struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
-                struct kmem_cache *slab);
+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
+                                  void (*sc_free)(struct nfs4_stid *));
 void nfs4_unhash_stid(struct nfs4_stid *s);
 void nfs4_put_stid(struct nfs4_stid *s);
 void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid);
diff --git a/fs/proc/page.c b/fs/proc/page.c
index a2066e6dee90..2726536489b1 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -173,7 +173,8 @@ u64 stable_page_flags(struct page *page)
         u |= kpf_copy_bit(k, KPF_ACTIVE,        PG_active);
         u |= kpf_copy_bit(k, KPF_RECLAIM,       PG_reclaim);
 
-        u |= kpf_copy_bit(k, KPF_SWAPCACHE,     PG_swapcache);
+        if (PageSwapCache(page))
+                u |= 1 << KPF_SWAPCACHE;
         u |= kpf_copy_bit(k, KPF_SWAPBACKED,    PG_swapbacked);
 
         u |= kpf_copy_bit(k, KPF_UNEVICTABLE,   PG_unevictable);
diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
index 27c059e1760a..1d887efaaf71 100644
--- a/fs/pstore/ram.c
+++ b/fs/pstore/ram.c
@@ -280,7 +280,7 @@ static ssize_t ramoops_pstore_read(u64 *id, enum pstore_type_id *type,
                                            1, id, type, PSTORE_TYPE_PMSG, 0);
 
         /* ftrace is last since it may want to dynamically allocate memory. */
-        if (!prz_ok(prz)) {
+        if (!prz_ok(prz) && cxt->fprzs) {
                 if (!(cxt->flags & RAMOOPS_FLAG_FTRACE_PER_CPU)) {
                         prz = ramoops_get_next_prz(cxt->fprzs,
                                         &cxt->ftrace_read_cnt, 1, id, type,
diff --git a/include/asm-generic/export.h b/include/asm-generic/export.h
index 63554e9f6e0c..719db1968d81 100644
--- a/include/asm-generic/export.h
+++ b/include/asm-generic/export.h
@@ -9,18 +9,15 @@
 #ifndef KSYM_ALIGN
 #define KSYM_ALIGN 8
 #endif
-#ifndef KCRC_ALIGN
-#define KCRC_ALIGN 8
-#endif
 #else
 #define __put .long
 #ifndef KSYM_ALIGN
 #define KSYM_ALIGN 4
 #endif
+#endif
 #ifndef KCRC_ALIGN
 #define KCRC_ALIGN 4
 #endif
-#endif
 
 #ifdef CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX
 #define KSYM(name) _##name
@@ -52,7 +49,11 @@ KSYM(__kstrtab_\name):
         .section ___kcrctab\sec+\name,"a"
         .balign KCRC_ALIGN
 KSYM(__kcrctab_\name):
-        __put KSYM(__crc_\name)
+#if defined(CONFIG_MODULE_REL_CRCS)
+        .long KSYM(__crc_\name) - .
+#else
+        .long KSYM(__crc_\name)
+#endif
         .weak KSYM(__crc_\name)
         .previous
 #endif
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 192016e2b518..9c4ee144b5f6 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -517,6 +517,7 @@ struct drm_device {
         struct drm_minor *control;              /**< Control node */
         struct drm_minor *primary;              /**< Primary node */
         struct drm_minor *render;               /**< Render node */
+        bool registered;
 
         /* currently active master for this device. Protected by master_mutex */
         struct drm_master *master;
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index a9b95246e26e..045a97cbeba2 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -381,6 +381,8 @@ struct drm_connector_funcs {
          * core drm connector interfaces. Everything added from this callback
          * should be unregistered in the early_unregister callback.
          *
+         * This is called while holding drm_connector->mutex.
+         *
          * Returns:
          *
          * 0 on success, or a negative error code on failure.
@@ -395,6 +397,8 @@ struct drm_connector_funcs {
          * late_register(). It is called from drm_connector_unregister(),
          * early in the driver unload sequence to disable userspace access
          * before data structures are torndown.
+         *
+         * This is called while holding drm_connector->mutex.
          */
         void (*early_unregister)(struct drm_connector *connector);
 
@@ -559,7 +563,6 @@ struct drm_cmdline_mode {
  * @interlace_allowed: can this connector handle interlaced modes?
  * @doublescan_allowed: can this connector handle doublescan?
  * @stereo_allowed: can this connector handle stereo modes?
- * @registered: is this connector exposed (registered) with userspace?
  * @modes: modes available on this connector (from fill_modes() + user)
  * @status: one of the drm_connector_status enums (connected, not, or unknown)
  * @probed_modes: list of modes derived directly from the display
@@ -608,6 +611,13 @@ struct drm_connector {
         char *name;
 
         /**
+         * @mutex: Lock for general connector state, but currently only protects
+         * @registered. Most of the connector state is still protected by the
+         * mutex in &drm_mode_config.
+         */
+        struct mutex mutex;
+
+        /**
          * @index: Compacted connector index, which matches the position inside
          * the mode_config.list for drivers not supporting hot-add/removing. Can
          * be used as an array index. It is invariant over the lifetime of the
@@ -620,6 +630,10 @@ struct drm_connector {
         bool interlace_allowed;
         bool doublescan_allowed;
         bool stereo_allowed;
+        /**
+         * @registered: Is this connector exposed (registered) with userspace?
+         * Protected by @mutex.
+         */
         bool registered;
         struct list_head modes; /* list of modes on this connector */
 
diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
index d67ab83823ad..79591c3660cc 100644
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -243,12 +243,10 @@ static inline int block_page_mkwrite_return(int err)
 {
         if (err == 0)
                 return VM_FAULT_LOCKED;
-        if (err == -EFAULT)
+        if (err == -EFAULT || err == -EAGAIN)
                 return VM_FAULT_NOPAGE;
         if (err == -ENOMEM)
                 return VM_FAULT_OOM;
-        if (err == -EAGAIN)
-                return VM_FAULT_RETRY;
         /* -ENOSPC, -EDQUOT, -EIO ... */
         return VM_FAULT_SIGBUS;
 }
diff --git a/include/linux/can/core.h b/include/linux/can/core.h
index a0875001b13c..df08a41d5be5 100644
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -45,10 +45,9 @@ struct can_proto {
 extern int  can_proto_register(const struct can_proto *cp);
 extern void can_proto_unregister(const struct can_proto *cp);
 
-extern int  can_rx_register(struct net_device *dev, canid_t can_id,
-                            canid_t mask,
-                            void (*func)(struct sk_buff *, void *),
-                            void *data, char *ident);
+int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
+                    void (*func)(struct sk_buff *, void *),
+                    void *data, char *ident, struct sock *sk);
 
 extern void can_rx_unregister(struct net_device *dev, canid_t can_id,
                               canid_t mask,
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index d936a0021839..921acaaa1601 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -8,9 +8,7 @@ enum cpuhp_state {
         CPUHP_CREATE_THREADS,
         CPUHP_PERF_PREPARE,
         CPUHP_PERF_X86_PREPARE,
-        CPUHP_PERF_X86_UNCORE_PREP,
         CPUHP_PERF_X86_AMD_UNCORE_PREP,
-        CPUHP_PERF_X86_RAPL_PREP,
         CPUHP_PERF_BFIN,
         CPUHP_PERF_POWER,
         CPUHP_PERF_SUPERH,
@@ -86,7 +84,6 @@ enum cpuhp_state {
         CPUHP_AP_IRQ_ARMADA_XP_STARTING,
         CPUHP_AP_IRQ_BCM2836_STARTING,
         CPUHP_AP_ARM_MVEBU_COHERENCY,
-        CPUHP_AP_PERF_X86_UNCORE_STARTING,
         CPUHP_AP_PERF_X86_AMD_UNCORE_STARTING,
         CPUHP_AP_PERF_X86_STARTING,
         CPUHP_AP_PERF_X86_AMD_IBS_STARTING,
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index c717f5ea88cb..b3d2c1a89ac4 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -560,7 +560,7 @@ static inline void cpumask_copy(struct cpumask *dstp,
 static inline int cpumask_parse_user(const char __user *buf, int len,
                                      struct cpumask *dstp)
 {
-        return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids);
+        return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
 }
 
 /**
@@ -575,7 +575,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len,
                                      struct cpumask *dstp)
 {
         return bitmap_parselist_user(buf, len, cpumask_bits(dstp),
-                                     nr_cpu_ids);
+                                     nr_cpumask_bits);
 }
 
 /**
@@ -590,7 +590,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
         char *nl = strchr(buf, '\n');
         unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf);
 
-        return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids);
+        return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
 }
 
 /**
@@ -602,7 +602,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
  */
 static inline int cpulist_parse(const char *buf, struct cpumask *dstp)
 {
-        return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids);
+        return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits);
 }
 
 /**
diff --git a/include/linux/export.h b/include/linux/export.h
index 2a0f61fbc731..1a1dfdb2a5c6 100644
--- a/include/linux/export.h
+++ b/include/linux/export.h
@@ -43,12 +43,19 @@ extern struct module __this_module;
 #ifdef CONFIG_MODVERSIONS
 /* Mark the CRC weak since genksyms apparently decides not to
  * generate a checksums for some symbols */
+#if defined(CONFIG_MODULE_REL_CRCS)
 #define __CRC_SYMBOL(sym, sec)                                          \
-        extern __visible void *__crc_##sym __attribute__((weak));       \
-        static const unsigned long __kcrctab_##sym                      \
-        __used                                                          \
-        __attribute__((section("___kcrctab" sec "+" #sym), used))       \
-        = (unsigned long) &__crc_##sym;
+        asm("   .section \"___kcrctab" sec "+" #sym "\", \"a\"  \n"     \
+            "   .weak   " VMLINUX_SYMBOL_STR(__crc_##sym) "     \n"     \
+            "   .long   " VMLINUX_SYMBOL_STR(__crc_##sym) " - . \n"     \
+            "   .previous                                       \n");
+#else
+#define __CRC_SYMBOL(sym, sec)                                          \
+        asm("   .section \"___kcrctab" sec "+" #sym "\", \"a\"  \n"     \
+            "   .weak   " VMLINUX_SYMBOL_STR(__crc_##sym) "     \n"     \
+            "   .long   " VMLINUX_SYMBOL_STR(__crc_##sym) "     \n"     \
+            "   .previous                                       \n");
+#endif
 #else
 #define __CRC_SYMBOL(sym, sec)
 #endif
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 13ba552e6c09..4c467ef50159 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -360,6 +360,7 @@ struct fscache_object {
 #define FSCACHE_OBJECT_IS_AVAILABLE     5       /* T if object has become active */
 #define FSCACHE_OBJECT_RETIRED          6       /* T if object was retired on relinquishment */
 #define FSCACHE_OBJECT_KILLED_BY_CACHE  7       /* T if object was killed by the cache */
+#define FSCACHE_OBJECT_RUN_AFTER_DEAD   8       /* T if object has been dispatched after death */
 
         struct list_head        cache_link;     /* link in cache->object_list */
         struct hlist_node       cookie_link;    /* link in cookie->backing_objects */
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 42fe43fb0c80..183efde54269 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
         u32 ring_data_startoffset;
         u32 priv_write_index;
         u32 priv_read_index;
+        u32 cached_read_index;
 };
 
 /*
@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
         return write;
 }
 
+static inline u32 hv_get_cached_bytes_to_write(
+        const struct hv_ring_buffer_info *rbi)
+{
+        u32 read_loc, write_loc, dsize, write;
+
+        dsize = rbi->ring_datasize;
+        read_loc = rbi->cached_read_index;
+        write_loc = rbi->ring_buffer->write_index;
+
+        write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
+                read_loc - write_loc;
+        return write;
+}
 /*
  * VMBUS version is 32 bit entity broken up into
  * two 16 bit quantities: major_number. minor_number.
@@ -1488,7 +1502,7 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
 
 static inline  void hv_signal_on_read(struct vmbus_channel *channel)
 {
-        u32 cur_write_sz;
+        u32 cur_write_sz, cached_write_sz;
         u32 pending_sz;
         struct hv_ring_buffer_info *rbi = &channel->inbound;
 
@@ -1512,12 +1526,24 @@ static inline  void hv_signal_on_read(struct vmbus_channel *channel)
 
         cur_write_sz = hv_get_bytes_to_write(rbi);
 
-        if (cur_write_sz >= pending_sz)
+        if (cur_write_sz < pending_sz)
+                return;
+
+        cached_write_sz = hv_get_cached_bytes_to_write(rbi);
+        if (cached_write_sz < pending_sz)
                 vmbus_setevent(channel);
 
         return;
 }
 
+static inline void
+init_cached_read_index(struct vmbus_channel *channel)
+{
+        struct hv_ring_buffer_info *rbi = &channel->inbound;
+
+        rbi->cached_read_index = rbi->ring_buffer->read_index;
+}
+
 /*
  * An API to support in-place processing of incoming VMBUS packets.
  */
@@ -1569,6 +1595,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
  * This call commits the read index and potentially signals the host.
  * Here is the pattern for using the "in-place" consumption APIs:
  *
+ * init_cached_read_index();
+ *
  * while (get_next_pkt_raw() {
  *      process the packet "in-place";
  *      put_pkt_raw();
diff --git a/include/linux/irq.h b/include/linux/irq.h
index e79875574b39..39e3254e5769 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -184,6 +184,7 @@ struct irq_data {
  *
  * IRQD_TRIGGER_MASK            - Mask for the trigger type bits
  * IRQD_SETAFFINITY_PENDING     - Affinity setting is pending
+ * IRQD_ACTIVATED               - Interrupt has already been activated
  * IRQD_NO_BALANCING            - Balancing disabled for this IRQ
  * IRQD_PER_CPU                 - Interrupt is per cpu
  * IRQD_AFFINITY_SET            - Interrupt affinity was set
@@ -202,6 +203,7 @@ struct irq_data {
 enum {
         IRQD_TRIGGER_MASK               = 0xf,
         IRQD_SETAFFINITY_PENDING        = (1 <<  8),
+        IRQD_ACTIVATED                  = (1 <<  9),
         IRQD_NO_BALANCING               = (1 << 10),
         IRQD_PER_CPU                    = (1 << 11),
         IRQD_AFFINITY_SET               = (1 << 12),
@@ -312,6 +314,21 @@ static inline bool irqd_affinity_is_managed(struct irq_data *d)
         return __irqd_to_state(d) & IRQD_AFFINITY_MANAGED;
 }
 
+static inline bool irqd_is_activated(struct irq_data *d)
+{
+        return __irqd_to_state(d) & IRQD_ACTIVATED;
+}
+
+static inline void irqd_set_activated(struct irq_data *d)
+{
+        __irqd_to_state(d) |= IRQD_ACTIVATED;
+}
+
+static inline void irqd_clr_activated(struct irq_data *d)
+{
+        __irqd_to_state(d) &= ~IRQD_ACTIVATED;
+}
+
 #undef __irqd_to_state
 
 static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
diff --git a/include/linux/log2.h b/include/linux/log2.h
index fd7ff3d91e6a..ef3d4f67118c 100644
--- a/include/linux/log2.h
+++ b/include/linux/log2.h
@@ -203,6 +203,17 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
  *  ... and so on.
  */
 
-#define order_base_2(n) ilog2(roundup_pow_of_two(n))
+static inline __attribute_const__
+int __order_base_2(unsigned long n)
+{
+        return n > 1 ? ilog2(n - 1) + 1 : 0;
+}
 
+#define order_base_2(n)                         \
+(                                               \
+        __builtin_constant_p(n) ? (             \
+                ((n) == 0 || (n) == 1) ? 0 :    \
+                ilog2((n) - 1) + 1) :           \
+        __order_base_2(n)                       \
+)
 #endif /* _LINUX_LOG2_H */
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index c1784c0b4f35..134a2f69c21a 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -85,7 +85,8 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages);
 extern int add_one_highpage(struct page *page, int pfn, int bad_ppro);
 /* VM interface that may be used by firmware interface */
 extern int online_pages(unsigned long, unsigned long, int);
-extern int test_pages_in_a_zone(unsigned long, unsigned long);
+extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
+        unsigned long *valid_start, unsigned long *valid_end);
 extern void __offline_isolated_pages(unsigned long, unsigned long);
 
 typedef void (*online_page_callback_t)(struct page *page);
diff --git a/include/linux/module.h b/include/linux/module.h
index 7c84273d60b9..cc7cba219b20 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -346,7 +346,7 @@ struct module {
 
         /* Exported symbols */
         const struct kernel_symbol *syms;
-        const unsigned long *crcs;
+        const s32 *crcs;
         unsigned int num_syms;
 
         /* Kernel parameters. */
@@ -359,18 +359,18 @@ struct module {
         /* GPL-only exported symbols. */
         unsigned int num_gpl_syms;
         const struct kernel_symbol *gpl_syms;
-        const unsigned long *gpl_crcs;
+        const s32 *gpl_crcs;
 
 #ifdef CONFIG_UNUSED_SYMBOLS
         /* unused exported symbols. */
         const struct kernel_symbol *unused_syms;
-        const unsigned long *unused_crcs;
+        const s32 *unused_crcs;
         unsigned int num_unused_syms;
 
         /* GPL-only, unused exported symbols. */
         unsigned int num_unused_gpl_syms;
         const struct kernel_symbol *unused_gpl_syms;
-        const unsigned long *unused_gpl_crcs;
+        const s32 *unused_gpl_crcs;
 #endif
 
 #ifdef CONFIG_MODULE_SIG
@@ -382,7 +382,7 @@ struct module {
 
         /* symbols that will be GPL-only in the near future. */
         const struct kernel_symbol *gpl_future_syms;
-        const unsigned long *gpl_future_crcs;
+        const s32 *gpl_future_crcs;
         unsigned int num_gpl_future_syms;
 
         /* Exception table */
@@ -523,7 +523,7 @@ struct module *find_module(const char *name);
 
 struct symsearch {
         const struct kernel_symbol *start, *stop;
-        const unsigned long *crcs;
+        const s32 *crcs;
         enum {
                 NOT_GPL_ONLY,
                 GPL_ONLY,
@@ -539,7 +539,7 @@ struct symsearch {
  */
 const struct kernel_symbol *find_symbol(const char *name,
                                         struct module **owner,
-                                        const unsigned long **crc,
+                                        const s32 **crc,
                                         bool gplok,
                                         bool warn);
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9bde9558b596..27914672602d 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -866,11 +866,15 @@ struct netdev_xdp {
  *      of useless work if you return NETDEV_TX_BUSY.
  *      Required; cannot be NULL.
  *
- * netdev_features_t (*ndo_fix_features)(struct net_device *dev,
- *              netdev_features_t features);
- *      Adjusts the requested feature flags according to device-specific
- *      constraints, and returns the resulting flags. Must not modify
- *      the device state.
+ * netdev_features_t (*ndo_features_check)(struct sk_buff *skb,
+ *                                         struct net_device *dev
+ *                                         netdev_features_t features);
+ *      Called by core transmit path to determine if device is capable of
+ *      performing offload operations on a given packet. This is to give
+ *      the device an opportunity to implement any restrictions that cannot
+ *      be otherwise expressed by feature flags. The check is called with
+ *      the set of features that the stack has calculated and it returns
+ *      those the driver believes to be appropriate.
  *
  * u16 (*ndo_select_queue)(struct net_device *dev, struct sk_buff *skb,
  *                         void *accel_priv, select_queue_fallback_t fallback);
@@ -1028,6 +1032,12 @@ struct netdev_xdp {
  *      Called to release previously enslaved netdev.
  *
  *      Feature/offload setting functions.
+ * netdev_features_t (*ndo_fix_features)(struct net_device *dev,
+ *              netdev_features_t features);
+ *      Adjusts the requested feature flags according to device-specific
+ *      constraints, and returns the resulting flags. Must not modify
+ *      the device state.
+ *
  * int (*ndo_set_features)(struct net_device *dev, netdev_features_t features);
  *      Called to update device configuration to new features. Passed
  *      feature set might be less than what was returned by ndo_fix_features()).
@@ -1100,15 +1110,6 @@ struct netdev_xdp {
  *      Callback to use for xmit over the accelerated station. This
  *      is used in place of ndo_start_xmit on accelerated net
  *      devices.
- * netdev_features_t (*ndo_features_check)(struct sk_buff *skb,
- *                                         struct net_device *dev
- *                                         netdev_features_t features);
- *      Called by core transmit path to determine if device is capable of
- *      performing offload operations on a given packet. This is to give
- *      the device an opportunity to implement any restrictions that cannot
- *      be otherwise expressed by feature flags. The check is called with
- *      the set of features that the stack has calculated and it returns
- *      those the driver believes to be appropriate.
  * int (*ndo_set_tx_maxrate)(struct net_device *dev,
  *                           int queue_index, u32 maxrate);
  *      Called when a user wants to set a max-rate limitation of specific
@@ -1510,6 +1511,7 @@ enum netdev_priv_flags {
  *      @max_mtu:       Interface Maximum MTU value
  *      @type:          Interface hardware type
  *      @hard_header_len: Maximum hardware header length.
+ *      @min_header_len:  Minimum hardware header length
  *
  *      @needed_headroom: Extra headroom the hardware may need, but not in all
  *                        cases can this be guaranteed
@@ -1727,6 +1729,7 @@ struct net_device {
         unsigned int            max_mtu;
         unsigned short          type;
         unsigned short          hard_header_len;
+        unsigned short          min_header_len;
 
         unsigned short          needed_headroom;
         unsigned short          needed_tailroom;
@@ -2693,6 +2696,8 @@ static inline bool dev_validate_header(const struct net_device *dev,
 {
         if (likely(len >= dev->hard_header_len))
                 return true;
+        if (len < dev->min_header_len)
+                return false;
 
         if (capable(CAP_SYS_RAWIO)) {
                 memset(ll_header + len, 0, dev->hard_header_len - len);
diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index bca536341d1a..1b1ca04820a3 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -282,7 +282,7 @@ enum nfsstat4 {
 
 static inline bool seqid_mutating_err(u32 err)
 {
-        /* rfc 3530 section 8.1.5: */
+        /* See RFC 7530, section 9.1.7 */
         switch (err) {
         case NFS4ERR_STALE_CLIENTID:
         case NFS4ERR_STALE_STATEID:
@@ -291,6 +291,7 @@ static inline bool seqid_mutating_err(u32 err)
         case NFS4ERR_BADXDR:
         case NFS4ERR_RESOURCE:
         case NFS4ERR_NOFILEHANDLE:
+        case NFS4ERR_MOVED:
                 return false;
         };
         return true;
diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
index 1c7eec09e5eb..3a481a49546e 100644
--- a/include/linux/percpu-refcount.h
+++ b/include/linux/percpu-refcount.h
@@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref)
 static inline bool percpu_ref_tryget(struct percpu_ref *ref)
 {
         unsigned long __percpu *percpu_count;
-        int ret;
+        bool ret;
 
         rcu_read_lock_sched();
 
@@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref)
 static inline bool percpu_ref_tryget_live(struct percpu_ref *ref)
 {
         unsigned long __percpu *percpu_count;
-        int ret = false;
+        bool ret = false;
 
         rcu_read_lock_sched();
 
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 85cc819676e8..333ad11b3dd9 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -216,5 +216,6 @@ void rpc_clnt_xprt_switch_put(struct rpc_clnt *);
 void rpc_clnt_xprt_switch_add_xprt(struct rpc_clnt *, struct rpc_xprt *);
 bool rpc_clnt_xprt_switch_has_addr(struct rpc_clnt *clnt,
                         const struct sockaddr *sap);
+void rpc_cleanup_clids(void);
 #endif /* __KERNEL__ */
 #endif /* _LINUX_SUNRPC_CLNT_H */
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index 3ebb168b9afc..a34b141f125f 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -309,6 +309,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
         }
 
         for (opt_iter = 6; opt_iter < opt_len;) {
+                if (opt_iter + 1 == opt_len) {
+                        err_offset = opt_iter;
+                        goto out;
+                }
                 tag_len = opt[opt_iter + 1];
                 if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) {
                         err_offset = opt_iter + 1;
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 7afe991e900e..dbf0abba33b8 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -776,6 +776,11 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
 {
         u32 hash;
 
+        /* @flowlabel may include more than a flow label, eg, the traffic class.
+         * Here we want only the flow label value.
+         */
+        flowlabel &= IPV6_FLOWLABEL_MASK;
+
         if (flowlabel ||
             net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF ||
             (!autolabel &&
diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index 73dd87647460..0388b9c5f5e2 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -178,7 +178,10 @@ static inline int lwtunnel_valid_encap_type(u16 encap_type)
 }
 static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len)
 {
-        return -EOPNOTSUPP;
+        /* return 0 since we are not walking attr looking for
+         * RTA_ENCAP_TYPE attribute on nexthops.
+         */
+        return 0;
 }
 
 static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
diff --git a/include/net/sock.h b/include/net/sock.h
index f0e867f58722..c4f5e6fca17c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2006,7 +2006,9 @@ void sk_reset_timer(struct sock *sk, struct timer_list *timer,
 void sk_stop_timer(struct sock *sk, struct timer_list *timer);
 
 int __sk_queue_drop_skb(struct sock *sk, struct sk_buff *skb,
-                        unsigned int flags);
+                        unsigned int flags,
+                        void (*destructor)(struct sock *sk,
+                                           struct sk_buff *skb));
 int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 
diff --git a/include/soc/arc/mcip.h b/include/soc/arc/mcip.h
index 6902c2a8bd23..4b6b489a8d7c 100644
--- a/include/soc/arc/mcip.h
+++ b/include/soc/arc/mcip.h
@@ -55,17 +55,17 @@ struct mcip_cmd {
 
 struct mcip_bcr {
 #ifdef CONFIG_CPU_BIG_ENDIAN
-                unsigned int pad3:8,
-                             idu:1, llm:1, num_cores:6,
-                             iocoh:1,  gfrc:1, dbg:1, pad2:1,
-                             msg:1, sem:1, ipi:1, pad:1,
+                unsigned int pad4:6, pw_dom:1, pad3:1,
+                             idu:1, pad2:1, num_cores:6,
+                             pad:1,  gfrc:1, dbg:1, pw:1,
+                             msg:1, sem:1, ipi:1, slv:1,
                              ver:8;
 #else
                 unsigned int ver:8,
-                             pad:1, ipi:1, sem:1, msg:1,
-                             pad2:1, dbg:1, gfrc:1, iocoh:1,
-                             num_cores:6, llm:1, idu:1,
-                             pad3:8;
+                             slv:1, ipi:1, sem:1, msg:1,
+                             pw:1, dbg:1, gfrc:1, pad:1,
+                             num_cores:6, pad2:1, idu:1,
+                             pad3:1, pw_dom:1, pad4:6;
 #endif
 };
 
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 43edf82e54ff..da854fb4530f 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -538,6 +538,7 @@ struct se_node_acl {
         char                    initiatorname[TRANSPORT_IQN_LEN];
         /* Used to signal demo mode created ACL, disabled by default */
         bool                    dynamic_node_acl;
+        bool                    dynamic_stop;
         u32                     queue_depth;
         u32                     acl_index;
         enum target_prot_type   saved_prot_type;
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index f0db7788f887..3dc91a46e8b8 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1384,6 +1384,8 @@ enum ethtool_link_mode_bit_indices {
         ETHTOOL_LINK_MODE_10000baseLR_Full_BIT  = 44,
         ETHTOOL_LINK_MODE_10000baseLRM_Full_BIT = 45,
         ETHTOOL_LINK_MODE_10000baseER_Full_BIT  = 46,
+        ETHTOOL_LINK_MODE_2500baseT_Full_BIT    = 47,
+        ETHTOOL_LINK_MODE_5000baseT_Full_BIT    = 48,
 
 
         /* Last allowed bit for __ETHTOOL_LINK_MODE_LEGACY_MASK is bit
@@ -1393,7 +1395,7 @@ enum ethtool_link_mode_bit_indices {
          */
 
         __ETHTOOL_LINK_MODE_LAST
-          = ETHTOOL_LINK_MODE_10000baseER_Full_BIT,
+          = ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
 };
 
 #define __ETHTOOL_LINK_MODE_LEGACY_MASK(base_name)      \
diff --git a/include/uapi/linux/seg6.h b/include/uapi/linux/seg6.h
index c396a8052f73..052799e4d751 100644
--- a/include/uapi/linux/seg6.h
+++ b/include/uapi/linux/seg6.h
@@ -23,14 +23,12 @@ struct ipv6_sr_hdr {
         __u8    type;
         __u8    segments_left;
         __u8    first_segment;
-        __u8    flag_1;
-        __u8    flag_2;
-        __u8    reserved;
+        __u8    flags;
+        __u16   reserved;
 
         struct in6_addr segments[0];
 };
 
-#define SR6_FLAG1_CLEANUP       (1 << 7)
 #define SR6_FLAG1_PROTECTED     (1 << 6)
 #define SR6_FLAG1_OAM           (1 << 5)
 #define SR6_FLAG1_ALERT         (1 << 4)
@@ -42,8 +40,7 @@ struct ipv6_sr_hdr {
 #define SR6_TLV_PADDING         4
 #define SR6_TLV_HMAC            5
 
-#define sr_has_cleanup(srh) ((srh)->flag_1 & SR6_FLAG1_CLEANUP)
-#define sr_has_hmac(srh) ((srh)->flag_1 & SR6_FLAG1_HMAC)
+#define sr_has_hmac(srh) ((srh)->flags & SR6_FLAG1_HMAC)
 
 struct sr6_tlv {
         __u8 type;
diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
index dfdfe4e92d31..f4f87cff6dc6 100644
--- a/include/uapi/rdma/ib_user_verbs.h
+++ b/include/uapi/rdma/ib_user_verbs.h
@@ -37,7 +37,6 @@
 #define IB_USER_VERBS_H
 
 #include <linux/types.h>
-#include <rdma/ib_verbs.h>
 
 /*
  * Increment this value if any changes that break userspace ABI
@@ -548,11 +547,17 @@ enum {
 };
 
 enum {
-        IB_USER_LEGACY_LAST_QP_ATTR_MASK = IB_QP_DEST_QPN
+        /*
+         * This value is equal to IB_QP_DEST_QPN.
+         */
+        IB_USER_LEGACY_LAST_QP_ATTR_MASK = 1ULL << 20,
 };
 
 enum {
-        IB_USER_LAST_QP_ATTR_MASK = IB_QP_RATE_LIMIT
+        /*
+         * This value is equal to IB_QP_RATE_LIMIT.
+         */
+        IB_USER_LAST_QP_ATTR_MASK = 1ULL << 25,
 };
 
 struct ib_uverbs_ex_create_qp {
diff --git a/init/Kconfig b/init/Kconfig
index e1a937348a3e..4dd8bd232a1d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1987,6 +1987,10 @@ config MODVERSIONS
           make them incompatible with the kernel you are running.  If
           unsure, say N.
 
+config MODULE_REL_CRCS
+        bool
+        depends on MODVERSIONS
+
 config MODULE_SRCVERSION_ALL
         bool "Source checksum for all modules"
         help
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2ee9ec3051b2..688dd02af985 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -5221,6 +5221,11 @@ err_free_css:
         return ERR_PTR(err);
 }
 
+/*
+ * The returned cgroup is fully initialized including its control mask, but
+ * it isn't associated with its kernfs_node and doesn't have the control
+ * mask applied.
+ */
 static struct cgroup *cgroup_create(struct cgroup *parent)
 {
         struct cgroup_root *root = parent->root;
@@ -5288,11 +5293,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
 
         cgroup_propagate_control(cgrp);
 
-        /* @cgrp doesn't have dir yet so the following will only create csses */
-        ret = cgroup_apply_control_enable(cgrp);
-        if (ret)
-                goto out_destroy;
-
         return cgrp;
 
 out_cancel_ref:
@@ -5300,9 +5300,6 @@ out_cancel_ref:
 out_free_cgrp:
         kfree(cgrp);
         return ERR_PTR(ret);
-out_destroy:
-        cgroup_destroy_locked(cgrp);
-        return ERR_PTR(ret);
 }
 
 static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 110b38a58493..e235bb991bdd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1469,7 +1469,6 @@ ctx_group_list(struct perf_event *event, struct perf_event_context *ctx)
 static void
 list_add_event(struct perf_event *event, struct perf_event_context *ctx)
 {
-
         lockdep_assert_held(&ctx->lock);
 
         WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
@@ -1624,6 +1623,8 @@ static void perf_group_attach(struct perf_event *event)
 {
         struct perf_event *group_leader = event->group_leader, *pos;
 
+        lockdep_assert_held(&event->ctx->lock);
+
         /*
          * We can have double attach due to group movement in perf_event_open.
          */
@@ -1697,6 +1698,8 @@ static void perf_group_detach(struct perf_event *event)
         struct perf_event *sibling, *tmp;
         struct list_head *list = NULL;
 
+        lockdep_assert_held(&event->ctx->lock);
+
         /*
          * We can have double detach due to exit/hot-unplug + close.
          */
@@ -1895,9 +1898,29 @@ __perf_remove_from_context(struct perf_event *event,
  */
 static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
 {
-        lockdep_assert_held(&event->ctx->mutex);
+        struct perf_event_context *ctx = event->ctx;
+
+        lockdep_assert_held(&ctx->mutex);
 
         event_function_call(event, __perf_remove_from_context, (void *)flags);
+
+        /*
+         * The above event_function_call() can NO-OP when it hits
+         * TASK_TOMBSTONE. In that case we must already have been detached
+         * from the context (by perf_event_exit_event()) but the grouping
+         * might still be in-tact.
+         */
+        WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
+        if ((flags & DETACH_GROUP) &&
+            (event->attach_state & PERF_ATTACH_GROUP)) {
+                /*
+                 * Since in that case we cannot possibly be scheduled, simply
+                 * detach now.
+                 */
+                raw_spin_lock_irq(&ctx->lock);
+                perf_group_detach(event);
+                raw_spin_unlock_irq(&ctx->lock);
+        }
 }
 
 /*
@@ -3464,14 +3487,15 @@ struct perf_read_data {
         int ret;
 };
 
-static int find_cpu_to_read(struct perf_event *event, int local_cpu)
+static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
 {
-        int event_cpu = event->oncpu;
         u16 local_pkg, event_pkg;
 
         if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) {
-                event_pkg =  topology_physical_package_id(event_cpu);
-                local_pkg =  topology_physical_package_id(local_cpu);
+                int local_cpu = smp_processor_id();
+
+                event_pkg = topology_physical_package_id(event_cpu);
+                local_pkg = topology_physical_package_id(local_cpu);
 
                 if (event_pkg == local_pkg)
                         return local_cpu;
@@ -3601,7 +3625,7 @@ u64 perf_event_read_local(struct perf_event *event)
 
 static int perf_event_read(struct perf_event *event, bool group)
 {
-        int ret = 0, cpu_to_read, local_cpu;
+        int event_cpu, ret = 0;
 
         /*
          * If event is enabled and currently active on a CPU, update the
@@ -3614,21 +3638,25 @@ static int perf_event_read(struct perf_event *event, bool group)
                         .ret = 0,
                 };
 
-                local_cpu = get_cpu();
-                cpu_to_read = find_cpu_to_read(event, local_cpu);
-                put_cpu();
+                event_cpu = READ_ONCE(event->oncpu);
+                if ((unsigned)event_cpu >= nr_cpu_ids)
+                        return 0;
+
+                preempt_disable();
+                event_cpu = __perf_event_read_cpu(event, event_cpu);
 
                 /*
                  * Purposely ignore the smp_call_function_single() return
                  * value.
                  *
-                 * If event->oncpu isn't a valid CPU it means the event got
+                 * If event_cpu isn't a valid CPU it means the event got
                  * scheduled out and that will have updated the event count.
                  *
                  * Therefore, either way, we'll have an up-to-date event count
                  * after this.
                  */
-                (void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
+                (void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
+                preempt_enable();
                 ret = data.ret;
         } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
                 struct perf_event_context *ctx = event->ctx;
@@ -6609,6 +6637,27 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
         char *buf = NULL;
         char *name;
 
+        if (vma->vm_flags & VM_READ)
+                prot |= PROT_READ;
+        if (vma->vm_flags & VM_WRITE)
+                prot |= PROT_WRITE;
+        if (vma->vm_flags & VM_EXEC)
+                prot |= PROT_EXEC;
+
+        if (vma->vm_flags & VM_MAYSHARE)
+                flags = MAP_SHARED;
+        else
+                flags = MAP_PRIVATE;
+
+        if (vma->vm_flags & VM_DENYWRITE)
+                flags |= MAP_DENYWRITE;
+        if (vma->vm_flags & VM_MAYEXEC)
+                flags |= MAP_EXECUTABLE;
+        if (vma->vm_flags & VM_LOCKED)
+                flags |= MAP_LOCKED;
+        if (vma->vm_flags & VM_HUGETLB)
+                flags |= MAP_HUGETLB;
+
         if (file) {
                 struct inode *inode;
                 dev_t dev;
@@ -6635,27 +6684,6 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
                 maj = MAJOR(dev);
                 min = MINOR(dev);
 
-                if (vma->vm_flags & VM_READ)
-                        prot |= PROT_READ;
-                if (vma->vm_flags & VM_WRITE)
-                        prot |= PROT_WRITE;
-                if (vma->vm_flags & VM_EXEC)
-                        prot |= PROT_EXEC;
-
-                if (vma->vm_flags & VM_MAYSHARE)
-                        flags = MAP_SHARED;
-                else
-                        flags = MAP_PRIVATE;
-
-                if (vma->vm_flags & VM_DENYWRITE)
-                        flags |= MAP_DENYWRITE;
-                if (vma->vm_flags & VM_MAYEXEC)
-                        flags |= MAP_EXECUTABLE;
-                if (vma->vm_flags & VM_LOCKED)
-                        flags |= MAP_LOCKED;
-                if (vma->vm_flags & VM_HUGETLB)
-                        flags |= MAP_HUGETLB;
-
                 goto got_name;
         } else {
                 if (vma->vm_ops && vma->vm_ops->name) {
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 8c0a0ae43521..b59e6768c5e9 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1346,6 +1346,30 @@ void irq_domain_free_irqs_parent(struct irq_domain *domain,
 }
 EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
 
+static void __irq_domain_activate_irq(struct irq_data *irq_data)
+{
+        if (irq_data && irq_data->domain) {
+                struct irq_domain *domain = irq_data->domain;
+
+                if (irq_data->parent_data)
+                        __irq_domain_activate_irq(irq_data->parent_data);
+                if (domain->ops->activate)
+                        domain->ops->activate(domain, irq_data);
+        }
+}
+
+static void __irq_domain_deactivate_irq(struct irq_data *irq_data)
+{
+        if (irq_data && irq_data->domain) {
+                struct irq_domain *domain = irq_data->domain;
+
+                if (domain->ops->deactivate)
+                        domain->ops->deactivate(domain, irq_data);
+                if (irq_data->parent_data)
+                        __irq_domain_deactivate_irq(irq_data->parent_data);
+        }
+}
+
 /**
  * irq_domain_activate_irq - Call domain_ops->activate recursively to activate
  *                           interrupt
@@ -1356,13 +1380,9 @@ EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
  */
 void irq_domain_activate_irq(struct irq_data *irq_data)
 {
-        if (irq_data && irq_data->domain) {
-                struct irq_domain *domain = irq_data->domain;
-
-                if (irq_data->parent_data)
-                        irq_domain_activate_irq(irq_data->parent_data);
-                if (domain->ops->activate)
-                        domain->ops->activate(domain, irq_data);
+        if (!irqd_is_activated(irq_data)) {
+                __irq_domain_activate_irq(irq_data);
+                irqd_set_activated(irq_data);
         }
 }
 
@@ -1376,13 +1396,9 @@ void irq_domain_activate_irq(struct irq_data *irq_data)
  */
 void irq_domain_deactivate_irq(struct irq_data *irq_data)
 {
-        if (irq_data && irq_data->domain) {
-                struct irq_domain *domain = irq_data->domain;
-
-                if (domain->ops->deactivate)
-                        domain->ops->deactivate(domain, irq_data);
-                if (irq_data->parent_data)
-                        irq_domain_deactivate_irq(irq_data->parent_data);
+        if (irqd_is_activated(irq_data)) {
+                __irq_domain_deactivate_irq(irq_data);
+                irqd_clr_activated(irq_data);
         }
 }
 
diff --git a/kernel/module.c b/kernel/module.c
index 38d4270925d4..3d8f126208e3 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -389,16 +389,16 @@ extern const struct kernel_symbol __start___ksymtab_gpl[];
 extern const struct kernel_symbol __stop___ksymtab_gpl[];
 extern const struct kernel_symbol __start___ksymtab_gpl_future[];
 extern const struct kernel_symbol __stop___ksymtab_gpl_future[];
-extern const unsigned long __start___kcrctab[];
-extern const unsigned long __start___kcrctab_gpl[];
-extern const unsigned long __start___kcrctab_gpl_future[];
+extern const s32 __start___kcrctab[];
+extern const s32 __start___kcrctab_gpl[];
+extern const s32 __start___kcrctab_gpl_future[];
 #ifdef CONFIG_UNUSED_SYMBOLS
 extern const struct kernel_symbol __start___ksymtab_unused[];
 extern const struct kernel_symbol __stop___ksymtab_unused[];
 extern const struct kernel_symbol __start___ksymtab_unused_gpl[];
 extern const struct kernel_symbol __stop___ksymtab_unused_gpl[];
-extern const unsigned long __start___kcrctab_unused[];
-extern const unsigned long __start___kcrctab_unused_gpl[];
+extern const s32 __start___kcrctab_unused[];
+extern const s32 __start___kcrctab_unused_gpl[];
 #endif
 
 #ifndef CONFIG_MODVERSIONS
@@ -497,7 +497,7 @@ struct find_symbol_arg {
 
         /* Output */
         struct module *owner;
-        const unsigned long *crc;
+        const s32 *crc;
         const struct kernel_symbol *sym;
 };
 
@@ -563,7 +563,7 @@ static bool find_symbol_in_section(const struct symsearch *syms,
  * (optional) module which owns it.  Needs preempt disabled or module_mutex. */
 const struct kernel_symbol *find_symbol(const char *name,
                                         struct module **owner,
-                                        const unsigned long **crc,
+                                        const s32 **crc,
                                         bool gplok,
                                         bool warn)
 {
@@ -1249,23 +1249,17 @@ static int try_to_force_load(struct module *mod, const char *reason)
 }
 
 #ifdef CONFIG_MODVERSIONS
-/* If the arch applies (non-zero) relocations to kernel kcrctab, unapply it. */
-static unsigned long maybe_relocated(unsigned long crc,
-                                     const struct module *crc_owner)
+
+static u32 resolve_rel_crc(const s32 *crc)
 {
-#ifdef ARCH_RELOCATES_KCRCTAB
-        if (crc_owner == NULL)
-                return crc - (unsigned long)reloc_start;
-#endif
-        return crc;
+        return *(u32 *)((void *)crc + *crc);
 }
 
 static int check_version(Elf_Shdr *sechdrs,
                          unsigned int versindex,
                          const char *symname,
                          struct module *mod,
-                         const unsigned long *crc,
-                         const struct module *crc_owner)
+                         const s32 *crc)
 {
         unsigned int i, num_versions;
         struct modversion_info *versions;
@@ -1283,13 +1277,19 @@ static int check_version(Elf_Shdr *sechdrs,
                 / sizeof(struct modversion_info);
 
         for (i = 0; i < num_versions; i++) {
+                u32 crcval;
+
                 if (strcmp(versions[i].name, symname) != 0)
                         continue;
 
-                if (versions[i].crc == maybe_relocated(*crc, crc_owner))
+                if (IS_ENABLED(CONFIG_MODULE_REL_CRCS))
+                        crcval = resolve_rel_crc(crc);
+                else
+                        crcval = *crc;
+                if (versions[i].crc == crcval)
                         return 1;
-                pr_debug("Found checksum %lX vs module %lX\n",
-                       maybe_relocated(*crc, crc_owner), versions[i].crc);
+                pr_debug("Found checksum %X vs module %lX\n",
+                         crcval, versions[i].crc);
                 goto bad_version;
         }
 
@@ -1307,7 +1307,7 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
                                           unsigned int versindex,
                                           struct module *mod)
 {
-        const unsigned long *crc;
+        const s32 *crc;
 
         /*
          * Since this should be found in kernel (which can't be removed), no
@@ -1321,8 +1321,7 @@ static inline int check_modstruct_version(Elf_Shdr *sechdrs,
         }
         preempt_enable();
         return check_version(sechdrs, versindex,
-                             VMLINUX_SYMBOL_STR(module_layout), mod, crc,
-                             NULL);
+                             VMLINUX_SYMBOL_STR(module_layout), mod, crc);
 }
 
 /* First part is kernel version, which we ignore if module has crcs. */
@@ -1340,8 +1339,7 @@ static inline int check_version(Elf_Shdr *sechdrs,
                                 unsigned int versindex,
                                 const char *symname,
                                 struct module *mod,
-                                const unsigned long *crc,
-                                const struct module *crc_owner)
+                                const s32 *crc)
 {
         return 1;
 }
@@ -1368,7 +1366,7 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
 {
         struct module *owner;
         const struct kernel_symbol *sym;
-        const unsigned long *crc;
+        const s32 *crc;
         int err;
 
         /*
@@ -1383,8 +1381,7 @@ static const struct kernel_symbol *resolve_symbol(struct module *mod,
         if (!sym)
                 goto unlock;
 
-        if (!check_version(info->sechdrs, info->index.vers, name, mod, crc,
-                           owner)) {
+        if (!check_version(info->sechdrs, info->index.vers, name, mod, crc)) {
                 sym = ERR_PTR(-EINVAL);
                 goto getname;
         }
diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
index b6e4c16377c7..9c15a9124e83 100644
--- a/kernel/stacktrace.c
+++ b/kernel/stacktrace.c
@@ -18,10 +18,8 @@ void print_stack_trace(struct stack_trace *trace, int spaces)
         if (WARN_ON(!trace->entries))
                 return;
 
-        for (i = 0; i < trace->nr_entries; i++) {
-                printk("%*c", 1 + spaces, ' ');
-                print_ip_sym(trace->entries[i]);
-        }
+        for (i = 0; i < trace->nr_entries; i++)
+                printk("%*c%pS\n", 1 + spaces, ' ', (void *)trace->entries[i]);
 }
 EXPORT_SYMBOL_GPL(print_stack_trace);
 
@@ -29,7 +27,6 @@ int snprint_stack_trace(char *buf, size_t size,
                         struct stack_trace *trace, int spaces)
 {
         int i;
-        unsigned long ip;
         int generated;
         int total = 0;
 
@@ -37,9 +34,8 @@ int snprint_stack_trace(char *buf, size_t size,
                 return 0;
 
         for (i = 0; i < trace->nr_entries; i++) {
-                ip = trace->entries[i];
-                generated = snprintf(buf, size, "%*c[<%p>] %pS\n",
-                                1 + spaces, ' ', (void *) ip, (void *) ip);
+                generated = snprintf(buf, size, "%*c%pS\n", 1 + spaces, ' ',
+                                     (void *)trace->entries[i]);
 
                 total += generated;
 
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 74e0388cc88d..fc6f740d0277 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -725,6 +725,11 @@ static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts,
                  */
                 if (delta == 0) {
                         tick_nohz_restart(ts, now);
+                        /*
+                         * Make sure next tick stop doesn't get fooled by past
+                         * clock deadline
+                         */
+                        ts->next_tick = 0;
                         goto out;
                 }
         }
diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
index 775569ec50d0..af344a1bf0d0 100644
--- a/kernel/trace/trace_hwlat.c
+++ b/kernel/trace/trace_hwlat.c
@@ -266,7 +266,7 @@ out:
 static struct cpumask save_cpumask;
 static bool disable_migrate;
 
-static void move_to_next_cpu(void)
+static void move_to_next_cpu(bool initmask)
 {
         static struct cpumask *current_mask;
         int next_cpu;
@@ -275,7 +275,7 @@ static void move_to_next_cpu(void)
                 return;
 
         /* Just pick the first CPU on first iteration */
-        if (!current_mask) {
+        if (initmask) {
                 current_mask = &save_cpumask;
                 get_online_cpus();
                 cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
@@ -330,10 +330,12 @@ static void move_to_next_cpu(void)
 static int kthread_fn(void *data)
 {
         u64 interval;
+        bool initmask = true;
 
         while (!kthread_should_stop()) {
 
-                move_to_next_cpu();
+                move_to_next_cpu(initmask);
+                initmask = false;
 
                 local_irq_disable();
                 get_sample();
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index a133ecd741e4..7ad9e53ad174 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1372,7 +1372,7 @@ kprobe_trace_selftest_target(int a1, int a2, int a3, int a4, int a5, int a6)
         return a1 + a2 + a3 + a4 + a5 + a6;
 }
 
-static struct __init trace_event_file *
+static __init struct trace_event_file *
 find_trace_probe_file(struct trace_kprobe *tk, struct trace_array *tr)
 {
         struct trace_event_file *file;
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 4bbd38ec3788..95c6336fc2b3 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -227,11 +227,10 @@ static __init int user_namespace_sysctl_init(void)
          * properly.
          */
         user_header = register_sysctl("user", empty);
+        kmemleak_ignore(user_header);
         BUG_ON(!user_header);
         BUG_ON(!setup_userns_sysctls(&init_user_ns));
 #endif
         return 0;
 }
 subsys_initcall(user_namespace_sysctl_init);
-
-
diff --git a/mm/filemap.c b/mm/filemap.c
index b772a33ef640..3f9afded581b 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1791,6 +1791,11 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
 
                 cond_resched();
 find_page:
+                if (fatal_signal_pending(current)) {
+                        error = -EINTR;
+                        goto out;
+                }
+
                 page = find_get_page(mapping, index);
                 if (!page) {
                         page_cache_sync_readahead(mapping,
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index b82b3e215157..f479365530b6 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -13,6 +13,7 @@
  *
  */
 
+#include <linux/ftrace.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
@@ -300,6 +301,8 @@ void kasan_report(unsigned long addr, size_t size,
         if (likely(!kasan_report_enabled()))
                 return;
 
+        disable_trace_on_warning();
+
         info.access_addr = (void *)addr;
         info.access_size = size;
         info.is_write = is_write;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index ca2723d47338..b8c11e063ff0 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1483,17 +1483,20 @@ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
 }
 
 /*
- * Confirm all pages in a range [start, end) is belongs to the same zone.
+ * Confirm all pages in a range [start, end) belong to the same zone.
+ * When true, return its valid [start, end).
  */
-int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
+                         unsigned long *valid_start, unsigned long *valid_end)
 {
         unsigned long pfn, sec_end_pfn;
+        unsigned long start, end;
         struct zone *zone = NULL;
         struct page *page;
         int i;
-        for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
+        for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1);
              pfn < end_pfn;
-             pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
+             pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) {
                 /* Make sure the memory section is present first */
                 if (!present_section_nr(pfn_to_section_nr(pfn)))
                         continue;
@@ -1509,10 +1512,20 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
                         page = pfn_to_page(pfn + i);
                         if (zone && page_zone(page) != zone)
                                 return 0;
+                        if (!zone)
+                                start = pfn + i;
                         zone = page_zone(page);
+                        end = pfn + MAX_ORDER_NR_PAGES;
                 }
         }
-        return 1;
+
+        if (zone) {
+                *valid_start = start;
+                *valid_end = end;
+                return 1;
+        } else {
+                return 0;
+        }
 }
 
 /*
@@ -1839,6 +1852,7 @@ static int __ref __offline_pages(unsigned long start_pfn,
         long offlined_pages;
         int ret, drain, retry_max, node;
         unsigned long flags;
+        unsigned long valid_start, valid_end;
         struct zone *zone;
         struct memory_notify arg;
 
@@ -1849,10 +1863,10 @@ static int __ref __offline_pages(unsigned long start_pfn,
                 return -EINVAL;
         /* This makes hotplug much easier...and readable.
            we assume this for now. .*/
-        if (!test_pages_in_a_zone(start_pfn, end_pfn))
+        if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
                 return -EINVAL;
 
-        zone = page_zone(pfn_to_page(start_pfn));
+        zone = page_zone(pfn_to_page(valid_start));
         node = zone_to_nid(zone);
         nr_pages = end_pfn - start_pfn;
 
diff --git a/mm/shmem.c b/mm/shmem.c
index bb53285a1d99..3a7587a0314d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -415,6 +415,7 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
                 struct shrink_control *sc, unsigned long nr_to_split)
 {
         LIST_HEAD(list), *pos, *next;
+        LIST_HEAD(to_remove);
         struct inode *inode;
         struct shmem_inode_info *info;
         struct page *page;
@@ -441,9 +442,8 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
                 /* Check if there's anything to gain */
                 if (round_up(inode->i_size, PAGE_SIZE) ==
                                 round_up(inode->i_size, HPAGE_PMD_SIZE)) {
-                        list_del_init(&info->shrinklist);
+                        list_move(&info->shrinklist, &to_remove);
                         removed++;
-                        iput(inode);
                         goto next;
                 }
 
@@ -454,6 +454,13 @@ next:
         }
         spin_unlock(&sbinfo->shrinklist_lock);
 
+        list_for_each_safe(pos, next, &to_remove) {
+                info = list_entry(pos, struct shmem_inode_info, shrinklist);
+                inode = &info->vfs_inode;
+                list_del_init(&info->shrinklist);
+                iput(inode);
+        }
+
         list_for_each_safe(pos, next, &list) {
                 int ret;
 
diff --git a/mm/slub.c b/mm/slub.c
index 7aa6f433f4de..7ec0a965c6a3 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1422,6 +1422,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
         int err;
         unsigned long i, count = oo_objects(s->oo);
 
+        /* Bailout if already initialised */
+        if (s->random_seq)
+                return 0;
+
         err = cache_random_seq_create(s, count, GFP_KERNEL);
         if (err) {
                 pr_err("SLUB: Unable to initialize free list for %s\n",
diff --git a/mm/zswap.c b/mm/zswap.c
index 067a0d62f318..cabf09e0128b 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -78,7 +78,13 @@ static u64 zswap_duplicate_entry;
 
 /* Enable/disable zswap (disabled by default) */
 static bool zswap_enabled;
-module_param_named(enabled, zswap_enabled, bool, 0644);
+static int zswap_enabled_param_set(const char *,
+                                   const struct kernel_param *);
+static struct kernel_param_ops zswap_enabled_param_ops = {
+        .set =          zswap_enabled_param_set,
+        .get =          param_get_bool,
+};
+module_param_cb(enabled, &zswap_enabled_param_ops, &zswap_enabled, 0644);
 
 /* Crypto compressor to use */
 #define ZSWAP_COMPRESSOR_DEFAULT "lzo"
@@ -176,6 +182,9 @@ static atomic_t zswap_pools_count = ATOMIC_INIT(0);
 /* used by param callback function */
 static bool zswap_init_started;
 
+/* fatal error during init */
+static bool zswap_init_failed;
+
 /*********************************
 * helpers and fwd declarations
 **********************************/
@@ -624,6 +633,11 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp,
         char *s = strstrip((char *)val);
         int ret;
 
+        if (zswap_init_failed) {
+                pr_err("can't set param, initialization failed\n");
+                return -ENODEV;
+        }
+
         /* no change required */
         if (!strcmp(s, *(char **)kp->arg))
                 return 0;
@@ -703,6 +717,17 @@ static int zswap_zpool_param_set(const char *val,
         return __zswap_param_set(val, kp, NULL, zswap_compressor);
 }
 
+static int zswap_enabled_param_set(const char *val,
+                                   const struct kernel_param *kp)
+{
+        if (zswap_init_failed) {
+                pr_err("can't enable, initialization failed\n");
+                return -ENODEV;
+        }
+
+        return param_set_bool(val, kp);
+}
+
 /*********************************
 * writeback code
 **********************************/
@@ -1201,6 +1226,9 @@ hp_fail:
 dstmem_fail:
         zswap_entry_cache_destroy();
 cache_fail:
+        /* if built-in, we aren't unloaded on failure; don't allow use */
+        zswap_init_failed = true;
+        zswap_enabled = false;
         return -ENOMEM;
 }
 /* must be late so crypto has time to come up */
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 1108079d934f..5488e4a6ccd0 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -445,6 +445,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
  * @func: callback function on filter match
  * @data: returned parameter for callback function
  * @ident: string for calling module identification
+ * @sk: socket pointer (might be NULL)
  *
  * Description:
  *  Invokes the callback function with the received sk_buff and the given
@@ -468,7 +469,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
  */
 int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
                     void (*func)(struct sk_buff *, void *), void *data,
-                    char *ident)
+                    char *ident, struct sock *sk)
 {
         struct receiver *r;
         struct hlist_head *rl;
@@ -496,6 +497,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
                 r->func    = func;
                 r->data    = data;
                 r->ident   = ident;
+                r->sk      = sk;
 
                 hlist_add_head_rcu(&r->list, rl);
                 d->entries++;
@@ -520,8 +522,11 @@ EXPORT_SYMBOL(can_rx_register);
 static void can_rx_delete_receiver(struct rcu_head *rp)
 {
         struct receiver *r = container_of(rp, struct receiver, rcu);
+        struct sock *sk = r->sk;
 
         kmem_cache_free(rcv_cache, r);
+        if (sk)
+                sock_put(sk);
 }
 
 /**
@@ -596,8 +601,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
         spin_unlock(&can_rcvlists_lock);
 
         /* schedule the receiver item for deletion */
-        if (r)
+        if (r) {
+                if (r->sk)
+                        sock_hold(r->sk);
                 call_rcu(&r->rcu, can_rx_delete_receiver);
+        }
 }
 EXPORT_SYMBOL(can_rx_unregister);
 
diff --git a/net/can/af_can.h b/net/can/af_can.h
index fca0fe9fc45a..b86f5129e838 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -50,13 +50,14 @@
 
 struct receiver {
         struct hlist_node list;
-        struct rcu_head rcu;
         canid_t can_id;
         canid_t mask;
         unsigned long matches;
         void (*func)(struct sk_buff *, void *);
         void *data;
         char *ident;
+        struct sock *sk;
+        struct rcu_head rcu;
 };
 
 #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 21ac75390e3d..95d13b233c65 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -734,14 +734,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
 
 static void bcm_remove_op(struct bcm_op *op)
 {
-        hrtimer_cancel(&op->timer);
-        hrtimer_cancel(&op->thrtimer);
-
-        if (op->tsklet.func)
-                tasklet_kill(&op->tsklet);
+        if (op->tsklet.func) {
+                while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
+                       test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
+                       hrtimer_active(&op->timer)) {
+                        hrtimer_cancel(&op->timer);
+                        tasklet_kill(&op->tsklet);
+                }
+        }
 
-        if (op->thrtsklet.func)
-                tasklet_kill(&op->thrtsklet);
+        if (op->thrtsklet.func) {
+                while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
+                       test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
+                       hrtimer_active(&op->thrtimer)) {
+                        hrtimer_cancel(&op->thrtimer);
+                        tasklet_kill(&op->thrtsklet);
+                }
+        }
 
         if ((op->frames) && (op->frames != &op->sframe))
                 kfree(op->frames);
@@ -1216,7 +1225,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                                 err = can_rx_register(dev, op->can_id,
                                                       REGMASK(op->can_id),
                                                       bcm_rx_handler, op,
-                                                      "bcm");
+                                                      "bcm", sk);
 
                                 op->rx_reg_dev = dev;
                                 dev_put(dev);
@@ -1225,7 +1234,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 } else
                         err = can_rx_register(NULL, op->can_id,
                                               REGMASK(op->can_id),
-                                              bcm_rx_handler, op, "bcm");
+                                              bcm_rx_handler, op, "bcm", sk);
                 if (err) {
                         /* this bcm rx op is broken -> remove it */
                         list_del(&op->list);
diff --git a/net/can/gw.c b/net/can/gw.c
index a54ab0c82104..7056a1a2bb70 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -442,7 +442,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj)
 {
         return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id,
                                gwj->ccgw.filter.can_mask, can_can_gw_rcv,
-                               gwj, "gw");
+                               gwj, "gw", NULL);
 }
 
 static inline void cgw_unregister_filter(struct cgw_job *gwj)
diff --git a/net/can/raw.c b/net/can/raw.c
index b075f028d7e2..6dc546a06673 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -190,7 +190,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,
         for (i = 0; i < count; i++) {
                 err = can_rx_register(dev, filter[i].can_id,
                                       filter[i].can_mask,
-                                      raw_rcv, sk, "raw");
+                                      raw_rcv, sk, "raw", sk);
                 if (err) {
                         /* clean up successfully registered filters */
                         while (--i >= 0)
@@ -211,7 +211,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,
 
         if (err_mask)
                 err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG,
-                                      raw_rcv, sk, "raw");
+                                      raw_rcv, sk, "raw", sk);
 
         return err;
 }
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 662bea587165..ea633342ab0d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -332,7 +332,9 @@ void __skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb, int len)
 EXPORT_SYMBOL(__skb_free_datagram_locked);
 
 int __sk_queue_drop_skb(struct sock *sk, struct sk_buff *skb,
-                        unsigned int flags)
+                        unsigned int flags,
+                        void (*destructor)(struct sock *sk,
+                                           struct sk_buff *skb))
 {
         int err = 0;
 
@@ -342,6 +344,8 @@ int __sk_queue_drop_skb(struct sock *sk, struct sk_buff *skb,
                 if (skb == skb_peek(&sk->sk_receive_queue)) {
                         __skb_unlink(skb, &sk->sk_receive_queue);
                         atomic_dec(&skb->users);
+                        if (destructor)
+                                destructor(sk, skb);
                         err = 0;
                 }
                 spin_unlock_bh(&sk->sk_receive_queue.lock);
@@ -375,7 +379,7 @@ EXPORT_SYMBOL(__sk_queue_drop_skb);
 
 int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
 {
-        int err = __sk_queue_drop_skb(sk, skb, flags);
+        int err = __sk_queue_drop_skb(sk, skb, flags, NULL);
 
         kfree_skb(skb);
         sk_mem_reclaim_partial(sk);
diff --git a/net/core/dev.c b/net/core/dev.c
index 7f218e095361..29101c98399f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1695,24 +1695,19 @@ EXPORT_SYMBOL_GPL(net_dec_egress_queue);
 
 static struct static_key netstamp_needed __read_mostly;
 #ifdef HAVE_JUMP_LABEL
-/* We are not allowed to call static_key_slow_dec() from irq context
- * If net_disable_timestamp() is called from irq context, defer the
- * static_key_slow_dec() calls.
- */
 static atomic_t netstamp_needed_deferred;
-#endif
-
-void net_enable_timestamp(void)
+static void netstamp_clear(struct work_struct *work)
 {
-#ifdef HAVE_JUMP_LABEL
         int deferred = atomic_xchg(&netstamp_needed_deferred, 0);
 
-        if (deferred) {
-                while (--deferred)
-                        static_key_slow_dec(&netstamp_needed);
-                return;
-        }
+        while (deferred--)
+                static_key_slow_dec(&netstamp_needed);
+}
+static DECLARE_WORK(netstamp_work, netstamp_clear);
 #endif
+
+void net_enable_timestamp(void)
+{
         static_key_slow_inc(&netstamp_needed);
 }
 EXPORT_SYMBOL(net_enable_timestamp);
@@ -1720,12 +1715,12 @@ EXPORT_SYMBOL(net_enable_timestamp);
 void net_disable_timestamp(void)
 {
 #ifdef HAVE_JUMP_LABEL
-        if (in_interrupt()) {
-                atomic_inc(&netstamp_needed_deferred);
-                return;
-        }
-#endif
+        /* net_disable_timestamp() can be called from non process context */
+        atomic_inc(&netstamp_needed_deferred);
+        schedule_work(&netstamp_work);
+#else
         static_key_slow_dec(&netstamp_needed);
+#endif
 }
 EXPORT_SYMBOL(net_disable_timestamp);
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 236a21e3c878..d92de0a1f0a4 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1405,9 +1405,12 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = vzalloc(reglen);
-        if (reglen && !regbuf)
-                return -ENOMEM;
+        regbuf = NULL;
+        if (reglen) {
+                regbuf = vzalloc(reglen);
+                if (!regbuf)
+                        return -ENOMEM;
+        }
 
         ops->get_regs(dev, &regs, regbuf);
 
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index da3862124545..0f99297b2fb3 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -273,6 +273,7 @@ static int dsa_user_port_apply(struct device_node *port, u32 index,
         if (err) {
                 dev_warn(ds->dev, "Failed to create slave %d: %d\n",
                          index, err);
+                ds->ports[index].netdev = NULL;
                 return err;
         }
 
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 8c5a479681ca..516c87e75de7 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -356,6 +356,7 @@ void ether_setup(struct net_device *dev)
         dev->header_ops         = &eth_header_ops;
         dev->type               = ARPHRD_ETHER;
         dev->hard_header_len    = ETH_HLEN;
+        dev->min_header_len     = ETH_HLEN;
         dev->mtu                = ETH_DATA_LEN;
         dev->min_mtu            = ETH_MIN_MTU;
         dev->max_mtu            = ETH_DATA_LEN;
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 72d6f056d863..ae206163c273 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1587,6 +1587,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
                                 goto validate_return_locked;
                         }
 
+                if (opt_iter + 1 == opt_len) {
+                        err_offset = opt_iter;
+                        goto validate_return_locked;
+                }
                 tag_len = tag[1];
                 if (tag_len > (opt_len - opt_iter)) {
                         err_offset = opt_iter + 1;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 5b15459955f8..44fd86de2823 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1172,6 +1172,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
                                 psf->sf_crcount = im->crcount;
                 }
                 in_dev_put(pmc->interface);
+                kfree(pmc);
         }
         spin_unlock_bh(&im->lock);
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 53ae0c6315ad..900011709e3b 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1238,7 +1238,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
                 pktinfo->ipi_ifindex = 0;
                 pktinfo->ipi_spec_dst.s_addr = 0;
         }
-        skb_dst_drop(skb);
+        /* We need to keep the dst for __ip_options_echo()
+         * We could restrict the test to opt.ts_needtime || opt.srr,
+         * but the following is good enough as IP options are not often used.
+         */
+        if (unlikely(IPCB(skb)->opt.optlen))
+                skb_dst_force(skb);
+        else
+                skb_dst_drop(skb);
 }
 
 int ip_setsockopt(struct sock *sk, int level,
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 86cca610f4c2..68d77b1f1495 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -642,6 +642,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
 {
         struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
 
+        if (!skb)
+                return 0;
         pfh->wcheck = csum_partial((char *)&pfh->icmph,
                 sizeof(struct icmphdr), pfh->wcheck);
         pfh->icmph.checksum = csum_fold(pfh->wcheck);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4a044964da66..0efb4c7f6704 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -770,6 +770,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                                 ret = -EAGAIN;
                                 break;
                         }
+                        /* if __tcp_splice_read() got nothing while we have
+                         * an skb in receive queue, we do not want to loop.
+                         * This might happen with URG data.
+                         */
+                        if (!skb_queue_empty(&sk->sk_receive_queue))
+                                break;
                         sk_wait_data(sk, &timeo, NULL);
                         if (signal_pending(current)) {
                                 ret = sock_intr_errno(timeo);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 1d5331a1b1dc..8ce50dc3ab8c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2518,9 +2518,11 @@ u32 __tcp_select_window(struct sock *sk)
         int full_space = min_t(int, tp->window_clamp, allowed_space);
         int window;
 
-        if (mss > full_space)
+        if (unlikely(mss > full_space)) {
                 mss = full_space;
-
+                if (mss <= 0)
+                        return 0;
+        }
         if (free_space < (full_space >> 1)) {
                 icsk->icsk_ack.quick = 0;
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1307a7c2e544..8aab7d78d25b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1501,7 +1501,7 @@ try_again:
         return err;
 
 csum_copy_err:
-        if (!__sk_queue_drop_skb(sk, skb, flags)) {
+        if (!__sk_queue_drop_skb(sk, skb, flags, udp_skb_destructor)) {
                 UDP_INC_STATS(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
                 UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f60e88e56255..a7bcc0ab5e99 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3386,9 +3386,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         }
 
                         if (idev) {
-                                if (idev->if_flags & IF_READY)
-                                        /* device is already configured. */
+                                if (idev->if_flags & IF_READY) {
+                                        /* device is already configured -
+                                         * but resend MLD reports, we might
+                                         * have roamed and need to update
+                                         * multicast snooping switches
+                                         */
+                                        ipv6_mc_up(idev);
                                         break;
+                                }
                                 idev->if_flags |= IF_READY;
                         }
 
@@ -4009,6 +4015,12 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id)
 
         if (bump_id)
                 rt_genid_bump_ipv6(dev_net(dev));
+
+        /* Make sure that a new temporary address will be created
+         * before this temporary address becomes deprecated.
+         */
+        if (ifp->flags & IFA_F_TEMPORARY)
+                addrconf_verify_rtnl();
 }
 
 static void addrconf_dad_run(struct inet6_dev *idev)
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index e4198502fd98..275cac628a95 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -327,7 +327,6 @@ static int ipv6_srh_rcv(struct sk_buff *skb)
         struct ipv6_sr_hdr *hdr;
         struct inet6_dev *idev;
         struct in6_addr *addr;
-        bool cleanup = false;
         int accept_seg6;
 
         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
@@ -351,11 +350,7 @@ static int ipv6_srh_rcv(struct sk_buff *skb)
 #endif
 
 looped_back:
-        if (hdr->segments_left > 0) {
-                if (hdr->nexthdr != NEXTHDR_IPV6 && hdr->segments_left == 1 &&
-                    sr_has_cleanup(hdr))
-                        cleanup = true;
-        } else {
+        if (hdr->segments_left == 0) {
                 if (hdr->nexthdr == NEXTHDR_IPV6) {
                         int offset = (hdr->hdrlen + 1) << 3;
 
@@ -418,21 +413,6 @@ looped_back:
 
         ipv6_hdr(skb)->daddr = *addr;
 
-        if (cleanup) {
-                int srhlen = (hdr->hdrlen + 1) << 3;
-                int nh = hdr->nexthdr;
-
-                skb_pull_rcsum(skb, sizeof(struct ipv6hdr) + srhlen);
-                memmove(skb_network_header(skb) + srhlen,
-                        skb_network_header(skb),
-                        (unsigned char *)hdr - skb_network_header(skb));
-                skb->network_header += srhlen;
-                ipv6_hdr(skb)->nexthdr = nh;
-                ipv6_hdr(skb)->payload_len = htons(skb->len -
-                                                   sizeof(struct ipv6hdr));
-                skb_push_rcsum(skb, sizeof(struct ipv6hdr));
-        }
-
         skb_dst_drop(skb);
 
         ip6_route_input(skb);
@@ -453,13 +433,8 @@ looped_back:
                 }
                 ipv6_hdr(skb)->hop_limit--;
 
-                /* be sure that srh is still present before reinjecting */
-                if (!cleanup) {
-                        skb_pull(skb, sizeof(struct ipv6hdr));
-                        goto looped_back;
-                }
-                skb_set_transport_header(skb, sizeof(struct ipv6hdr));
-                IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
+                skb_pull(skb, sizeof(struct ipv6hdr));
+                goto looped_back;
         }
 
         dst_input(skb);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 558631860d91..630b73be5999 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -367,35 +367,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
 
 
 static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                u8 type, u8 code, int offset, __be32 info)
+                       u8 type, u8 code, int offset, __be32 info)
 {
-        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
-        __be16 *p = (__be16 *)(skb->data + offset);
-        int grehlen = offset + 4;
+        const struct gre_base_hdr *greh;
+        const struct ipv6hdr *ipv6h;
+        int grehlen = sizeof(*greh);
         struct ip6_tnl *t;
+        int key_off = 0;
         __be16 flags;
+        __be32 key;
 
-        flags = p[0];
-        if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
-                if (flags&(GRE_VERSION|GRE_ROUTING))
-                        return;
-                if (flags&GRE_KEY) {
-                        grehlen += 4;
-                        if (flags&GRE_CSUM)
-                                grehlen += 4;
-                }
+        if (!pskb_may_pull(skb, offset + grehlen))
+                return;
+        greh = (const struct gre_base_hdr *)(skb->data + offset);
+        flags = greh->flags;
+        if (flags & (GRE_VERSION | GRE_ROUTING))
+                return;
+        if (flags & GRE_CSUM)
+                grehlen += 4;
+        if (flags & GRE_KEY) {
+                key_off = grehlen + offset;
+                grehlen += 4;
         }
 
-        /* If only 8 bytes returned, keyed message will be dropped here */
-        if (!pskb_may_pull(skb, grehlen))
+        if (!pskb_may_pull(skb, offset + grehlen))
                 return;
         ipv6h = (const struct ipv6hdr *)skb->data;
-        p = (__be16 *)(skb->data + offset);
+        greh = (const struct gre_base_hdr *)(skb->data + offset);
+        key = key_off ? *(__be32 *)(skb->data + key_off) : 0;
 
         t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
-                                flags & GRE_KEY ?
-                                *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
-                                p[1]);
+                                 key, greh->protocol);
         if (!t)
                 return;
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 2c0df09e9036..b6a94ff0bbd0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1344,7 +1344,7 @@ emsgsize:
          */
         if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
             headersize == sizeof(struct ipv6hdr) &&
-            length < mtu - headersize &&
+            length <= mtu - headersize &&
             !(flags & MSG_MORE) &&
             rt->dst.dev->features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
                 csummode = CHECKSUM_PARTIAL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ff8ee06491c3..75fac933c209 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -441,7 +441,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
                                 if (i + sizeof(*tel) > optlen)
                                         break;
 
-                                tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;
+                                tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
                                 /* return index of option if found and valid */
                                 if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
                                     tel->length == 1)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 7139fffd61b6..1bdc703cb966 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -779,6 +779,7 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
                                 psf->sf_crcount = im->mca_crcount;
                 }
                 in6_dev_put(pmc->idev);
+                kfree(pmc);
         }
         spin_unlock_bh(&im->mca_lock);
 }
diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index 03a064803626..6ef3dfb6e811 100644
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c
@@ -174,7 +174,7 @@ int seg6_hmac_compute(struct seg6_hmac_info *hinfo, struct ipv6_sr_hdr *hdr,
          * hash function (RadioGatun) with up to 1216 bits
          */
 
-        /* saddr(16) + first_seg(1) + cleanup(1) + keyid(4) + seglist(16n) */
+        /* saddr(16) + first_seg(1) + flags(1) + keyid(4) + seglist(16n) */
         plen = 16 + 1 + 1 + 4 + (hdr->first_segment + 1) * 16;
 
         /* this limit allows for 14 segments */
@@ -186,7 +186,7 @@ int seg6_hmac_compute(struct seg6_hmac_info *hinfo, struct ipv6_sr_hdr *hdr,
          *
          * 1. Source IPv6 address (128 bits)
          * 2. first_segment value (8 bits)
-         * 3. cleanup flag (8 bits: highest bit is cleanup value, others are 0)
+         * 3. Flags (8 bits)
          * 4. HMAC Key ID (32 bits)
          * 5. All segments in the segments list (n * 128 bits)
          */
@@ -202,8 +202,8 @@ int seg6_hmac_compute(struct seg6_hmac_info *hinfo, struct ipv6_sr_hdr *hdr,
         /* first_segment value */
         *off++ = hdr->first_segment;
 
-        /* cleanup flag */
-        *off++ = !!(sr_has_cleanup(hdr)) << 7;
+        /* flags */
+        *off++ = hdr->flags;
 
         /* HMAC Key ID */
         memcpy(off, &hmackeyid, 4);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index fad992ad4bc8..99853c6e33a8 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1380,6 +1380,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
         err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
         if (err) {
                 free_percpu(dev->tstats);
+                dev->tstats = NULL;
                 return err;
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cb8929681dc7..eaad72c3d746 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -991,6 +991,16 @@ drop:
         return 0; /* don't send reset */
 }
 
+static void tcp_v6_restore_cb(struct sk_buff *skb)
+{
+        /* We need to move header back to the beginning if xfrm6_policy_check()
+         * and tcp_v6_fill_cb() are going to be called again.
+         * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
+         */
+        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+                sizeof(struct inet6_skb_parm));
+}
+
 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
                                          struct request_sock *req,
                                          struct dst_entry *dst,
@@ -1182,8 +1192,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
                                                       sk_gfp_mask(sk, GFP_ATOMIC));
                         consume_skb(ireq->pktopts);
                         ireq->pktopts = NULL;
-                        if (newnp->pktoptions)
+                        if (newnp->pktoptions) {
+                                tcp_v6_restore_cb(newnp->pktoptions);
                                 skb_set_owner_r(newnp->pktoptions, newsk);
+                        }
                 }
         }
 
@@ -1198,16 +1210,6 @@ out:
         return NULL;
 }
 
-static void tcp_v6_restore_cb(struct sk_buff *skb)
-{
-        /* We need to move header back to the beginning if xfrm6_policy_check()
-         * and tcp_v6_fill_cb() are going to be called again.
-         * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
-         */
-        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
-                sizeof(struct inet6_skb_parm));
-}
-
 /* The socket must have it's spinlock held when we get
  * here, unless it is a TCP_LISTEN socket.
  *
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4d5c4eee4b3f..8990856f5101 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -441,7 +441,7 @@ try_again:
         return err;
 
 csum_copy_err:
-        if (!__sk_queue_drop_skb(sk, skb, flags)) {
+        if (!__sk_queue_drop_skb(sk, skb, flags, udp_skb_destructor)) {
                 if (is_udp4) {
                         UDP_INC_STATS(sock_net(sk),
                                       UDP_MIB_CSUMERRORS, is_udplite);
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 7e08a4d3d77d..64f0e8531af0 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -929,23 +929,25 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
                         goto out_error;
         }
 
-        /* New message, alloc head skb */
-        head = alloc_skb(0, sk->sk_allocation);
-        while (!head) {
-                kcm_push(kcm);
-                err = sk_stream_wait_memory(sk, &timeo);
-                if (err)
-                        goto out_error;
-
+        if (msg_data_left(msg)) {
+                /* New message, alloc head skb */
                 head = alloc_skb(0, sk->sk_allocation);
-        }
+                while (!head) {
+                        kcm_push(kcm);
+                        err = sk_stream_wait_memory(sk, &timeo);
+                        if (err)
+                                goto out_error;
 
-        skb = head;
+                        head = alloc_skb(0, sk->sk_allocation);
+                }
 
-        /* Set ip_summed to CHECKSUM_UNNECESSARY to avoid calling
-         * csum_and_copy_from_iter from skb_do_copy_data_nocache.
-         */
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                skb = head;
+
+                /* Set ip_summed to CHECKSUM_UNNECESSARY to avoid calling
+                 * csum_and_copy_from_iter from skb_do_copy_data_nocache.
+                 */
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+        }
 
 start:
         while (msg_data_left(msg)) {
@@ -1018,10 +1020,12 @@ wait_for_memory:
         if (eor) {
                 bool not_busy = skb_queue_empty(&sk->sk_write_queue);
 
-                /* Message complete, queue it on send buffer */
-                __skb_queue_tail(&sk->sk_write_queue, head);
-                kcm->seq_skb = NULL;
-                KCM_STATS_INCR(kcm->stats.tx_msgs);
+                if (head) {
+                        /* Message complete, queue it on send buffer */
+                        __skb_queue_tail(&sk->sk_write_queue, head);
+                        kcm->seq_skb = NULL;
+                        KCM_STATS_INCR(kcm->stats.tx_msgs);
+                }
 
                 if (msg->msg_flags & MSG_BATCH) {
                         kcm->tx_wait_more = true;
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 8f560f7140a0..aebf281d09ee 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -263,6 +263,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
 int l2tp_nl_register_ops(enum l2tp_pwtype pw_type,
                          const struct l2tp_nl_cmd_ops *ops);
 void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 
 /* Session reference counts. Incremented when code obtains a reference
  * to a session.
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 3d73278b86ca..28c21546d5b6 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -11,6 +11,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <asm/ioctls.h>
 #include <linux/icmp.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -553,6 +554,30 @@ out:
         return err ? err : copied;
 }
 
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+{
+        struct sk_buff *skb;
+        int amount;
+
+        switch (cmd) {
+        case SIOCOUTQ:
+                amount = sk_wmem_alloc_get(sk);
+                break;
+        case SIOCINQ:
+                spin_lock_bh(&sk->sk_receive_queue.lock);
+                skb = skb_peek(&sk->sk_receive_queue);
+                amount = skb ? skb->len : 0;
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
+                break;
+
+        default:
+                return -ENOIOCTLCMD;
+        }
+
+        return put_user(amount, (int __user *)arg);
+}
+EXPORT_SYMBOL(l2tp_ioctl);
+
 static struct proto l2tp_ip_prot = {
         .name              = "L2TP/IP",
         .owner             = THIS_MODULE,
@@ -561,7 +586,7 @@ static struct proto l2tp_ip_prot = {
         .bind              = l2tp_ip_bind,
         .connect           = l2tp_ip_connect,
         .disconnect        = l2tp_ip_disconnect,
-        .ioctl             = udp_ioctl,
+        .ioctl             = l2tp_ioctl,
         .destroy           = l2tp_ip_destroy_sock,
         .setsockopt        = ip_setsockopt,
         .getsockopt        = ip_getsockopt,
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 331ccf5a7bad..f47c45250f86 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -722,7 +722,7 @@ static struct proto l2tp_ip6_prot = {
         .bind              = l2tp_ip6_bind,
         .connect           = l2tp_ip6_connect,
         .disconnect        = l2tp_ip6_disconnect,
-        .ioctl             = udp_ioctl,
+        .ioctl             = l2tp_ioctl,
         .destroy           = l2tp_ip6_destroy_sock,
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
diff --git a/net/mac80211/fils_aead.c b/net/mac80211/fils_aead.c
index ecfdd97758a3..5c3af5eb4052 100644
--- a/net/mac80211/fils_aead.c
+++ b/net/mac80211/fils_aead.c
@@ -124,7 +124,7 @@ static int aes_siv_encrypt(const u8 *key, size_t key_len,
 
         /* CTR */
 
-        tfm2 = crypto_alloc_skcipher("ctr(aes)", 0, 0);
+        tfm2 = crypto_alloc_skcipher("ctr(aes)", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm2)) {
                 kfree(tmp);
                 return PTR_ERR(tfm2);
@@ -183,7 +183,7 @@ static int aes_siv_decrypt(const u8 *key, size_t key_len,
 
         /* CTR */
 
-        tfm2 = crypto_alloc_skcipher("ctr(aes)", 0, 0);
+        tfm2 = crypto_alloc_skcipher("ctr(aes)", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(tfm2))
                 return PTR_ERR(tfm2);
         /* K2 for CTR */
@@ -272,7 +272,7 @@ int fils_encrypt_assoc_req(struct sk_buff *skb,
         crypt_len = skb->data + skb->len - encr;
         skb_put(skb, AES_BLOCK_SIZE);
         return aes_siv_encrypt(assoc_data->fils_kek, assoc_data->fils_kek_len,
-                               encr, crypt_len, 1, addr, len, encr);
+                               encr, crypt_len, 5, addr, len, encr);
 }
 
 int fils_decrypt_assoc_resp(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 42120d965263..50e1b7f78bd4 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -339,7 +339,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
         /* fast-forward to vendor IEs */
         offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
 
-        if (offset) {
+        if (offset < ifmsh->ie_len) {
                 len = ifmsh->ie_len - offset;
                 data = ifmsh->ie + offset;
                 if (skb_tailroom(skb) < len)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 3d555c79a7b5..d56ee46b11fc 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2755,7 +2755,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         struct virtio_net_hdr vnet_hdr = { 0 };
         int offset = 0;
         struct packet_sock *po = pkt_sk(sk);
-        int hlen, tlen;
+        int hlen, tlen, linear;
         int extra_len = 0;
 
         /*
@@ -2816,8 +2816,9 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         err = -ENOBUFS;
         hlen = LL_RESERVED_SPACE(dev);
         tlen = dev->needed_tailroom;
-        skb = packet_alloc_skb(sk, hlen + tlen, hlen, len,
-                               __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len),
+        linear = __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len);
+        linear = max(linear, min_t(int, len, dev->hard_header_len));
+        skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, linear,
                                msg->msg_flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out_unlock;
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 970db7a41684..5752789acc13 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -568,9 +568,9 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
                                &mask->icmp.type,
                                TCA_FLOWER_KEY_ICMPV6_TYPE_MASK,
                                sizeof(key->icmp.type));
-                fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV4_CODE,
+                fl_set_key_val(tb, &key->icmp.code, TCA_FLOWER_KEY_ICMPV6_CODE,
                                &mask->icmp.code,
-                               TCA_FLOWER_KEY_ICMPV4_CODE_MASK,
+                               TCA_FLOWER_KEY_ICMPV6_CODE_MASK,
                                sizeof(key->icmp.code));
         }
 
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index f935429bd5ef..b12bc2abea93 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -16,16 +16,11 @@
 #include <net/sch_generic.h>
 #include <net/pkt_cls.h>
 
-struct cls_mall_filter {
+struct cls_mall_head {
         struct tcf_exts exts;
         struct tcf_result res;
         u32 handle;
-        struct rcu_head rcu;
         u32 flags;
-};
-
-struct cls_mall_head {
-        struct cls_mall_filter *filter;
         struct rcu_head rcu;
 };
 
@@ -33,38 +28,29 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                          struct tcf_result *res)
 {
         struct cls_mall_head *head = rcu_dereference_bh(tp->root);
-        struct cls_mall_filter *f = head->filter;
 
-        if (tc_skip_sw(f->flags))
+        if (tc_skip_sw(head->flags))
                 return -1;
 
-        return tcf_exts_exec(skb, &f->exts, res);
+        return tcf_exts_exec(skb, &head->exts, res);
 }
 
 static int mall_init(struct tcf_proto *tp)
 {
-        struct cls_mall_head *head;
-
-        head = kzalloc(sizeof(*head), GFP_KERNEL);
-        if (!head)
-                return -ENOBUFS;
-
-        rcu_assign_pointer(tp->root, head);
-
         return 0;
 }
 
-static void mall_destroy_filter(struct rcu_head *head)
+static void mall_destroy_rcu(struct rcu_head *rcu)
 {
-        struct cls_mall_filter *f = container_of(head, struct cls_mall_filter, rcu);
+        struct cls_mall_head *head = container_of(rcu, struct cls_mall_head,
+                                                  rcu);
 
-        tcf_exts_destroy(&f->exts);
-
-        kfree(f);
+        tcf_exts_destroy(&head->exts);
+        kfree(head);
 }
 
 static int mall_replace_hw_filter(struct tcf_proto *tp,
-                                  struct cls_mall_filter *f,
+                                  struct cls_mall_head *head,
                                   unsigned long cookie)
 {
         struct net_device *dev = tp->q->dev_queue->dev;
@@ -74,7 +60,7 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
         offload.type = TC_SETUP_MATCHALL;
         offload.cls_mall = &mall_offload;
         offload.cls_mall->command = TC_CLSMATCHALL_REPLACE;
-        offload.cls_mall->exts = &f->exts;
+        offload.cls_mall->exts = &head->exts;
         offload.cls_mall->cookie = cookie;
 
         return dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol,
@@ -82,7 +68,7 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
 }
 
 static void mall_destroy_hw_filter(struct tcf_proto *tp,
-                                   struct cls_mall_filter *f,
+                                   struct cls_mall_head *head,
                                    unsigned long cookie)
 {
         struct net_device *dev = tp->q->dev_queue->dev;
@@ -103,29 +89,20 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
         struct net_device *dev = tp->q->dev_queue->dev;
-        struct cls_mall_filter *f = head->filter;
 
-        if (!force && f)
-                return false;
+        if (!head)
+                return true;
 
-        if (f) {
-                if (tc_should_offload(dev, tp, f->flags))
-                        mall_destroy_hw_filter(tp, f, (unsigned long) f);
+        if (tc_should_offload(dev, tp, head->flags))
+                mall_destroy_hw_filter(tp, head, (unsigned long) head);
 
-                call_rcu(&f->rcu, mall_destroy_filter);
-        }
-        kfree_rcu(head, rcu);
+        call_rcu(&head->rcu, mall_destroy_rcu);
         return true;
 }
 
 static unsigned long mall_get(struct tcf_proto *tp, u32 handle)
 {
-        struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *f = head->filter;
-
-        if (f && f->handle == handle)
-                return (unsigned long) f;
-        return 0;
+        return 0UL;
 }
 
 static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
@@ -134,7 +111,7 @@ static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
 };
 
 static int mall_set_parms(struct net *net, struct tcf_proto *tp,
-                          struct cls_mall_filter *f,
+                          struct cls_mall_head *head,
                           unsigned long base, struct nlattr **tb,
                           struct nlattr *est, bool ovr)
 {
@@ -147,11 +124,11 @@ static int mall_set_parms(struct net *net, struct tcf_proto *tp,
                 return err;
 
         if (tb[TCA_MATCHALL_CLASSID]) {
-                f->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
-                tcf_bind_filter(tp, &f->res, base);
+                head->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
+                tcf_bind_filter(tp, &head->res, base);
         }
 
-        tcf_exts_change(tp, &f->exts, &e);
+        tcf_exts_change(tp, &head->exts, &e);
 
         return 0;
 }
@@ -162,21 +139,17 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                        unsigned long *arg, bool ovr)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *fold = (struct cls_mall_filter *) *arg;
         struct net_device *dev = tp->q->dev_queue->dev;
-        struct cls_mall_filter *f;
         struct nlattr *tb[TCA_MATCHALL_MAX + 1];
+        struct cls_mall_head *new;
         u32 flags = 0;
         int err;
 
         if (!tca[TCA_OPTIONS])
                 return -EINVAL;
 
-        if (head->filter)
-                return -EBUSY;
-
-        if (fold)
-                return -EINVAL;
+        if (head)
+                return -EEXIST;
 
         err = nla_parse_nested(tb, TCA_MATCHALL_MAX,
                                tca[TCA_OPTIONS], mall_policy);
@@ -189,23 +162,23 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                         return -EINVAL;
         }
 
-        f = kzalloc(sizeof(*f), GFP_KERNEL);
-        if (!f)
+        new = kzalloc(sizeof(*new), GFP_KERNEL);
+        if (!new)
                 return -ENOBUFS;
 
-        tcf_exts_init(&f->exts, TCA_MATCHALL_ACT, 0);
+        tcf_exts_init(&new->exts, TCA_MATCHALL_ACT, 0);
 
         if (!handle)
                 handle = 1;
-        f->handle = handle;
-        f->flags = flags;
+        new->handle = handle;
+        new->flags = flags;
 
-        err = mall_set_parms(net, tp, f, base, tb, tca[TCA_RATE], ovr);
+        err = mall_set_parms(net, tp, new, base, tb, tca[TCA_RATE], ovr);
         if (err)
                 goto errout;
 
         if (tc_should_offload(dev, tp, flags)) {
-                err = mall_replace_hw_filter(tp, f, (unsigned long) f);
+                err = mall_replace_hw_filter(tp, new, (unsigned long) new);
                 if (err) {
                         if (tc_skip_sw(flags))
                                 goto errout;
@@ -214,39 +187,29 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
                 }
         }
 
-        *arg = (unsigned long) f;
-        rcu_assign_pointer(head->filter, f);
-
+        *arg = (unsigned long) head;
+        rcu_assign_pointer(tp->root, new);
+        if (head)
+                call_rcu(&head->rcu, mall_destroy_rcu);
         return 0;
 
 errout:
-        kfree(f);
+        kfree(new);
         return err;
 }
 
 static int mall_delete(struct tcf_proto *tp, unsigned long arg)
 {
-        struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *f = (struct cls_mall_filter *) arg;
-        struct net_device *dev = tp->q->dev_queue->dev;
-
-        if (tc_should_offload(dev, tp, f->flags))
-                mall_destroy_hw_filter(tp, f, (unsigned long) f);
-
-        RCU_INIT_POINTER(head->filter, NULL);
-        tcf_unbind_filter(tp, &f->res);
-        call_rcu(&f->rcu, mall_destroy_filter);
-        return 0;
+        return -EOPNOTSUPP;
 }
 
 static void mall_walk(struct tcf_proto *tp, struct tcf_walker *arg)
 {
         struct cls_mall_head *head = rtnl_dereference(tp->root);
-        struct cls_mall_filter *f = head->filter;
 
         if (arg->count < arg->skip)
                 goto skip;
-        if (arg->fn(tp, (unsigned long) f, arg) < 0)
+        if (arg->fn(tp, (unsigned long) head, arg) < 0)
                 arg->stop = 1;
 skip:
         arg->count++;
@@ -255,28 +218,28 @@ skip:
 static int mall_dump(struct net *net, struct tcf_proto *tp, unsigned long fh,
                      struct sk_buff *skb, struct tcmsg *t)
 {
-        struct cls_mall_filter *f = (struct cls_mall_filter *) fh;
+        struct cls_mall_head *head = (struct cls_mall_head *) fh;
         struct nlattr *nest;
 
-        if (!f)
+        if (!head)
                 return skb->len;
 
-        t->tcm_handle = f->handle;
+        t->tcm_handle = head->handle;
 
         nest = nla_nest_start(skb, TCA_OPTIONS);
         if (!nest)
                 goto nla_put_failure;
 
-        if (f->res.classid &&
-            nla_put_u32(skb, TCA_MATCHALL_CLASSID, f->res.classid))
+        if (head->res.classid &&
+            nla_put_u32(skb, TCA_MATCHALL_CLASSID, head->res.classid))
                 goto nla_put_failure;
 
-        if (tcf_exts_dump(skb, &f->exts))
+        if (tcf_exts_dump(skb, &head->exts))
                 goto nla_put_failure;
 
         nla_nest_end(skb, nest);
 
-        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
+        if (tcf_exts_dump_stats(skb, &head->exts) < 0)
                 goto nla_put_failure;
 
         return skb->len;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 37eeab7899fc..1b5d669e3029 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -239,7 +239,7 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
         union sctp_addr *laddr = (union sctp_addr *)addr;
         struct sctp_transport *transport;
 
-        if (sctp_verify_addr(sk, laddr, af->sockaddr_len))
+        if (!af || sctp_verify_addr(sk, laddr, af->sockaddr_len))
                 return NULL;
 
         addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
@@ -7426,7 +7426,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                  */
                 release_sock(sk);
                 current_timeo = schedule_timeout(current_timeo);
-                BUG_ON(sk != asoc->base.sk);
+                if (sk != asoc->base.sk)
+                        goto do_error;
                 lock_sock(sk);
 
                 *timeo_p = current_timeo;
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index dc6fb79a361f..25d9a9cf7b66 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
         if (!oa->data)
                 return -ENOMEM;
 
-        creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL);
+        creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
         if (!creds) {
                 kfree(oa->data);
                 return -ENOMEM;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 1efbe48e794f..1dc9f3bac099 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -336,6 +336,11 @@ out:
 
 static DEFINE_IDA(rpc_clids);
 
+void rpc_cleanup_clids(void)
+{
+        ida_destroy(&rpc_clids);
+}
+
 static int rpc_alloc_clid(struct rpc_clnt *clnt)
 {
         int clid;
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index d1c330a7953a..c73de181467a 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -119,6 +119,7 @@ out:
 static void __exit
 cleanup_sunrpc(void)
 {
+        rpc_cleanup_clids();
         rpcauth_remove_module();
         cleanup_socket_xprt();
         svc_cleanup_xprt_sock();
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5c1b267e22be..aee396b9f190 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5916,6 +5916,7 @@ do {									    \
                         break;
                 }
                 cfg->ht_opmode = ht_opmode;
+                mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
         }
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
                                   1, 65535, mask,
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index eadcd4d359d9..d883116ebaa4 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -164,6 +164,7 @@ cmd_gensymtypes_c =                                                         \
     $(CPP) -D__GENKSYMS__ $(c_flags) $< |                                   \
     $(GENKSYMS) $(if $(1), -T $(2))                                         \
      $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))             \
+     $(patsubst y,-R,$(CONFIG_MODULE_REL_CRCS))                             \
      $(if $(KBUILD_PRESERVE),-p)                                            \
      -r $(firstword $(wildcard $(2:.symtypes=.symref) /dev/null))
 
@@ -337,6 +338,7 @@ cmd_gensymtypes_S =                                                         \
     $(CPP) -D__GENKSYMS__ $(c_flags) -xc - |                                \
     $(GENKSYMS) $(if $(1), -T $(2))                                         \
      $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))             \
+     $(patsubst y,-R,$(CONFIG_MODULE_REL_CRCS))                             \
      $(if $(KBUILD_PRESERVE),-p)                                            \
      -r $(firstword $(wildcard $(2:.symtypes=.symref) /dev/null))
 
diff --git a/scripts/genksyms/genksyms.c b/scripts/genksyms/genksyms.c
index 06121ce524a7..c9235d8340f1 100644
--- a/scripts/genksyms/genksyms.c
+++ b/scripts/genksyms/genksyms.c
@@ -44,7 +44,7 @@ char *cur_filename, *source_file;
 int in_source_file;
 
 static int flag_debug, flag_dump_defs, flag_reference, flag_dump_types,
-           flag_preserve, flag_warnings;
+           flag_preserve, flag_warnings, flag_rel_crcs;
 static const char *mod_prefix = "";
 
 static int errors;
@@ -693,7 +693,10 @@ void export_symbol(const char *name)
                         fputs(">\n", debugfile);
 
                 /* Used as a linker script. */
-                printf("%s__crc_%s = 0x%08lx ;\n", mod_prefix, name, crc);
+                printf(!flag_rel_crcs ? "%s__crc_%s = 0x%08lx;\n" :
+                       "SECTIONS { .rodata : ALIGN(4) { "
+                       "%s__crc_%s = .; LONG(0x%08lx); } }\n",
+                       mod_prefix, name, crc);
         }
 }
 
@@ -730,7 +733,7 @@ void error_with_pos(const char *fmt, ...)
 
 static void genksyms_usage(void)
 {
-        fputs("Usage:\n" "genksyms [-adDTwqhV] > /path/to/.tmp_obj.ver\n" "\n"
+        fputs("Usage:\n" "genksyms [-adDTwqhVR] > /path/to/.tmp_obj.ver\n" "\n"
 #ifdef __GNU_LIBRARY__
               "  -s, --symbol-prefix   Select symbol prefix\n"
               "  -d, --debug           Increment the debug level (repeatable)\n"
@@ -742,6 +745,7 @@ static void genksyms_usage(void)
               "  -q, --quiet           Disable warnings (default)\n"
               "  -h, --help            Print this message\n"
               "  -V, --version         Print the release version\n"
+              "  -R, --relative-crc    Emit section relative symbol CRCs\n"
 #else                           /* __GNU_LIBRARY__ */
               "  -s                    Select symbol prefix\n"
               "  -d                    Increment the debug level (repeatable)\n"
@@ -753,6 +757,7 @@ static void genksyms_usage(void)
               "  -q                    Disable warnings (default)\n"
               "  -h                    Print this message\n"
               "  -V                    Print the release version\n"
+              "  -R                    Emit section relative symbol CRCs\n"
 #endif                          /* __GNU_LIBRARY__ */
               , stderr);
 }
@@ -774,13 +779,14 @@ int main(int argc, char **argv)
                 {"preserve", 0, 0, 'p'},
                 {"version", 0, 0, 'V'},
                 {"help", 0, 0, 'h'},
+                {"relative-crc", 0, 0, 'R'},
                 {0, 0, 0, 0}
         };
 
-        while ((o = getopt_long(argc, argv, "s:dwqVDr:T:ph",
+        while ((o = getopt_long(argc, argv, "s:dwqVDr:T:phR",
                                 &long_opts[0], NULL)) != EOF)
 #else                           /* __GNU_LIBRARY__ */
-        while ((o = getopt(argc, argv, "s:dwqVDr:T:ph")) != EOF)
+        while ((o = getopt(argc, argv, "s:dwqVDr:T:phR")) != EOF)
 #endif                          /* __GNU_LIBRARY__ */
                 switch (o) {
                 case 's':
@@ -823,6 +829,9 @@ int main(int argc, char **argv)
                 case 'h':
                         genksyms_usage();
                         return 0;
+                case 'R':
+                        flag_rel_crcs = 1;
+                        break;
                 default:
                         genksyms_usage();
                         return 1;
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 299b92ca1ae0..5d554419170b 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -219,6 +219,10 @@ static int symbol_valid(struct sym_entry *s)
                 "_SDA2_BASE_",          /* ppc */
                 NULL };
 
+        static char *special_prefixes[] = {
+                "__crc_",               /* modversions */
+                NULL };
+
         static char *special_suffixes[] = {
                 "_veneer",              /* arm */
                 "_from_arm",            /* arm */
@@ -259,6 +263,14 @@ static int symbol_valid(struct sym_entry *s)
                 if (strcmp(sym_name, special_symbols[i]) == 0)
                         return 0;
 
+        for (i = 0; special_prefixes[i]; i++) {
+                int l = strlen(special_prefixes[i]);
+
+                if (l <= strlen(sym_name) &&
+                    strncmp(sym_name, special_prefixes[i], l) == 0)
+                        return 0;
+        }
+
         for (i = 0; special_suffixes[i]; i++) {
                 int l = strlen(sym_name) - strlen(special_suffixes[i]);
 
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 29c89a6bad3d..4dedd0d3d3a7 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -621,6 +621,16 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
         if (strncmp(symname, CRC_PFX, strlen(CRC_PFX)) == 0) {
                 is_crc = true;
                 crc = (unsigned int) sym->st_value;
+                if (sym->st_shndx != SHN_UNDEF && sym->st_shndx != SHN_ABS) {
+                        unsigned int *crcp;
+
+                        /* symbol points to the CRC in the ELF object */
+                        crcp = (void *)info->hdr + sym->st_value +
+                               info->sechdrs[sym->st_shndx].sh_offset -
+                               (info->hdr->e_type != ET_REL ?
+                                info->sechdrs[sym->st_shndx].sh_addr : 0);
+                        crc = *crcp;
+                }
                 sym_update_crc(symname + strlen(CRC_PFX), mod, crc,
                                 export);
         }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index c7c6619431d5..d98550abe16d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5887,7 +5887,7 @@ static int selinux_setprocattr(struct task_struct *p,
                 return error;
 
         /* Obtain a SID for the context, if one was specified. */
-        if (size && str[1] && str[1] != '\n') {
+        if (size && str[0] && str[0] != '\n') {
                 if (str[size-1] == '\n') {
                         str[size-1] = 0;
                         size--;
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index c850345c43b5..dfa5156f3585 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
 {
         unsigned long flags;
         struct snd_seq_event_cell *ptr;
-        int max_count = 5 * HZ;
 
         if (snd_BUG_ON(!pool))
                 return -EINVAL;
@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
         if (waitqueue_active(&pool->output_sleep))
                 wake_up(&pool->output_sleep);
 
-        while (atomic_read(&pool->counter) > 0) {
-                if (max_count == 0) {
-                        pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter));
-                        break;
-                }
+        while (atomic_read(&pool->counter) > 0)
                 schedule_timeout_uninterruptible(1);
-                max_count--;
-        }
         
         /* release all resources */
         spin_lock_irqsave(&pool->lock, flags);
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 0bec02e89d51..450c5187eecb 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void)
         }
 }
 
+static void queue_use(struct snd_seq_queue *queue, int client, int use);
+
 /* allocate a new queue -
  * return queue index value or negative value for error
  */
@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
         if (q == NULL)
                 return -ENOMEM;
         q->info_flags = info_flags;
+        queue_use(q, client, 1);
         if (queue_list_add(q) < 0) {
                 queue_delete(q);
                 return -ENOMEM;
         }
-        snd_seq_queue_use(q->queue, client, 1); /* use this queue */
         return q->queue;
 }
 
@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,
         return result;
 }
 
-
-/* use or unuse this queue -
- * if it is the first client, starts the timer.
- * if it is not longer used by any clients, stop the timer.
- */
-int snd_seq_queue_use(int queueid, int client, int use)
+/* use or unuse this queue */
+static void queue_use(struct snd_seq_queue *queue, int client, int use)
 {
-        struct snd_seq_queue *queue;
-
-        queue = queueptr(queueid);
-        if (queue == NULL)
-                return -EINVAL;
-        mutex_lock(&queue->timer_mutex);
         if (use) {
                 if (!test_and_set_bit(client, queue->clients_bitmap))
                         queue->clients++;
@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use)
         } else {
                 snd_seq_timer_close(queue);
         }
+}
+
+/* use or unuse this queue -
+ * if it is the first client, starts the timer.
+ * if it is not longer used by any clients, stop the timer.
+ */
+int snd_seq_queue_use(int queueid, int client, int use)
+{
+        struct snd_seq_queue *queue;
+
+        queue = queueptr(queueid);
+        if (queue == NULL)
+                return -EINVAL;
+        mutex_lock(&queue->timer_mutex);
+        queue_use(queue, client, use);
         mutex_unlock(&queue->timer_mutex);
         queuefree(queue);
         return 0;
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index cf9bc042fe96..3fc201c3b95a 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3639,6 +3639,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP",	patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP",   patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP",   patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP",   patch_nvhdmi),
+HDA_CODEC_ENTRY(0x10de0080, "GPU 80 HDMI/DP",   patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP",   patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP",   patch_nvhdmi),
 HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI",       patch_nvhdmi_2ch),
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index 90009c0b3a92..ab3c280a23d1 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -754,8 +754,9 @@ int line6_probe(struct usb_interface *interface,
                 goto error;
         }
 
+        line6_get_interval(line6);
+
         if (properties->capabilities & LINE6_CAP_CONTROL) {
-                line6_get_interval(line6);
                 ret = line6_init_cap_control(line6);
                 if (ret < 0)
                         goto error;
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index 5e0dea2cdc01..039636ffb6c8 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -150,9 +150,9 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
                 *type = INSN_RETURN;
                 break;
 
-        case 0xc5: /* iret */
         case 0xca: /* retf */
         case 0xcb: /* retf */
+        case 0xcf: /* iret */
                 *type = INSN_CONTEXT_SWITCH;
                 break;
 
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 9ff0db4e2d0c..933aeec46f4a 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -1199,7 +1199,7 @@ static int ui_init(void)
                 BUG_ON(1);
         }
 
-        perf_hpp__register_sort_field(fmt);
+        perf_hpp__prepend_sort_field(fmt);
         return 0;
 }
 
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 37388397b5bc..18cfcdc90356 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -521,6 +521,12 @@ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
         list_add_tail(&format->sort_list, &list->sorts);
 }
 
+void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
+                                       struct perf_hpp_fmt *format)
+{
+        list_add(&format->sort_list, &list->sorts);
+}
+
 void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
 {
         list_del(&format->list);
@@ -560,6 +566,10 @@ void perf_hpp__setup_output_field(struct perf_hpp_list *list)
         perf_hpp_list__for_each_sort_list(list, fmt) {
                 struct perf_hpp_fmt *pos;
 
+                /* skip sort-only fields ("sort_compute" in perf diff) */
+                if (!fmt->entry && !fmt->color)
+                        continue;
+
                 perf_hpp_list__for_each_format(list, pos) {
                         if (fmt_equal(fmt, pos))
                                 goto next;
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 42922512c1c6..8b610dd9e2f6 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -437,7 +437,7 @@ fill_node(struct callchain_node *node, struct callchain_cursor *cursor)
                 }
                 call->ip = cursor_node->ip;
                 call->ms.sym = cursor_node->sym;
-                call->ms.map = cursor_node->map;
+                call->ms.map = map__get(cursor_node->map);
 
                 if (cursor_node->branch) {
                         call->branch_count = 1;
@@ -477,6 +477,7 @@ add_child(struct callchain_node *parent,
 
                 list_for_each_entry_safe(call, tmp, &new->val, list) {
                         list_del(&call->list);
+                        map__zput(call->ms.map);
                         free(call);
                 }
                 free(new);
@@ -761,6 +762,7 @@ merge_chain_branch(struct callchain_cursor *cursor,
                                         list->ms.map, list->ms.sym,
                                         false, NULL, 0, 0);
                 list_del(&list->list);
+                map__zput(list->ms.map);
                 free(list);
         }
 
@@ -811,7 +813,8 @@ int callchain_cursor_append(struct callchain_cursor *cursor,
         }
 
         node->ip = ip;
-        node->map = map;
+        map__zput(node->map);
+        node->map = map__get(map);
         node->sym = sym;
         node->branch = branch;
         node->nr_loop_iter = nr_loop_iter;
@@ -1142,11 +1145,13 @@ static void free_callchain_node(struct callchain_node *node)
 
         list_for_each_entry_safe(list, tmp, &node->parent_val, list) {
                 list_del(&list->list);
+                map__zput(list->ms.map);
                 free(list);
         }
 
         list_for_each_entry_safe(list, tmp, &node->val, list) {
                 list_del(&list->list);
+                map__zput(list->ms.map);
                 free(list);
         }
 
@@ -1210,6 +1215,7 @@ int callchain_node__make_parent_list(struct callchain_node *node)
                                 goto out;
                         *new = *chain;
                         new->has_children = false;
+                        map__get(new->ms.map);
                         list_add_tail(&new->list, &head);
                 }
                 parent = parent->parent;
@@ -1230,6 +1236,7 @@ int callchain_node__make_parent_list(struct callchain_node *node)
 out:
         list_for_each_entry_safe(chain, new, &head, list) {
                 list_del(&chain->list);
+                map__zput(chain->ms.map);
                 free(chain);
         }
         return -ENOMEM;
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 35c8e379530f..4f4b60f1558a 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -5,6 +5,7 @@
 #include <linux/list.h>
 #include <linux/rbtree.h>
 #include "event.h"
+#include "map.h"
 #include "symbol.h"
 
 #define HELP_PAD "\t\t\t\t"
@@ -184,8 +185,13 @@ int callchain_merge(struct callchain_cursor *cursor,
  */
 static inline void callchain_cursor_reset(struct callchain_cursor *cursor)
 {
+        struct callchain_cursor_node *node;
+
         cursor->nr = 0;
         cursor->last = &cursor->first;
+
+        for (node = cursor->first; node != NULL; node = node->next)
+                map__zput(node->map);
 }
 
 int callchain_cursor_append(struct callchain_cursor *cursor, u64 ip,
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 6770a9645609..7d1b7d33e644 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1,6 +1,7 @@
 #include "util.h"
 #include "build-id.h"
 #include "hist.h"
+#include "map.h"
 #include "session.h"
 #include "sort.h"
 #include "evlist.h"
@@ -1019,6 +1020,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
                          int max_stack_depth, void *arg)
 {
         int err, err2;
+        struct map *alm = NULL;
+
+        if (al && al->map)
+                alm = map__get(al->map);
 
         err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent,
                                         iter->evsel, al, max_stack_depth);
@@ -1058,6 +1063,8 @@ out:
         if (!err)
                 err = err2;
 
+        map__put(alm);
+
         return err;
 }
 
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index d4b6514eeef5..28c216e3d5b7 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -283,6 +283,8 @@ void perf_hpp_list__column_register(struct perf_hpp_list *list,
                                     struct perf_hpp_fmt *format);
 void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
                                         struct perf_hpp_fmt *format);
+void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
+                                       struct perf_hpp_fmt *format);
 
 static inline void perf_hpp__column_register(struct perf_hpp_fmt *format)
 {
@@ -294,6 +296,11 @@ static inline void perf_hpp__register_sort_field(struct perf_hpp_fmt *format)
         perf_hpp_list__register_sort_field(&perf_hpp_list, format);
 }
 
+static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
+{
+        perf_hpp_list__prepend_sort_field(&perf_hpp_list, format);
+}
+
 #define perf_hpp_list__for_each_format(_list, format) \
         list_for_each_entry(format, &(_list)->fields, list)