Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc

This fix was intended for 4.13, but didn't get in because both maintainers were on vacation. Paul Mackerras: "It adds mutual exclusion between list_add_rcu and list_del_rcu calls on the kvm->arch.spapr_tce_tables list. Without this, userspace could potentially trigger corruption of the list and cause a host crash or worse."
author: Radim Krčmář <rkrcmar@redhat.com> 2017-09-08 08:40:43 -0400
committer: Radim Krčmář <rkrcmar@redhat.com> 2017-09-08 08:40:43 -0400
commit: 5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760 (patch)
tree: daca83ea5f9af1bd158504bd0b5af89c5a99b7fa
parent: 78809a68490d84eb632a215be2121d4b44c86954 (diff)
parent: edd03602d97236e8fea13cd76886c576186aa307 (diff)
488 files changed, 6346 insertions, 2101 deletions
diff --git a/Documentation/fb/efifb.txt b/Documentation/fb/efifb.txt
index a59916c29b33..1a85c1bdaf38 100644
--- a/Documentation/fb/efifb.txt
+++ b/Documentation/fb/efifb.txt
@@ -27,5 +27,11 @@ You have to add the following kernel parameters in your elilo.conf:
        Macbook Pro 17", iMac 20" :
                video=efifb:i20
+Accepted options:
+nowc    Don't map the framebuffer write combined. This can be used
+        to workaround side-effects and slowdowns on other CPU cores
+        when large amounts of console data are written.
 --
 Edgar Hucek <gimli@dark-green.com>
diff --git a/Documentation/gpio/gpio-legacy.txt b/Documentation/gpio/gpio-legacy.txt
index b34fd94f7089..5eacc147ea87 100644
--- a/Documentation/gpio/gpio-legacy.txt
+++ b/Documentation/gpio/gpio-legacy.txt
@@ -459,7 +459,7 @@ pin controller?
 This is done by registering "ranges" of pins, which are essentially
 cross-reference tables. These are described in
-Documentation/pinctrl.txt
+Documentation/driver-api/pinctl.rst
 While the pin allocation is totally managed by the pinctrl subsystem,
 gpio (under gpiolib) is still maintained by gpio drivers. It may happen
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 65ea5915178b..074670b98bac 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -58,20 +58,23 @@ Symbols/Function Pointers
        %ps     versatile_init
        %pB     prev_fn_of_versatile_init+0x88/0x88
-For printing symbols and function pointers. The ``S`` and ``s`` specifiers
+The ``F`` and ``f`` specifiers are for printing function pointers,
-result in the symbol name with (``S``) or without (``s``) offsets. Where
+for example, f->func, &gettimeofday. They have the same result as
-this is used on a kernel without KALLSYMS - the symbol address is
+``S`` and ``s`` specifiers. But they do an extra conversion on
-printed instead.
+ia64, ppc64 and parisc64 architectures where the function pointers
+are actually function descriptors.
+The ``S`` and ``s`` specifiers can be used for printing symbols
+from direct addresses, for example, __builtin_return_address(0),
+(void *)regs->ip. They result in the symbol name with (``S``) or
+without (``s``) offsets. If KALLSYMS are disabled then the symbol
+address is printed instead.
 The ``B`` specifier results in the symbol name with offsets and should be
 used when printing stack backtraces. The specifier takes into
 consideration the effect of compiler optimisations which may occur
 when tail-call``s are used and marked with the noreturn GCC attribute.
-On ia64, ppc64 and parisc64 architectures function pointers are
-actually function descriptors which must first be resolved. The ``F`` and
-``f`` specifiers perform this resolution and then provide the same
-functionality as the ``S`` and ``s`` specifiers.
 Kernel Pointers
 ===============
diff --git a/MAINTAINERS b/MAINTAINERS
index fc6cfd06abdc..c06454cc7cea 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1161,7 +1161,7 @@ M:	Brendan Higgins <brendanhiggins@google.com>
 R:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
 R:      Joel Stanley <joel@jms.id.au>
 L:      linux-i2c@vger.kernel.org
-L:      openbmc@lists.ozlabs.org
+L:      openbmc@lists.ozlabs.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/irqchip/irq-aspeed-i2c-ic.c
 F:      drivers/i2c/busses/i2c-aspeed.c
@@ -5834,7 +5834,7 @@ F:	drivers/staging/greybus/spi.c
 F:      drivers/staging/greybus/spilib.c
 F:      drivers/staging/greybus/spilib.h
-GREYBUS LOOBACK/TIME PROTOCOLS DRIVERS
+GREYBUS LOOPBACK/TIME PROTOCOLS DRIVERS
 M:      Bryan O'Donoghue <pure.logic@nexus-software.ie>
 S:      Maintained
 F:      drivers/staging/greybus/loopback.c
@@ -7110,7 +7110,6 @@ M:	Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
-T:      git git://git.infradead.org/users/jcooper/linux.git irqchip/core
 F:      Documentation/devicetree/bindings/interrupt-controller/
 F:      drivers/irqchip/
@@ -10398,7 +10397,7 @@ L:	linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git
 S:      Maintained
 F:      Documentation/devicetree/bindings/pinctrl/
-F:      Documentation/pinctrl.txt
+F:      Documentation/driver-api/pinctl.rst
 F:      drivers/pinctrl/
 F:      include/linux/pinctrl/
@@ -14019,6 +14018,7 @@ F:	drivers/block/virtio_blk.c
 F:      include/linux/virtio*.h
 F:      include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
+F:      mm/balloon_compaction.c
 VIRTIO CRYPTO DRIVER
 M:      Gonglei <arei.gonglei@huawei.com>
diff --git a/Makefile b/Makefile
index 6eba23bcb5ad..235826f95741 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index dfcc8e00cf1c..0ade3619f3c3 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -297,6 +297,7 @@
                                #address-cells = <1>;
                                #size-cells = <1>;
                                status = "disabled";
+                                ranges;
                                adc: adc@50030800 {
                                        compatible = "fsl,imx25-gcq";
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
index aeaa5a6e4fcf..a24e4f1911ab 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
@@ -507,7 +507,7 @@
        pinctrl_pcie: pciegrp {
                fsl,pins = <
                        /* PCIe reset */
-                        MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0x030b0
+                        MX6QDL_PAD_EIM_DA0__GPIO3_IO00  0x030b0
                        MX6QDL_PAD_EIM_DA4__GPIO3_IO04  0x030b0
                >;
        };
@@ -668,7 +668,7 @@
 &pcie {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_pcie>;
-        reset-gpio = <&gpio6 31 GPIO_ACTIVE_LOW>;
+        reset-gpio = <&gpio3 0 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 54c45402286b..0a24d1bf3c39 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -557,6 +557,14 @@
                        >;
                };
+                pinctrl_spi4: spi4grp {
+                        fsl,pins = <
+                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
+                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
+                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
+                        >;
+                };
                pinctrl_tsc2046_pendown: tsc2046_pendown {
                        fsl,pins = <
                                MX7D_PAD_EPDC_BDR1__GPIO2_IO29          0x59
@@ -697,13 +705,5 @@
                fsl,pins = <
                        MX7D_PAD_LPSR_GPIO1_IO01__PWM1_OUT              0x110b0
                >;
-                pinctrl_spi4: spi4grp {
-                        fsl,pins = <
-                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
-                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
-                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
-                        >;
-                };
        };
 };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index cc06da394366..60e69aeacbdb 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -303,7 +303,7 @@
                        #size-cells = <1>;
                        atmel,smc = <&hsmc>;
                        reg = <0x10000000 0x10000000
-                               0x40000000 0x30000000>;
+                               0x60000000 0x30000000>;
                        ranges = <0x0 0x0 0x10000000 0x10000000
                                  0x1 0x0 0x60000000 0x10000000
                                  0x2 0x0 0x70000000 0x10000000
@@ -1048,18 +1048,18 @@
                        };
                        hsmc: hsmc@f8014000 {
-                                compatible = "atmel,sama5d3-smc", "syscon", "simple-mfd";
+                                compatible = "atmel,sama5d2-smc", "syscon", "simple-mfd";
                                reg = <0xf8014000 0x1000>;
-                                interrupts = <5 IRQ_TYPE_LEVEL_HIGH 6>;
+                                interrupts = <17 IRQ_TYPE_LEVEL_HIGH 6>;
                                clocks = <&hsmc_clk>;
                                #address-cells = <1>;
                                #size-cells = <1>;
                                ranges;
-                                pmecc: ecc-engine@ffffc070 {
+                                pmecc: ecc-engine@f8014070 {
                                        compatible = "atmel,sama5d2-pmecc";
-                                        reg = <0xffffc070 0x490>,
+                                        reg = <0xf8014070 0x490>,
-                                              <0xffffc500 0x100>;
+                                              <0xf8014500 0x100>;
                                };
                        };
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 3f2eb76243e3..d5562f9ce600 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -148,7 +148,8 @@ static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 }
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
 {
        tlb->mm = mm;
        tlb->fullmm = !(start | (end+1));
@@ -166,8 +167,14 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
 }
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                        unsigned long start, unsigned long end, bool force)
 {
+        if (force) {
+                tlb->range_start = start;
+                tlb->range_end = end;
+        }
        tlb_flush_mmu(tlb);
        /* keep the page table cache within bounds */
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index 0d1f026d831a..ba2fde2909f9 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -51,6 +51,7 @@
        compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
        aliases {
+                ethernet0 = &emac;
                serial0 = &uart0;
                serial1 = &uart1;
        };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index 08cda24ea194..827168bc22ed 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -51,6 +51,7 @@
        compatible = "pine64,pine64", "allwinner,sun50i-a64";
        aliases {
+                ethernet0 = &emac;
                serial0 = &uart0;
                serial1 = &uart1;
                serial2 = &uart2;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
index 17eb1cc5bf6b..216e3a5dafae 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
@@ -53,6 +53,7 @@
                     "allwinner,sun50i-a64";
        aliases {
+                ethernet0 = &emac;
                serial0 = &uart0;
        };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
index 732e2e06f503..d9a720bff05d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
@@ -120,5 +120,8 @@
 };
 &pio {
+        interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
        compatible = "allwinner,sun50i-h5-pinctrl";
 };
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index a451996f590a..f903957da504 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -45,7 +45,7 @@
                stdout-path = "serial0:115200n8";
        };
-        audio_clkout: audio_clkout {
+        audio_clkout: audio-clkout {
                /*
                 * This is same as <&rcar_sound 0>
                 * but needed to avoid cs2000/rcar_sound probe dead-lock
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index 74d08e44a651..a652ce0a5cb2 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -65,13 +65,13 @@ DECLARE_PER_CPU(const struct arch_timer_erratum_workaround *,
        u64 _val;                                                       \
        if (needs_unstable_timer_counter_workaround()) {                \
                const struct arch_timer_erratum_workaround *wa;         \
-                preempt_disable();                                      \
+                preempt_disable_notrace();                              \
                wa = __this_cpu_read(timer_unstable_counter_workaround); \
                if (wa && wa->read_##reg)                               \
                        _val = wa->read_##reg();                        \
                else                                                    \
                        _val = read_sysreg(reg);                        \
-                preempt_enable();                                       \
+                preempt_enable_notrace();                               \
        } else {                                                        \
                _val = read_sysreg(reg);                                \
        }                                                               \
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index acae781f7359..3288c2b36731 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -114,10 +114,10 @@
 /*
 * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
 * space open for things that want to use the area for 32-bit pointers.
 */
-#define ELF_ET_DYN_BASE         0x100000000UL
+#define ELF_ET_DYN_BASE         (2 * TASK_SIZE_64 / 3)
 #ifndef __ASSEMBLY__
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index fced197b9626..cbe5ac3699bf 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -168,7 +168,8 @@ static inline void __tlb_alloc_page(struct mmu_gather *tlb)
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
 {
        tlb->mm = mm;
        tlb->max = ARRAY_SIZE(tlb->local);
@@ -185,8 +186,11 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
 * collected.
 */
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                        unsigned long start, unsigned long end, bool force)
 {
+        if (force)
+                tlb->need_flush = 1;
        /*
         * Note: tlb->nr may be 0 at this point, so we can't rely on tlb->start_addr and
         * tlb->end_addr.
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 8dd20358464f..48d91d5be4e9 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2260,7 +2260,7 @@ config CPU_R4K_CACHE_TLB
 config MIPS_MT_SMP
        bool "MIPS MT SMP support (1 TC on each available VPE)"
-        depends on SYS_SUPPORTS_MULTITHREADING && !CPU_MIPSR6
+        depends on SYS_SUPPORTS_MULTITHREADING && !CPU_MIPSR6 && !CPU_MICROMIPS
        select CPU_MIPSR2_IRQ_VI
        select CPU_MIPSR2_IRQ_EI
        select SYNC_R4K
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 04343625b929..bc2708c9ada4 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -243,8 +243,21 @@ include arch/mips/Kbuild.platforms
 ifdef CONFIG_PHYSICAL_START
 load-y                                  = $(CONFIG_PHYSICAL_START)
 endif
-entry-y                         = 0x$(shell $(NM) vmlinux 2>/dev/null \
+entry-noisa-y                           = 0x$(shell $(NM) vmlinux 2>/dev/null \
                                        | grep "\bkernel_entry\b" | cut -f1 -d \ )
+ifdef CONFIG_CPU_MICROMIPS
+  #
+  # Set the ISA bit, since the kernel_entry symbol in the ELF will have it
+  # clear which would lead to images containing addresses which bootloaders may
+  # jump to as MIPS32 code.
+  #
+  entry-y = $(patsubst %0,%1,$(patsubst %2,%3,$(patsubst %4,%5, \
+              $(patsubst %6,%7,$(patsubst %8,%9,$(patsubst %a,%b, \
+              $(patsubst %c,%d,$(patsubst %e,%f,$(entry-noisa-y)))))))))
+else
+  entry-y = $(entry-noisa-y)
+endif
 cflags-y                        += -I$(srctree)/arch/mips/include/asm/mach-generic
 drivers-$(CONFIG_PCI)           += arch/mips/pci/
diff --git a/arch/mips/boot/compressed/.gitignore b/arch/mips/boot/compressed/.gitignore
new file mode 100644
index 000000000000..ebae133f1d00
--- /dev/null
+++ b/arch/mips/boot/compressed/.gitignore
@@ -0,0 +1,2 @@
+ashldi3.c
+bswapsi.c
diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c
index 542be1cd0f32..bfdfaf32d2c4 100644
--- a/arch/mips/cavium-octeon/octeon-usb.c
+++ b/arch/mips/cavium-octeon/octeon-usb.c
@@ -13,9 +13,9 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/of_platform.h>
+#include <linux/io.h>
 #include <asm/octeon/octeon.h>
-#include <asm/octeon/cvmx-gpio-defs.h>
 /* USB Control Register */
 union cvm_usbdrd_uctl_ctl {
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 1910223a9c02..cea2bb1621e6 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -147,23 +147,12 @@
                 * Find irq with highest priority
                 */
                # open coded PTR_LA t1, cpu_mask_nr_tbl
-#if (_MIPS_SZPTR == 32)
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
                # open coded la t1, cpu_mask_nr_tbl
                lui     t1, %hi(cpu_mask_nr_tbl)
                addiu   t1, %lo(cpu_mask_nr_tbl)
+#else
-#endif
+#error GCC `-msym32' option required for 64-bit DECstation builds
-#if (_MIPS_SZPTR == 64)
-                # open coded dla t1, cpu_mask_nr_tbl
-                .set    push
-                .set    noat
-                lui     t1, %highest(cpu_mask_nr_tbl)
-                lui     AT, %hi(cpu_mask_nr_tbl)
-                daddiu  t1, t1, %higher(cpu_mask_nr_tbl)
-                daddiu  AT, AT, %lo(cpu_mask_nr_tbl)
-                dsll    t1, 32
-                daddu   t1, t1, AT
-                .set    pop
 #endif
 1:              lw      t2,(t1)
                nop
@@ -214,23 +203,12 @@
                 * Find irq with highest priority
                 */
                # open coded PTR_LA t1,asic_mask_nr_tbl
-#if (_MIPS_SZPTR == 32)
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
                # open coded la t1, asic_mask_nr_tbl
                lui     t1, %hi(asic_mask_nr_tbl)
                addiu   t1, %lo(asic_mask_nr_tbl)
+#else
-#endif
+#error GCC `-msym32' option required for 64-bit DECstation builds
-#if (_MIPS_SZPTR == 64)
-                # open coded dla t1, asic_mask_nr_tbl
-                .set    push
-                .set    noat
-                lui     t1, %highest(asic_mask_nr_tbl)
-                lui     AT, %hi(asic_mask_nr_tbl)
-                daddiu  t1, t1, %higher(asic_mask_nr_tbl)
-                daddiu  AT, AT, %lo(asic_mask_nr_tbl)
-                dsll    t1, 32
-                daddu   t1, t1, AT
-                .set    pop
 #endif
 2:              lw      t2,(t1)
                nop
diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
index fc67947ed658..8b14c2706aa5 100644
--- a/arch/mips/include/asm/cache.h
+++ b/arch/mips/include/asm/cache.h
@@ -9,6 +9,8 @@
 #ifndef _ASM_CACHE_H
 #define _ASM_CACHE_H
+#include <kmalloc.h>
 #define L1_CACHE_SHIFT          CONFIG_MIPS_L1_CACHE_SHIFT
 #define L1_CACHE_BYTES          (1 << L1_CACHE_SHIFT)
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 8baa9033b181..721b698bfe3c 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -428,6 +428,9 @@
 #ifndef cpu_scache_line_size
 #define cpu_scache_line_size()  cpu_data[0].scache.linesz
 #endif
+#ifndef cpu_tcache_line_size
+#define cpu_tcache_line_size()  cpu_data[0].tcache.linesz
+#endif
 #ifndef cpu_hwrena_impl_bits
 #define cpu_hwrena_impl_bits            0
diff --git a/arch/mips/include/asm/octeon/cvmx-l2c-defs.h b/arch/mips/include/asm/octeon/cvmx-l2c-defs.h
index d045973ddb33..3ea84acf1814 100644
--- a/arch/mips/include/asm/octeon/cvmx-l2c-defs.h
+++ b/arch/mips/include/asm/octeon/cvmx-l2c-defs.h
@@ -33,6 +33,10 @@
 #define CVMX_L2C_DBG (CVMX_ADD_IO_SEG(0x0001180080000030ull))
 #define CVMX_L2C_CFG (CVMX_ADD_IO_SEG(0x0001180080000000ull))
 #define CVMX_L2C_CTL (CVMX_ADD_IO_SEG(0x0001180080800000ull))
+#define CVMX_L2C_ERR_TDTX(block_id)                                            \
+        (CVMX_ADD_IO_SEG(0x0001180080A007E0ull) + ((block_id) & 3) * 0x40000ull)
+#define CVMX_L2C_ERR_TTGX(block_id)                                            \
+        (CVMX_ADD_IO_SEG(0x0001180080A007E8ull) + ((block_id) & 3) * 0x40000ull)
 #define CVMX_L2C_LCKBASE (CVMX_ADD_IO_SEG(0x0001180080000058ull))
 #define CVMX_L2C_LCKOFF (CVMX_ADD_IO_SEG(0x0001180080000060ull))
 #define CVMX_L2C_PFCTL (CVMX_ADD_IO_SEG(0x0001180080000090ull))
@@ -66,9 +70,40 @@
                ((offset) & 1) * 8)
 #define CVMX_L2C_WPAR_PPX(offset) (CVMX_ADD_IO_SEG(0x0001180080840000ull)    + \
                ((offset) & 31) * 8)
-#define CVMX_L2D_FUS3 (CVMX_ADD_IO_SEG(0x00011800800007B8ull))
+union cvmx_l2c_err_tdtx {
+        uint64_t u64;
+        struct cvmx_l2c_err_tdtx_s {
+                __BITFIELD_FIELD(uint64_t dbe:1,
+                __BITFIELD_FIELD(uint64_t sbe:1,
+                __BITFIELD_FIELD(uint64_t vdbe:1,
+                __BITFIELD_FIELD(uint64_t vsbe:1,
+                __BITFIELD_FIELD(uint64_t syn:10,
+                __BITFIELD_FIELD(uint64_t reserved_22_49:28,
+                __BITFIELD_FIELD(uint64_t wayidx:18,
+                __BITFIELD_FIELD(uint64_t reserved_2_3:2,
+                __BITFIELD_FIELD(uint64_t type:2,
+                ;)))))))))
+        } s;
+};
+union cvmx_l2c_err_ttgx {
+        uint64_t u64;
+        struct cvmx_l2c_err_ttgx_s {
+                __BITFIELD_FIELD(uint64_t dbe:1,
+                __BITFIELD_FIELD(uint64_t sbe:1,
+                __BITFIELD_FIELD(uint64_t noway:1,
+                __BITFIELD_FIELD(uint64_t reserved_56_60:5,
+                __BITFIELD_FIELD(uint64_t syn:6,
+                __BITFIELD_FIELD(uint64_t reserved_22_49:28,
+                __BITFIELD_FIELD(uint64_t wayidx:15,
+                __BITFIELD_FIELD(uint64_t reserved_2_6:5,
+                __BITFIELD_FIELD(uint64_t type:2,
+                ;)))))))))
+        } s;
+};
 union cvmx_l2c_cfg {
        uint64_t u64;
        struct cvmx_l2c_cfg_s {
diff --git a/arch/mips/include/asm/octeon/cvmx-l2d-defs.h b/arch/mips/include/asm/octeon/cvmx-l2d-defs.h
new file mode 100644
index 000000000000..a951ad5d65ad
--- /dev/null
+++ b/arch/mips/include/asm/octeon/cvmx-l2d-defs.h
@@ -0,0 +1,60 @@
+/***********************license start***************
+ * Author: Cavium Networks
+ *
+ * Contact: support@caviumnetworks.com
+ * This file is part of the OCTEON SDK
+ *
+ * Copyright (c) 2003-2017 Cavium, Inc.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, Version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This file is distributed in the hope that it will be useful, but
+ * AS-IS and WITHOUT ANY WARRANTY; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE, TITLE, or
+ * NONINFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this file; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ * or visit http://www.gnu.org/licenses/.
+ *
+ * This file may also be available under a different license from Cavium.
+ * Contact Cavium Networks for more information
+ ***********************license end**************************************/
+#ifndef __CVMX_L2D_DEFS_H__
+#define __CVMX_L2D_DEFS_H__
+#define CVMX_L2D_ERR    (CVMX_ADD_IO_SEG(0x0001180080000010ull))
+#define CVMX_L2D_FUS3   (CVMX_ADD_IO_SEG(0x00011800800007B8ull))
+union cvmx_l2d_err {
+        uint64_t u64;
+        struct cvmx_l2d_err_s {
+                __BITFIELD_FIELD(uint64_t reserved_6_63:58,
+                __BITFIELD_FIELD(uint64_t bmhclsel:1,
+                __BITFIELD_FIELD(uint64_t ded_err:1,
+                __BITFIELD_FIELD(uint64_t sec_err:1,
+                __BITFIELD_FIELD(uint64_t ded_intena:1,
+                __BITFIELD_FIELD(uint64_t sec_intena:1,
+                __BITFIELD_FIELD(uint64_t ecc_ena:1,
+                ;)))))))
+        } s;
+};
+union cvmx_l2d_fus3 {
+        uint64_t u64;
+        struct cvmx_l2d_fus3_s {
+                __BITFIELD_FIELD(uint64_t reserved_40_63:24,
+                __BITFIELD_FIELD(uint64_t ema_ctl:3,
+                __BITFIELD_FIELD(uint64_t reserved_34_36:3,
+                __BITFIELD_FIELD(uint64_t q3fus:34,
+                ;))))
+        } s;
+};
+#endif
diff --git a/arch/mips/include/asm/octeon/cvmx.h b/arch/mips/include/asm/octeon/cvmx.h
index 9742202f2a32..e638735cc3ac 100644
--- a/arch/mips/include/asm/octeon/cvmx.h
+++ b/arch/mips/include/asm/octeon/cvmx.h
@@ -62,6 +62,7 @@ enum cvmx_mips_space {
 #include <asm/octeon/cvmx-iob-defs.h>
 #include <asm/octeon/cvmx-ipd-defs.h>
 #include <asm/octeon/cvmx-l2c-defs.h>
+#include <asm/octeon/cvmx-l2d-defs.h>
 #include <asm/octeon/cvmx-l2t-defs.h>
 #include <asm/octeon/cvmx-led-defs.h>
 #include <asm/octeon/cvmx-mio-defs.h>
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 770d4d1516cb..6bace7695788 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -376,9 +376,6 @@ asmlinkage void start_secondary(void)
        cpumask_set_cpu(cpu, &cpu_coherent_mask);
        notify_cpu_starting(cpu);
-        complete(&cpu_running);
-        synchronise_count_slave(cpu);
        set_cpu_online(cpu, true);
        set_cpu_sibling_map(cpu);
@@ -386,6 +383,9 @@ asmlinkage void start_secondary(void)
        calculate_cpu_foreign_map();
+        complete(&cpu_running);
+        synchronise_count_slave(cpu);
        /*
         * irq will be enabled in ->smp_finish(), enabling it too early
         * is dangerous.
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index 3f74f6c1f065..9fea6c6bbf49 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -48,7 +48,7 @@
 #include "uasm.c"
-static const struct insn const insn_table[insn_invalid] = {
+static const struct insn insn_table[insn_invalid] = {
        [insn_addiu]    = {M(addiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM},
        [insn_addu]     = {M(spec_op, 0, 0, 0, 0, addu_op), RS | RT | RD},
        [insn_and]      = {M(spec_op, 0, 0, 0, 0, and_op), RS | RT | RD},
diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
new file mode 100644
index 000000000000..3f87b96da5c4
--- /dev/null
+++ b/arch/mips/net/ebpf_jit.c
@@ -0,0 +1,1950 @@
+/*
+ * Just-In-Time compiler for eBPF filters on MIPS
+ *
+ * Copyright (c) 2017 Cavium, Inc.
+ *
+ * Based on code from:
+ *
+ * Copyright (c) 2014 Imagination Technologies Ltd.
+ * Author: Markos Chandras <markos.chandras@imgtec.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License.
+ */
+#include <linux/bitops.h>
+#include <linux/errno.h>
+#include <linux/filter.h>
+#include <linux/bpf.h>
+#include <linux/slab.h>
+#include <asm/bitops.h>
+#include <asm/byteorder.h>
+#include <asm/cacheflush.h>
+#include <asm/cpu-features.h>
+#include <asm/uasm.h>
+/* Registers used by JIT */
+#define MIPS_R_ZERO     0
+#define MIPS_R_AT       1
+#define MIPS_R_V0       2       /* BPF_R0 */
+#define MIPS_R_V1       3
+#define MIPS_R_A0       4       /* BPF_R1 */
+#define MIPS_R_A1       5       /* BPF_R2 */
+#define MIPS_R_A2       6       /* BPF_R3 */
+#define MIPS_R_A3       7       /* BPF_R4 */
+#define MIPS_R_A4       8       /* BPF_R5 */
+#define MIPS_R_T4       12      /* BPF_AX */
+#define MIPS_R_T5       13
+#define MIPS_R_T6       14
+#define MIPS_R_T7       15
+#define MIPS_R_S0       16      /* BPF_R6 */
+#define MIPS_R_S1       17      /* BPF_R7 */
+#define MIPS_R_S2       18      /* BPF_R8 */
+#define MIPS_R_S3       19      /* BPF_R9 */
+#define MIPS_R_S4       20      /* BPF_TCC */
+#define MIPS_R_S5       21
+#define MIPS_R_S6       22
+#define MIPS_R_S7       23
+#define MIPS_R_T8       24
+#define MIPS_R_T9       25
+#define MIPS_R_SP       29
+#define MIPS_R_RA       31
+/* eBPF flags */
+#define EBPF_SAVE_S0    BIT(0)
+#define EBPF_SAVE_S1    BIT(1)
+#define EBPF_SAVE_S2    BIT(2)
+#define EBPF_SAVE_S3    BIT(3)
+#define EBPF_SAVE_S4    BIT(4)
+#define EBPF_SAVE_RA    BIT(5)
+#define EBPF_SEEN_FP    BIT(6)
+#define EBPF_SEEN_TC    BIT(7)
+#define EBPF_TCC_IN_V1  BIT(8)
+/*
+ * For the mips64 ISA, we need to track the value range or type for
+ * each JIT register.  The BPF machine requires zero extended 32-bit
+ * values, but the mips64 ISA requires sign extended 32-bit values.
+ * At each point in the BPF program we track the state of every
+ * register so that we can zero extend or sign extend as the BPF
+ * semantics require.
+ */
+enum reg_val_type {
+        /* uninitialized */
+        REG_UNKNOWN,
+        /* not known to be 32-bit compatible. */
+        REG_64BIT,
+        /* 32-bit compatible, no truncation needed for 64-bit ops. */
+        REG_64BIT_32BIT,
+        /* 32-bit compatible, need truncation for 64-bit ops. */
+        REG_32BIT,
+        /* 32-bit zero extended. */
+        REG_32BIT_ZERO_EX,
+        /* 32-bit no sign/zero extension needed. */
+        REG_32BIT_POS
+};
+/*
+ * high bit of offsets indicates if long branch conversion done at
+ * this insn.
+ */
+#define OFFSETS_B_CONV  BIT(31)
+/**
+ * struct jit_ctx - JIT context
+ * @skf:                The sk_filter
+ * @stack_size:         eBPF stack size
+ * @tmp_offset:         eBPF $sp offset to 8-byte temporary memory
+ * @idx:                Instruction index
+ * @flags:              JIT flags
+ * @offsets:            Instruction offsets
+ * @target:             Memory location for the compiled filter
+ * @reg_val_types       Packed enum reg_val_type for each register.
+ */
+struct jit_ctx {
+        const struct bpf_prog *skf;
+        int stack_size;
+        int tmp_offset;
+        u32 idx;
+        u32 flags;
+        u32 *offsets;
+        u32 *target;
+        u64 *reg_val_types;
+        unsigned int long_b_conversion:1;
+        unsigned int gen_b_offsets:1;
+};
+static void set_reg_val_type(u64 *rvt, int reg, enum reg_val_type type)
+{
+        *rvt &= ~(7ull << (reg * 3));
+        *rvt |= ((u64)type << (reg * 3));
+}
+static enum reg_val_type get_reg_val_type(const struct jit_ctx *ctx,
+                                          int index, int reg)
+{
+        return (ctx->reg_val_types[index] >> (reg * 3)) & 7;
+}
+/* Simply emit the instruction if the JIT memory space has been allocated */
+#define emit_instr(ctx, func, ...)                      \
+do {                                                    \
+        if ((ctx)->target != NULL) {                    \
+                u32 *p = &(ctx)->target[ctx->idx];      \
+                uasm_i_##func(&p, ##__VA_ARGS__);       \
+        }                                               \
+        (ctx)->idx++;                                   \
+} while (0)
+static unsigned int j_target(struct jit_ctx *ctx, int target_idx)
+{
+        unsigned long target_va, base_va;
+        unsigned int r;
+        if (!ctx->target)
+                return 0;
+        base_va = (unsigned long)ctx->target;
+        target_va = base_va + (ctx->offsets[target_idx] & ~OFFSETS_B_CONV);
+        if ((base_va & ~0x0ffffffful) != (target_va & ~0x0ffffffful))
+                return (unsigned int)-1;
+        r = target_va & 0x0ffffffful;
+        return r;
+}
+/* Compute the immediate value for PC-relative branches. */
+static u32 b_imm(unsigned int tgt, struct jit_ctx *ctx)
+{
+        if (!ctx->gen_b_offsets)
+                return 0;
+        /*
+         * We want a pc-relative branch.  tgt is the instruction offset
+         * we want to jump to.
+         * Branch on MIPS:
+         * I: target_offset <- sign_extend(offset)
+         * I+1: PC += target_offset (delay slot)
+         *
+         * ctx->idx currently points to the branch instruction
+         * but the offset is added to the delay slot so we need
+         * to subtract 4.
+         */
+        return (ctx->offsets[tgt] & ~OFFSETS_B_CONV) -
+                (ctx->idx * 4) - 4;
+}
+int bpf_jit_enable __read_mostly;
+enum which_ebpf_reg {
+        src_reg,
+        src_reg_no_fp,
+        dst_reg,
+        dst_reg_fp_ok
+};
+/*
+ * For eBPF, the register mapping naturally falls out of the
+ * requirements of eBPF and the MIPS n64 ABI.  We don't maintain a
+ * separate frame pointer, so BPF_REG_10 relative accesses are
+ * adjusted to be $sp relative.
+ */
+int ebpf_to_mips_reg(struct jit_ctx *ctx, const struct bpf_insn *insn,
+                     enum which_ebpf_reg w)
+{
+        int ebpf_reg = (w == src_reg || w == src_reg_no_fp) ?
+                insn->src_reg : insn->dst_reg;
+        switch (ebpf_reg) {
+        case BPF_REG_0:
+                return MIPS_R_V0;
+        case BPF_REG_1:
+                return MIPS_R_A0;
+        case BPF_REG_2:
+                return MIPS_R_A1;
+        case BPF_REG_3:
+                return MIPS_R_A2;
+        case BPF_REG_4:
+                return MIPS_R_A3;
+        case BPF_REG_5:
+                return MIPS_R_A4;
+        case BPF_REG_6:
+                ctx->flags |= EBPF_SAVE_S0;
+                return MIPS_R_S0;
+        case BPF_REG_7:
+                ctx->flags |= EBPF_SAVE_S1;
+                return MIPS_R_S1;
+        case BPF_REG_8:
+                ctx->flags |= EBPF_SAVE_S2;
+                return MIPS_R_S2;
+        case BPF_REG_9:
+                ctx->flags |= EBPF_SAVE_S3;
+                return MIPS_R_S3;
+        case BPF_REG_10:
+                if (w == dst_reg || w == src_reg_no_fp)
+                        goto bad_reg;
+                ctx->flags |= EBPF_SEEN_FP;
+                /*
+                 * Needs special handling, return something that
+                 * cannot be clobbered just in case.
+                 */
+                return MIPS_R_ZERO;
+        case BPF_REG_AX:
+                return MIPS_R_T4;
+        default:
+bad_reg:
+                WARN(1, "Illegal bpf reg: %d\n", ebpf_reg);
+                return -EINVAL;
+        }
+}
+/*
+ * eBPF stack frame will be something like:
+ *
+ *  Entry $sp ------>   +--------------------------------+
+ *                      |   $ra  (optional)              |
+ *                      +--------------------------------+
+ *                      |   $s0  (optional)              |
+ *                      +--------------------------------+
+ *                      |   $s1  (optional)              |
+ *                      +--------------------------------+
+ *                      |   $s2  (optional)              |
+ *                      +--------------------------------+
+ *                      |   $s3  (optional)              |
+ *                      +--------------------------------+
+ *                      |   $s4  (optional)              |
+ *                      +--------------------------------+
+ *                      |   tmp-storage  (if $ra saved)  |
+ * $sp + tmp_offset --> +--------------------------------+ <--BPF_REG_10
+ *                      |   BPF_REG_10 relative storage  |
+ *                      |    MAX_BPF_STACK (optional)    |
+ *                      |      .                         |
+ *                      |      .                         |
+ *                      |      .                         |
+ *     $sp -------->    +--------------------------------+
+ *
+ * If BPF_REG_10 is never referenced, then the MAX_BPF_STACK sized
+ * area is not allocated.
+ */
+static int gen_int_prologue(struct jit_ctx *ctx)
+{
+        int stack_adjust = 0;
+        int store_offset;
+        int locals_size;
+        if (ctx->flags & EBPF_SAVE_RA)
+                /*
+                 * If RA we are doing a function call and may need
+                 * extra 8-byte tmp area.
+                 */
+                stack_adjust += 16;
+        if (ctx->flags & EBPF_SAVE_S0)
+                stack_adjust += 8;
+        if (ctx->flags & EBPF_SAVE_S1)
+                stack_adjust += 8;
+        if (ctx->flags & EBPF_SAVE_S2)
+                stack_adjust += 8;
+        if (ctx->flags & EBPF_SAVE_S3)
+                stack_adjust += 8;
+        if (ctx->flags & EBPF_SAVE_S4)
+                stack_adjust += 8;
+        BUILD_BUG_ON(MAX_BPF_STACK & 7);
+        locals_size = (ctx->flags & EBPF_SEEN_FP) ? MAX_BPF_STACK : 0;
+        stack_adjust += locals_size;
+        ctx->tmp_offset = locals_size;
+        ctx->stack_size = stack_adjust;
+        /*
+         * First instruction initializes the tail call count (TCC).
+         * On tail call we skip this instruction, and the TCC is
+         * passed in $v1 from the caller.
+         */
+        emit_instr(ctx, daddiu, MIPS_R_V1, MIPS_R_ZERO, MAX_TAIL_CALL_CNT);
+        if (stack_adjust)
+                emit_instr(ctx, daddiu, MIPS_R_SP, MIPS_R_SP, -stack_adjust);
+        else
+                return 0;
+        store_offset = stack_adjust - 8;
+        if (ctx->flags & EBPF_SAVE_RA) {
+                emit_instr(ctx, sd, MIPS_R_RA, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S0) {
+                emit_instr(ctx, sd, MIPS_R_S0, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S1) {
+                emit_instr(ctx, sd, MIPS_R_S1, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S2) {
+                emit_instr(ctx, sd, MIPS_R_S2, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S3) {
+                emit_instr(ctx, sd, MIPS_R_S3, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S4) {
+                emit_instr(ctx, sd, MIPS_R_S4, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if ((ctx->flags & EBPF_SEEN_TC) && !(ctx->flags & EBPF_TCC_IN_V1))
+                emit_instr(ctx, daddu, MIPS_R_S4, MIPS_R_V1, MIPS_R_ZERO);
+        return 0;
+}
+static int build_int_epilogue(struct jit_ctx *ctx, int dest_reg)
+{
+        const struct bpf_prog *prog = ctx->skf;
+        int stack_adjust = ctx->stack_size;
+        int store_offset = stack_adjust - 8;
+        int r0 = MIPS_R_V0;
+        if (dest_reg == MIPS_R_RA &&
+            get_reg_val_type(ctx, prog->len, BPF_REG_0) == REG_32BIT_ZERO_EX)
+                /* Don't let zero extended value escape. */
+                emit_instr(ctx, sll, r0, r0, 0);
+        if (ctx->flags & EBPF_SAVE_RA) {
+                emit_instr(ctx, ld, MIPS_R_RA, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S0) {
+                emit_instr(ctx, ld, MIPS_R_S0, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S1) {
+                emit_instr(ctx, ld, MIPS_R_S1, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S2) {
+                emit_instr(ctx, ld, MIPS_R_S2, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S3) {
+                emit_instr(ctx, ld, MIPS_R_S3, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        if (ctx->flags & EBPF_SAVE_S4) {
+                emit_instr(ctx, ld, MIPS_R_S4, store_offset, MIPS_R_SP);
+                store_offset -= 8;
+        }
+        emit_instr(ctx, jr, dest_reg);
+        if (stack_adjust)
+                emit_instr(ctx, daddiu, MIPS_R_SP, MIPS_R_SP, stack_adjust);
+        else
+                emit_instr(ctx, nop);
+        return 0;
+}
+static void gen_imm_to_reg(const struct bpf_insn *insn, int reg,
+                           struct jit_ctx *ctx)
+{
+        if (insn->imm >= S16_MIN && insn->imm <= S16_MAX) {
+                emit_instr(ctx, addiu, reg, MIPS_R_ZERO, insn->imm);
+        } else {
+                int lower = (s16)(insn->imm & 0xffff);
+                int upper = insn->imm - lower;
+                emit_instr(ctx, lui, reg, upper >> 16);
+                emit_instr(ctx, addiu, reg, reg, lower);
+        }
+}
+static int gen_imm_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
+                        int idx)
+{
+        int upper_bound, lower_bound;
+        int dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+        if (dst < 0)
+                return dst;
+        switch (BPF_OP(insn->code)) {
+        case BPF_MOV:
+        case BPF_ADD:
+                upper_bound = S16_MAX;
+                lower_bound = S16_MIN;
+                break;
+        case BPF_SUB:
+                upper_bound = -(int)S16_MIN;
+                lower_bound = -(int)S16_MAX;
+                break;
+        case BPF_AND:
+        case BPF_OR:
+        case BPF_XOR:
+                upper_bound = 0xffff;
+                lower_bound = 0;
+                break;
+        case BPF_RSH:
+        case BPF_LSH:
+        case BPF_ARSH:
+                /* Shift amounts are truncated, no need for bounds */
+                upper_bound = S32_MAX;
+                lower_bound = S32_MIN;
+                break;
+        default:
+                return -EINVAL;
+        }
+        /*
+         * Immediate move clobbers the register, so no sign/zero
+         * extension needed.
+         */
+        if (BPF_CLASS(insn->code) == BPF_ALU64 &&
+            BPF_OP(insn->code) != BPF_MOV &&
+            get_reg_val_type(ctx, idx, insn->dst_reg) == REG_32BIT)
+                emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
+        /* BPF_ALU | BPF_LSH doesn't need separate sign extension */
+        if (BPF_CLASS(insn->code) == BPF_ALU &&
+            BPF_OP(insn->code) != BPF_LSH &&
+            BPF_OP(insn->code) != BPF_MOV &&
+            get_reg_val_type(ctx, idx, insn->dst_reg) != REG_32BIT)
+                emit_instr(ctx, sll, dst, dst, 0);
+        if (insn->imm >= lower_bound && insn->imm <= upper_bound) {
+                /* single insn immediate case */
+                switch (BPF_OP(insn->code) | BPF_CLASS(insn->code)) {
+                case BPF_ALU64 | BPF_MOV:
+                        emit_instr(ctx, daddiu, dst, MIPS_R_ZERO, insn->imm);
+                        break;
+                case BPF_ALU64 | BPF_AND:
+                case BPF_ALU | BPF_AND:
+                        emit_instr(ctx, andi, dst, dst, insn->imm);
+                        break;
+                case BPF_ALU64 | BPF_OR:
+                case BPF_ALU | BPF_OR:
+                        emit_instr(ctx, ori, dst, dst, insn->imm);
+                        break;
+                case BPF_ALU64 | BPF_XOR:
+                case BPF_ALU | BPF_XOR:
+                        emit_instr(ctx, xori, dst, dst, insn->imm);
+                        break;
+                case BPF_ALU64 | BPF_ADD:
+                        emit_instr(ctx, daddiu, dst, dst, insn->imm);
+                        break;
+                case BPF_ALU64 | BPF_SUB:
+                        emit_instr(ctx, daddiu, dst, dst, -insn->imm);
+                        break;
+                case BPF_ALU64 | BPF_RSH:
+                        emit_instr(ctx, dsrl_safe, dst, dst, insn->imm & 0x3f);
+                        break;
+                case BPF_ALU | BPF_RSH:
+                        emit_instr(ctx, srl, dst, dst, insn->imm & 0x1f);
+                        break;
+                case BPF_ALU64 | BPF_LSH:
+                        emit_instr(ctx, dsll_safe, dst, dst, insn->imm & 0x3f);
+                        break;
+                case BPF_ALU | BPF_LSH:
+                        emit_instr(ctx, sll, dst, dst, insn->imm & 0x1f);
+                        break;
+                case BPF_ALU64 | BPF_ARSH:
+                        emit_instr(ctx, dsra_safe, dst, dst, insn->imm & 0x3f);
+                        break;
+                case BPF_ALU | BPF_ARSH:
+                        emit_instr(ctx, sra, dst, dst, insn->imm & 0x1f);
+                        break;
+                case BPF_ALU | BPF_MOV:
+                        emit_instr(ctx, addiu, dst, MIPS_R_ZERO, insn->imm);
+                        break;
+                case BPF_ALU | BPF_ADD:
+                        emit_instr(ctx, addiu, dst, dst, insn->imm);
+                        break;
+                case BPF_ALU | BPF_SUB:
+                        emit_instr(ctx, addiu, dst, dst, -insn->imm);
+                        break;
+                default:
+                        return -EINVAL;
+                }
+        } else {
+                /* multi insn immediate case */
+                if (BPF_OP(insn->code) == BPF_MOV) {
+                        gen_imm_to_reg(insn, dst, ctx);
+                } else {
+                        gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                        switch (BPF_OP(insn->code) | BPF_CLASS(insn->code)) {
+                        case BPF_ALU64 | BPF_AND:
+                        case BPF_ALU | BPF_AND:
+                                emit_instr(ctx, and, dst, dst, MIPS_R_AT);
+                                break;
+                        case BPF_ALU64 | BPF_OR:
+                        case BPF_ALU | BPF_OR:
+                                emit_instr(ctx, or, dst, dst, MIPS_R_AT);
+                                break;
+                        case BPF_ALU64 | BPF_XOR:
+                        case BPF_ALU | BPF_XOR:
+                                emit_instr(ctx, xor, dst, dst, MIPS_R_AT);
+                                break;
+                        case BPF_ALU64 | BPF_ADD:
+                                emit_instr(ctx, daddu, dst, dst, MIPS_R_AT);
+                                break;
+                        case BPF_ALU64 | BPF_SUB:
+                                emit_instr(ctx, dsubu, dst, dst, MIPS_R_AT);
+                                break;
+                        case BPF_ALU | BPF_ADD:
+                                emit_instr(ctx, addu, dst, dst, MIPS_R_AT);
+                                break;
+                        case BPF_ALU | BPF_SUB:
+                                emit_instr(ctx, subu, dst, dst, MIPS_R_AT);
+                                break;
+                        default:
+                                return -EINVAL;
+                        }
+                }
+        }
+        return 0;
+}
+static void * __must_check
+ool_skb_header_pointer(const struct sk_buff *skb, int offset,
+                       int len, void *buffer)
+{
+        return skb_header_pointer(skb, offset, len, buffer);
+}
+static int size_to_len(const struct bpf_insn *insn)
+{
+        switch (BPF_SIZE(insn->code)) {
+        case BPF_B:
+                return 1;
+        case BPF_H:
+                return 2;
+        case BPF_W:
+                return 4;
+        case BPF_DW:
+                return 8;
+        }
+        return 0;
+}
+static void emit_const_to_reg(struct jit_ctx *ctx, int dst, u64 value)
+{
+        if (value >= 0xffffffffffff8000ull || value < 0x8000ull) {
+                emit_instr(ctx, daddiu, dst, MIPS_R_ZERO, (int)value);
+        } else if (value >= 0xffffffff80000000ull ||
+                   (value < 0x80000000 && value > 0xffff)) {
+                emit_instr(ctx, lui, dst, (s32)(s16)(value >> 16));
+                emit_instr(ctx, ori, dst, dst, (unsigned int)(value & 0xffff));
+        } else {
+                int i;
+                bool seen_part = false;
+                int needed_shift = 0;
+                for (i = 0; i < 4; i++) {
+                        u64 part = (value >> (16 * (3 - i))) & 0xffff;
+                        if (seen_part && needed_shift > 0 && (part || i == 3)) {
+                                emit_instr(ctx, dsll_safe, dst, dst, needed_shift);
+                                needed_shift = 0;
+                        }
+                        if (part) {
+                                if (i == 0 || (!seen_part && i < 3 && part < 0x8000)) {
+                                        emit_instr(ctx, lui, dst, (s32)(s16)part);
+                                        needed_shift = -16;
+                                } else {
+                                        emit_instr(ctx, ori, dst,
+                                                   seen_part ? dst : MIPS_R_ZERO,
+                                                   (unsigned int)part);
+                                }
+                                seen_part = true;
+                        }
+                        if (seen_part)
+                                needed_shift += 16;
+                }
+        }
+}
+static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx)
+{
+        int off, b_off;
+        ctx->flags |= EBPF_SEEN_TC;
+        /*
+         * if (index >= array->map.max_entries)
+         *     goto out;
+         */
+        off = offsetof(struct bpf_array, map.max_entries);
+        emit_instr(ctx, lwu, MIPS_R_T5, off, MIPS_R_A1);
+        emit_instr(ctx, sltu, MIPS_R_AT, MIPS_R_T5, MIPS_R_A2);
+        b_off = b_imm(this_idx + 1, ctx);
+        emit_instr(ctx, bne, MIPS_R_AT, MIPS_R_ZERO, b_off);
+        /*
+         * if (--TCC < 0)
+         *     goto out;
+         */
+        /* Delay slot */
+        emit_instr(ctx, daddiu, MIPS_R_T5,
+                   (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4, -1);
+        b_off = b_imm(this_idx + 1, ctx);
+        emit_instr(ctx, bltz, MIPS_R_T5, b_off);
+        /*
+         * prog = array->ptrs[index];
+         * if (prog == NULL)
+         *     goto out;
+         */
+        /* Delay slot */
+        emit_instr(ctx, dsll, MIPS_R_T8, MIPS_R_A2, 3);
+        emit_instr(ctx, daddu, MIPS_R_T8, MIPS_R_T8, MIPS_R_A1);
+        off = offsetof(struct bpf_array, ptrs);
+        emit_instr(ctx, ld, MIPS_R_AT, off, MIPS_R_T8);
+        b_off = b_imm(this_idx + 1, ctx);
+        emit_instr(ctx, beq, MIPS_R_AT, MIPS_R_ZERO, b_off);
+        /* Delay slot */
+        emit_instr(ctx, nop);
+        /* goto *(prog->bpf_func + 4); */
+        off = offsetof(struct bpf_prog, bpf_func);
+        emit_instr(ctx, ld, MIPS_R_T9, off, MIPS_R_AT);
+        /* All systems are go... propagate TCC */
+        emit_instr(ctx, daddu, MIPS_R_V1, MIPS_R_T5, MIPS_R_ZERO);
+        /* Skip first instruction (TCC initialization) */
+        emit_instr(ctx, daddiu, MIPS_R_T9, MIPS_R_T9, 4);
+        return build_int_epilogue(ctx, MIPS_R_T9);
+}
+static bool use_bbit_insns(void)
+{
+        switch (current_cpu_type()) {
+        case CPU_CAVIUM_OCTEON:
+        case CPU_CAVIUM_OCTEON_PLUS:
+        case CPU_CAVIUM_OCTEON2:
+        case CPU_CAVIUM_OCTEON3:
+                return true;
+        default:
+                return false;
+        }
+}
+static bool is_bad_offset(int b_off)
+{
+        return b_off > 0x1ffff || b_off < -0x20000;
+}
+/* Returns the number of insn slots consumed. */
+static int build_one_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
+                          int this_idx, int exit_idx)
+{
+        int src, dst, r, td, ts, mem_off, b_off;
+        bool need_swap, did_move, cmp_eq;
+        unsigned int target;
+        u64 t64;
+        s64 t64s;
+        switch (insn->code) {
+        case BPF_ALU64 | BPF_ADD | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_SUB | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_OR | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_AND | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_LSH | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_RSH | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_XOR | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_ARSH | BPF_K: /* ALU64_IMM */
+        case BPF_ALU64 | BPF_MOV | BPF_K: /* ALU64_IMM */
+        case BPF_ALU | BPF_MOV | BPF_K: /* ALU32_IMM */
+        case BPF_ALU | BPF_ADD | BPF_K: /* ALU32_IMM */
+        case BPF_ALU | BPF_SUB | BPF_K: /* ALU32_IMM */
+        case BPF_ALU | BPF_OR | BPF_K: /* ALU64_IMM */
+        case BPF_ALU | BPF_AND | BPF_K: /* ALU64_IMM */
+        case BPF_ALU | BPF_LSH | BPF_K: /* ALU64_IMM */
+        case BPF_ALU | BPF_RSH | BPF_K: /* ALU64_IMM */
+        case BPF_ALU | BPF_XOR | BPF_K: /* ALU64_IMM */
+        case BPF_ALU | BPF_ARSH | BPF_K: /* ALU64_IMM */
+                r = gen_imm_insn(insn, ctx, this_idx);
+                if (r < 0)
+                        return r;
+                break;
+        case BPF_ALU64 | BPF_MUL | BPF_K: /* ALU64_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                if (get_reg_val_type(ctx, this_idx, insn->dst_reg) == REG_32BIT)
+                        emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
+                if (insn->imm == 1) /* Mult by 1 is a nop */
+                        break;
+                gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                emit_instr(ctx, dmultu, MIPS_R_AT, dst);
+                emit_instr(ctx, mflo, dst);
+                break;
+        case BPF_ALU64 | BPF_NEG | BPF_K: /* ALU64_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                if (get_reg_val_type(ctx, this_idx, insn->dst_reg) == REG_32BIT)
+                        emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
+                emit_instr(ctx, dsubu, dst, MIPS_R_ZERO, dst);
+                break;
+        case BPF_ALU | BPF_MUL | BPF_K: /* ALU_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
+                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                        /* sign extend */
+                        emit_instr(ctx, sll, dst, dst, 0);
+                }
+                if (insn->imm == 1) /* Mult by 1 is a nop */
+                        break;
+                gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                emit_instr(ctx, multu, dst, MIPS_R_AT);
+                emit_instr(ctx, mflo, dst);
+                break;
+        case BPF_ALU | BPF_NEG | BPF_K: /* ALU_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
+                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                        /* sign extend */
+                        emit_instr(ctx, sll, dst, dst, 0);
+                }
+                emit_instr(ctx, subu, dst, MIPS_R_ZERO, dst);
+                break;
+        case BPF_ALU | BPF_DIV | BPF_K: /* ALU_IMM */
+        case BPF_ALU | BPF_MOD | BPF_K: /* ALU_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                if (insn->imm == 0) { /* Div by zero */
+                        b_off = b_imm(exit_idx, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, beq, MIPS_R_ZERO, MIPS_R_ZERO, b_off);
+                        emit_instr(ctx, addu, MIPS_R_V0, MIPS_R_ZERO, MIPS_R_ZERO);
+                }
+                td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
+                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX)
+                        /* sign extend */
+                        emit_instr(ctx, sll, dst, dst, 0);
+                if (insn->imm == 1) {
+                        /* div by 1 is a nop, mod by 1 is zero */
+                        if (BPF_OP(insn->code) == BPF_MOD)
+                                emit_instr(ctx, addu, dst, MIPS_R_ZERO, MIPS_R_ZERO);
+                        break;
+                }
+                gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                emit_instr(ctx, divu, dst, MIPS_R_AT);
+                if (BPF_OP(insn->code) == BPF_DIV)
+                        emit_instr(ctx, mflo, dst);
+                else
+                        emit_instr(ctx, mfhi, dst);
+                break;
+        case BPF_ALU64 | BPF_DIV | BPF_K: /* ALU_IMM */
+        case BPF_ALU64 | BPF_MOD | BPF_K: /* ALU_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                if (insn->imm == 0) { /* Div by zero */
+                        b_off = b_imm(exit_idx, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, beq, MIPS_R_ZERO, MIPS_R_ZERO, b_off);
+                        emit_instr(ctx, addu, MIPS_R_V0, MIPS_R_ZERO, MIPS_R_ZERO);
+                }
+                if (get_reg_val_type(ctx, this_idx, insn->dst_reg) == REG_32BIT)
+                        emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
+                if (insn->imm == 1) {
+                        /* div by 1 is a nop, mod by 1 is zero */
+                        if (BPF_OP(insn->code) == BPF_MOD)
+                                emit_instr(ctx, addu, dst, MIPS_R_ZERO, MIPS_R_ZERO);
+                        break;
+                }
+                gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                emit_instr(ctx, ddivu, dst, MIPS_R_AT);
+                if (BPF_OP(insn->code) == BPF_DIV)
+                        emit_instr(ctx, mflo, dst);
+                else
+                        emit_instr(ctx, mfhi, dst);
+                break;
+        case BPF_ALU64 | BPF_MOV | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_ADD | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_SUB | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_XOR | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_OR | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_AND | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_MUL | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_DIV | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_MOD | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_LSH | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_RSH | BPF_X: /* ALU64_REG */
+        case BPF_ALU64 | BPF_ARSH | BPF_X: /* ALU64_REG */
+                src = ebpf_to_mips_reg(ctx, insn, src_reg);
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (src < 0 || dst < 0)
+                        return -EINVAL;
+                if (get_reg_val_type(ctx, this_idx, insn->dst_reg) == REG_32BIT)
+                        emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
+                did_move = false;
+                if (insn->src_reg == BPF_REG_10) {
+                        if (BPF_OP(insn->code) == BPF_MOV) {
+                                emit_instr(ctx, daddiu, dst, MIPS_R_SP, MAX_BPF_STACK);
+                                did_move = true;
+                        } else {
+                                emit_instr(ctx, daddiu, MIPS_R_AT, MIPS_R_SP, MAX_BPF_STACK);
+                                src = MIPS_R_AT;
+                        }
+                } else if (get_reg_val_type(ctx, this_idx, insn->src_reg) == REG_32BIT) {
+                        int tmp_reg = MIPS_R_AT;
+                        if (BPF_OP(insn->code) == BPF_MOV) {
+                                tmp_reg = dst;
+                                did_move = true;
+                        }
+                        emit_instr(ctx, daddu, tmp_reg, src, MIPS_R_ZERO);
+                        emit_instr(ctx, dinsu, tmp_reg, MIPS_R_ZERO, 32, 32);
+                        src = MIPS_R_AT;
+                }
+                switch (BPF_OP(insn->code)) {
+                case BPF_MOV:
+                        if (!did_move)
+                                emit_instr(ctx, daddu, dst, src, MIPS_R_ZERO);
+                        break;
+                case BPF_ADD:
+                        emit_instr(ctx, daddu, dst, dst, src);
+                        break;
+                case BPF_SUB:
+                        emit_instr(ctx, dsubu, dst, dst, src);
+                        break;
+                case BPF_XOR:
+                        emit_instr(ctx, xor, dst, dst, src);
+                        break;
+                case BPF_OR:
+                        emit_instr(ctx, or, dst, dst, src);
+                        break;
+                case BPF_AND:
+                        emit_instr(ctx, and, dst, dst, src);
+                        break;
+                case BPF_MUL:
+                        emit_instr(ctx, dmultu, dst, src);
+                        emit_instr(ctx, mflo, dst);
+                        break;
+                case BPF_DIV:
+                case BPF_MOD:
+                        b_off = b_imm(exit_idx, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, beq, src, MIPS_R_ZERO, b_off);
+                        emit_instr(ctx, movz, MIPS_R_V0, MIPS_R_ZERO, src);
+                        emit_instr(ctx, ddivu, dst, src);
+                        if (BPF_OP(insn->code) == BPF_DIV)
+                                emit_instr(ctx, mflo, dst);
+                        else
+                                emit_instr(ctx, mfhi, dst);
+                        break;
+                case BPF_LSH:
+                        emit_instr(ctx, dsllv, dst, dst, src);
+                        break;
+                case BPF_RSH:
+                        emit_instr(ctx, dsrlv, dst, dst, src);
+                        break;
+                case BPF_ARSH:
+                        emit_instr(ctx, dsrav, dst, dst, src);
+                        break;
+                default:
+                        pr_err("ALU64_REG NOT HANDLED\n");
+                        return -EINVAL;
+                }
+                break;
+        case BPF_ALU | BPF_MOV | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_ADD | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_SUB | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_XOR | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_OR | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_AND | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_MUL | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_DIV | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_MOD | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_LSH | BPF_X: /* ALU_REG */
+        case BPF_ALU | BPF_RSH | BPF_X: /* ALU_REG */
+                src = ebpf_to_mips_reg(ctx, insn, src_reg_no_fp);
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (src < 0 || dst < 0)
+                        return -EINVAL;
+                td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
+                if (td == REG_64BIT || td == REG_32BIT_ZERO_EX) {
+                        /* sign extend */
+                        emit_instr(ctx, sll, dst, dst, 0);
+                }
+                did_move = false;
+                ts = get_reg_val_type(ctx, this_idx, insn->src_reg);
+                if (ts == REG_64BIT || ts == REG_32BIT_ZERO_EX) {
+                        int tmp_reg = MIPS_R_AT;
+                        if (BPF_OP(insn->code) == BPF_MOV) {
+                                tmp_reg = dst;
+                                did_move = true;
+                        }
+                        /* sign extend */
+                        emit_instr(ctx, sll, tmp_reg, src, 0);
+                        src = MIPS_R_AT;
+                }
+                switch (BPF_OP(insn->code)) {
+                case BPF_MOV:
+                        if (!did_move)
+                                emit_instr(ctx, addu, dst, src, MIPS_R_ZERO);
+                        break;
+                case BPF_ADD:
+                        emit_instr(ctx, addu, dst, dst, src);
+                        break;
+                case BPF_SUB:
+                        emit_instr(ctx, subu, dst, dst, src);
+                        break;
+                case BPF_XOR:
+                        emit_instr(ctx, xor, dst, dst, src);
+                        break;
+                case BPF_OR:
+                        emit_instr(ctx, or, dst, dst, src);
+                        break;
+                case BPF_AND:
+                        emit_instr(ctx, and, dst, dst, src);
+                        break;
+                case BPF_MUL:
+                        emit_instr(ctx, mul, dst, dst, src);
+                        break;
+                case BPF_DIV:
+                case BPF_MOD:
+                        b_off = b_imm(exit_idx, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, beq, src, MIPS_R_ZERO, b_off);
+                        emit_instr(ctx, movz, MIPS_R_V0, MIPS_R_ZERO, src);
+                        emit_instr(ctx, divu, dst, src);
+                        if (BPF_OP(insn->code) == BPF_DIV)
+                                emit_instr(ctx, mflo, dst);
+                        else
+                                emit_instr(ctx, mfhi, dst);
+                        break;
+                case BPF_LSH:
+                        emit_instr(ctx, sllv, dst, dst, src);
+                        break;
+                case BPF_RSH:
+                        emit_instr(ctx, srlv, dst, dst, src);
+                        break;
+                default:
+                        pr_err("ALU_REG NOT HANDLED\n");
+                        return -EINVAL;
+                }
+                break;
+        case BPF_JMP | BPF_EXIT:
+                if (this_idx + 1 < exit_idx) {
+                        b_off = b_imm(exit_idx, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, beq, MIPS_R_ZERO, MIPS_R_ZERO, b_off);
+                        emit_instr(ctx, nop);
+                }
+                break;
+        case BPF_JMP | BPF_JEQ | BPF_K: /* JMP_IMM */
+        case BPF_JMP | BPF_JNE | BPF_K: /* JMP_IMM */
+                cmp_eq = (BPF_OP(insn->code) == BPF_JEQ);
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg_fp_ok);
+                if (dst < 0)
+                        return dst;
+                if (insn->imm == 0) {
+                        src = MIPS_R_ZERO;
+                } else {
+                        gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                        src = MIPS_R_AT;
+                }
+                goto jeq_common;
+        case BPF_JMP | BPF_JEQ | BPF_X: /* JMP_REG */
+        case BPF_JMP | BPF_JNE | BPF_X:
+        case BPF_JMP | BPF_JSGT | BPF_X:
+        case BPF_JMP | BPF_JSGE | BPF_X:
+        case BPF_JMP | BPF_JGT | BPF_X:
+        case BPF_JMP | BPF_JGE | BPF_X:
+        case BPF_JMP | BPF_JSET | BPF_X:
+                src = ebpf_to_mips_reg(ctx, insn, src_reg_no_fp);
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (src < 0 || dst < 0)
+                        return -EINVAL;
+                td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
+                ts = get_reg_val_type(ctx, this_idx, insn->src_reg);
+                if (td == REG_32BIT && ts != REG_32BIT) {
+                        emit_instr(ctx, sll, MIPS_R_AT, src, 0);
+                        src = MIPS_R_AT;
+                } else if (ts == REG_32BIT && td != REG_32BIT) {
+                        emit_instr(ctx, sll, MIPS_R_AT, dst, 0);
+                        dst = MIPS_R_AT;
+                }
+                if (BPF_OP(insn->code) == BPF_JSET) {
+                        emit_instr(ctx, and, MIPS_R_AT, dst, src);
+                        cmp_eq = false;
+                        dst = MIPS_R_AT;
+                        src = MIPS_R_ZERO;
+                } else if (BPF_OP(insn->code) == BPF_JSGT) {
+                        emit_instr(ctx, dsubu, MIPS_R_AT, dst, src);
+                        if ((insn + 1)->code == (BPF_JMP | BPF_EXIT) && insn->off == 1) {
+                                b_off = b_imm(exit_idx, ctx);
+                                if (is_bad_offset(b_off))
+                                        return -E2BIG;
+                                emit_instr(ctx, blez, MIPS_R_AT, b_off);
+                                emit_instr(ctx, nop);
+                                return 2; /* We consumed the exit. */
+                        }
+                        b_off = b_imm(this_idx + insn->off + 1, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, bgtz, MIPS_R_AT, b_off);
+                        emit_instr(ctx, nop);
+                        break;
+                } else if (BPF_OP(insn->code) == BPF_JSGE) {
+                        emit_instr(ctx, slt, MIPS_R_AT, dst, src);
+                        cmp_eq = true;
+                        dst = MIPS_R_AT;
+                        src = MIPS_R_ZERO;
+                } else if (BPF_OP(insn->code) == BPF_JGT) {
+                        /* dst or src could be AT */
+                        emit_instr(ctx, dsubu, MIPS_R_T8, dst, src);
+                        emit_instr(ctx, sltu, MIPS_R_AT, dst, src);
+                        /* SP known to be non-zero, movz becomes boolean not */
+                        emit_instr(ctx, movz, MIPS_R_T9, MIPS_R_SP, MIPS_R_T8);
+                        emit_instr(ctx, movn, MIPS_R_T9, MIPS_R_ZERO, MIPS_R_T8);
+                        emit_instr(ctx, or, MIPS_R_AT, MIPS_R_T9, MIPS_R_AT);
+                        cmp_eq = true;
+                        dst = MIPS_R_AT;
+                        src = MIPS_R_ZERO;
+                } else if (BPF_OP(insn->code) == BPF_JGE) {
+                        emit_instr(ctx, sltu, MIPS_R_AT, dst, src);
+                        cmp_eq = true;
+                        dst = MIPS_R_AT;
+                        src = MIPS_R_ZERO;
+                } else { /* JNE/JEQ case */
+                        cmp_eq = (BPF_OP(insn->code) == BPF_JEQ);
+                }
+jeq_common:
+                /*
+                 * If the next insn is EXIT and we are jumping arround
+                 * only it, invert the sense of the compare and
+                 * conditionally jump to the exit.  Poor man's branch
+                 * chaining.
+                 */
+                if ((insn + 1)->code == (BPF_JMP | BPF_EXIT) && insn->off == 1) {
+                        b_off = b_imm(exit_idx, ctx);
+                        if (is_bad_offset(b_off)) {
+                                target = j_target(ctx, exit_idx);
+                                if (target == (unsigned int)-1)
+                                        return -E2BIG;
+                                cmp_eq = !cmp_eq;
+                                b_off = 4 * 3;
+                                if (!(ctx->offsets[this_idx] & OFFSETS_B_CONV)) {
+                                        ctx->offsets[this_idx] |= OFFSETS_B_CONV;
+                                        ctx->long_b_conversion = 1;
+                                }
+                        }
+                        if (cmp_eq)
+                                emit_instr(ctx, bne, dst, src, b_off);
+                        else
+                                emit_instr(ctx, beq, dst, src, b_off);
+                        emit_instr(ctx, nop);
+                        if (ctx->offsets[this_idx] & OFFSETS_B_CONV) {
+                                emit_instr(ctx, j, target);
+                                emit_instr(ctx, nop);
+                        }
+                        return 2; /* We consumed the exit. */
+                }
+                b_off = b_imm(this_idx + insn->off + 1, ctx);
+                if (is_bad_offset(b_off)) {
+                        target = j_target(ctx, this_idx + insn->off + 1);
+                        if (target == (unsigned int)-1)
+                                return -E2BIG;
+                        cmp_eq = !cmp_eq;
+                        b_off = 4 * 3;
+                        if (!(ctx->offsets[this_idx] & OFFSETS_B_CONV)) {
+                                ctx->offsets[this_idx] |= OFFSETS_B_CONV;
+                                ctx->long_b_conversion = 1;
+                        }
+                }
+                if (cmp_eq)
+                        emit_instr(ctx, beq, dst, src, b_off);
+                else
+                        emit_instr(ctx, bne, dst, src, b_off);
+                emit_instr(ctx, nop);
+                if (ctx->offsets[this_idx] & OFFSETS_B_CONV) {
+                        emit_instr(ctx, j, target);
+                        emit_instr(ctx, nop);
+                }
+                break;
+        case BPF_JMP | BPF_JSGT | BPF_K: /* JMP_IMM */
+        case BPF_JMP | BPF_JSGE | BPF_K: /* JMP_IMM */
+                cmp_eq = (BPF_OP(insn->code) == BPF_JSGE);
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg_fp_ok);
+                if (dst < 0)
+                        return dst;
+                if (insn->imm == 0) {
+                        if ((insn + 1)->code == (BPF_JMP | BPF_EXIT) && insn->off == 1) {
+                                b_off = b_imm(exit_idx, ctx);
+                                if (is_bad_offset(b_off))
+                                        return -E2BIG;
+                                if (cmp_eq)
+                                        emit_instr(ctx, bltz, dst, b_off);
+                                else
+                                        emit_instr(ctx, blez, dst, b_off);
+                                emit_instr(ctx, nop);
+                                return 2; /* We consumed the exit. */
+                        }
+                        b_off = b_imm(this_idx + insn->off + 1, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        if (cmp_eq)
+                                emit_instr(ctx, bgez, dst, b_off);
+                        else
+                                emit_instr(ctx, bgtz, dst, b_off);
+                        emit_instr(ctx, nop);
+                        break;
+                }
+                /*
+                 * only "LT" compare available, so we must use imm + 1
+                 * to generate "GT"
+                 */
+                t64s = insn->imm + (cmp_eq ? 0 : 1);
+                if (t64s >= S16_MIN && t64s <= S16_MAX) {
+                        emit_instr(ctx, slti, MIPS_R_AT, dst, (int)t64s);
+                        src = MIPS_R_AT;
+                        dst = MIPS_R_ZERO;
+                        cmp_eq = true;
+                        goto jeq_common;
+                }
+                emit_const_to_reg(ctx, MIPS_R_AT, (u64)t64s);
+                emit_instr(ctx, slt, MIPS_R_AT, dst, MIPS_R_AT);
+                src = MIPS_R_AT;
+                dst = MIPS_R_ZERO;
+                cmp_eq = true;
+                goto jeq_common;
+        case BPF_JMP | BPF_JGT | BPF_K:
+        case BPF_JMP | BPF_JGE | BPF_K:
+                cmp_eq = (BPF_OP(insn->code) == BPF_JGE);
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg_fp_ok);
+                if (dst < 0)
+                        return dst;
+                /*
+                 * only "LT" compare available, so we must use imm + 1
+                 * to generate "GT"
+                 */
+                t64s = (u64)(u32)(insn->imm) + (cmp_eq ? 0 : 1);
+                if (t64s >= 0 && t64s <= S16_MAX) {
+                        emit_instr(ctx, sltiu, MIPS_R_AT, dst, (int)t64s);
+                        src = MIPS_R_AT;
+                        dst = MIPS_R_ZERO;
+                        cmp_eq = true;
+                        goto jeq_common;
+                }
+                emit_const_to_reg(ctx, MIPS_R_AT, (u64)t64s);
+                emit_instr(ctx, sltu, MIPS_R_AT, dst, MIPS_R_AT);
+                src = MIPS_R_AT;
+                dst = MIPS_R_ZERO;
+                cmp_eq = true;
+                goto jeq_common;
+        case BPF_JMP | BPF_JSET | BPF_K: /* JMP_IMM */
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg_fp_ok);
+                if (dst < 0)
+                        return dst;
+                if (use_bbit_insns() && hweight32((u32)insn->imm) == 1) {
+                        if ((insn + 1)->code == (BPF_JMP | BPF_EXIT) && insn->off == 1) {
+                                b_off = b_imm(exit_idx, ctx);
+                                if (is_bad_offset(b_off))
+                                        return -E2BIG;
+                                emit_instr(ctx, bbit0, dst, ffs((u32)insn->imm) - 1, b_off);
+                                emit_instr(ctx, nop);
+                                return 2; /* We consumed the exit. */
+                        }
+                        b_off = b_imm(this_idx + insn->off + 1, ctx);
+                        if (is_bad_offset(b_off))
+                                return -E2BIG;
+                        emit_instr(ctx, bbit1, dst, ffs((u32)insn->imm) - 1, b_off);
+                        emit_instr(ctx, nop);
+                        break;
+                }
+                t64 = (u32)insn->imm;
+                emit_const_to_reg(ctx, MIPS_R_AT, t64);
+                emit_instr(ctx, and, MIPS_R_AT, dst, MIPS_R_AT);
+                src = MIPS_R_AT;
+                dst = MIPS_R_ZERO;
+                cmp_eq = false;
+                goto jeq_common;
+        case BPF_JMP | BPF_JA:
+                /*
+                 * Prefer relative branch for easier debugging, but
+                 * fall back if needed.
+                 */
+                b_off = b_imm(this_idx + insn->off + 1, ctx);
+                if (is_bad_offset(b_off)) {
+                        target = j_target(ctx, this_idx + insn->off + 1);
+                        if (target == (unsigned int)-1)
+                                return -E2BIG;
+                        emit_instr(ctx, j, target);
+                } else {
+                        emit_instr(ctx, b, b_off);
+                }
+                emit_instr(ctx, nop);
+                break;
+        case BPF_LD | BPF_DW | BPF_IMM:
+                if (insn->src_reg != 0)
+                        return -EINVAL;
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                t64 = ((u64)(u32)insn->imm) | ((u64)(insn + 1)->imm << 32);
+                emit_const_to_reg(ctx, dst, t64);
+                return 2; /* Double slot insn */
+        case BPF_JMP | BPF_CALL:
+                ctx->flags |= EBPF_SAVE_RA;
+                t64s = (s64)insn->imm + (s64)__bpf_call_base;
+                emit_const_to_reg(ctx, MIPS_R_T9, (u64)t64s);
+                emit_instr(ctx, jalr, MIPS_R_RA, MIPS_R_T9);
+                /* delay slot */
+                emit_instr(ctx, nop);
+                break;
+        case BPF_JMP | BPF_TAIL_CALL:
+                if (emit_bpf_tail_call(ctx, this_idx))
+                        return -EINVAL;
+                break;
+        case BPF_LD | BPF_B | BPF_ABS:
+        case BPF_LD | BPF_H | BPF_ABS:
+        case BPF_LD | BPF_W | BPF_ABS:
+        case BPF_LD | BPF_DW | BPF_ABS:
+                ctx->flags |= EBPF_SAVE_RA;
+                gen_imm_to_reg(insn, MIPS_R_A1, ctx);
+                emit_instr(ctx, addiu, MIPS_R_A2, MIPS_R_ZERO, size_to_len(insn));
+                if (insn->imm < 0) {
+                        emit_const_to_reg(ctx, MIPS_R_T9, (u64)bpf_internal_load_pointer_neg_helper);
+                } else {
+                        emit_const_to_reg(ctx, MIPS_R_T9, (u64)ool_skb_header_pointer);
+                        emit_instr(ctx, daddiu, MIPS_R_A3, MIPS_R_SP, ctx->tmp_offset);
+                }
+                goto ld_skb_common;
+        case BPF_LD | BPF_B | BPF_IND:
+        case BPF_LD | BPF_H | BPF_IND:
+        case BPF_LD | BPF_W | BPF_IND:
+        case BPF_LD | BPF_DW | BPF_IND:
+                ctx->flags |= EBPF_SAVE_RA;
+                src = ebpf_to_mips_reg(ctx, insn, src_reg_no_fp);
+                if (src < 0)
+                        return src;
+                ts = get_reg_val_type(ctx, this_idx, insn->src_reg);
+                if (ts == REG_32BIT_ZERO_EX) {
+                        /* sign extend */
+                        emit_instr(ctx, sll, MIPS_R_A1, src, 0);
+                        src = MIPS_R_A1;
+                }
+                if (insn->imm >= S16_MIN && insn->imm <= S16_MAX) {
+                        emit_instr(ctx, daddiu, MIPS_R_A1, src, insn->imm);
+                } else {
+                        gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                        emit_instr(ctx, daddu, MIPS_R_A1, MIPS_R_AT, src);
+                }
+                /* truncate to 32-bit int */
+                emit_instr(ctx, sll, MIPS_R_A1, MIPS_R_A1, 0);
+                emit_instr(ctx, daddiu, MIPS_R_A3, MIPS_R_SP, ctx->tmp_offset);
+                emit_instr(ctx, slt, MIPS_R_AT, MIPS_R_A1, MIPS_R_ZERO);
+                emit_const_to_reg(ctx, MIPS_R_T8, (u64)bpf_internal_load_pointer_neg_helper);
+                emit_const_to_reg(ctx, MIPS_R_T9, (u64)ool_skb_header_pointer);
+                emit_instr(ctx, addiu, MIPS_R_A2, MIPS_R_ZERO, size_to_len(insn));
+                emit_instr(ctx, movn, MIPS_R_T9, MIPS_R_T8, MIPS_R_AT);
+ld_skb_common:
+                emit_instr(ctx, jalr, MIPS_R_RA, MIPS_R_T9);
+                /* delay slot move */
+                emit_instr(ctx, daddu, MIPS_R_A0, MIPS_R_S0, MIPS_R_ZERO);
+                /* Check the error value */
+                b_off = b_imm(exit_idx, ctx);
+                if (is_bad_offset(b_off)) {
+                        target = j_target(ctx, exit_idx);
+                        if (target == (unsigned int)-1)
+                                return -E2BIG;
+                        if (!(ctx->offsets[this_idx] & OFFSETS_B_CONV)) {
+                                ctx->offsets[this_idx] |= OFFSETS_B_CONV;
+                                ctx->long_b_conversion = 1;
+                        }
+                        emit_instr(ctx, bne, MIPS_R_V0, MIPS_R_ZERO, 4 * 3);
+                        emit_instr(ctx, nop);
+                        emit_instr(ctx, j, target);
+                        emit_instr(ctx, nop);
+                } else {
+                        emit_instr(ctx, beq, MIPS_R_V0, MIPS_R_ZERO, b_off);
+                        emit_instr(ctx, nop);
+                }
+#ifdef __BIG_ENDIAN
+                need_swap = false;
+#else
+                need_swap = true;
+#endif
+                dst = MIPS_R_V0;
+                switch (BPF_SIZE(insn->code)) {
+                case BPF_B:
+                        emit_instr(ctx, lbu, dst, 0, MIPS_R_V0);
+                        break;
+                case BPF_H:
+                        emit_instr(ctx, lhu, dst, 0, MIPS_R_V0);
+                        if (need_swap)
+                                emit_instr(ctx, wsbh, dst, dst);
+                        break;
+                case BPF_W:
+                        emit_instr(ctx, lw, dst, 0, MIPS_R_V0);
+                        if (need_swap) {
+                                emit_instr(ctx, wsbh, dst, dst);
+                                emit_instr(ctx, rotr, dst, dst, 16);
+                        }
+                        break;
+                case BPF_DW:
+                        emit_instr(ctx, ld, dst, 0, MIPS_R_V0);
+                        if (need_swap) {
+                                emit_instr(ctx, dsbh, dst, dst);
+                                emit_instr(ctx, dshd, dst, dst);
+                        }
+                        break;
+                }
+                break;
+        case BPF_ALU | BPF_END | BPF_FROM_BE:
+        case BPF_ALU | BPF_END | BPF_FROM_LE:
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                td = get_reg_val_type(ctx, this_idx, insn->dst_reg);
+                if (insn->imm == 64 && td == REG_32BIT)
+                        emit_instr(ctx, dinsu, dst, MIPS_R_ZERO, 32, 32);
+                if (insn->imm != 64 &&
+                    (td == REG_64BIT || td == REG_32BIT_ZERO_EX)) {
+                        /* sign extend */
+                        emit_instr(ctx, sll, dst, dst, 0);
+                }
+#ifdef __BIG_ENDIAN
+                need_swap = (BPF_SRC(insn->code) == BPF_FROM_LE);
+#else
+                need_swap = (BPF_SRC(insn->code) == BPF_FROM_BE);
+#endif
+                if (insn->imm == 16) {
+                        if (need_swap)
+                                emit_instr(ctx, wsbh, dst, dst);
+                        emit_instr(ctx, andi, dst, dst, 0xffff);
+                } else if (insn->imm == 32) {
+                        if (need_swap) {
+                                emit_instr(ctx, wsbh, dst, dst);
+                                emit_instr(ctx, rotr, dst, dst, 16);
+                        }
+                } else { /* 64-bit*/
+                        if (need_swap) {
+                                emit_instr(ctx, dsbh, dst, dst);
+                                emit_instr(ctx, dshd, dst, dst);
+                        }
+                }
+                break;
+        case BPF_ST | BPF_B | BPF_MEM:
+        case BPF_ST | BPF_H | BPF_MEM:
+        case BPF_ST | BPF_W | BPF_MEM:
+        case BPF_ST | BPF_DW | BPF_MEM:
+                if (insn->dst_reg == BPF_REG_10) {
+                        ctx->flags |= EBPF_SEEN_FP;
+                        dst = MIPS_R_SP;
+                        mem_off = insn->off + MAX_BPF_STACK;
+                } else {
+                        dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                        if (dst < 0)
+                                return dst;
+                        mem_off = insn->off;
+                }
+                gen_imm_to_reg(insn, MIPS_R_AT, ctx);
+                switch (BPF_SIZE(insn->code)) {
+                case BPF_B:
+                        emit_instr(ctx, sb, MIPS_R_AT, mem_off, dst);
+                        break;
+                case BPF_H:
+                        emit_instr(ctx, sh, MIPS_R_AT, mem_off, dst);
+                        break;
+                case BPF_W:
+                        emit_instr(ctx, sw, MIPS_R_AT, mem_off, dst);
+                        break;
+                case BPF_DW:
+                        emit_instr(ctx, sd, MIPS_R_AT, mem_off, dst);
+                        break;
+                }
+                break;
+        case BPF_LDX | BPF_B | BPF_MEM:
+        case BPF_LDX | BPF_H | BPF_MEM:
+        case BPF_LDX | BPF_W | BPF_MEM:
+        case BPF_LDX | BPF_DW | BPF_MEM:
+                if (insn->src_reg == BPF_REG_10) {
+                        ctx->flags |= EBPF_SEEN_FP;
+                        src = MIPS_R_SP;
+                        mem_off = insn->off + MAX_BPF_STACK;
+                } else {
+                        src = ebpf_to_mips_reg(ctx, insn, src_reg_no_fp);
+                        if (src < 0)
+                                return src;
+                        mem_off = insn->off;
+                }
+                dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                if (dst < 0)
+                        return dst;
+                switch (BPF_SIZE(insn->code)) {
+                case BPF_B:
+                        emit_instr(ctx, lbu, dst, mem_off, src);
+                        break;
+                case BPF_H:
+                        emit_instr(ctx, lhu, dst, mem_off, src);
+                        break;
+                case BPF_W:
+                        emit_instr(ctx, lw, dst, mem_off, src);
+                        break;
+                case BPF_DW:
+                        emit_instr(ctx, ld, dst, mem_off, src);
+                        break;
+                }
+                break;
+        case BPF_STX | BPF_B | BPF_MEM:
+        case BPF_STX | BPF_H | BPF_MEM:
+        case BPF_STX | BPF_W | BPF_MEM:
+        case BPF_STX | BPF_DW | BPF_MEM:
+        case BPF_STX | BPF_W | BPF_XADD:
+        case BPF_STX | BPF_DW | BPF_XADD:
+                if (insn->dst_reg == BPF_REG_10) {
+                        ctx->flags |= EBPF_SEEN_FP;
+                        dst = MIPS_R_SP;
+                        mem_off = insn->off + MAX_BPF_STACK;
+                } else {
+                        dst = ebpf_to_mips_reg(ctx, insn, dst_reg);
+                        if (dst < 0)
+                                return dst;
+                        mem_off = insn->off;
+                }
+                src = ebpf_to_mips_reg(ctx, insn, src_reg_no_fp);
+                if (src < 0)
+                        return dst;
+                if (BPF_MODE(insn->code) == BPF_XADD) {
+                        switch (BPF_SIZE(insn->code)) {
+                        case BPF_W:
+                                if (get_reg_val_type(ctx, this_idx, insn->src_reg) == REG_32BIT) {
+                                        emit_instr(ctx, sll, MIPS_R_AT, src, 0);
+                                        src = MIPS_R_AT;
+                                }
+                                emit_instr(ctx, ll, MIPS_R_T8, mem_off, dst);
+                                emit_instr(ctx, addu, MIPS_R_T8, MIPS_R_T8, src);
+                                emit_instr(ctx, sc, MIPS_R_T8, mem_off, dst);
+                                /*
+                                 * On failure back up to LL (-4
+                                 * instructions of 4 bytes each
+                                 */
+                                emit_instr(ctx, beq, MIPS_R_T8, MIPS_R_ZERO, -4 * 4);
+                                emit_instr(ctx, nop);
+                                break;
+                        case BPF_DW:
+                                if (get_reg_val_type(ctx, this_idx, insn->src_reg) == REG_32BIT) {
+                                        emit_instr(ctx, daddu, MIPS_R_AT, src, MIPS_R_ZERO);
+                                        emit_instr(ctx, dinsu, MIPS_R_AT, MIPS_R_ZERO, 32, 32);
+                                        src = MIPS_R_AT;
+                                }
+                                emit_instr(ctx, lld, MIPS_R_T8, mem_off, dst);
+                                emit_instr(ctx, daddu, MIPS_R_T8, MIPS_R_T8, src);
+                                emit_instr(ctx, scd, MIPS_R_T8, mem_off, dst);
+                                emit_instr(ctx, beq, MIPS_R_T8, MIPS_R_ZERO, -4 * 4);
+                                emit_instr(ctx, nop);
+                                break;
+                        }
+                } else { /* BPF_MEM */
+                        switch (BPF_SIZE(insn->code)) {
+                        case BPF_B:
+                                emit_instr(ctx, sb, src, mem_off, dst);
+                                break;
+                        case BPF_H:
+                                emit_instr(ctx, sh, src, mem_off, dst);
+                                break;
+                        case BPF_W:
+                                emit_instr(ctx, sw, src, mem_off, dst);
+                                break;
+                        case BPF_DW:
+                                if (get_reg_val_type(ctx, this_idx, insn->src_reg) == REG_32BIT) {
+                                        emit_instr(ctx, daddu, MIPS_R_AT, src, MIPS_R_ZERO);
+                                        emit_instr(ctx, dinsu, MIPS_R_AT, MIPS_R_ZERO, 32, 32);
+                                        src = MIPS_R_AT;
+                                }
+                                emit_instr(ctx, sd, src, mem_off, dst);
+                                break;
+                        }
+                }
+                break;
+        default:
+                pr_err("NOT HANDLED %d - (%02x)\n",
+                       this_idx, (unsigned int)insn->code);
+                return -EINVAL;
+        }
+        return 1;
+}
+#define RVT_VISITED_MASK 0xc000000000000000ull
+#define RVT_FALL_THROUGH 0x4000000000000000ull
+#define RVT_BRANCH_TAKEN 0x8000000000000000ull
+#define RVT_DONE (RVT_FALL_THROUGH | RVT_BRANCH_TAKEN)
+static int build_int_body(struct jit_ctx *ctx)
+{
+        const struct bpf_prog *prog = ctx->skf;
+        const struct bpf_insn *insn;
+        int i, r;
+        for (i = 0; i < prog->len; ) {
+                insn = prog->insnsi + i;
+                if ((ctx->reg_val_types[i] & RVT_VISITED_MASK) == 0) {
+                        /* dead instruction, don't emit it. */
+                        i++;
+                        continue;
+                }
+                if (ctx->target == NULL)
+                        ctx->offsets[i] = (ctx->offsets[i] & OFFSETS_B_CONV) | (ctx->idx * 4);
+                r = build_one_insn(insn, ctx, i, prog->len);
+                if (r < 0)
+                        return r;
+                i += r;
+        }
+        /* epilogue offset */
+        if (ctx->target == NULL)
+                ctx->offsets[i] = ctx->idx * 4;
+        /*
+         * All exits have an offset of the epilogue, some offsets may
+         * not have been set due to banch-around threading, so set
+         * them now.
+         */
+        if (ctx->target == NULL)
+                for (i = 0; i < prog->len; i++) {
+                        insn = prog->insnsi + i;
+                        if (insn->code == (BPF_JMP | BPF_EXIT))
+                                ctx->offsets[i] = ctx->idx * 4;
+                }
+        return 0;
+}
+/* return the last idx processed, or negative for error */
+static int reg_val_propagate_range(struct jit_ctx *ctx, u64 initial_rvt,
+                                   int start_idx, bool follow_taken)
+{
+        const struct bpf_prog *prog = ctx->skf;
+        const struct bpf_insn *insn;
+        u64 exit_rvt = initial_rvt;
+        u64 *rvt = ctx->reg_val_types;
+        int idx;
+        int reg;
+        for (idx = start_idx; idx < prog->len; idx++) {
+                rvt[idx] = (rvt[idx] & RVT_VISITED_MASK) | exit_rvt;
+                insn = prog->insnsi + idx;
+                switch (BPF_CLASS(insn->code)) {
+                case BPF_ALU:
+                        switch (BPF_OP(insn->code)) {
+                        case BPF_ADD:
+                        case BPF_SUB:
+                        case BPF_MUL:
+                        case BPF_DIV:
+                        case BPF_OR:
+                        case BPF_AND:
+                        case BPF_LSH:
+                        case BPF_RSH:
+                        case BPF_NEG:
+                        case BPF_MOD:
+                        case BPF_XOR:
+                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT);
+                                break;
+                        case BPF_MOV:
+                                if (BPF_SRC(insn->code)) {
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT);
+                                } else {
+                                        /* IMM to REG move*/
+                                        if (insn->imm >= 0)
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT_POS);
+                                        else
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT);
+                                }
+                                break;
+                        case BPF_END:
+                                if (insn->imm == 64)
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT);
+                                else if (insn->imm == 32)
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT);
+                                else /* insn->imm == 16 */
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT_POS);
+                                break;
+                        }
+                        rvt[idx] |= RVT_DONE;
+                        break;
+                case BPF_ALU64:
+                        switch (BPF_OP(insn->code)) {
+                        case BPF_MOV:
+                                if (BPF_SRC(insn->code)) {
+                                        /* REG to REG move*/
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT);
+                                } else {
+                                        /* IMM to REG move*/
+                                        if (insn->imm >= 0)
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT_POS);
+                                        else
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT_32BIT);
+                                }
+                                break;
+                        default:
+                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT);
+                        }
+                        rvt[idx] |= RVT_DONE;
+                        break;
+                case BPF_LD:
+                        switch (BPF_SIZE(insn->code)) {
+                        case BPF_DW:
+                                if (BPF_MODE(insn->code) == BPF_IMM) {
+                                        s64 val;
+                                        val = (s64)((u32)insn->imm | ((u64)(insn + 1)->imm << 32));
+                                        if (val > 0 && val <= S32_MAX)
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT_POS);
+                                        else if (val >= S32_MIN && val <= S32_MAX)
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT_32BIT);
+                                        else
+                                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT);
+                                        rvt[idx] |= RVT_DONE;
+                                        idx++;
+                                } else {
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT);
+                                }
+                                break;
+                        case BPF_B:
+                        case BPF_H:
+                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT_POS);
+                                break;
+                        case BPF_W:
+                                if (BPF_MODE(insn->code) == BPF_IMM)
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg,
+                                                         insn->imm >= 0 ? REG_32BIT_POS : REG_32BIT);
+                                else
+                                        set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT);
+                                break;
+                        }
+                        rvt[idx] |= RVT_DONE;
+                        break;
+                case BPF_LDX:
+                        switch (BPF_SIZE(insn->code)) {
+                        case BPF_DW:
+                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_64BIT);
+                                break;
+                        case BPF_B:
+                        case BPF_H:
+                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT_POS);
+                                break;
+                        case BPF_W:
+                                set_reg_val_type(&exit_rvt, insn->dst_reg, REG_32BIT);
+                                break;
+                        }
+                        rvt[idx] |= RVT_DONE;
+                        break;
+                case BPF_JMP:
+                        switch (BPF_OP(insn->code)) {
+                        case BPF_EXIT:
+                                rvt[idx] = RVT_DONE | exit_rvt;
+                                rvt[prog->len] = exit_rvt;
+                                return idx;
+                        case BPF_JA:
+                                rvt[idx] |= RVT_DONE;
+                                idx += insn->off;
+                                break;
+                        case BPF_JEQ:
+                        case BPF_JGT:
+                        case BPF_JGE:
+                        case BPF_JSET:
+                        case BPF_JNE:
+                        case BPF_JSGT:
+                        case BPF_JSGE:
+                                if (follow_taken) {
+                                        rvt[idx] |= RVT_BRANCH_TAKEN;
+                                        idx += insn->off;
+                                        follow_taken = false;
+                                } else {
+                                        rvt[idx] |= RVT_FALL_THROUGH;
+                                }
+                                break;
+                        case BPF_CALL:
+                                set_reg_val_type(&exit_rvt, BPF_REG_0, REG_64BIT);
+                                /* Upon call return, argument registers are clobbered. */
+                                for (reg = BPF_REG_0; reg <= BPF_REG_5; reg++)
+                                        set_reg_val_type(&exit_rvt, reg, REG_64BIT);
+                                rvt[idx] |= RVT_DONE;
+                                break;
+                        default:
+                                WARN(1, "Unhandled BPF_JMP case.\n");
+                                rvt[idx] |= RVT_DONE;
+                                break;
+                        }
+                        break;
+                default:
+                        rvt[idx] |= RVT_DONE;
+                        break;
+                }
+        }
+        return idx;
+}
+/*
+ * Track the value range (i.e. 32-bit vs. 64-bit) of each register at
+ * each eBPF insn.  This allows unneeded sign and zero extension
+ * operations to be omitted.
+ *
+ * Doesn't handle yet confluence of control paths with conflicting
+ * ranges, but it is good enough for most sane code.
+ */
+static int reg_val_propagate(struct jit_ctx *ctx)
+{
+        const struct bpf_prog *prog = ctx->skf;
+        u64 exit_rvt;
+        int reg;
+        int i;
+        /*
+         * 11 registers * 3 bits/reg leaves top bits free for other
+         * uses.  Bit-62..63 used to see if we have visited an insn.
+         */
+        exit_rvt = 0;
+        /* Upon entry, argument registers are 64-bit. */
+        for (reg = BPF_REG_1; reg <= BPF_REG_5; reg++)
+                set_reg_val_type(&exit_rvt, reg, REG_64BIT);
+        /*
+         * First follow all conditional branches on the fall-through
+         * edge of control flow..
+         */
+        reg_val_propagate_range(ctx, exit_rvt, 0, false);
+restart_search:
+        /*
+         * Then repeatedly find the first conditional branch where
+         * both edges of control flow have not been taken, and follow
+         * the branch taken edge.  We will end up restarting the
+         * search once per conditional branch insn.
+         */
+        for (i = 0; i < prog->len; i++) {
+                u64 rvt = ctx->reg_val_types[i];
+                if ((rvt & RVT_VISITED_MASK) == RVT_DONE ||
+                    (rvt & RVT_VISITED_MASK) == 0)
+                        continue;
+                if ((rvt & RVT_VISITED_MASK) == RVT_FALL_THROUGH) {
+                        reg_val_propagate_range(ctx, rvt & ~RVT_VISITED_MASK, i, true);
+                } else { /* RVT_BRANCH_TAKEN */
+                        WARN(1, "Unexpected RVT_BRANCH_TAKEN case.\n");
+                        reg_val_propagate_range(ctx, rvt & ~RVT_VISITED_MASK, i, false);
+                }
+                goto restart_search;
+        }
+        /*
+         * Eventually all conditional branches have been followed on
+         * both branches and we are done.  Any insn that has not been
+         * visited at this point is dead.
+         */
+        return 0;
+}
+static void jit_fill_hole(void *area, unsigned int size)
+{
+        u32 *p;
+        /* We are guaranteed to have aligned memory. */
+        for (p = area; size >= sizeof(u32); size -= sizeof(u32))
+                uasm_i_break(&p, BRK_BUG); /* Increments p */
+}
+struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+{
+        struct bpf_prog *orig_prog = prog;
+        bool tmp_blinded = false;
+        struct bpf_prog *tmp;
+        struct bpf_binary_header *header = NULL;
+        struct jit_ctx ctx;
+        unsigned int image_size;
+        u8 *image_ptr;
+        if (!bpf_jit_enable || !cpu_has_mips64r2)
+                return prog;
+        tmp = bpf_jit_blind_constants(prog);
+        /* If blinding was requested and we failed during blinding,
+         * we must fall back to the interpreter.
+         */
+        if (IS_ERR(tmp))
+                return orig_prog;
+        if (tmp != prog) {
+                tmp_blinded = true;
+                prog = tmp;
+        }
+        memset(&ctx, 0, sizeof(ctx));
+        ctx.offsets = kcalloc(prog->len + 1, sizeof(*ctx.offsets), GFP_KERNEL);
+        if (ctx.offsets == NULL)
+                goto out_err;
+        ctx.reg_val_types = kcalloc(prog->len + 1, sizeof(*ctx.reg_val_types), GFP_KERNEL);
+        if (ctx.reg_val_types == NULL)
+                goto out_err;
+        ctx.skf = prog;
+        if (reg_val_propagate(&ctx))
+                goto out_err;
+        /*
+         * First pass discovers used resources and instruction offsets
+         * assuming short branches are used.
+         */
+        if (build_int_body(&ctx))
+                goto out_err;
+        /*
+         * If no calls are made (EBPF_SAVE_RA), then tail call count
+         * in $v1, else we must save in n$s4.
+         */
+        if (ctx.flags & EBPF_SEEN_TC) {
+                if (ctx.flags & EBPF_SAVE_RA)
+                        ctx.flags |= EBPF_SAVE_S4;
+                else
+                        ctx.flags |= EBPF_TCC_IN_V1;
+        }
+        /*
+         * Second pass generates offsets, if any branches are out of
+         * range a jump-around long sequence is generated, and we have
+         * to try again from the beginning to generate the new
+         * offsets.  This is done until no additional conversions are
+         * necessary.
+         */
+        do {
+                ctx.idx = 0;
+                ctx.gen_b_offsets = 1;
+                ctx.long_b_conversion = 0;
+                if (gen_int_prologue(&ctx))
+                        goto out_err;
+                if (build_int_body(&ctx))
+                        goto out_err;
+                if (build_int_epilogue(&ctx, MIPS_R_RA))
+                        goto out_err;
+        } while (ctx.long_b_conversion);
+        image_size = 4 * ctx.idx;
+        header = bpf_jit_binary_alloc(image_size, &image_ptr,
+                                      sizeof(u32), jit_fill_hole);
+        if (header == NULL)
+                goto out_err;
+        ctx.target = (u32 *)image_ptr;
+        /* Third pass generates the code */
+        ctx.idx = 0;
+        if (gen_int_prologue(&ctx))
+                goto out_err;
+        if (build_int_body(&ctx))
+                goto out_err;
+        if (build_int_epilogue(&ctx, MIPS_R_RA))
+                goto out_err;
+        /* Update the icache */
+        flush_icache_range((unsigned long)ctx.target,
+                           (unsigned long)(ctx.target + ctx.idx * sizeof(u32)));
+        if (bpf_jit_enable > 1)
+                /* Dump JIT code */
+                bpf_jit_dump(prog->len, image_size, 2, ctx.target);
+        bpf_jit_binary_lock_ro(header);
+        prog->bpf_func = (void *)ctx.target;
+        prog->jited = 1;
+        prog->jited_len = image_size;
+out_normal:
+        if (tmp_blinded)
+                bpf_jit_prog_release_other(prog, prog == orig_prog ?
+                                           tmp : orig_prog);
+        kfree(ctx.offsets);
+        kfree(ctx.reg_val_types);
+        return prog;
+out_err:
+        prog = orig_prog;
+        if (header)
+                bpf_jit_binary_free(header);
+        goto out_normal;
+}
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index bd67ac74fe2d..9632436d74d7 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -28,16 +28,15 @@ EXPORT_SYMBOL(PCIBIOS_MIN_MEM);
 static int __init pcibios_set_cache_line_size(void)
 {
-        struct cpuinfo_mips *c = &current_cpu_data;
        unsigned int lsize;
        /*
         * Set PCI cacheline size to that of the highest level in the
         * cache hierarchy.
         */
-        lsize = c->dcache.linesz;
+        lsize = cpu_dcache_line_size();
-        lsize = c->scache.linesz ? : lsize;
+        lsize = cpu_scache_line_size() ? : lsize;
-        lsize = c->tcache.linesz ? : lsize;
+        lsize = cpu_tcache_line_size() ? : lsize;
        BUG_ON(!lsize);
diff --git a/arch/mips/vdso/gettimeofday.c b/arch/mips/vdso/gettimeofday.c
index 974276e828b2..e2690d7ca4dd 100644
--- a/arch/mips/vdso/gettimeofday.c
+++ b/arch/mips/vdso/gettimeofday.c
@@ -35,7 +35,8 @@ static __always_inline long gettimeofday_fallback(struct timeval *_tv,
        "       syscall\n"
        : "=r" (ret), "=r" (error)
        : "r" (tv), "r" (tz), "r" (nr)
-        : "memory");
+        : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13",
+          "$14", "$15", "$24", "$25", "hi", "lo", "memory");
        return error ? -ret : ret;
 }
@@ -55,7 +56,8 @@ static __always_inline long clock_gettime_fallback(clockid_t _clkid,
        "       syscall\n"
        : "=r" (ret), "=r" (error)
        : "r" (clkid), "r" (ts), "r" (nr)
-        : "memory");
+        : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13",
+          "$14", "$15", "$24", "$25", "hi", "lo", "memory");
        return error ? -ret : ret;
 }
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 36f858c37ca7..81b0031f909f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -199,7 +199,7 @@ config PPC
        select HAVE_OPTPROBES                   if PPC64
        select HAVE_PERF_EVENTS
        select HAVE_PERF_EVENTS_NMI             if PPC64
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
        select HAVE_PERF_REGS
        select HAVE_PERF_USER_STACK_DUMP
        select HAVE_RCU_TABLE_FREE              if SMP
diff --git a/arch/powerpc/configs/powernv_defconfig b/arch/powerpc/configs/powernv_defconfig
index 0695ce047d56..34fc9bbfca9e 100644
--- a/arch/powerpc/configs/powernv_defconfig
+++ b/arch/powerpc/configs/powernv_defconfig
@@ -293,7 +293,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 5175028c56ce..c5246d29f385 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -324,7 +324,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_DEBUG_MUTEXES=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index 1a61aa20dfba..fd5d98a0b95c 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -291,7 +291,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 49d8422767b4..e925c1c99c71 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -223,17 +223,27 @@ system_call_exit:
        andi.   r0,r9,(_TIF_SYSCALL_DOTRACE|_TIF_SINGLESTEP|_TIF_USER_WORK_MASK|_TIF_PERSYSCALL_MASK)
        bne-    .Lsyscall_exit_work
-        /* If MSR_FP and MSR_VEC are set in user msr, then no need to restore */
+        andi.   r0,r8,MSR_FP
-        li      r7,MSR_FP
+        beq 2f
 #ifdef CONFIG_ALTIVEC
-        oris    r7,r7,MSR_VEC@h
+        andis.  r0,r8,MSR_VEC@h
+        bne     3f
 #endif
-        and     r0,r8,r7
+2:      addi    r3,r1,STACK_FRAME_OVERHEAD
-        cmpd    r0,r7
+#ifdef CONFIG_PPC_BOOK3S
-        bne     .Lsyscall_restore_math
+        li      r10,MSR_RI
-.Lsyscall_restore_math_cont:
+        mtmsrd  r10,1           /* Restore RI */
+#endif
+        bl      restore_math
+#ifdef CONFIG_PPC_BOOK3S
+        li      r11,0
+        mtmsrd  r11,1
+#endif
+        ld      r8,_MSR(r1)
+        ld      r3,RESULT(r1)
+        li      r11,-MAX_ERRNO
-        cmpld   r3,r11
+3:      cmpld   r3,r11
        ld      r5,_CCR(r1)
        bge-    .Lsyscall_error
 .Lsyscall_error_cont:
@@ -267,40 +277,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
        std     r5,_CCR(r1)
        b       .Lsyscall_error_cont
-.Lsyscall_restore_math:
-        /*
-         * Some initial tests from restore_math to avoid the heavyweight
-         * C code entry and MSR manipulations.
-         */
-        LOAD_REG_IMMEDIATE(r0, MSR_TS_MASK)
-        and.    r0,r0,r8
-        bne     1f
-        ld      r7,PACACURRENT(r13)
-        lbz     r0,THREAD+THREAD_LOAD_FP(r7)
-#ifdef CONFIG_ALTIVEC
-        lbz     r6,THREAD+THREAD_LOAD_VEC(r7)
-        add     r0,r0,r6
-#endif
-        cmpdi   r0,0
-        beq     .Lsyscall_restore_math_cont
-1:      addi    r3,r1,STACK_FRAME_OVERHEAD
-#ifdef CONFIG_PPC_BOOK3S
-        li      r10,MSR_RI
-        mtmsrd  r10,1           /* Restore RI */
-#endif
-        bl      restore_math
-#ifdef CONFIG_PPC_BOOK3S
-        li      r11,0
-        mtmsrd  r11,1
-#endif
-        /* Restore volatiles, reload MSR from updated one */
-        ld      r8,_MSR(r1)
-        ld      r3,RESULT(r1)
-        li      r11,-MAX_ERRNO
-        b       .Lsyscall_restore_math_cont
 /* Traced system call support */
 .Lsyscall_dotrace:
        bl      save_nvgprs
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 9f3e2c932dcc..1f0fd361e09b 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -362,7 +362,8 @@ void enable_kernel_vsx(void)
        cpumsr = msr_check_and_set(MSR_FP|MSR_VEC|MSR_VSX);
-        if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) {
+        if (current->thread.regs &&
+            (current->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP))) {
                check_if_tm_restore_required(current);
                /*
                 * If a thread has already been reclaimed then the
@@ -386,7 +387,7 @@ void flush_vsx_to_thread(struct task_struct *tsk)
 {
        if (tsk->thread.regs) {
                preempt_disable();
-                if (tsk->thread.regs->msr & MSR_VSX) {
+                if (tsk->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP)) {
                        BUG_ON(tsk != current);
                        giveup_vsx(tsk);
                }
@@ -511,10 +512,6 @@ void restore_math(struct pt_regs *regs)
 {
        unsigned long msr;
-        /*
-         * Syscall exit makes a similar initial check before branching
-         * to restore_math. Keep them in synch.
-         */
        if (!msr_tm_active(regs->msr) &&
                !current->thread.load_fp && !loadvec(current->thread))
                return;
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index cf0e1245b8cc..8d3320562c70 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -351,7 +351,7 @@ static void nmi_ipi_lock_start(unsigned long *flags)
        hard_irq_disable();
        while (atomic_cmpxchg(&__nmi_ipi_lock, 0, 1) == 1) {
                raw_local_irq_restore(*flags);
-                cpu_relax();
+                spin_until_cond(atomic_read(&__nmi_ipi_lock) == 0);
                raw_local_irq_save(*flags);
                hard_irq_disable();
        }
@@ -360,7 +360,7 @@ static void nmi_ipi_lock_start(unsigned long *flags)
 static void nmi_ipi_lock(void)
 {
        while (atomic_cmpxchg(&__nmi_ipi_lock, 0, 1) == 1)
-                cpu_relax();
+                spin_until_cond(atomic_read(&__nmi_ipi_lock) == 0);
 }
 static void nmi_ipi_unlock(void)
@@ -475,7 +475,7 @@ int smp_send_nmi_ipi(int cpu, void (*fn)(struct pt_regs *), u64 delay_us)
        nmi_ipi_lock_start(&flags);
        while (nmi_ipi_busy_count) {
                nmi_ipi_unlock_end(&flags);
-                cpu_relax();
+                spin_until_cond(nmi_ipi_busy_count == 0);
                nmi_ipi_lock_start(&flags);
        }
diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
index b67f8b03a32d..34721a257a77 100644
--- a/arch/powerpc/kernel/watchdog.c
+++ b/arch/powerpc/kernel/watchdog.c
@@ -71,15 +71,20 @@ static inline void wd_smp_lock(unsigned long *flags)
         * This may be called from low level interrupt handlers at some
         * point in future.
         */
-        local_irq_save(*flags);
+        raw_local_irq_save(*flags);
-        while (unlikely(test_and_set_bit_lock(0, &__wd_smp_lock)))
+        hard_irq_disable(); /* Make it soft-NMI safe */
-                cpu_relax();
+        while (unlikely(test_and_set_bit_lock(0, &__wd_smp_lock))) {
+                raw_local_irq_restore(*flags);
+                spin_until_cond(!test_bit(0, &__wd_smp_lock));
+                raw_local_irq_save(*flags);
+                hard_irq_disable();
+        }
 }
 static inline void wd_smp_unlock(unsigned long *flags)
 {
        clear_bit_unlock(0, &__wd_smp_lock);
-        local_irq_restore(*flags);
+        raw_local_irq_restore(*flags);
 }
 static void wd_lockup_ipi(struct pt_regs *regs)
@@ -96,10 +101,10 @@ static void wd_lockup_ipi(struct pt_regs *regs)
                nmi_panic(regs, "Hard LOCKUP");
 }
-static void set_cpu_stuck(int cpu, u64 tb)
+static void set_cpumask_stuck(const struct cpumask *cpumask, u64 tb)
 {
-        cpumask_set_cpu(cpu, &wd_smp_cpus_stuck);
+        cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask);
-        cpumask_clear_cpu(cpu, &wd_smp_cpus_pending);
+        cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask);
        if (cpumask_empty(&wd_smp_cpus_pending)) {
                wd_smp_last_reset_tb = tb;
                cpumask_andnot(&wd_smp_cpus_pending,
@@ -107,6 +112,10 @@ static void set_cpu_stuck(int cpu, u64 tb)
                                &wd_smp_cpus_stuck);
        }
 }
+static void set_cpu_stuck(int cpu, u64 tb)
+{
+        set_cpumask_stuck(cpumask_of(cpu), tb);
+}
 static void watchdog_smp_panic(int cpu, u64 tb)
 {
@@ -135,11 +144,9 @@ static void watchdog_smp_panic(int cpu, u64 tb)
        }
        smp_flush_nmi_ipi(1000000);
-        /* Take the stuck CPU out of the watch group */
+        /* Take the stuck CPUs out of the watch group */
-        for_each_cpu(c, &wd_smp_cpus_pending)
+        set_cpumask_stuck(&wd_smp_cpus_pending, tb);
-                set_cpu_stuck(c, tb);
-out:
        wd_smp_unlock(&flags);
        printk_safe_flush();
@@ -152,6 +159,11 @@ out:
        if (hardlockup_panic)
                nmi_panic(NULL, "Hard LOCKUP");
+        return;
+out:
+        wd_smp_unlock(&flags);
 }
 static void wd_smp_clear_cpu_pending(int cpu, u64 tb)
@@ -258,9 +270,11 @@ static void wd_timer_fn(unsigned long data)
 void arch_touch_nmi_watchdog(void)
 {
+        unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000;
        int cpu = smp_processor_id();
-        watchdog_timer_interrupt(cpu);
+        if (get_tb() - per_cpu(wd_timer_tb, cpu) >= ticks)
+                watchdog_timer_interrupt(cpu);
 }
 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
@@ -283,6 +297,8 @@ static void stop_watchdog_timer_on(unsigned int cpu)
 static int start_wd_on_cpu(unsigned int cpu)
 {
+        unsigned long flags;
        if (cpumask_test_cpu(cpu, &wd_cpus_enabled)) {
                WARN_ON(1);
                return 0;
@@ -297,12 +313,14 @@ static int start_wd_on_cpu(unsigned int cpu)
        if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
                return 0;
+        wd_smp_lock(&flags);
        cpumask_set_cpu(cpu, &wd_cpus_enabled);
        if (cpumask_weight(&wd_cpus_enabled) == 1) {
                cpumask_set_cpu(cpu, &wd_smp_cpus_pending);
                wd_smp_last_reset_tb = get_tb();
        }
-        smp_wmb();
+        wd_smp_unlock(&flags);
        start_watchdog_timer_on(cpu);
        return 0;
@@ -310,12 +328,17 @@ static int start_wd_on_cpu(unsigned int cpu)
 static int stop_wd_on_cpu(unsigned int cpu)
 {
+        unsigned long flags;
        if (!cpumask_test_cpu(cpu, &wd_cpus_enabled))
                return 0; /* Can happen in CPU unplug case */
        stop_watchdog_timer_on(cpu);
+        wd_smp_lock(&flags);
        cpumask_clear_cpu(cpu, &wd_cpus_enabled);
+        wd_smp_unlock(&flags);
        wd_smp_clear_cpu_pending(cpu, get_tb());
        return 0;
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index a160c14304eb..8f2da8bba737 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -265,8 +265,11 @@ static int kvm_spapr_tce_release(struct inode *inode, struct file *filp)
 {
        struct kvmppc_spapr_tce_table *stt = filp->private_data;
        struct kvmppc_spapr_tce_iommu_table *stit, *tmp;
+        struct kvm *kvm = stt->kvm;
+        mutex_lock(&kvm->lock);
        list_del_rcu(&stt->list);
+        mutex_unlock(&kvm->lock);
        list_for_each_entry_safe(stit, tmp, &stt->iommu_tables, next) {
                WARN_ON(!kref_read(&stit->kref));
@@ -294,6 +297,7 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
                                   struct kvm_create_spapr_tce_64 *args)
 {
        struct kvmppc_spapr_tce_table *stt = NULL;
+        struct kvmppc_spapr_tce_table *siter;
        unsigned long npages, size;
        int ret = -ENOMEM;
        int i;
@@ -301,25 +305,17 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
        if (!args->size)
                return -EINVAL;
-        /* Check this LIOBN hasn't been previously allocated */
-        list_for_each_entry(stt, &kvm->arch.spapr_tce_tables, list) {
-                if (stt->liobn == args->liobn)
-                        return -EBUSY;
-        }
        size = _ALIGN_UP(args->size, PAGE_SIZE >> 3);
        npages = kvmppc_tce_pages(size);
        ret = kvmppc_account_memlimit(kvmppc_stt_pages(npages), true);
-        if (ret) {
+        if (ret)
-                stt = NULL;
+                return ret;
-                goto fail;
-        }
        ret = -ENOMEM;
        stt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),
                      GFP_KERNEL);
        if (!stt)
-                goto fail;
+                goto fail_acct;
        stt->liobn = args->liobn;
        stt->page_shift = args->page_shift;
@@ -334,24 +330,39 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
                        goto fail;
        }
-        kvm_get_kvm(kvm);
        mutex_lock(&kvm->lock);
-        list_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);
+        /* Check this LIOBN hasn't been previously allocated */
+        ret = 0;
+        list_for_each_entry(siter, &kvm->arch.spapr_tce_tables, list) {
+                if (siter->liobn == args->liobn) {
+                        ret = -EBUSY;
+                        break;
+                }
+        }
+        if (!ret)
+                ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops,
+                                       stt, O_RDWR | O_CLOEXEC);
+        if (ret >= 0) {
+                list_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);
+                kvm_get_kvm(kvm);
+        }
        mutex_unlock(&kvm->lock);
-        return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops,
+        if (ret >= 0)
-                                stt, O_RDWR | O_CLOEXEC);
+                return ret;
-fail:
+ fail:
-        if (stt) {
+        for (i = 0; i < npages; i++)
-                for (i = 0; i < npages; i++)
+                if (stt->pages[i])
-                        if (stt->pages[i])
+                        __free_page(stt->pages[i]);
-                                __free_page(stt->pages[i]);
-                kfree(stt);
+        kfree(stt);
-        }
+ fail_acct:
+        kvmppc_account_memlimit(kvmppc_stt_pages(npages), false);
        return ret;
 }
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 9dd6b54a43dc..663a4a861e7f 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1298,6 +1298,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
        /* Hypervisor doorbell - exit only if host IPI flag set */
        cmpwi   r12, BOOK3S_INTERRUPT_H_DOORBELL
        bne     3f
+BEGIN_FTR_SECTION
+        PPC_MSGSYNC
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
        lbz     r0, HSTATE_HOST_IPI(r13)
        cmpwi   r0, 0
        beq     4f
diff --git a/arch/powerpc/kvm/book3s_xive_template.c b/arch/powerpc/kvm/book3s_xive_template.c
index 4636ca6e7d38..d1ed2c41b5d2 100644
--- a/arch/powerpc/kvm/book3s_xive_template.c
+++ b/arch/powerpc/kvm/book3s_xive_template.c
@@ -16,7 +16,22 @@ static void GLUE(X_PFX,ack_pending)(struct kvmppc_xive_vcpu *xc)
        u8 cppr;
        u16 ack;
-        /* XXX DD1 bug workaround: Check PIPR vs. CPPR first ! */
+        /*
+         * Ensure any previous store to CPPR is ordered vs.
+         * the subsequent loads from PIPR or ACK.
+         */
+        eieio();
+        /*
+         * DD1 bug workaround: If PIPR is less favored than CPPR
+         * ignore the interrupt or we might incorrectly lose an IPB
+         * bit.
+         */
+        if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
+                u8 pipr = __x_readb(__x_tima + TM_QW1_OS + TM_PIPR);
+                if (pipr >= xc->hw_cppr)
+                        return;
+        }
        /* Perform the acknowledge OS to register cycle. */
        ack = be16_to_cpu(__x_readw(__x_tima + TM_SPC_ACK_OS_REG));
@@ -235,6 +250,11 @@ skip_ipi:
        /*
         * If we found an interrupt, adjust what the guest CPPR should
         * be as if we had just fetched that interrupt from HW.
+         *
+         * Note: This can only make xc->cppr smaller as the previous
+         * loop will only exit with hirq != 0 if prio is lower than
+         * the current xc->cppr. Thus we don't need to re-check xc->mfrr
+         * for pending IPIs.
         */
        if (hirq)
                xc->cppr = prio;
@@ -381,6 +401,12 @@ X_STATIC int GLUE(X_PFX,h_cppr)(struct kvm_vcpu *vcpu, unsigned long cppr)
        xc->cppr = cppr;
        /*
+         * Order the above update of xc->cppr with the subsequent
+         * read of xc->mfrr inside push_pending_to_hw()
+         */
+        smp_mb();
+        /*
         * We are masking less, we need to look for pending things
         * to deliver and set VP pending bits accordingly to trigger
         * a new interrupt otherwise we might miss MFRR changes for
@@ -420,21 +446,37 @@ X_STATIC int GLUE(X_PFX,h_eoi)(struct kvm_vcpu *vcpu, unsigned long xirr)
         * used to signal MFRR changes is EOId when fetched from
         * the queue.
         */
-        if (irq == XICS_IPI || irq == 0)
+        if (irq == XICS_IPI || irq == 0) {
+                /*
+                 * This barrier orders the setting of xc->cppr vs.
+                 * subsquent test of xc->mfrr done inside
+                 * scan_interrupts and push_pending_to_hw
+                 */
+                smp_mb();
                goto bail;
+        }
        /* Find interrupt source */
        sb = kvmppc_xive_find_source(xive, irq, &src);
        if (!sb) {
                pr_devel(" source not found !\n");
                rc = H_PARAMETER;
+                /* Same as above */
+                smp_mb();
                goto bail;
        }
        state = &sb->irq_state[src];
        kvmppc_xive_select_irq(state, &hw_num, &xd);
        state->in_eoi = true;
-        mb();
+        /*
+         * This barrier orders both setting of in_eoi above vs,
+         * subsequent test of guest_priority, and the setting
+         * of xc->cppr vs. subsquent test of xc->mfrr done inside
+         * scan_interrupts and push_pending_to_hw
+         */
+        smp_mb();
 again:
        if (state->guest_priority == MASKED) {
@@ -461,6 +503,14 @@ again:
        }
+        /*
+         * This barrier orders the above guest_priority check
+         * and spin_lock/unlock with clearing in_eoi below.
+         *
+         * It also has to be a full mb() as it must ensure
+         * the MMIOs done in source_eoi() are completed before
+         * state->in_eoi is visible.
+         */
        mb();
        state->in_eoi = false;
 bail:
@@ -495,6 +545,18 @@ X_STATIC int GLUE(X_PFX,h_ipi)(struct kvm_vcpu *vcpu, unsigned long server,
        /* Locklessly write over MFRR */
        xc->mfrr = mfrr;
+        /*
+         * The load of xc->cppr below and the subsequent MMIO store
+         * to the IPI must happen after the above mfrr update is
+         * globally visible so that:
+         *
+         * - Synchronize with another CPU doing an H_EOI or a H_CPPR
+         *   updating xc->cppr then reading xc->mfrr.
+         *
+         * - The target of the IPI sees the xc->mfrr update
+         */
+        mb();
        /* Shoot the IPI if most favored than target cppr */
        if (mfrr < xc->cppr)
                __x_writeq(0, __x_trig_page(&xc->vp_ipi_data));
diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c
index 2abee070373f..a553aeea7af6 100644
--- a/arch/powerpc/platforms/powernv/idle.c
+++ b/arch/powerpc/platforms/powernv/idle.c
@@ -56,6 +56,7 @@ u64 pnv_first_deep_stop_state = MAX_STOP_STATE;
 */
 static u64 pnv_deepest_stop_psscr_val;
 static u64 pnv_deepest_stop_psscr_mask;
+static u64 pnv_deepest_stop_flag;
 static bool deepest_stop_found;
 static int pnv_save_sprs_for_deep_states(void)
@@ -185,8 +186,40 @@ static void pnv_alloc_idle_core_states(void)
        update_subcore_sibling_mask();
-        if (supported_cpuidle_states & OPAL_PM_LOSE_FULL_CONTEXT)
+        if (supported_cpuidle_states & OPAL_PM_LOSE_FULL_CONTEXT) {
-                pnv_save_sprs_for_deep_states();
+                int rc = pnv_save_sprs_for_deep_states();
+                if (likely(!rc))
+                        return;
+                /*
+                 * The stop-api is unable to restore hypervisor
+                 * resources on wakeup from platform idle states which
+                 * lose full context. So disable such states.
+                 */
+                supported_cpuidle_states &= ~OPAL_PM_LOSE_FULL_CONTEXT;
+                pr_warn("cpuidle-powernv: Disabling idle states that lose full context\n");
+                pr_warn("cpuidle-powernv: Idle power-savings, CPU-Hotplug affected\n");
+                if (cpu_has_feature(CPU_FTR_ARCH_300) &&
+                    (pnv_deepest_stop_flag & OPAL_PM_LOSE_FULL_CONTEXT)) {
+                        /*
+                         * Use the default stop state for CPU-Hotplug
+                         * if available.
+                         */
+                        if (default_stop_found) {
+                                pnv_deepest_stop_psscr_val =
+                                        pnv_default_stop_val;
+                                pnv_deepest_stop_psscr_mask =
+                                        pnv_default_stop_mask;
+                                pr_warn("cpuidle-powernv: Offlined CPUs will stop with psscr = 0x%016llx\n",
+                                        pnv_deepest_stop_psscr_val);
+                        } else { /* Fallback to snooze loop for CPU-Hotplug */
+                                deepest_stop_found = false;
+                                pr_warn("cpuidle-powernv: Offlined CPUs will busy wait\n");
+                        }
+                }
+        }
 }
 u32 pnv_get_supported_cpuidle_states(void)
@@ -375,7 +408,8 @@ unsigned long pnv_cpu_offline(unsigned int cpu)
                                                pnv_deepest_stop_psscr_val;
                srr1 = power9_idle_stop(psscr);
-        } else if (idle_states & OPAL_PM_WINKLE_ENABLED) {
+        } else if ((idle_states & OPAL_PM_WINKLE_ENABLED) &&
+                   (idle_states & OPAL_PM_LOSE_FULL_CONTEXT)) {
                srr1 = power7_idle_insn(PNV_THREAD_WINKLE);
        } else if ((idle_states & OPAL_PM_SLEEP_ENABLED) ||
                   (idle_states & OPAL_PM_SLEEP_ENABLED_ER1)) {
@@ -553,6 +587,7 @@ static int __init pnv_power9_idle_init(struct device_node *np, u32 *flags,
                        max_residency_ns = residency_ns[i];
                        pnv_deepest_stop_psscr_val = psscr_val[i];
                        pnv_deepest_stop_psscr_mask = psscr_mask[i];
+                        pnv_deepest_stop_flag = flags[i];
                        deepest_stop_found = true;
                }
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 7317b3108a88..2eb8ff0d6fca 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -47,10 +47,9 @@ struct mmu_table_batch {
 extern void tlb_table_flush(struct mmu_gather *tlb);
 extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
-static inline void tlb_gather_mmu(struct mmu_gather *tlb,
+static inline void
-                                  struct mm_struct *mm,
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
-                                  unsigned long start,
+                        unsigned long start, unsigned long end)
-                                  unsigned long end)
 {
        tlb->mm = mm;
        tlb->start = start;
@@ -76,9 +75,15 @@ static inline void tlb_flush_mmu(struct mmu_gather *tlb)
        tlb_flush_mmu_free(tlb);
 }
-static inline void tlb_finish_mmu(struct mmu_gather *tlb,
+static inline void
-                                  unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
+        if (force) {
+                tlb->start = start;
+                tlb->end = end;
+        }
        tlb_flush_mmu(tlb);
 }
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 01c6fbc3e85b..1803797fc885 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1253,7 +1253,8 @@ static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp)
                insn_count = bpf_jit_insn(jit, fp, i);
                if (insn_count < 0)
                        return -1;
-                jit->addrs[i + 1] = jit->prg; /* Next instruction address */
+                /* Next instruction address */
+                jit->addrs[i + insn_count] = jit->prg;
        }
        bpf_jit_epilogue(jit);
diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
index 46e0d635e36f..51a8bc967e75 100644
--- a/arch/sh/include/asm/tlb.h
+++ b/arch/sh/include/asm/tlb.h
@@ -36,7 +36,8 @@ static inline void init_tlb_gather(struct mmu_gather *tlb)
 }
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                unsigned long start, unsigned long end)
 {
        tlb->mm = mm;
        tlb->start = start;
@@ -47,9 +48,10 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
 }
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
-        if (tlb->fullmm)
+        if (tlb->fullmm || force)
                flush_tlb_mm(tlb->mm);
        /* keep the page table cache within bounds */
diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
index 1d8321c827a8..1b1286d05069 100644
--- a/arch/sparc/include/asm/spitfire.h
+++ b/arch/sparc/include/asm/spitfire.h
@@ -47,10 +47,26 @@
 #define SUN4V_CHIP_NIAGARA5     0x05
 #define SUN4V_CHIP_SPARC_M6     0x06
 #define SUN4V_CHIP_SPARC_M7     0x07
+#define SUN4V_CHIP_SPARC_M8     0x08
 #define SUN4V_CHIP_SPARC64X     0x8a
 #define SUN4V_CHIP_SPARC_SN     0x8b
 #define SUN4V_CHIP_UNKNOWN      0xff
+/*
+ * The following CPU_ID_xxx constants are used
+ * to identify the CPU type in the setup phase
+ * (see head_64.S)
+ */
+#define CPU_ID_NIAGARA1         ('1')
+#define CPU_ID_NIAGARA2         ('2')
+#define CPU_ID_NIAGARA3         ('3')
+#define CPU_ID_NIAGARA4         ('4')
+#define CPU_ID_NIAGARA5         ('5')
+#define CPU_ID_M6               ('6')
+#define CPU_ID_M7               ('7')
+#define CPU_ID_M8               ('8')
+#define CPU_ID_SONOMA1          ('N')
 #ifndef __ASSEMBLY__
 enum ultra_tlb_layout {
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index 493e023a468a..ef4f18f7a674 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -506,6 +506,12 @@ static void __init sun4v_cpu_probe(void)
                sparc_pmu_type = "sparc-m7";
                break;
+        case SUN4V_CHIP_SPARC_M8:
+                sparc_cpu_type = "SPARC-M8";
+                sparc_fpu_type = "SPARC-M8 integrated FPU";
+                sparc_pmu_type = "sparc-m8";
+                break;
        case SUN4V_CHIP_SPARC_SN:
                sparc_cpu_type = "SPARC-SN";
                sparc_fpu_type = "SPARC-SN integrated FPU";
diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
index 45c820e1cba5..90d550bbfeef 100644
--- a/arch/sparc/kernel/cpumap.c
+++ b/arch/sparc/kernel/cpumap.c
@@ -328,6 +328,7 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
        case SUN4V_CHIP_NIAGARA5:
        case SUN4V_CHIP_SPARC_M6:
        case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
        case SUN4V_CHIP_SPARC_SN:
        case SUN4V_CHIP_SPARC64X:
                rover_inc_table = niagara_iterate_method;
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 41a407328667..78e0211753d2 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -424,22 +424,25 @@ EXPORT_SYMBOL(sun4v_chip_type)
         nop
 70:     ldub    [%g1 + 7], %g2
-        cmp     %g2, '3'
+        cmp     %g2, CPU_ID_NIAGARA3
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA3, %g4
-        cmp     %g2, '4'
+        cmp     %g2, CPU_ID_NIAGARA4
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA4, %g4
-        cmp     %g2, '5'
+        cmp     %g2, CPU_ID_NIAGARA5
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA5, %g4
-        cmp     %g2, '6'
+        cmp     %g2, CPU_ID_M6
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_SPARC_M6, %g4
-        cmp     %g2, '7'
+        cmp     %g2, CPU_ID_M7
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_SPARC_M7, %g4
-        cmp     %g2, 'N'
+        cmp     %g2, CPU_ID_M8
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_SPARC_M8, %g4
+        cmp     %g2, CPU_ID_SONOMA1
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_SPARC_SN, %g4
        ba,pt   %xcc, 49f
@@ -448,10 +451,10 @@ EXPORT_SYMBOL(sun4v_chip_type)
 91:     sethi   %hi(prom_cpu_compatible), %g1
        or      %g1, %lo(prom_cpu_compatible), %g1
        ldub    [%g1 + 17], %g2
-        cmp     %g2, '1'
+        cmp     %g2, CPU_ID_NIAGARA1
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA1, %g4
-        cmp     %g2, '2'
+        cmp     %g2, CPU_ID_NIAGARA2
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA2, %g4
        
@@ -602,6 +605,9 @@ niagara_tlb_fixup:
        cmp     %g1, SUN4V_CHIP_SPARC_M7
        be,pt   %xcc, niagara4_patch
         nop
+        cmp     %g1, SUN4V_CHIP_SPARC_M8
+        be,pt   %xcc, niagara4_patch
+         nop
        cmp     %g1, SUN4V_CHIP_SPARC_SN
        be,pt   %xcc, niagara4_patch
         nop
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 4d9c3e13c150..150ee7d4b059 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -288,10 +288,17 @@ static void __init sun4v_patch(void)
        sun4v_patch_2insn_range(&__sun4v_2insn_patch,
                                &__sun4v_2insn_patch_end);
-        if (sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
-            sun4v_chip_type == SUN4V_CHIP_SPARC_SN)
+        switch (sun4v_chip_type) {
+        case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
+        case SUN4V_CHIP_SPARC_SN:
                sun_m7_patch_2insn_range(&__sun_m7_2insn_patch,
                                         &__sun_m7_2insn_patch_end);
+                break;
+        default:
+                break;
+        }
        sun4v_hvapi_init();
 }
@@ -529,6 +536,7 @@ static void __init init_sparc64_elf_hwcap(void)
                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                    sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                        cap |= HWCAP_SPARC_BLKINIT;
@@ -538,6 +546,7 @@ static void __init init_sparc64_elf_hwcap(void)
                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                    sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                        cap |= HWCAP_SPARC_N2;
@@ -568,6 +577,7 @@ static void __init init_sparc64_elf_hwcap(void)
                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                            sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                                cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
@@ -578,6 +588,7 @@ static void __init init_sparc64_elf_hwcap(void)
                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                            sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                            sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                                cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index fed73f14aa49..afa0099f3748 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -1944,12 +1944,22 @@ static void __init setup_page_offset(void)
                        break;
                case SUN4V_CHIP_SPARC_M7:
                case SUN4V_CHIP_SPARC_SN:
-                default:
                        /* M7 and later support 52-bit virtual addresses.  */
                        sparc64_va_hole_top =    0xfff8000000000000UL;
                        sparc64_va_hole_bottom = 0x0008000000000000UL;
                        max_phys_bits = 49;
                        break;
+                case SUN4V_CHIP_SPARC_M8:
+                default:
+                        /* M8 and later support 54-bit virtual addresses.
+                         * However, restricting M8 and above VA bits to 53
+                         * as 4-level page table cannot support more than
+                         * 53 VA bits.
+                         */
+                        sparc64_va_hole_top =    0xfff0000000000000UL;
+                        sparc64_va_hole_bottom = 0x0010000000000000UL;
+                        max_phys_bits = 51;
+                        break;
                }
        }
@@ -2161,6 +2171,7 @@ static void __init sun4v_linear_pte_xor_finalize(void)
         */
        switch (sun4v_chip_type) {
        case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
        case SUN4V_CHIP_SPARC_SN:
                pagecv_flag = 0x00;
                break;
@@ -2313,6 +2324,7 @@ void __init paging_init(void)
         */
        switch (sun4v_chip_type) {
        case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
        case SUN4V_CHIP_SPARC_SN:
                page_cache4v_flag = _PAGE_CP_4V;
                break;
diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
index 600a2e9bfee2..344d95619d03 100644
--- a/arch/um/include/asm/tlb.h
+++ b/arch/um/include/asm/tlb.h
@@ -45,7 +45,8 @@ static inline void init_tlb_gather(struct mmu_gather *tlb)
 }
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                unsigned long start, unsigned long end)
 {
        tlb->mm = mm;
        tlb->start = start;
@@ -80,13 +81,19 @@ tlb_flush_mmu(struct mmu_gather *tlb)
        tlb_flush_mmu_free(tlb);
 }
-/* tlb_finish_mmu
+/* arch_tlb_finish_mmu
 *      Called at the end of the shootdown operation to free up any resources
 *      that were required.
 */
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
+        if (force) {
+                tlb->start = start;
+                tlb->end = end;
+                tlb->need_flush = 1;
+        }
        tlb_flush_mmu(tlb);
        /* keep the page table cache within bounds */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 781521b7cf9e..323cb065be5e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -100,6 +100,7 @@ config X86
        select GENERIC_STRNCPY_FROM_USER
        select GENERIC_STRNLEN_USER
        select GENERIC_TIME_VSYSCALL
+        select HARDLOCKUP_CHECK_TIMESTAMP       if X86_64
        select HAVE_ACPI_APEI                   if ACPI
        select HAVE_ACPI_APEI_NMI               if ACPI
        select HAVE_ALIGNED_STRUCT_PAGE         if SLUB
@@ -163,7 +164,7 @@ config X86
        select HAVE_PCSPKR_PLATFORM
        select HAVE_PERF_EVENTS
        select HAVE_PERF_EVENTS_NMI
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI
        select HAVE_PERF_REGS
        select HAVE_PERF_USER_STACK_DUMP
        select HAVE_REGS_AND_STACK_ACCESS_API
diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
index 1cd792db15ef..1eab79c9ac48 100644
--- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S
+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
@@ -117,11 +117,10 @@
        .set T1, REG_T1
 .endm
-#define K_BASE          %r8
 #define HASH_PTR        %r9
+#define BLOCKS_CTR      %r8
 #define BUFFER_PTR      %r10
 #define BUFFER_PTR2     %r13
-#define BUFFER_END      %r11
 #define PRECALC_BUF     %r14
 #define WK_BUF          %r15
@@ -205,14 +204,14 @@
                 * blended AVX2 and ALU instruction scheduling
                 * 1 vector iteration per 8 rounds
                 */
-                vmovdqu ((i * 2) + PRECALC_OFFSET)(BUFFER_PTR), W_TMP
+                vmovdqu (i * 2)(BUFFER_PTR), W_TMP
        .elseif ((i & 7) == 1)
-                vinsertf128 $1, (((i-1) * 2)+PRECALC_OFFSET)(BUFFER_PTR2),\
+                vinsertf128 $1, ((i-1) * 2)(BUFFER_PTR2),\
                         WY_TMP, WY_TMP
        .elseif ((i & 7) == 2)
                vpshufb YMM_SHUFB_BSWAP, WY_TMP, WY
        .elseif ((i & 7) == 4)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
        .elseif ((i & 7) == 7)
                vmovdqu  WY_TMP, PRECALC_WK(i&~7)
@@ -255,7 +254,7 @@
                vpxor   WY, WY_TMP, WY_TMP
        .elseif ((i & 7) == 7)
                vpxor   WY_TMP2, WY_TMP, WY
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                vmovdqu WY_TMP, PRECALC_WK(i&~7)
                PRECALC_ROTATE_WY
@@ -291,7 +290,7 @@
                vpsrld  $30, WY, WY
                vpor    WY, WY_TMP, WY
        .elseif ((i & 7) == 7)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                vmovdqu WY_TMP, PRECALC_WK(i&~7)
                PRECALC_ROTATE_WY
@@ -446,6 +445,16 @@
 .endm
+/* Add constant only if (%2 > %3) condition met (uses RTA as temp)
+ * %1 + %2 >= %3 ? %4 : 0
+ */
+.macro ADD_IF_GE a, b, c, d
+        mov     \a, RTA
+        add     $\d, RTA
+        cmp     $\c, \b
+        cmovge  RTA, \a
+.endm
 /*
 * macro implements 80 rounds of SHA-1, for multiple blocks with s/w pipelining
 */
@@ -463,13 +472,16 @@
        lea     (2*4*80+32)(%rsp), WK_BUF
        # Precalc WK for first 2 blocks
-        PRECALC_OFFSET = 0
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 2, 64
        .set i, 0
        .rept    160
                PRECALC i
                .set i, i + 1
        .endr
-        PRECALC_OFFSET = 128
+        /* Go to next block if needed */
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 3, 128
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
        xchg    WK_BUF, PRECALC_BUF
        .align 32
@@ -479,8 +491,8 @@ _loop:
         * we use K_BASE value as a signal of a last block,
         * it is set below by: cmovae BUFFER_PTR, K_BASE
         */
-        cmp     K_BASE, BUFFER_PTR
+        test BLOCKS_CTR, BLOCKS_CTR
-        jne     _begin
+        jnz _begin
        .align 32
        jmp     _end
        .align 32
@@ -512,10 +524,10 @@ _loop0:
                .set j, j+2
        .endr
-        add     $(2*64), BUFFER_PTR       /* move to next odd-64-byte block */
+        /* Update Counter */
-        cmp     BUFFER_END, BUFFER_PTR    /* is current block the last one? */
+        sub $1, BLOCKS_CTR
-        cmovae  K_BASE, BUFFER_PTR      /* signal the last iteration smartly */
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 4, 128
        /*
         * rounds
         * 60,62,64,66,68
@@ -532,8 +544,8 @@ _loop0:
        UPDATE_HASH     12(HASH_PTR), D
        UPDATE_HASH     16(HASH_PTR), E
-        cmp     K_BASE, BUFFER_PTR      /* is current block the last one? */
+        test    BLOCKS_CTR, BLOCKS_CTR
-        je      _loop
+        jz      _loop
        mov     TB, B
@@ -575,10 +587,10 @@ _loop2:
                .set j, j+2
        .endr
-        add     $(2*64), BUFFER_PTR2      /* move to next even-64-byte block */
+        /* update counter */
+        sub     $1, BLOCKS_CTR
-        cmp     BUFFER_END, BUFFER_PTR2   /* is current block the last one */
+        /* Move to the next block only if needed*/
-        cmovae  K_BASE, BUFFER_PTR       /* signal the last iteration smartly */
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
        jmp     _loop3
 _loop3:
@@ -641,19 +653,12 @@ _loop3:
        avx2_zeroupper
-        lea     K_XMM_AR(%rip), K_BASE
+        /* Setup initial values */
        mov     CTX, HASH_PTR
        mov     BUF, BUFFER_PTR
-        lea     64(BUF), BUFFER_PTR2
-        shl     $6, CNT                 /* mul by 64 */
-        add     BUF, CNT
-        add     $64, CNT
-        mov     CNT, BUFFER_END
-        cmp     BUFFER_END, BUFFER_PTR2
+        mov     BUF, BUFFER_PTR2
-        cmovae  K_BASE, BUFFER_PTR2
+        mov     CNT, BLOCKS_CTR
        xmm_mov BSWAP_SHUFB_CTL(%rip), YMM_SHUFB_BSWAP
diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c
index f960a043cdeb..fc61739150e7 100644
--- a/arch/x86/crypto/sha1_ssse3_glue.c
+++ b/arch/x86/crypto/sha1_ssse3_glue.c
@@ -201,7 +201,7 @@ asmlinkage void sha1_transform_avx2(u32 *digest, const char *data,
 static bool avx2_usable(void)
 {
-        if (false && avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
+        if (avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
                && boot_cpu_has(X86_FEATURE_BMI1)
                && boot_cpu_has(X86_FEATURE_BMI2))
                return true;
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index d271fb79248f..6d078b89a5e8 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1211,6 +1211,8 @@ ENTRY(nmi)
         * other IST entries.
         */
+        ASM_CLAC
        /* Use %rdx as our temp variable throughout */
        pushq   %rdx
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 8e3db8f642a7..af12e294caed 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2114,7 +2114,7 @@ static void refresh_pce(void *ignored)
        load_mm_cr4(this_cpu_read(cpu_tlbstate.loaded_mm));
 }
-static void x86_pmu_event_mapped(struct perf_event *event)
+static void x86_pmu_event_mapped(struct perf_event *event, struct mm_struct *mm)
 {
        if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                return;
@@ -2129,22 +2129,20 @@ static void x86_pmu_event_mapped(struct perf_event *event)
         * For now, this can't happen because all callers hold mmap_sem
         * for write.  If this changes, we'll need a different solution.
         */
-        lockdep_assert_held_exclusive(&current->mm->mmap_sem);
+        lockdep_assert_held_exclusive(&mm->mmap_sem);
-        if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
+        if (atomic_inc_return(&mm->context.perf_rdpmc_allowed) == 1)
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
-static void x86_pmu_event_unmapped(struct perf_event *event)
+static void x86_pmu_event_unmapped(struct perf_event *event, struct mm_struct *mm)
 {
-        if (!current->mm)
-                return;
        if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                return;
-        if (atomic_dec_and_test(&current->mm->context.perf_rdpmc_allowed))
+        if (atomic_dec_and_test(&mm->context.perf_rdpmc_allowed))
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
 static int x86_pmu_event_idx(struct perf_event *event)
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 8ae8c5ce3a1f..ddd8d3516bfc 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -69,7 +69,7 @@ struct bts_buffer {
        struct bts_phys buf[0];
 };
-struct pmu bts_pmu;
+static struct pmu bts_pmu;
 static size_t buf_size(struct page *page)
 {
diff --git a/arch/x86/events/intel/p4.c b/arch/x86/events/intel/p4.c
index eb0533558c2b..d32c0eed38ca 100644
--- a/arch/x86/events/intel/p4.c
+++ b/arch/x86/events/intel/p4.c
@@ -587,7 +587,7 @@ static __initconst const u64 p4_hw_cache_event_ids
 * P4_CONFIG_ALIASABLE or bits for P4_PEBS_METRIC, they are
 * either up to date automatically or not applicable at all.
 */
-struct p4_event_alias {
+static struct p4_event_alias {
        u64 original;
        u64 alternative;
 } p4_event_aliases[] = {
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index a45e2114a846..8e2457cb6b4a 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -559,7 +559,7 @@ static struct attribute_group rapl_pmu_format_group = {
        .attrs = rapl_formats_attr,
 };
-const struct attribute_group *rapl_attr_groups[] = {
+static const struct attribute_group *rapl_attr_groups[] = {
        &rapl_pmu_attr_group,
        &rapl_pmu_format_group,
        &rapl_pmu_events_group,
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 44ec523287f6..1c5390f1cf09 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -721,7 +721,7 @@ static struct attribute *uncore_pmu_attrs[] = {
        NULL,
 };
-static struct attribute_group uncore_pmu_attr_group = {
+static const struct attribute_group uncore_pmu_attr_group = {
        .attrs = uncore_pmu_attrs,
 };
diff --git a/arch/x86/events/intel/uncore_nhmex.c b/arch/x86/events/intel/uncore_nhmex.c
index cda569332005..6a5cbe90f859 100644
--- a/arch/x86/events/intel/uncore_nhmex.c
+++ b/arch/x86/events/intel/uncore_nhmex.c
@@ -272,7 +272,7 @@ static struct attribute *nhmex_uncore_ubox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_ubox_format_group = {
+static const struct attribute_group nhmex_uncore_ubox_format_group = {
        .name           = "format",
        .attrs          = nhmex_uncore_ubox_formats_attr,
 };
@@ -299,7 +299,7 @@ static struct attribute *nhmex_uncore_cbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_cbox_format_group = {
+static const struct attribute_group nhmex_uncore_cbox_format_group = {
        .name = "format",
        .attrs = nhmex_uncore_cbox_formats_attr,
 };
@@ -407,7 +407,7 @@ static struct attribute *nhmex_uncore_bbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_bbox_format_group = {
+static const struct attribute_group nhmex_uncore_bbox_format_group = {
        .name = "format",
        .attrs = nhmex_uncore_bbox_formats_attr,
 };
@@ -484,7 +484,7 @@ static struct attribute *nhmex_uncore_sbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_sbox_format_group = {
+static const struct attribute_group nhmex_uncore_sbox_format_group = {
        .name                   = "format",
        .attrs                  = nhmex_uncore_sbox_formats_attr,
 };
@@ -898,7 +898,7 @@ static struct attribute *nhmex_uncore_mbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_mbox_format_group = {
+static const struct attribute_group nhmex_uncore_mbox_format_group = {
        .name           = "format",
        .attrs          = nhmex_uncore_mbox_formats_attr,
 };
@@ -1163,7 +1163,7 @@ static struct attribute *nhmex_uncore_rbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_rbox_format_group = {
+static const struct attribute_group nhmex_uncore_rbox_format_group = {
        .name = "format",
        .attrs = nhmex_uncore_rbox_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index a3dcc12bef4a..db1127ce685e 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -130,7 +130,7 @@ static struct attribute *snb_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group snb_uncore_format_group = {
+static const struct attribute_group snb_uncore_format_group = {
        .name           = "format",
        .attrs          = snb_uncore_formats_attr,
 };
@@ -289,7 +289,7 @@ static struct attribute *snb_uncore_imc_formats_attr[] = {
        NULL,
 };
-static struct attribute_group snb_uncore_imc_format_group = {
+static const struct attribute_group snb_uncore_imc_format_group = {
        .name = "format",
        .attrs = snb_uncore_imc_formats_attr,
 };
@@ -769,7 +769,7 @@ static struct attribute *nhm_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhm_uncore_format_group = {
+static const struct attribute_group nhm_uncore_format_group = {
        .name = "format",
        .attrs = nhm_uncore_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 4f9127644b80..db1fe377e6dd 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -602,27 +602,27 @@ static struct uncore_event_desc snbep_uncore_qpi_events[] = {
        { /* end: all zeroes */ },
 };
-static struct attribute_group snbep_uncore_format_group = {
+static const struct attribute_group snbep_uncore_format_group = {
        .name = "format",
        .attrs = snbep_uncore_formats_attr,
 };
-static struct attribute_group snbep_uncore_ubox_format_group = {
+static const struct attribute_group snbep_uncore_ubox_format_group = {
        .name = "format",
        .attrs = snbep_uncore_ubox_formats_attr,
 };
-static struct attribute_group snbep_uncore_cbox_format_group = {
+static const struct attribute_group snbep_uncore_cbox_format_group = {
        .name = "format",
        .attrs = snbep_uncore_cbox_formats_attr,
 };
-static struct attribute_group snbep_uncore_pcu_format_group = {
+static const struct attribute_group snbep_uncore_pcu_format_group = {
        .name = "format",
        .attrs = snbep_uncore_pcu_formats_attr,
 };
-static struct attribute_group snbep_uncore_qpi_format_group = {
+static const struct attribute_group snbep_uncore_qpi_format_group = {
        .name = "format",
        .attrs = snbep_uncore_qpi_formats_attr,
 };
@@ -1431,27 +1431,27 @@ static struct attribute *ivbep_uncore_qpi_formats_attr[] = {
        NULL,
 };
-static struct attribute_group ivbep_uncore_format_group = {
+static const struct attribute_group ivbep_uncore_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_formats_attr,
 };
-static struct attribute_group ivbep_uncore_ubox_format_group = {
+static const struct attribute_group ivbep_uncore_ubox_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_ubox_formats_attr,
 };
-static struct attribute_group ivbep_uncore_cbox_format_group = {
+static const struct attribute_group ivbep_uncore_cbox_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_cbox_formats_attr,
 };
-static struct attribute_group ivbep_uncore_pcu_format_group = {
+static const struct attribute_group ivbep_uncore_pcu_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_pcu_formats_attr,
 };
-static struct attribute_group ivbep_uncore_qpi_format_group = {
+static const struct attribute_group ivbep_uncore_qpi_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_qpi_formats_attr,
 };
@@ -1887,7 +1887,7 @@ static struct attribute *knl_uncore_ubox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_ubox_format_group = {
+static const struct attribute_group knl_uncore_ubox_format_group = {
        .name = "format",
        .attrs = knl_uncore_ubox_formats_attr,
 };
@@ -1927,7 +1927,7 @@ static struct attribute *knl_uncore_cha_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_cha_format_group = {
+static const struct attribute_group knl_uncore_cha_format_group = {
        .name = "format",
        .attrs = knl_uncore_cha_formats_attr,
 };
@@ -2037,7 +2037,7 @@ static struct attribute *knl_uncore_pcu_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_pcu_format_group = {
+static const struct attribute_group knl_uncore_pcu_format_group = {
        .name = "format",
        .attrs = knl_uncore_pcu_formats_attr,
 };
@@ -2187,7 +2187,7 @@ static struct attribute *knl_uncore_irp_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_irp_format_group = {
+static const struct attribute_group knl_uncore_irp_format_group = {
        .name = "format",
        .attrs = knl_uncore_irp_formats_attr,
 };
@@ -2385,7 +2385,7 @@ static struct attribute *hswep_uncore_ubox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group hswep_uncore_ubox_format_group = {
+static const struct attribute_group hswep_uncore_ubox_format_group = {
        .name = "format",
        .attrs = hswep_uncore_ubox_formats_attr,
 };
@@ -2439,7 +2439,7 @@ static struct attribute *hswep_uncore_cbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group hswep_uncore_cbox_format_group = {
+static const struct attribute_group hswep_uncore_cbox_format_group = {
        .name = "format",
        .attrs = hswep_uncore_cbox_formats_attr,
 };
@@ -2621,7 +2621,7 @@ static struct attribute *hswep_uncore_sbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group hswep_uncore_sbox_format_group = {
+static const struct attribute_group hswep_uncore_sbox_format_group = {
        .name = "format",
        .attrs = hswep_uncore_sbox_formats_attr,
 };
@@ -3314,7 +3314,7 @@ static struct attribute *skx_uncore_cha_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_uncore_chabox_format_group = {
+static const struct attribute_group skx_uncore_chabox_format_group = {
        .name = "format",
        .attrs = skx_uncore_cha_formats_attr,
 };
@@ -3427,7 +3427,7 @@ static struct attribute *skx_uncore_iio_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_uncore_iio_format_group = {
+static const struct attribute_group skx_uncore_iio_format_group = {
        .name = "format",
        .attrs = skx_uncore_iio_formats_attr,
 };
@@ -3484,7 +3484,7 @@ static struct attribute *skx_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_uncore_format_group = {
+static const struct attribute_group skx_uncore_format_group = {
        .name = "format",
        .attrs = skx_uncore_formats_attr,
 };
@@ -3605,7 +3605,7 @@ static struct attribute *skx_upi_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_upi_uncore_format_group = {
+static const struct attribute_group skx_upi_uncore_format_group = {
        .name = "format",
        .attrs = skx_upi_uncore_formats_attr,
 };
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 0e25e7a8ab03..ac030f7fbbdc 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -286,7 +286,7 @@
 #define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */
 #define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
 #define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
-#define X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE (15*32+15) /* Virtual VMLOAD VMSAVE */
+#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
 #define X86_FEATURE_VGIF        (15*32+16) /* Virtual GIF */
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 1c18d83d3f09..9aeb91935ce0 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -247,11 +247,11 @@ extern int force_personality32;
 /*
 * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
 * space open for things that want to use the area for 32-bit pointers.
 */
 #define ELF_ET_DYN_BASE         (mmap_is_ia32() ? 0x000400000UL : \
-                                                  0x100000000UL)
+                                                  (TASK_SIZE / 3 * 2))
 /* This yields a mask that user programs can use to figure out what
   instruction set this CPU supports.  This could be done in user space,
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 255645f60ca2..554cdb205d17 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -450,10 +450,10 @@ static inline int copy_fpregs_to_fpstate(struct fpu *fpu)
        return 0;
 }
-static inline void __copy_kernel_to_fpregs(union fpregs_state *fpstate)
+static inline void __copy_kernel_to_fpregs(union fpregs_state *fpstate, u64 mask)
 {
        if (use_xsave()) {
-                copy_kernel_to_xregs(&fpstate->xsave, -1);
+                copy_kernel_to_xregs(&fpstate->xsave, mask);
        } else {
                if (use_fxsr())
                        copy_kernel_to_fxregs(&fpstate->fxsave);
@@ -477,7 +477,7 @@ static inline void copy_kernel_to_fpregs(union fpregs_state *fpstate)
                        : : [addr] "m" (fpstate));
        }
-        __copy_kernel_to_fpregs(fpstate);
+        __copy_kernel_to_fpregs(fpstate, -1);
 }
 extern int copy_fpstate_to_sigframe(void __user *buf, void __user *fp, int size);
diff --git a/arch/x86/include/asm/hypervisor.h b/arch/x86/include/asm/hypervisor.h
index 21126155a739..0ead9dbb9130 100644
--- a/arch/x86/include/asm/hypervisor.h
+++ b/arch/x86/include/asm/hypervisor.h
@@ -43,6 +43,9 @@ struct hypervisor_x86 {
        /* pin current vcpu to specified physical cpu (run rarely) */
        void            (*pin_vcpu)(int);
+        /* called during init_mem_mapping() to setup early mappings. */
+        void            (*init_mem_mapping)(void);
 };
 extern const struct hypervisor_x86 *x86_hyper;
@@ -57,8 +60,15 @@ extern const struct hypervisor_x86 x86_hyper_kvm;
 extern void init_hypervisor_platform(void);
 extern bool hypervisor_x2apic_available(void);
 extern void hypervisor_pin_vcpu(int cpu);
+static inline void hypervisor_init_mem_mapping(void)
+{
+        if (x86_hyper && x86_hyper->init_mem_mapping)
+                x86_hyper->init_mem_mapping();
+}
 #else
 static inline void init_hypervisor_platform(void) { }
 static inline bool hypervisor_x2apic_available(void) { return false; }
+static inline void hypervisor_init_mem_mapping(void) { }
 #endif /* CONFIG_HYPERVISOR_GUEST */
 #endif /* _ASM_X86_HYPERVISOR_H */
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index afa70749903e..702af26de87e 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -492,6 +492,7 @@ struct kvm_vcpu_arch {
        unsigned long cr4;
        unsigned long cr4_guest_owned_bits;
        unsigned long cr8;
+        u32 pkru;
        u32 hflags;
        u64 efer;
        u64 apic_base;
diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
index 7cf7c70b6ef2..0ee83321a313 100644
--- a/arch/x86/kernel/cpu/aperfmperf.c
+++ b/arch/x86/kernel/cpu/aperfmperf.c
@@ -40,13 +40,16 @@ static void aperfmperf_snapshot_khz(void *dummy)
        struct aperfmperf_sample *s = this_cpu_ptr(&samples);
        ktime_t now = ktime_get();
        s64 time_delta = ktime_ms_delta(now, s->time);
+        unsigned long flags;
        /* Don't bother re-computing within the cache threshold time. */
        if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
                return;
+        local_irq_save(flags);
        rdmsrl(MSR_IA32_APERF, aperf);
        rdmsrl(MSR_IA32_MPERF, mperf);
+        local_irq_restore(flags);
        aperf_delta = aperf - s->aperf;
        mperf_delta = mperf - s->mperf;
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d7cc190ae457..f7370abd33c6 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -122,7 +122,7 @@ static struct attribute *thermal_throttle_attrs[] = {
        NULL
 };
-static struct attribute_group thermal_attr_group = {
+static const struct attribute_group thermal_attr_group = {
        .attrs  = thermal_throttle_attrs,
        .name   = "thermal_throttle"
 };
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 9cb98ee103db..86e8f0b2537b 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -561,7 +561,7 @@ static struct attribute *mc_default_attrs[] = {
        NULL
 };
-static struct attribute_group mc_attr_group = {
+static const struct attribute_group mc_attr_group = {
        .attrs                  = mc_default_attrs,
        .name                   = "microcode",
 };
@@ -707,7 +707,7 @@ static struct attribute *cpu_root_microcode_attrs[] = {
        NULL
 };
-static struct attribute_group cpu_root_microcode_group = {
+static const struct attribute_group cpu_root_microcode_group = {
        .name  = "microcode",
        .attrs = cpu_root_microcode_attrs,
 };
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index c5bb63be4ba1..40d5a8a75212 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -237,6 +237,18 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
        stop_machine(mtrr_rendezvous_handler, &data, cpu_online_mask);
 }
+static void set_mtrr_cpuslocked(unsigned int reg, unsigned long base,
+                                unsigned long size, mtrr_type type)
+{
+        struct set_mtrr_data data = { .smp_reg = reg,
+                                      .smp_base = base,
+                                      .smp_size = size,
+                                      .smp_type = type
+                                    };
+        stop_machine_cpuslocked(mtrr_rendezvous_handler, &data, cpu_online_mask);
+}
 static void set_mtrr_from_inactive_cpu(unsigned int reg, unsigned long base,
                                      unsigned long size, mtrr_type type)
 {
@@ -370,7 +382,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
        /* Search for an empty MTRR */
        i = mtrr_if->get_free_region(base, size, replace);
        if (i >= 0) {
-                set_mtrr(i, base, size, type);
+                set_mtrr_cpuslocked(i, base, size, type);
                if (likely(replace < 0)) {
                        mtrr_usage_table[i] = 1;
                } else {
@@ -378,7 +390,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
                        if (increment)
                                mtrr_usage_table[i]++;
                        if (unlikely(replace != i)) {
-                                set_mtrr(replace, 0, 0, 0);
+                                set_mtrr_cpuslocked(replace, 0, 0, 0);
                                mtrr_usage_table[replace] = 0;
                        }
                }
@@ -506,7 +518,7 @@ int mtrr_del_page(int reg, unsigned long base, unsigned long size)
                goto out;
        }
        if (--mtrr_usage_table[reg] < 1)
-                set_mtrr(reg, 0, 0, 0);
+                set_mtrr_cpuslocked(reg, 0, 0, 0);
        error = reg;
 out:
        mutex_unlock(&mtrr_mutex);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 46c3c73e7f43..9ba79543d9ee 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -53,6 +53,7 @@ void __head __startup_64(unsigned long physaddr)
        pudval_t *pud;
        pmdval_t *pmd, pmd_entry;
        int i;
+        unsigned int *next_pgt_ptr;
        /* Is the address too large? */
        if (physaddr >> MAX_PHYSMEM_BITS)
@@ -91,9 +92,9 @@ void __head __startup_64(unsigned long physaddr)
         * creates a bunch of nonsense entries but that is fine --
         * it avoids problems around wraparound.
         */
+        next_pgt_ptr = fixup_pointer(&next_early_pgt, physaddr);
-        pud = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+        pud = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
-        pmd = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+        pmd = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
        if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
                p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 4afc67f5facc..06e1ff5562c0 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -55,7 +55,7 @@ static struct bin_attribute *boot_params_data_attrs[] = {
        NULL,
 };
-static struct attribute_group boot_params_attr_group = {
+static const struct attribute_group boot_params_attr_group = {
        .attrs = boot_params_version_attrs,
        .bin_attrs = boot_params_data_attrs,
 };
@@ -202,7 +202,7 @@ static struct bin_attribute *setup_data_data_attrs[] = {
        NULL,
 };
-static struct attribute_group setup_data_attr_group = {
+static const struct attribute_group setup_data_attr_group = {
        .attrs = setup_data_type_attrs,
        .bin_attrs = setup_data_data_attrs,
 };
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index b474c8de7fba..54b9e89d4d6b 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -971,7 +971,8 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
 * Returns zero if CPU booted OK, else error code from
 * ->wakeup_secondary_cpu.
 */
-static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
+                       int *cpu0_nmi_registered)
 {
        volatile u32 *trampoline_status =
                (volatile u32 *) __va(real_mode_header->trampoline_status);
@@ -979,7 +980,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
        unsigned long start_ip = real_mode_header->trampoline_start;
        unsigned long boot_error = 0;
-        int cpu0_nmi_registered = 0;
        unsigned long timeout;
        idle->thread.sp = (unsigned long)task_pt_regs(idle);
@@ -1035,7 +1035,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                boot_error = apic->wakeup_secondary_cpu(apicid, start_ip);
        else
                boot_error = wakeup_cpu_via_init_nmi(cpu, start_ip, apicid,
-                                                     &cpu0_nmi_registered);
+                                                     cpu0_nmi_registered);
        if (!boot_error) {
                /*
@@ -1080,12 +1080,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                 */
                smpboot_restore_warm_reset_vector();
        }
-        /*
-         * Clean up the nmi handler. Do this after the callin and callout sync
-         * to avoid impact of possible long unregister time.
-         */
-        if (cpu0_nmi_registered)
-                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
        return boot_error;
 }
@@ -1093,8 +1087,9 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
 int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
        int apicid = apic->cpu_present_to_apicid(cpu);
+        int cpu0_nmi_registered = 0;
        unsigned long flags;
-        int err;
+        int err, ret = 0;
        WARN_ON(irqs_disabled());
@@ -1131,10 +1126,11 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
        common_cpu_up(cpu, tidle);
-        err = do_boot_cpu(apicid, cpu, tidle);
+        err = do_boot_cpu(apicid, cpu, tidle, &cpu0_nmi_registered);
        if (err) {
                pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
-                return -EIO;
+                ret = -EIO;
+                goto unreg_nmi;
        }
        /*
@@ -1150,7 +1146,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
                touch_nmi_watchdog();
        }
-        return 0;
+unreg_nmi:
+        /*
+         * Clean up the nmi handler. Do this after the callin and callout sync
+         * to avoid impact of possible long unregister time.
+         */
+        if (cpu0_nmi_registered)
+                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
+        return ret;
 }
 /**
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 1cea3ffba82d..0099e10eb045 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -474,7 +474,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                        entry->ecx &= kvm_cpuid_7_0_ecx_x86_features;
                        cpuid_mask(&entry->ecx, CPUID_7_ECX);
                        /* PKU is not yet implemented for shadow paging. */
-                        if (!tdp_enabled)
+                        if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))
                                entry->ecx &= ~F(PKU);
                        entry->edx &= kvm_cpuid_7_0_edx_x86_features;
                        entry->edx &= get_scattered_cpuid_leaf(7, 0, CPUID_EDX);
diff --git a/arch/x86/kvm/kvm_cache_regs.h b/arch/x86/kvm/kvm_cache_regs.h
index 0052317b2733..9add410f195f 100644
--- a/arch/x86/kvm/kvm_cache_regs.h
+++ b/arch/x86/kvm/kvm_cache_regs.h
@@ -84,11 +84,6 @@ static inline u64 kvm_read_edx_eax(struct kvm_vcpu *vcpu)
                | ((u64)(kvm_register_read(vcpu, VCPU_REGS_RDX) & -1u) << 32);
 }
-static inline u32 kvm_read_pkru(struct kvm_vcpu *vcpu)
-{
-        return kvm_x86_ops->get_pkru(vcpu);
-}
 static inline void enter_guest_mode(struct kvm_vcpu *vcpu)
 {
        vcpu->arch.hflags |= HF_GUEST_MASK;
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index e2999f57bfc4..64a2dbd2b1af 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -172,7 +172,7 @@ static inline u8 permission_fault(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
                * index of the protection domain, so pte_pkey * 2 is
                * is the index of the first bit for the domain.
                */
-                pkru_bits = (kvm_read_pkru(vcpu) >> (pte_pkey * 2)) & 3;
+                pkru_bits = (vcpu->arch.pkru >> (pte_pkey * 2)) & 3;
                /* clear present bit, replace PFEC.RSVD with ACC_USER_MASK. */
                offset = (pfec & ~1) +
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 9f6fb0ef206c..968f38dcb864 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1117,7 +1117,7 @@ static __init int svm_hardware_setup(void)
        if (vls) {
                if (!npt_enabled ||
-                    !boot_cpu_has(X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE) ||
+                    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
                    !IS_ENABLED(CONFIG_X86_64)) {
                        vls = false;
                } else {
@@ -1790,11 +1790,6 @@ static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
        to_svm(vcpu)->vmcb->save.rflags = rflags;
 }
-static u32 svm_get_pkru(struct kvm_vcpu *vcpu)
-{
-        return 0;
-}
 static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
 {
        switch (reg) {
@@ -5436,8 +5431,6 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
        .get_rflags = svm_get_rflags,
        .set_rflags = svm_set_rflags,
-        .get_pkru = svm_get_pkru,
        .tlb_flush = svm_flush_tlb,
        .run = svm_vcpu_run,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index ec6b1932dea9..c6efc1f88b25 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -641,8 +641,6 @@ struct vcpu_vmx {
        u64 current_tsc_ratio;
-        bool guest_pkru_valid;
-        u32 guest_pkru;
        u32 host_pkru;
        /*
@@ -2398,11 +2396,6 @@ static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
                to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
 }
-static u32 vmx_get_pkru(struct kvm_vcpu *vcpu)
-{
-        return to_vmx(vcpu)->guest_pkru;
-}
 static u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
 {
        u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
@@ -9291,8 +9284,10 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
        if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
                vmx_set_interrupt_shadow(vcpu, 0);
-        if (vmx->guest_pkru_valid)
+        if (static_cpu_has(X86_FEATURE_PKU) &&
-                __write_pkru(vmx->guest_pkru);
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+            vcpu->arch.pkru != vmx->host_pkru)
+                __write_pkru(vcpu->arch.pkru);
        atomic_switch_perf_msrs(vmx);
        debugctlmsr = get_debugctlmsr();
@@ -9440,13 +9435,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
         * back on host, so it is safe to read guest PKRU from current
         * XSAVE.
         */
-        if (boot_cpu_has(X86_FEATURE_OSPKE)) {
+        if (static_cpu_has(X86_FEATURE_PKU) &&
-                vmx->guest_pkru = __read_pkru();
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
-                if (vmx->guest_pkru != vmx->host_pkru) {
+                vcpu->arch.pkru = __read_pkru();
-                        vmx->guest_pkru_valid = true;
+                if (vcpu->arch.pkru != vmx->host_pkru)
                        __write_pkru(vmx->host_pkru);
-                } else
-                        vmx->guest_pkru_valid = false;
        }
        /*
@@ -11964,8 +11957,6 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
        .get_rflags = vmx_get_rflags,
        .set_rflags = vmx_set_rflags,
-        .get_pkru = vmx_get_pkru,
        .tlb_flush = vmx_flush_tlb,
        .run = vmx_vcpu_run,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3abaff61829d..afd9525b4b7c 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3269,7 +3269,12 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
                        u32 size, offset, ecx, edx;
                        cpuid_count(XSTATE_CPUID, index,
                                    &size, &offset, &ecx, &edx);
-                        memcpy(dest + offset, src, size);
+                        if (feature == XFEATURE_MASK_PKRU)
+                                memcpy(dest + offset, &vcpu->arch.pkru,
+                                       sizeof(vcpu->arch.pkru));
+                        else
+                                memcpy(dest + offset, src, size);
                }
                valid -= feature;
@@ -3307,7 +3312,11 @@ static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
                        u32 size, offset, ecx, edx;
                        cpuid_count(XSTATE_CPUID, index,
                                    &size, &offset, &ecx, &edx);
-                        memcpy(dest, src + offset, size);
+                        if (feature == XFEATURE_MASK_PKRU)
+                                memcpy(&vcpu->arch.pkru, src + offset,
+                                       sizeof(vcpu->arch.pkru));
+                        else
+                                memcpy(dest, src + offset, size);
                }
                valid -= feature;
@@ -7667,7 +7676,9 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
         */
        vcpu->guest_fpu_loaded = 1;
        __kernel_fpu_begin();
-        __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state);
+        /* PKRU is separately restored in kvm_x86_ops->run.  */
+        __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state,
+                                ~XFEATURE_MASK_PKRU);
        trace_kvm_fpu(1);
 }
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 673541eb3b3f..bf3f1065d6ad 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -18,6 +18,7 @@
 #include <asm/dma.h>            /* for MAX_DMA_PFN */
 #include <asm/microcode.h>
 #include <asm/kaslr.h>
+#include <asm/hypervisor.h>
 /*
 * We need to define the tracepoints somewhere, and tlb.c
@@ -636,6 +637,8 @@ void __init init_mem_mapping(void)
        load_cr3(swapper_pg_dir);
        __flush_tlb_all();
+        hypervisor_init_mem_mapping();
        early_memtest(0, max_pfn_mapped << PAGE_SHIFT);
 }
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 229d04a83f85..a88cfbfbd078 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -50,8 +50,7 @@ unsigned long tasksize_64bit(void)
 static unsigned long stack_maxrandom_size(unsigned long task_size)
 {
        unsigned long max = 0;
-        if ((current->flags & PF_RANDOMIZE) &&
+        if (current->flags & PF_RANDOMIZE) {
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
                max = (-1UL) & __STACK_RND_MASK(task_size == tasksize_32bit());
                max <<= PAGE_SHIFT;
        }
@@ -79,13 +78,13 @@ static int mmap_is_legacy(void)
 static unsigned long arch_rnd(unsigned int rndbits)
 {
+        if (!(current->flags & PF_RANDOMIZE))
+                return 0;
        return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT;
 }
 unsigned long arch_mmap_rnd(void)
 {
-        if (!(current->flags & PF_RANDOMIZE))
-                return 0;
        return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
 }
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3e4bdb442fbc..f44c0bc95aa2 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -26,7 +26,7 @@
 static struct bau_operations ops __ro_after_init;
 /* timeouts in nanoseconds (indexed by UVH_AGING_PRESCALE_SEL urgency7 30:28) */
-static int timeout_base_ns[] = {
+static const int timeout_base_ns[] = {
                20,
                160,
                1280,
@@ -1216,7 +1216,7 @@ static struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
 * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
 * Such a message must be ignored.
 */
-void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
+static void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
 {
        unsigned long mmr_image;
        unsigned char swack_vec;
diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c
index 87d791356ea9..de503c225ae1 100644
--- a/arch/x86/xen/enlighten_hvm.c
+++ b/arch/x86/xen/enlighten_hvm.c
@@ -12,6 +12,7 @@
 #include <asm/setup.h>
 #include <asm/hypervisor.h>
 #include <asm/e820/api.h>
+#include <asm/early_ioremap.h>
 #include <asm/xen/cpuid.h>
 #include <asm/xen/hypervisor.h>
@@ -21,38 +22,50 @@
 #include "mmu.h"
 #include "smp.h"
-void __ref xen_hvm_init_shared_info(void)
+static unsigned long shared_info_pfn;
+void xen_hvm_init_shared_info(void)
 {
        struct xen_add_to_physmap xatp;
-        u64 pa;
-        if (HYPERVISOR_shared_info == &xen_dummy_shared_info) {
-                /*
-                 * Search for a free page starting at 4kB physical address.
-                 * Low memory is preferred to avoid an EPT large page split up
-                 * by the mapping.
-                 * Starting below X86_RESERVE_LOW (usually 64kB) is fine as
-                 * the BIOS used for HVM guests is well behaved and won't
-                 * clobber memory other than the first 4kB.
-                 */
-                for (pa = PAGE_SIZE;
-                     !e820__mapped_all(pa, pa + PAGE_SIZE, E820_TYPE_RAM) ||
-                     memblock_is_reserved(pa);
-                     pa += PAGE_SIZE)
-                        ;
-                memblock_reserve(pa, PAGE_SIZE);
-                HYPERVISOR_shared_info = __va(pa);
-        }
        xatp.domid = DOMID_SELF;
        xatp.idx = 0;
        xatp.space = XENMAPSPACE_shared_info;
-        xatp.gpfn = virt_to_pfn(HYPERVISOR_shared_info);
+        xatp.gpfn = shared_info_pfn;
        if (HYPERVISOR_memory_op(XENMEM_add_to_physmap, &xatp))
                BUG();
 }
+static void __init reserve_shared_info(void)
+{
+        u64 pa;
+        /*
+         * Search for a free page starting at 4kB physical address.
+         * Low memory is preferred to avoid an EPT large page split up
+         * by the mapping.
+         * Starting below X86_RESERVE_LOW (usually 64kB) is fine as
+         * the BIOS used for HVM guests is well behaved and won't
+         * clobber memory other than the first 4kB.
+         */
+        for (pa = PAGE_SIZE;
+             !e820__mapped_all(pa, pa + PAGE_SIZE, E820_TYPE_RAM) ||
+             memblock_is_reserved(pa);
+             pa += PAGE_SIZE)
+                ;
+        shared_info_pfn = PHYS_PFN(pa);
+        memblock_reserve(pa, PAGE_SIZE);
+        HYPERVISOR_shared_info = early_memremap(pa, PAGE_SIZE);
+}
+static void __init xen_hvm_init_mem_mapping(void)
+{
+        early_memunmap(HYPERVISOR_shared_info, PAGE_SIZE);
+        HYPERVISOR_shared_info = __va(PFN_PHYS(shared_info_pfn));
+}
 static void __init init_hvm_pv_info(void)
 {
        int major, minor;
@@ -153,6 +166,7 @@ static void __init xen_hvm_guest_init(void)
        init_hvm_pv_info();
+        reserve_shared_info();
        xen_hvm_init_shared_info();
        /*
@@ -218,5 +232,6 @@ const struct hypervisor_x86 x86_hyper_xen_hvm = {
        .init_platform          = xen_hvm_guest_init,
        .pin_vcpu               = xen_pin_vcpu,
        .x2apic_available       = xen_x2apic_para_available,
+        .init_mem_mapping       = xen_hvm_init_mem_mapping,
 };
 EXPORT_SYMBOL(x86_hyper_xen_hvm);
diff --git a/arch/xtensa/include/asm/Kbuild b/arch/xtensa/include/asm/Kbuild
index 2d716ebc5a5e..dff7cc39437c 100644
--- a/arch/xtensa/include/asm/Kbuild
+++ b/arch/xtensa/include/asm/Kbuild
@@ -1,5 +1,6 @@
 generic-y += bug.h
 generic-y += clkdev.h
+generic-y += device.h
 generic-y += div64.h
 generic-y += dma-contiguous.h
 generic-y += emergency-restart.h
@@ -17,6 +18,7 @@ generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
+generic-y += param.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += rwsem.h
diff --git a/arch/xtensa/include/asm/device.h b/arch/xtensa/include/asm/device.h
deleted file mode 100644
index 1deeb8ebbb1b..000000000000
--- a/arch/xtensa/include/asm/device.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Arch specific extensions to struct device
- *
- * This file is released under the GPLv2
- */
-#ifndef _ASM_XTENSA_DEVICE_H
-#define _ASM_XTENSA_DEVICE_H
-struct dev_archdata {
-};
-struct pdev_archdata {
-};
-#endif /* _ASM_XTENSA_DEVICE_H */
diff --git a/arch/xtensa/include/asm/param.h b/arch/xtensa/include/asm/param.h
deleted file mode 100644
index 0a70e780ef2a..000000000000
--- a/arch/xtensa/include/asm/param.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * include/asm-xtensa/param.h
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 2001 - 2005 Tensilica Inc.
- */
-#ifndef _XTENSA_PARAM_H
-#define _XTENSA_PARAM_H
-#include <uapi/asm/param.h>
-# define HZ             CONFIG_HZ       /* internal timer frequency */
-# define USER_HZ        100             /* for user interfaces in "ticks" */
-# define CLOCKS_PER_SEC (USER_HZ)       /* frequnzy at which times() counts */
-#endif /* _XTENSA_PARAM_H */
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index d159e9b9c018..672391003e40 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -94,13 +94,11 @@ unsigned long __sync_fetch_and_or_4(unsigned long *p, unsigned long v)
 }
 EXPORT_SYMBOL(__sync_fetch_and_or_4);
-#ifdef CONFIG_NET
 /*
 * Networking support
 */
 EXPORT_SYMBOL(csum_partial);
 EXPORT_SYMBOL(csum_partial_copy_generic);
-#endif /* CONFIG_NET */
 /*
 * Architecture-specific symbols
diff --git a/arch/xtensa/mm/cache.c b/arch/xtensa/mm/cache.c
index 1a804a2f9a5b..3c75c4e597da 100644
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -103,6 +103,7 @@ void clear_user_highpage(struct page *page, unsigned long vaddr)
        clear_page_alias(kvaddr, paddr);
        preempt_enable();
 }
+EXPORT_SYMBOL(clear_user_highpage);
 void copy_user_highpage(struct page *dst, struct page *src,
                        unsigned long vaddr, struct vm_area_struct *vma)
@@ -119,10 +120,7 @@ void copy_user_highpage(struct page *dst, struct page *src,
        copy_page_alias(dst_vaddr, src_vaddr, dst_paddr, src_paddr);
        preempt_enable();
 }
+EXPORT_SYMBOL(copy_user_highpage);
-#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
 /*
 * Any time the kernel writes to a user page cache page, or it is about to
@@ -176,7 +174,7 @@ void flush_dcache_page(struct page *page)
        /* There shouldn't be an entry in the cache for this page anymore. */
 }
+EXPORT_SYMBOL(flush_dcache_page);
 /*
 * For now, flush the whole cache. FIXME??
@@ -188,6 +186,7 @@ void local_flush_cache_range(struct vm_area_struct *vma,
        __flush_invalidate_dcache_all();
        __invalidate_icache_all();
 }
+EXPORT_SYMBOL(local_flush_cache_range);
 /* 
 * Remove any entry in the cache for this page. 
@@ -207,8 +206,9 @@ void local_flush_cache_page(struct vm_area_struct *vma, unsigned long address,
        __flush_invalidate_dcache_page_alias(virt, phys);
        __invalidate_icache_page_alias(virt, phys);
 }
+EXPORT_SYMBOL(local_flush_cache_page);
-#endif
+#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
 void
 update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
@@ -225,7 +225,7 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
        flush_tlb_page(vma, addr);
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+#if (DCACHE_WAY_SIZE > PAGE_SIZE)
        if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) {
                unsigned long phys = page_to_phys(page);
@@ -256,7 +256,7 @@ update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
 * flush_dcache_page() on the page.
 */
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+#if (DCACHE_WAY_SIZE > PAGE_SIZE)
 void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
                unsigned long vaddr, void *dst, const void *src,
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index 63e771ab56d8..859f0a8c97c8 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -71,17 +71,29 @@ struct bfq_service_tree {
 *
 * bfq_sched_data is the basic scheduler queue.  It supports three
 * ioprio_classes, and can be used either as a toplevel queue or as an
- * intermediate queue on a hierarchical setup.  @next_in_service
+ * intermediate queue in a hierarchical setup.
- * points to the active entity of the sched_data service trees that
- * will be scheduled next. It is used to reduce the number of steps
- * needed for each hierarchical-schedule update.
 *
 * The supported ioprio_classes are the same as in CFQ, in descending
 * priority order, IOPRIO_CLASS_RT, IOPRIO_CLASS_BE, IOPRIO_CLASS_IDLE.
 * Requests from higher priority queues are served before all the
 * requests from lower priority queues; among requests of the same
 * queue requests are served according to B-WF2Q+.
- * All the fields are protected by the queue lock of the containing bfqd.
+ *
+ * The schedule is implemented by the service trees, plus the field
+ * @next_in_service, which points to the entity on the active trees
+ * that will be served next, if 1) no changes in the schedule occurs
+ * before the current in-service entity is expired, 2) the in-service
+ * queue becomes idle when it expires, and 3) if the entity pointed by
+ * in_service_entity is not a queue, then the in-service child entity
+ * of the entity pointed by in_service_entity becomes idle on
+ * expiration. This peculiar definition allows for the following
+ * optimization, not yet exploited: while a given entity is still in
+ * service, we already know which is the best candidate for next
+ * service among the other active entitities in the same parent
+ * entity. We can then quickly compare the timestamps of the
+ * in-service entity with those of such best candidate.
+ *
+ * All fields are protected by the lock of the containing bfqd.
 */
 struct bfq_sched_data {
        /* entity in service */
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 979f8f21b7e2..911aa7431dbe 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -188,21 +188,23 @@ static bool bfq_update_parent_budget(struct bfq_entity *next_in_service)
 /*
 * This function tells whether entity stops being a candidate for next
- * service, according to the following logic.
+ * service, according to the restrictive definition of the field
+ * next_in_service. In particular, this function is invoked for an
+ * entity that is about to be set in service.
 *
- * This function is invoked for an entity that is about to be set in
+ * If entity is a queue, then the entity is no longer a candidate for
- * service. If such an entity is a queue, then the entity is no longer
+ * next service according to the that definition, because entity is
- * a candidate for next service (i.e, a candidate entity to serve
+ * about to become the in-service queue. This function then returns
- * after the in-service entity is expired). The function then returns
+ * true if entity is a queue.
- * true.
 *
- * In contrast, the entity could stil be a candidate for next service
+ * In contrast, entity could still be a candidate for next service if
- * if it is not a queue, and has more than one child. In fact, even if
+ * it is not a queue, and has more than one active child. In fact,
- * one of its children is about to be set in service, other children
+ * even if one of its children is about to be set in service, other
- * may still be the next to serve. As a consequence, a non-queue
+ * active children may still be the next to serve, for the parent
- * entity is not a candidate for next-service only if it has only one
+ * entity, even according to the above definition. As a consequence, a
- * child. And only if this condition holds, then the function returns
+ * non-queue entity is not a candidate for next-service only if it has
- * true for a non-queue entity.
+ * only one active child. And only if this condition holds, then this
+ * function returns true for a non-queue entity.
 */
 static bool bfq_no_longer_next_in_service(struct bfq_entity *entity)
 {
@@ -213,6 +215,18 @@ static bool bfq_no_longer_next_in_service(struct bfq_entity *entity)
        bfqg = container_of(entity, struct bfq_group, entity);
+        /*
+         * The field active_entities does not always contain the
+         * actual number of active children entities: it happens to
+         * not account for the in-service entity in case the latter is
+         * removed from its active tree (which may get done after
+         * invoking the function bfq_no_longer_next_in_service in
+         * bfq_get_next_queue). Fortunately, here, i.e., while
+         * bfq_no_longer_next_in_service is not yet completed in
+         * bfq_get_next_queue, bfq_active_extract has not yet been
+         * invoked, and thus active_entities still coincides with the
+         * actual number of active entities.
+         */
        if (bfqg->active_entities == 1)
                return true;
@@ -954,7 +968,7 @@ static void bfq_update_fin_time_enqueue(struct bfq_entity *entity,
 * one of its children receives a new request.
 *
 * Basically, this function updates the timestamps of entity and
- * inserts entity into its active tree, ater possible extracting it
+ * inserts entity into its active tree, ater possibly extracting it
 * from its idle tree.
 */
 static void __bfq_activate_entity(struct bfq_entity *entity,
@@ -1048,7 +1062,7 @@ static void __bfq_requeue_entity(struct bfq_entity *entity)
                entity->start = entity->finish;
                /*
                 * In addition, if the entity had more than one child
-                 * when set in service, then was not extracted from
+                 * when set in service, then it was not extracted from
                 * the active tree. This implies that the position of
                 * the entity in the active tree may need to be
                 * changed now, because we have just updated the start
@@ -1056,9 +1070,8 @@ static void __bfq_requeue_entity(struct bfq_entity *entity)
                 * time in a moment (the requeueing is then, more
                 * precisely, a repositioning in this case). To
                 * implement this repositioning, we: 1) dequeue the
-                 * entity here, 2) update the finish time and
+                 * entity here, 2) update the finish time and requeue
-                 * requeue the entity according to the new
+                 * the entity according to the new timestamps below.
-                 * timestamps below.
                 */
                if (entity->tree)
                        bfq_active_extract(st, entity);
@@ -1105,9 +1118,10 @@ static void __bfq_activate_requeue_entity(struct bfq_entity *entity,
 /**
- * bfq_activate_entity - activate or requeue an entity representing a bfq_queue,
+ * bfq_activate_requeue_entity - activate or requeue an entity representing a
- *                       and activate, requeue or reposition all ancestors
+ *                               bfq_queue, and activate, requeue or reposition
- *                       for which such an update becomes necessary.
+ *                               all ancestors for which such an update becomes
+ *                               necessary.
 * @entity: the entity to activate.
 * @non_blocking_wait_rq: true if this entity was waiting for a request
 * @requeue: true if this is a requeue, which implies that bfqq is
@@ -1135,9 +1149,9 @@ static void bfq_activate_requeue_entity(struct bfq_entity *entity,
 * @ins_into_idle_tree: if false, the entity will not be put into the
 *                      idle tree.
 *
- * Deactivates an entity, independently from its previous state.  Must
+ * Deactivates an entity, independently of its previous state.  Must
 * be invoked only if entity is on a service tree. Extracts the entity
- * from that tree, and if necessary and allowed, puts it on the idle
+ * from that tree, and if necessary and allowed, puts it into the idle
 * tree.
 */
 bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
@@ -1158,8 +1172,10 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
        st = bfq_entity_service_tree(entity);
        is_in_service = entity == sd->in_service_entity;
-        if (is_in_service)
+        if (is_in_service) {
                bfq_calc_finish(entity, entity->service);
+                sd->in_service_entity = NULL;
+        }
        if (entity->tree == &st->active)
                bfq_active_extract(st, entity);
@@ -1177,7 +1193,7 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
 /**
 * bfq_deactivate_entity - deactivate an entity representing a bfq_queue.
 * @entity: the entity to deactivate.
- * @ins_into_idle_tree: true if the entity can be put on the idle tree
+ * @ins_into_idle_tree: true if the entity can be put into the idle tree
 */
 static void bfq_deactivate_entity(struct bfq_entity *entity,
                                  bool ins_into_idle_tree,
@@ -1208,16 +1224,29 @@ static void bfq_deactivate_entity(struct bfq_entity *entity,
                         */
                        bfq_update_next_in_service(sd, NULL);
-                if (sd->next_in_service)
+                if (sd->next_in_service || sd->in_service_entity) {
                        /*
-                         * The parent entity is still backlogged,
+                         * The parent entity is still active, because
-                         * because next_in_service is not NULL. So, no
+                         * either next_in_service or in_service_entity
-                         * further upwards deactivation must be
+                         * is not NULL. So, no further upwards
-                         * performed.  Yet, next_in_service has
+                         * deactivation must be performed.  Yet,
-                         * changed.  Then the schedule does need to be
+                         * next_in_service has changed. Then the
-                         * updated upwards.
+                         * schedule does need to be updated upwards.
+                         *
+                         * NOTE If in_service_entity is not NULL, then
+                         * next_in_service may happen to be NULL,
+                         * although the parent entity is evidently
+                         * active. This happens if 1) the entity
+                         * pointed by in_service_entity is the only
+                         * active entity in the parent entity, and 2)
+                         * according to the definition of
+                         * next_in_service, the in_service_entity
+                         * cannot be considered as
+                         * next_in_service. See the comments on the
+                         * definition of next_in_service for details.
                         */
                        break;
+                }
                /*
                 * If we get here, then the parent is no more
@@ -1494,47 +1523,34 @@ struct bfq_queue *bfq_get_next_queue(struct bfq_data *bfqd)
                /*
                 * If entity is no longer a candidate for next
-                 * service, then we extract it from its active tree,
+                 * service, then it must be extracted from its active
-                 * for the following reason. To further boost the
+                 * tree, so as to make sure that it won't be
-                 * throughput in some special case, BFQ needs to know
+                 * considered when computing next_in_service. See the
-                 * which is the next candidate entity to serve, while
+                 * comments on the function
-                 * there is already an entity in service. In this
+                 * bfq_no_longer_next_in_service() for details.
-                 * respect, to make it easy to compute/update the next
-                 * candidate entity to serve after the current
-                 * candidate has been set in service, there is a case
-                 * where it is necessary to extract the current
-                 * candidate from its service tree. Such a case is
-                 * when the entity just set in service cannot be also
-                 * a candidate for next service. Details about when
-                 * this conditions holds are reported in the comments
-                 * on the function bfq_no_longer_next_in_service()
-                 * invoked below.
                 */
                if (bfq_no_longer_next_in_service(entity))
                        bfq_active_extract(bfq_entity_service_tree(entity),
                                           entity);
                /*
-                 * For the same reason why we may have just extracted
+                 * Even if entity is not to be extracted according to
-                 * entity from its active tree, we may need to update
+                 * the above check, a descendant entity may get
-                 * next_in_service for the sched_data of entity too,
+                 * extracted in one of the next iterations of this
-                 * regardless of whether entity has been extracted.
+                 * loop. Such an event could cause a change in
-                 * In fact, even if entity has not been extracted, a
+                 * next_in_service for the level of the descendant
-                 * descendant entity may get extracted. Such an event
+                 * entity, and thus possibly back to this level.
-                 * would cause a change in next_in_service for the
-                 * level of the descendant entity, and thus possibly
-                 * back to upper levels.
                 *
-                 * We cannot perform the resulting needed update
+                 * However, we cannot perform the resulting needed
-                 * before the end of this loop, because, to know which
+                 * update of next_in_service for this level before the
-                 * is the correct next-to-serve candidate entity for
+                 * end of the whole loop, because, to know which is
-                 * each level, we need first to find the leaf entity
+                 * the correct next-to-serve candidate entity for each
-                 * to set in service. In fact, only after we know
+                 * level, we need first to find the leaf entity to set
-                 * which is the next-to-serve leaf entity, we can
+                 * in service. In fact, only after we know which is
-                 * discover whether the parent entity of the leaf
+                 * the next-to-serve leaf entity, we can discover
-                 * entity becomes the next-to-serve, and so on.
+                 * whether the parent entity of the leaf entity
+                 * becomes the next-to-serve, and so on.
                 */
        }
        bfqq = bfq_entity_to_bfqq(entity);
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 83e92beb3c9f..9b1ea478577b 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -387,9 +387,11 @@ static void bio_integrity_verify_fn(struct work_struct *work)
 */
 bool __bio_integrity_endio(struct bio *bio)
 {
-        if (bio_op(bio) == REQ_OP_READ && !bio->bi_status) {
+        struct blk_integrity *bi = bdev_get_integrity(bio->bi_bdev);
-                struct bio_integrity_payload *bip = bio_integrity(bio);
+        struct bio_integrity_payload *bip = bio_integrity(bio);
+        if (bio_op(bio) == REQ_OP_READ && !bio->bi_status &&
+            (bip->bip_flags & BIP_BLOCK_INTEGRITY) && bi->profile->verify_fn) {
                INIT_WORK(&bip->bip_work, bio_integrity_verify_fn);
                queue_work(kintegrityd_wq, &bip->bip_work);
                return false;
diff --git a/block/blk-mq-pci.c b/block/blk-mq-pci.c
index 0c3354cf3552..76944e3271bf 100644
--- a/block/blk-mq-pci.c
+++ b/block/blk-mq-pci.c
@@ -36,12 +36,18 @@ int blk_mq_pci_map_queues(struct blk_mq_tag_set *set, struct pci_dev *pdev)
        for (queue = 0; queue < set->nr_hw_queues; queue++) {
                mask = pci_irq_get_affinity(pdev, queue);
                if (!mask)
-                        return -EINVAL;
+                        goto fallback;
                for_each_cpu(cpu, mask)
                        set->mq_map[cpu] = queue;
        }
        return 0;
+fallback:
+        WARN_ON_ONCE(set->nr_hw_queues > 1);
+        for_each_possible_cpu(cpu)
+                set->mq_map[cpu] = 0;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(blk_mq_pci_map_queues);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 041f7b7fa0d6..4603b115e234 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -301,11 +301,12 @@ static struct request *blk_mq_get_request(struct request_queue *q,
        struct elevator_queue *e = q->elevator;
        struct request *rq;
        unsigned int tag;
+        struct blk_mq_ctx *local_ctx = NULL;
        blk_queue_enter_live(q);
        data->q = q;
        if (likely(!data->ctx))
-                data->ctx = blk_mq_get_ctx(q);
+                data->ctx = local_ctx = blk_mq_get_ctx(q);
        if (likely(!data->hctx))
                data->hctx = blk_mq_map_queue(q, data->ctx->cpu);
        if (op & REQ_NOWAIT)
@@ -324,6 +325,10 @@ static struct request *blk_mq_get_request(struct request_queue *q,
        tag = blk_mq_get_tag(data);
        if (tag == BLK_MQ_TAG_FAIL) {
+                if (local_ctx) {
+                        blk_mq_put_ctx(local_ctx);
+                        data->ctx = NULL;
+                }
                blk_queue_exit(q);
                return NULL;
        }
@@ -355,13 +360,13 @@ struct request *blk_mq_alloc_request(struct request_queue *q, unsigned int op,
                return ERR_PTR(ret);
        rq = blk_mq_get_request(q, NULL, op, &alloc_data);
-        blk_mq_put_ctx(alloc_data.ctx);
        blk_queue_exit(q);
        if (!rq)
                return ERR_PTR(-EWOULDBLOCK);
+        blk_mq_put_ctx(alloc_data.ctx);
        rq->__data_len = 0;
        rq->__sector = (sector_t) -1;
        rq->bio = rq->biotail = NULL;
@@ -406,7 +411,6 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
        alloc_data.ctx = __blk_mq_get_ctx(q, cpu);
        rq = blk_mq_get_request(q, NULL, op, &alloc_data);
        blk_queue_exit(q);
        if (!rq)
@@ -679,8 +683,8 @@ EXPORT_SYMBOL(blk_mq_kick_requeue_list);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q,
                                    unsigned long msecs)
 {
-        kblockd_schedule_delayed_work(&q->requeue_work,
+        kblockd_mod_delayed_work_on(WORK_CPU_UNBOUND, &q->requeue_work,
-                                      msecs_to_jiffies(msecs));
+                                    msecs_to_jiffies(msecs));
 }
 EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 4ac3e06b41d8..98aa8c808a33 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -17,6 +17,16 @@
 #include <linux/serial_core.h>
 /*
+ * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
+ * occasionally getting stuck as 1. To avoid the potential for a hang, check
+ * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
+ * implementations, so only do so if an affected platform is detected in
+ * parse_spcr().
+ */
+bool qdf2400_e44_present;
+EXPORT_SYMBOL(qdf2400_e44_present);
+/*
 * Some Qualcomm Datacenter Technologies SoCs have a defective UART BUSY bit.
 * Detect them by examining the OEM fields in the SPCR header, similiar to PCI
 * quirk detection in pci_mcfg.c.
@@ -147,8 +157,30 @@ int __init parse_spcr(bool earlycon)
                goto done;
        }
-        if (qdf2400_erratum_44_present(&table->header))
+        /*
-                uart = "qdf2400_e44";
+         * If the E44 erratum is required, then we need to tell the pl011
+         * driver to implement the work-around.
+         *
+         * The global variable is used by the probe function when it
+         * creates the UARTs, whether or not they're used as a console.
+         *
+         * If the user specifies "traditional" earlycon, the qdf2400_e44
+         * console name matches the EARLYCON_DECLARE() statement, and
+         * SPCR is not used.  Parameter "earlycon" is false.
+         *
+         * If the user specifies "SPCR" earlycon, then we need to update
+         * the console name so that it also says "qdf2400_e44".  Parameter
+         * "earlycon" is true.
+         *
+         * For consistency, if we change the console name, then we do it
+         * for everyone, not just earlycon.
+         */
+        if (qdf2400_erratum_44_present(&table->header)) {
+                qdf2400_e44_present = true;
+                if (earlycon)
+                        uart = "qdf2400_e44";
+        }
        if (xgene_8250_erratum_present(table))
                iotype = "mmio32";
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index b9f907eedbf7..bfbe1e154128 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -30,7 +30,6 @@
 #include <linux/syscore_ops.h>
 #include <linux/reboot.h>
 #include <linux/security.h>
-#include <linux/swait.h>
 #include <generated/utsrelease.h>
@@ -112,13 +111,13 @@ static inline long firmware_loading_timeout(void)
 * state of the firmware loading.
 */
 struct fw_state {
-        struct swait_queue_head wq;
+        struct completion completion;
        enum fw_status status;
 };
 static void fw_state_init(struct fw_state *fw_st)
 {
-        init_swait_queue_head(&fw_st->wq);
+        init_completion(&fw_st->completion);
        fw_st->status = FW_STATUS_UNKNOWN;
 }
@@ -131,9 +130,7 @@ static int __fw_state_wait_common(struct fw_state *fw_st, long timeout)
 {
        long ret;
-        ret = swait_event_interruptible_timeout(fw_st->wq,
+        ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
-                                __fw_state_is_done(READ_ONCE(fw_st->status)),
-                                timeout);
        if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
                return -ENOENT;
        if (!ret)
@@ -148,35 +145,34 @@ static void __fw_state_set(struct fw_state *fw_st,
        WRITE_ONCE(fw_st->status, status);
        if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
-                swake_up(&fw_st->wq);
+                complete_all(&fw_st->completion);
 }
 #define fw_state_start(fw_st)                                   \
        __fw_state_set(fw_st, FW_STATUS_LOADING)
 #define fw_state_done(fw_st)                                    \
        __fw_state_set(fw_st, FW_STATUS_DONE)
+#define fw_state_aborted(fw_st)                                 \
+        __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait(fw_st)                                    \
        __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
-#ifndef CONFIG_FW_LOADER_USER_HELPER
-#define fw_state_is_aborted(fw_st)      false
-#else /* CONFIG_FW_LOADER_USER_HELPER */
 static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
 {
        return fw_st->status == status;
 }
+#define fw_state_is_aborted(fw_st)                              \
+        __fw_state_check(fw_st, FW_STATUS_ABORTED)
+#ifdef CONFIG_FW_LOADER_USER_HELPER
 #define fw_state_aborted(fw_st)                                 \
        __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_is_done(fw_st)                                 \
        __fw_state_check(fw_st, FW_STATUS_DONE)
 #define fw_state_is_loading(fw_st)                              \
        __fw_state_check(fw_st, FW_STATUS_LOADING)
-#define fw_state_is_aborted(fw_st)                              \
-        __fw_state_check(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait_timeout(fw_st, timeout)                   \
        __fw_state_wait_common(fw_st, timeout)
@@ -1200,6 +1196,28 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
        return 1; /* need to load */
 }
+/*
+ * Batched requests need only one wake, we need to do this step last due to the
+ * fallback mechanism. The buf is protected with kref_get(), and it won't be
+ * released until the last user calls release_firmware().
+ *
+ * Failed batched requests are possible as well, in such cases we just share
+ * the struct firmware_buf and won't release it until all requests are woken
+ * and have gone through this same path.
+ */
+static void fw_abort_batch_reqs(struct firmware *fw)
+{
+        struct firmware_buf *buf;
+        /* Loaded directly? */
+        if (!fw || !fw->priv)
+                return;
+        buf = fw->priv;
+        if (!fw_state_is_aborted(&buf->fw_st))
+                fw_state_aborted(&buf->fw_st);
+}
 /* called from request_firmware() and request_firmware_work_func() */
 static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -1243,6 +1261,7 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
 out:
        if (ret < 0) {
+                fw_abort_batch_reqs(fw);
                release_firmware(fw);
                fw = NULL;
        }
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 6b16ead1da58..ad9749463d4f 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -875,6 +875,56 @@ static void print_version(void)
                printk(KERN_INFO "%s", version);
 }
+struct vdc_check_port_data {
+        int     dev_no;
+        char    *type;
+};
+static int vdc_device_probed(struct device *dev, void *arg)
+{
+        struct vio_dev *vdev = to_vio_dev(dev);
+        struct vdc_check_port_data *port_data;
+        port_data = (struct vdc_check_port_data *)arg;
+        if ((vdev->dev_no == port_data->dev_no) &&
+            (!(strcmp((char *)&vdev->type, port_data->type))) &&
+                dev_get_drvdata(dev)) {
+                /* This device has already been configured
+                 * by vdc_port_probe()
+                 */
+                return 1;
+        } else {
+                return 0;
+        }
+}
+/* Determine whether the VIO device is part of an mpgroup
+ * by locating all the virtual-device-port nodes associated
+ * with the parent virtual-device node for the VIO device
+ * and checking whether any of these nodes are vdc-ports
+ * which have already been configured.
+ *
+ * Returns true if this device is part of an mpgroup and has
+ * already been probed.
+ */
+static bool vdc_port_mpgroup_check(struct vio_dev *vdev)
+{
+        struct vdc_check_port_data port_data;
+        struct device *dev;
+        port_data.dev_no = vdev->dev_no;
+        port_data.type = (char *)&vdev->type;
+        dev = device_find_child(vdev->dev.parent, &port_data,
+                                vdc_device_probed);
+        if (dev)
+                return true;
+        return false;
+}
 static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 {
        struct mdesc_handle *hp;
@@ -893,6 +943,14 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
                goto err_out_release_mdesc;
        }
+        /* Check if this device is part of an mpgroup */
+        if (vdc_port_mpgroup_check(vdev)) {
+                printk(KERN_WARNING
+                        "VIO: Ignoring extra vdisk port %s",
+                        dev_name(&vdev->dev));
+                goto err_out_release_mdesc;
+        }
        port = kzalloc(sizeof(*port), GFP_KERNEL);
        err = -ENOMEM;
        if (!port) {
@@ -943,6 +1001,9 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
        if (err)
                goto err_out_free_tx_ring;
+        /* Note that the device driver_data is used to determine
+         * whether the port has been probed.
+         */
        dev_set_drvdata(&vdev->dev, port);
        mdesc_release(hp);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98e34e4c62b8..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2075,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                        /*
                         * Get the bios in the request so we can re-queue them.
                         */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                            shadow[j].request->cmd_flags & REQ_FUA) {
                                /*
                                 * Flush operations don't contain bios, so
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 856d5dc02451..3b1b6340ba13 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -308,7 +308,7 @@ static ssize_t comp_algorithm_store(struct device *dev,
                struct device_attribute *attr, const char *buf, size_t len)
 {
        struct zram *zram = dev_to_zram(dev);
-        char compressor[CRYPTO_MAX_ALG_NAME];
+        char compressor[ARRAY_SIZE(zram->compressor)];
        size_t sz;
        strlcpy(compressor, buf, sizeof(compressor));
@@ -327,7 +327,7 @@ static ssize_t comp_algorithm_store(struct device *dev,
                return -EBUSY;
        }
-        strlcpy(zram->compressor, compressor, sizeof(compressor));
+        strcpy(zram->compressor, compressor);
        up_write(&zram->init_lock);
        return len;
 }
diff --git a/drivers/char/random.c b/drivers/char/random.c
index afa3ce7d3e72..8ad92707e45f 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1492,7 +1492,7 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
 #ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
        print_once = true;
 #endif
-        pr_notice("random: %s called from %pF with crng_init=%d\n",
+        pr_notice("random: %s called from %pS with crng_init=%d\n",
                  func_name, caller, crng_init);
 }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index fcae5ca6ac92..54a67f8a28eb 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -262,7 +262,7 @@ config CLKSRC_LPC32XX
 config CLKSRC_PISTACHIO
        bool "Clocksource for Pistachio SoC" if COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on GENERIC_CLOCKEVENTS && HAS_IOMEM
        select TIMER_OF
        help
          Enables the clocksource for the Pistachio SoC.
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index aae87c4c546e..72bbfccef113 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1440,7 +1440,7 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
         * While unlikely, it's theoretically possible that none of the frames
         * in a timer expose the combination of feature we want.
         */
-        for (i = i; i < timer_count; i++) {
+        for (i = 0; i < timer_count; i++) {
                timer = &timers[i];
                frame = arch_timer_mem_find_best_frame(timer);
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index bc48cbf6a795..269db74a0658 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -305,7 +305,7 @@ static int em_sti_probe(struct platform_device *pdev)
        irq = platform_get_irq(pdev, 0);
        if (irq < 0) {
                dev_err(&pdev->dev, "failed to get irq\n");
-                return -EINVAL;
+                return irq;
        }
        /* map memory, let base point to the STI instance */
@@ -314,11 +314,12 @@ static int em_sti_probe(struct platform_device *pdev)
        if (IS_ERR(p->base))
                return PTR_ERR(p->base);
-        if (devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
+        ret = devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
-                             IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                               IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
-                             dev_name(&pdev->dev), p)) {
+                               dev_name(&pdev->dev), p);
+        if (ret) {
                dev_err(&pdev->dev, "failed to request low IRQ\n");
-                return -ENOENT;
+                return ret;
        }
        /* get hold of clock */
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index d509b500a7b5..4d7aef9d9c15 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -128,9 +128,9 @@ static __init int timer_base_init(struct device_node *np,
        const char *name = of_base->name ? of_base->name : np->full_name;
        of_base->base = of_io_request_and_map(np, of_base->index, name);
-        if (!of_base->base) {
+        if (IS_ERR(of_base->base)) {
                pr_err("Failed to iomap (%s)\n", name);
-                return -ENXIO;
+                return PTR_ERR(of_base->base);
        }
        return 0;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0566455f233e..65ee4fcace1f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1613,8 +1613,7 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
 {
-        return mul_ext_fp(cpu->sample.core_avg_perf,
+        return mul_ext_fp(cpu->sample.core_avg_perf, cpu_khz);
-                          cpu->pstate.max_pstate_physical * cpu->pstate.scaling);
 }
 static inline int32_t get_avg_pstate(struct cpudata *cpu)
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 37b0698b7193..42896a67aeae 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -235,6 +235,7 @@ static inline int validate_dt_prop_sizes(const char *prop1, int prop1_len,
        return -1;
 }
+extern u32 pnv_get_supported_cpuidle_states(void);
 static int powernv_add_idle_states(void)
 {
        struct device_node *power_mgt;
@@ -248,6 +249,8 @@ static int powernv_add_idle_states(void)
        const char *names[CPUIDLE_STATE_MAX];
        u32 has_stop_states = 0;
        int i, rc;
+        u32 supported_flags = pnv_get_supported_cpuidle_states();
        /* Currently we have snooze statically defined */
@@ -362,6 +365,13 @@ static int powernv_add_idle_states(void)
        for (i = 0; i < dt_idle_states; i++) {
                unsigned int exit_latency, target_residency;
                bool stops_timebase = false;
+                /*
+                 * Skip the platform idle state whose flag isn't in
+                 * the supported_cpuidle_states flag mask.
+                 */
+                if ((flags[i] & supported_flags) != flags[i])
+                        continue;
                /*
                 * If an idle state has exit latency beyond
                 * POWERNV_THRESHOLD_LATENCY_NS then don't use it
diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
index 8527a5899a2f..3f819399cd95 100644
--- a/drivers/crypto/inside-secure/safexcel_hash.c
+++ b/drivers/crypto/inside-secure/safexcel_hash.c
@@ -883,10 +883,7 @@ static int safexcel_hmac_sha1_setkey(struct crypto_ahash *tfm, const u8 *key,
        if (ret)
                return ret;
-        memcpy(ctx->ipad, &istate.state, SHA1_DIGEST_SIZE);
+        for (i = 0; i < SHA1_DIGEST_SIZE / sizeof(u32); i++) {
-        memcpy(ctx->opad, &ostate.state, SHA1_DIGEST_SIZE);
-        for (i = 0; i < ARRAY_SIZE(istate.state); i++) {
                if (ctx->ipad[i] != le32_to_cpu(istate.state[i]) ||
                    ctx->opad[i] != le32_to_cpu(ostate.state[i])) {
                        ctx->base.needs_inv = true;
@@ -894,6 +891,9 @@ static int safexcel_hmac_sha1_setkey(struct crypto_ahash *tfm, const u8 *key,
                }
        }
+        memcpy(ctx->ipad, &istate.state, SHA1_DIGEST_SIZE);
+        memcpy(ctx->opad, &ostate.state, SHA1_DIGEST_SIZE);
        return 0;
 }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 427cbe012729..dadc4a808df5 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1073,7 +1073,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
                req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
                                &crypt->icv_rev_aes);
                if (unlikely(!req_ctx->hmac_virt))
-                        goto free_buf_src;
+                        goto free_buf_dst;
                if (!encrypt) {
                        scatterwalk_map_and_copy(req_ctx->hmac_virt,
                                req->src, cryptlen, authsize, 0);
@@ -1088,10 +1088,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
        BUG_ON(qmgr_stat_overflow(SEND_QID));
        return -EINPROGRESS;
-free_buf_src:
-        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
 free_buf_dst:
        free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
+free_buf_src:
+        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
        crypt->ctl_flags = CTL_FLAG_UNUSED;
        return -ENOMEM;
 }
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index d7e219d2669d..66fb40d0ebdb 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -304,7 +304,7 @@ static int sync_file_release(struct inode *inode, struct file *file)
 {
        struct sync_file *sync_file = file->private_data;
-        if (test_bit(POLL_ENABLED, &sync_file->fence->flags))
+        if (test_bit(POLL_ENABLED, &sync_file->flags))
                dma_fence_remove_callback(sync_file->fence, &sync_file->cb);
        dma_fence_put(sync_file->fence);
        kfree(sync_file);
@@ -318,7 +318,8 @@ static unsigned int sync_file_poll(struct file *file, poll_table *wait)
        poll_wait(file, &sync_file->wq, wait);
-        if (!test_and_set_bit(POLL_ENABLED, &sync_file->fence->flags)) {
+        if (list_empty(&sync_file->cb.node) &&
+            !test_and_set_bit(POLL_ENABLED, &sync_file->flags)) {
                if (dma_fence_add_callback(sync_file->fence, &sync_file->cb,
                                           fence_check_cb_func) < 0)
                        wake_up_all(&sync_file->wq);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6899180b265..c586f44312f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -244,6 +244,12 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                struct dma_fence *f = e->fence;
                struct amd_sched_fence *s_fence = to_amd_sched_fence(f);
+                if (dma_fence_is_signaled(f)) {
+                        hash_del(&e->node);
+                        dma_fence_put(f);
+                        kmem_cache_free(amdgpu_sync_slab, e);
+                        continue;
+                }
                if (ring && s_fence) {
                        /* For fences from the same ring it is sufficient
                         * when they are scheduled.
@@ -256,13 +262,6 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                        }
                }
-                if (dma_fence_is_signaled(f)) {
-                        hash_del(&e->node);
-                        dma_fence_put(f);
-                        kmem_cache_free(amdgpu_sync_slab, e);
-                        continue;
-                }
                return f;
        }
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 5c26488e7a2d..0529e500c534 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1255,7 +1255,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id)
        /* port@2 is the output port */
        ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &tc->panel, NULL);
-        if (ret)
+        if (ret && ret != -ENODEV)
                return ret;
        /* Shut down GPIO is optional */
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 5bd93169dac2..6463fc2c736f 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream,
                if (ret)
                        return ret;
-                if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) {
+                if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) {
-                        DRM_ERROR("relocation %u outside object", i);
+                        DRM_ERROR("relocation %u outside object\n", i);
                        return -EINVAL;
                }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index d48fd7c918f8..73217c281c9a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -145,13 +145,19 @@ static struct drm_framebuffer *
 exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                      const struct drm_mode_fb_cmd2 *mode_cmd)
 {
+        const struct drm_format_info *info = drm_get_format_info(dev, mode_cmd);
        struct exynos_drm_gem *exynos_gem[MAX_FB_BUFFER];
        struct drm_gem_object *obj;
        struct drm_framebuffer *fb;
        int i;
        int ret;
-        for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
+        for (i = 0; i < info->num_planes; i++) {
+                unsigned int height = (i == 0) ? mode_cmd->height :
+                                     DIV_ROUND_UP(mode_cmd->height, info->vsub);
+                unsigned long size = height * mode_cmd->pitches[i] +
+                                     mode_cmd->offsets[i];
                obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[i]);
                if (!obj) {
                        DRM_ERROR("failed to lookup gem object\n");
@@ -160,6 +166,12 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                }
                exynos_gem[i] = to_exynos_gem(obj);
+                if (size > exynos_gem[i]->size) {
+                        i++;
+                        ret = -EINVAL;
+                        goto err;
+                }
        }
        fb = exynos_drm_framebuffer_init(dev, mode_cmd, exynos_gem, i);
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 700050556242..1648887d3f55 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -46,6 +46,8 @@
 #define same_context(a, b) (((a)->context_id == (b)->context_id) && \
                ((a)->lrca == (b)->lrca))
+static void clean_workloads(struct intel_vgpu *vgpu, unsigned long engine_mask);
 static int context_switch_events[] = {
        [RCS] = RCS_AS_CONTEXT_SWITCH,
        [BCS] = BCS_AS_CONTEXT_SWITCH,
@@ -499,10 +501,10 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 static int complete_execlist_workload(struct intel_vgpu_workload *workload)
 {
        struct intel_vgpu *vgpu = workload->vgpu;
-        struct intel_vgpu_execlist *execlist =
+        int ring_id = workload->ring_id;
-                &vgpu->execlist[workload->ring_id];
+        struct intel_vgpu_execlist *execlist = &vgpu->execlist[ring_id];
        struct intel_vgpu_workload *next_workload;
-        struct list_head *next = workload_q_head(vgpu, workload->ring_id)->next;
+        struct list_head *next = workload_q_head(vgpu, ring_id)->next;
        bool lite_restore = false;
        int ret;
@@ -512,10 +514,25 @@ static int complete_execlist_workload(struct intel_vgpu_workload *workload)
        release_shadow_batch_buffer(workload);
        release_shadow_wa_ctx(&workload->wa_ctx);
-        if (workload->status || vgpu->resetting)
+        if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
+                /* if workload->status is not successful means HW GPU
+                 * has occurred GPU hang or something wrong with i915/GVT,
+                 * and GVT won't inject context switch interrupt to guest.
+                 * So this error is a vGPU hang actually to the guest.
+                 * According to this we should emunlate a vGPU hang. If
+                 * there are pending workloads which are already submitted
+                 * from guest, we should clean them up like HW GPU does.
+                 *
+                 * if it is in middle of engine resetting, the pending
+                 * workloads won't be submitted to HW GPU and will be
+                 * cleaned up during the resetting process later, so doing
+                 * the workload clean up here doesn't have any impact.
+                 **/
+                clean_workloads(vgpu, ENGINE_MASK(ring_id));
                goto out;
+        }
-        if (!list_empty(workload_q_head(vgpu, workload->ring_id))) {
+        if (!list_empty(workload_q_head(vgpu, ring_id))) {
                struct execlist_ctx_descriptor_format *this_desc, *next_desc;
                next_workload = container_of(next,
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 5dad9298b2d5..a26c1705430e 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -72,11 +72,13 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
        struct intel_gvt_device_info *info = &gvt->device_info;
        struct pci_dev *pdev = gvt->dev_priv->drm.pdev;
        struct intel_gvt_mmio_info *e;
+        struct gvt_mmio_block *block = gvt->mmio.mmio_block;
+        int num = gvt->mmio.num_mmio_block;
        struct gvt_firmware_header *h;
        void *firmware;
        void *p;
        unsigned long size, crc32_start;
-        int i;
+        int i, j;
        int ret;
        size = sizeof(*h) + info->mmio_size + info->cfg_space_size;
@@ -105,6 +107,13 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
        hash_for_each(gvt->mmio.mmio_info_table, i, e, node)
                *(u32 *)(p + e->offset) = I915_READ_NOTRACE(_MMIO(e->offset));
+        for (i = 0; i < num; i++, block++) {
+                for (j = 0; j < block->size; j += 4)
+                        *(u32 *)(p + INTEL_GVT_MMIO_OFFSET(block->offset) + j) =
+                                I915_READ_NOTRACE(_MMIO(INTEL_GVT_MMIO_OFFSET(
+                                                        block->offset) + j));
+        }
        memcpy(gvt->firmware.mmio, p, info->mmio_size);
        crc32_start = offsetof(struct gvt_firmware_header, crc32) + 4;
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 3a74e79eac2f..2964a4d01a66 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -149,7 +149,7 @@ struct intel_vgpu {
        bool active;
        bool pv_notified;
        bool failsafe;
-        bool resetting;
+        unsigned int resetting_eng;
        void *sched_data;
        struct vgpu_sched_ctl sched_ctl;
@@ -195,6 +195,15 @@ struct intel_gvt_fence {
        unsigned long vgpu_allocated_fence_num;
 };
+/* Special MMIO blocks. */
+struct gvt_mmio_block {
+        unsigned int device;
+        i915_reg_t   offset;
+        unsigned int size;
+        gvt_mmio_func read;
+        gvt_mmio_func write;
+};
 #define INTEL_GVT_MMIO_HASH_BITS 11
 struct intel_gvt_mmio {
@@ -214,6 +223,9 @@ struct intel_gvt_mmio {
 /* This reg could be accessed by unaligned address */
 #define F_UNALIGN       (1 << 6)
+        struct gvt_mmio_block *mmio_block;
+        unsigned int num_mmio_block;
        DECLARE_HASHTABLE(mmio_info_table, INTEL_GVT_MMIO_HASH_BITS);
        unsigned int num_tracked_mmio;
 };
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 17febe830ff6..feed9921b3b3 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -2857,31 +2857,15 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
        return 0;
 }
-/* Special MMIO blocks. */
-static struct gvt_mmio_block {
-        unsigned int device;
-        i915_reg_t   offset;
-        unsigned int size;
-        gvt_mmio_func read;
-        gvt_mmio_func write;
-} gvt_mmio_blocks[] = {
-        {D_SKL_PLUS, _MMIO(CSR_MMIO_START_RANGE), 0x3000, NULL, NULL},
-        {D_ALL, _MMIO(MCHBAR_MIRROR_BASE_SNB), 0x40000, NULL, NULL},
-        {D_ALL, _MMIO(VGT_PVINFO_PAGE), VGT_PVINFO_SIZE,
-                pvinfo_mmio_read, pvinfo_mmio_write},
-        {D_ALL, LGC_PALETTE(PIPE_A, 0), 1024, NULL, NULL},
-        {D_ALL, LGC_PALETTE(PIPE_B, 0), 1024, NULL, NULL},
-        {D_ALL, LGC_PALETTE(PIPE_C, 0), 1024, NULL, NULL},
-};
 static struct gvt_mmio_block *find_mmio_block(struct intel_gvt *gvt,
                                              unsigned int offset)
 {
        unsigned long device = intel_gvt_get_device_type(gvt);
-        struct gvt_mmio_block *block = gvt_mmio_blocks;
+        struct gvt_mmio_block *block = gvt->mmio.mmio_block;
+        int num = gvt->mmio.num_mmio_block;
        int i;
-        for (i = 0; i < ARRAY_SIZE(gvt_mmio_blocks); i++, block++) {
+        for (i = 0; i < num; i++, block++) {
                if (!(device & block->device))
                        continue;
                if (offset >= INTEL_GVT_MMIO_OFFSET(block->offset) &&
@@ -2912,6 +2896,17 @@ void intel_gvt_clean_mmio_info(struct intel_gvt *gvt)
        gvt->mmio.mmio_attribute = NULL;
 }
+/* Special MMIO blocks. */
+static struct gvt_mmio_block mmio_blocks[] = {
+        {D_SKL_PLUS, _MMIO(CSR_MMIO_START_RANGE), 0x3000, NULL, NULL},
+        {D_ALL, _MMIO(MCHBAR_MIRROR_BASE_SNB), 0x40000, NULL, NULL},
+        {D_ALL, _MMIO(VGT_PVINFO_PAGE), VGT_PVINFO_SIZE,
+                pvinfo_mmio_read, pvinfo_mmio_write},
+        {D_ALL, LGC_PALETTE(PIPE_A, 0), 1024, NULL, NULL},
+        {D_ALL, LGC_PALETTE(PIPE_B, 0), 1024, NULL, NULL},
+        {D_ALL, LGC_PALETTE(PIPE_C, 0), 1024, NULL, NULL},
+};
 /**
 * intel_gvt_setup_mmio_info - setup MMIO information table for GVT device
 * @gvt: GVT device
@@ -2951,6 +2946,9 @@ int intel_gvt_setup_mmio_info(struct intel_gvt *gvt)
                        goto err;
        }
+        gvt->mmio.mmio_block = mmio_blocks;
+        gvt->mmio.num_mmio_block = ARRAY_SIZE(mmio_blocks);
        gvt_dbg_mmio("traced %u virtual mmio registers\n",
                     gvt->mmio.num_tracked_mmio);
        return 0;
@@ -3030,7 +3028,7 @@ int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
        gvt_mmio_func func;
        int ret;
-        if (WARN_ON(bytes > 4))
+        if (WARN_ON(bytes > 8))
                return -EINVAL;
        /*
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 4f7057d62d88..22e08eb2d0b7 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -432,7 +432,8 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
                i915_gem_request_put(fetch_and_zero(&workload->req));
-                if (!workload->status && !vgpu->resetting) {
+                if (!workload->status && !(vgpu->resetting_eng &
+                                           ENGINE_MASK(ring_id))) {
                        update_guest_context(workload);
                        for_each_set_bit(event, workload->pending_events,
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 90c14e6e3ea0..3deadcbd5a24 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -480,11 +480,13 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
 {
        struct intel_gvt *gvt = vgpu->gvt;
        struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
+        unsigned int resetting_eng = dmlr ? ALL_ENGINES : engine_mask;
        gvt_dbg_core("------------------------------------------\n");
        gvt_dbg_core("resseting vgpu%d, dmlr %d, engine_mask %08x\n",
                     vgpu->id, dmlr, engine_mask);
-        vgpu->resetting = true;
+        vgpu->resetting_eng = resetting_eng;
        intel_vgpu_stop_schedule(vgpu);
        /*
@@ -497,7 +499,7 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                mutex_lock(&gvt->lock);
        }
-        intel_vgpu_reset_execlist(vgpu, dmlr ? ALL_ENGINES : engine_mask);
+        intel_vgpu_reset_execlist(vgpu, resetting_eng);
        /* full GPU reset or device model level reset */
        if (engine_mask == ALL_ENGINES || dmlr) {
@@ -520,7 +522,7 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                }
        }
-        vgpu->resetting = false;
+        vgpu->resetting_eng = 0;
        gvt_dbg_core("reset vgpu%d done\n", vgpu->id);
        gvt_dbg_core("------------------------------------------\n");
 }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 00d8967c8512..d1bd53b73738 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4580,7 +4580,7 @@ static void gen9_sseu_device_status(struct drm_i915_private *dev_priv,
                sseu->slice_mask |= BIT(s);
-                if (IS_GEN9_BC(dev_priv))
+                if (IS_GEN9_BC(dev_priv) || IS_CANNONLAKE(dev_priv))
                        sseu->subslice_mask =
                                INTEL_INFO(dev_priv)->sseu.subslice_mask;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 39ed58a21fc1..e1e971ee2ed5 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -688,19 +688,19 @@ static inline bool skip_rcs_switch(struct i915_hw_ppgtt *ppgtt,
 }
 static bool
-needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt,
+needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt, struct intel_engine_cs *engine)
-                  struct intel_engine_cs *engine,
-                  struct i915_gem_context *to)
 {
+        struct i915_gem_context *from = engine->legacy_active_context;
        if (!ppgtt)
                return false;
        /* Always load the ppgtt on first use */
-        if (!engine->legacy_active_context)
+        if (!from)
                return true;
        /* Same context without new entries, skip */
-        if (engine->legacy_active_context == to &&
+        if ((!from->ppgtt || from->ppgtt == ppgtt) &&
            !(intel_engine_flag(engine) & ppgtt->pd_dirty_rings))
                return false;
@@ -744,7 +744,7 @@ static int do_rcs_switch(struct drm_i915_gem_request *req)
        if (skip_rcs_switch(ppgtt, engine, to))
                return 0;
-        if (needs_pd_load_pre(ppgtt, engine, to)) {
+        if (needs_pd_load_pre(ppgtt, engine)) {
                /* Older GENs and non render rings still want the load first,
                 * "PP_DCLV followed by PP_DIR_BASE register through Load
                 * Register Immediate commands in Ring Buffer before submitting
@@ -841,7 +841,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                struct i915_hw_ppgtt *ppgtt =
                        to->ppgtt ?: req->i915->mm.aliasing_ppgtt;
-                if (needs_pd_load_pre(ppgtt, engine, to)) {
+                if (needs_pd_load_pre(ppgtt, engine)) {
                        int ret;
                        trace_switch_mm(engine, to);
@@ -852,6 +852,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                        ppgtt->pd_dirty_rings &= ~intel_engine_flag(engine);
                }
+                engine->legacy_active_context = to;
                return 0;
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 7032c542a9b1..4dd4c2159a92 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -242,6 +242,10 @@ int i915_gem_render_state_emit(struct drm_i915_gem_request *req)
                        goto err_unpin;
        }
+        ret = req->engine->emit_flush(req, EMIT_INVALIDATE);
+        if (ret)
+                goto err_unpin;
        ret = req->engine->emit_bb_start(req,
                                         so->batch_offset, so->batch_size,
                                         I915_DISPATCH_SECURE);
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 1032f98add11..77fb39808131 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -43,16 +43,21 @@ static bool shrinker_lock(struct drm_i915_private *dev_priv, bool *unlock)
                return true;
        case MUTEX_TRYLOCK_FAILED:
+                *unlock = false;
+                preempt_disable();
                do {
                        cpu_relax();
                        if (mutex_trylock(&dev_priv->drm.struct_mutex)) {
-        case MUTEX_TRYLOCK_SUCCESS:
                                *unlock = true;
-                                return true;
+                                break;
                        }
                } while (!need_resched());
+                preempt_enable();
+                return *unlock;
-                return false;
+        case MUTEX_TRYLOCK_SUCCESS:
+                *unlock = true;
+                return true;
        }
        BUG();
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 9cd22f83b0cf..f33d90226704 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1601,11 +1601,11 @@ static int gen8_emit_oa_config(struct drm_i915_gem_request *req)
        u32 *cs;
        int i;
-        cs = intel_ring_begin(req, n_flex_regs * 2 + 4);
+        cs = intel_ring_begin(req, ARRAY_SIZE(flex_mmio) * 2 + 4);
        if (IS_ERR(cs))
                return PTR_ERR(cs);
-        *cs++ = MI_LOAD_REGISTER_IMM(n_flex_regs + 1);
+        *cs++ = MI_LOAD_REGISTER_IMM(ARRAY_SIZE(flex_mmio) + 1);
        *cs++ = i915_mmio_reg_offset(GEN8_OACTXCONTROL);
        *cs++ = (dev_priv->perf.oa.period_exponent << GEN8_OA_TIMER_PERIOD_SHIFT) |
diff --git a/drivers/gpu/drm/i915/intel_color.c b/drivers/gpu/drm/i915/intel_color.c
index 306c6b06b330..17c4ae7e4e7c 100644
--- a/drivers/gpu/drm/i915/intel_color.c
+++ b/drivers/gpu/drm/i915/intel_color.c
@@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct drm_crtc_state *state, u32 offset)
                }
                /* Program the max register to clamp values > 1.0. */
+                i = lut_size - 1;
                I915_WRITE(PREC_PAL_GC_MAX(pipe, 0),
                           drm_color_lut_extract(lut[i].red, 16));
                I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 9edeaaef77ad..d3b3252a8742 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1762,7 +1762,7 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv,
        if (dev_priv->vbt.edp.low_vswing) {
                if (voltage == VOLTAGE_INFO_0_85V) {
                        *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_85V);
-                        return cnl_ddi_translations_dp_0_85V;
+                        return cnl_ddi_translations_edp_0_85V;
                } else if (voltage == VOLTAGE_INFO_0_95V) {
                        *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_95V);
                        return cnl_ddi_translations_edp_0_95V;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9471c88d449e..cc484b56eeaa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3485,6 +3485,13 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
            !gpu_reset_clobbers_display(dev_priv))
                return;
+        /* We have a modeset vs reset deadlock, defensively unbreak it.
+         *
+         * FIXME: We can do a _lot_ better, this is just a first iteration.
+         */
+        i915_gem_set_wedged(dev_priv);
+        DRM_DEBUG_DRIVER("Wedging GPU to avoid deadlocks with pending modeset updates\n");
        /*
         * Need mode_config.mutex so that we don't
         * trample ongoing ->detect() and whatnot.
diff --git a/drivers/gpu/drm/i915/intel_lrc.h b/drivers/gpu/drm/i915/intel_lrc.h
index 52b3a1fd4059..57ef5833c427 100644
--- a/drivers/gpu/drm/i915/intel_lrc.h
+++ b/drivers/gpu/drm/i915/intel_lrc.h
@@ -63,7 +63,6 @@ enum {
 };
 /* Logical Rings */
-void intel_logical_ring_stop(struct intel_engine_cs *engine);
 void intel_logical_ring_cleanup(struct intel_engine_cs *engine);
 int logical_render_ring_init(struct intel_engine_cs *engine);
 int logical_xcs_ring_init(struct intel_engine_cs *engine);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 96c2cbd81869..593349be8b9d 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -469,7 +469,7 @@ static u32 intel_panel_compute_brightness(struct intel_connector *connector,
        if (i915.invert_brightness > 0 ||
            dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS) {
-                return panel->backlight.max - val;
+                return panel->backlight.max - val + panel->backlight.min;
        }
        return val;
diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index b638d192ce5e..99d39b2aefa6 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -5,7 +5,7 @@ config DRM_MSM
        depends on ARCH_QCOM || (ARM && COMPILE_TEST)
        depends on OF && COMMON_CLK
        depends on MMU
-        select QCOM_MDT_LOADER
+        select QCOM_MDT_LOADER if ARCH_QCOM
        select REGULATOR
        select DRM_KMS_HELPER
        select DRM_PANEL
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index b4b54f1c24bc..f9eae03aa1dc 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -15,7 +15,7 @@
 #include <linux/cpumask.h>
 #include <linux/qcom_scm.h>
 #include <linux/dma-mapping.h>
-#include <linux/of_reserved_mem.h>
+#include <linux/of_address.h>
 #include <linux/soc/qcom/mdt_loader.h>
 #include "msm_gem.h"
 #include "msm_mmu.h"
@@ -26,16 +26,34 @@ static void a5xx_dump(struct msm_gpu *gpu);
 #define GPU_PAS_ID 13
-#if IS_ENABLED(CONFIG_QCOM_MDT_LOADER)
 static int zap_shader_load_mdt(struct device *dev, const char *fwname)
 {
        const struct firmware *fw;
+        struct device_node *np;
+        struct resource r;
        phys_addr_t mem_phys;
        ssize_t mem_size;
        void *mem_region = NULL;
        int ret;
+        if (!IS_ENABLED(CONFIG_ARCH_QCOM))
+                return -EINVAL;
+        np = of_get_child_by_name(dev->of_node, "zap-shader");
+        if (!np)
+                return -ENODEV;
+        np = of_parse_phandle(np, "memory-region", 0);
+        if (!np)
+                return -EINVAL;
+        ret = of_address_to_resource(np, 0, &r);
+        if (ret)
+                return ret;
+        mem_phys = r.start;
+        mem_size = resource_size(&r);
        /* Request the MDT file for the firmware */
        ret = request_firmware(&fw, fwname, dev);
        if (ret) {
@@ -51,7 +69,7 @@ static int zap_shader_load_mdt(struct device *dev, const char *fwname)
        }
        /* Allocate memory for the firmware image */
-        mem_region = dmam_alloc_coherent(dev, mem_size, &mem_phys, GFP_KERNEL);
+        mem_region = memremap(mem_phys, mem_size,  MEMREMAP_WC);
        if (!mem_region) {
                ret = -ENOMEM;
                goto out;
@@ -69,16 +87,13 @@ static int zap_shader_load_mdt(struct device *dev, const char *fwname)
                DRM_DEV_ERROR(dev, "Unable to authorize the image\n");
 out:
+        if (mem_region)
+                memunmap(mem_region);
        release_firmware(fw);
        return ret;
 }
-#else
-static int zap_shader_load_mdt(struct device *dev, const char *fwname)
-{
-        return -ENODEV;
-}
-#endif
 static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
        struct msm_file_private *ctx)
@@ -117,12 +132,10 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
        gpu->funcs->flush(gpu);
 }
-struct a5xx_hwcg {
+static const struct {
        u32 offset;
        u32 value;
-};
+} a5xx_hwcg[] = {
-static const struct a5xx_hwcg a530_hwcg[] = {
        {REG_A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
        {REG_A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
        {REG_A5XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
@@ -217,38 +230,16 @@ static const struct a5xx_hwcg a530_hwcg[] = {
        {REG_A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222}
 };
-static const struct {
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state)
-        int (*test)(struct adreno_gpu *gpu);
-        const struct a5xx_hwcg *regs;
-        unsigned int count;
-} a5xx_hwcg_regs[] = {
-        { adreno_is_a530, a530_hwcg, ARRAY_SIZE(a530_hwcg), },
-};
-static void _a5xx_enable_hwcg(struct msm_gpu *gpu,
-                const struct a5xx_hwcg *regs, unsigned int count)
 {
        unsigned int i;
-        for (i = 0; i < count; i++)
+        for (i = 0; i < ARRAY_SIZE(a5xx_hwcg); i++)
-                gpu_write(gpu, regs[i].offset, regs[i].value);
+                gpu_write(gpu, a5xx_hwcg[i].offset,
+                        state ? a5xx_hwcg[i].value : 0);
-        gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, 0xAAA8AA00);
+        gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, state ? 0xAAA8AA00 : 0);
-        gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, 0x182);
+        gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, state ? 0x182 : 0x180);
-}
-static void a5xx_enable_hwcg(struct msm_gpu *gpu)
-{
-        struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-        unsigned int i;
-        for (i = 0; i < ARRAY_SIZE(a5xx_hwcg_regs); i++) {
-                if (a5xx_hwcg_regs[i].test(adreno_gpu)) {
-                        _a5xx_enable_hwcg(gpu, a5xx_hwcg_regs[i].regs,
-                                a5xx_hwcg_regs[i].count);
-                        return;
-                }
-        }
 }
 static int a5xx_me_init(struct msm_gpu *gpu)
@@ -377,45 +368,6 @@ static int a5xx_zap_shader_resume(struct msm_gpu *gpu)
        return ret;
 }
-/* Set up a child device to "own" the zap shader */
-static int a5xx_zap_shader_dev_init(struct device *parent, struct device *dev)
-{
-        struct device_node *node;
-        int ret;
-        if (dev->parent)
-                return 0;
-        /* Find the sub-node for the zap shader */
-        node = of_get_child_by_name(parent->of_node, "zap-shader");
-        if (!node) {
-                DRM_DEV_ERROR(parent, "zap-shader not found in device tree\n");
-                return -ENODEV;
-        }
-        dev->parent = parent;
-        dev->of_node = node;
-        dev_set_name(dev, "adreno_zap_shader");
-        ret = device_register(dev);
-        if (ret) {
-                DRM_DEV_ERROR(parent, "Couldn't register zap shader device\n");
-                goto out;
-        }
-        ret = of_reserved_mem_device_init(dev);
-        if (ret) {
-                DRM_DEV_ERROR(parent, "Unable to set up the reserved memory\n");
-                device_unregister(dev);
-        }
-out:
-        if (ret)
-                dev->parent = NULL;
-        return ret;
-}
 static int a5xx_zap_shader_init(struct msm_gpu *gpu)
 {
        static bool loaded;
@@ -444,11 +396,7 @@ static int a5xx_zap_shader_init(struct msm_gpu *gpu)
                return -ENODEV;
        }
-        ret = a5xx_zap_shader_dev_init(&pdev->dev, &a5xx_gpu->zap_dev);
+        ret = zap_shader_load_mdt(&pdev->dev, adreno_gpu->info->zapfw);
-        if (!ret)
-                ret = zap_shader_load_mdt(&a5xx_gpu->zap_dev,
-                        adreno_gpu->info->zapfw);
        loaded = !ret;
@@ -545,7 +493,7 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
        gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL1, 0xA6FFFFFF);
        /* Enable HWCG */
-        a5xx_enable_hwcg(gpu);
+        a5xx_set_hwcg(gpu, true);
        gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL2, 0x0000003F);
@@ -691,9 +639,6 @@ static void a5xx_destroy(struct msm_gpu *gpu)
        DBG("%s", gpu->name);
-        if (a5xx_gpu->zap_dev.parent)
-                device_unregister(&a5xx_gpu->zap_dev);
        if (a5xx_gpu->pm4_bo) {
                if (a5xx_gpu->pm4_iova)
                        msm_gem_put_iova(a5xx_gpu->pm4_bo, gpu->aspace);
@@ -920,31 +865,30 @@ static const u32 a5xx_registers[] = {
        0x0000, 0x0002, 0x0004, 0x0020, 0x0022, 0x0026, 0x0029, 0x002B,
        0x002E, 0x0035, 0x0038, 0x0042, 0x0044, 0x0044, 0x0047, 0x0095,
        0x0097, 0x00BB, 0x03A0, 0x0464, 0x0469, 0x046F, 0x04D2, 0x04D3,
-        0x04E0, 0x0533, 0x0540, 0x0555, 0xF400, 0xF400, 0xF800, 0xF807,
+        0x04E0, 0x0533, 0x0540, 0x0555, 0x0800, 0x081A, 0x081F, 0x0841,
-        0x0800, 0x081A, 0x081F, 0x0841, 0x0860, 0x0860, 0x0880, 0x08A0,
+        0x0860, 0x0860, 0x0880, 0x08A0, 0x0B00, 0x0B12, 0x0B15, 0x0B28,
-        0x0B00, 0x0B12, 0x0B15, 0x0B28, 0x0B78, 0x0B7F, 0x0BB0, 0x0BBD,
+        0x0B78, 0x0B7F, 0x0BB0, 0x0BBD, 0x0BC0, 0x0BC6, 0x0BD0, 0x0C53,
-        0x0BC0, 0x0BC6, 0x0BD0, 0x0C53, 0x0C60, 0x0C61, 0x0C80, 0x0C82,
+        0x0C60, 0x0C61, 0x0C80, 0x0C82, 0x0C84, 0x0C85, 0x0C90, 0x0C98,
-        0x0C84, 0x0C85, 0x0C90, 0x0C98, 0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2,
+        0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2, 0x2180, 0x2185, 0x2580, 0x2585,
-        0x2180, 0x2185, 0x2580, 0x2585, 0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7,
+        0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7, 0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8,
-        0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8, 0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8,
+        0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8, 0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E,
-        0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E, 0x2100, 0x211E, 0x2140, 0x2145,
+        0x2100, 0x211E, 0x2140, 0x2145, 0x2500, 0x251E, 0x2540, 0x2545,
-        0x2500, 0x251E, 0x2540, 0x2545, 0x0D10, 0x0D17, 0x0D20, 0x0D23,
+        0x0D10, 0x0D17, 0x0D20, 0x0D23, 0x0D30, 0x0D30, 0x20C0, 0x20C0,
-        0x0D30, 0x0D30, 0x20C0, 0x20C0, 0x24C0, 0x24C0, 0x0E40, 0x0E43,
+        0x24C0, 0x24C0, 0x0E40, 0x0E43, 0x0E4A, 0x0E4A, 0x0E50, 0x0E57,
-        0x0E4A, 0x0E4A, 0x0E50, 0x0E57, 0x0E60, 0x0E7C, 0x0E80, 0x0E8E,
+        0x0E60, 0x0E7C, 0x0E80, 0x0E8E, 0x0E90, 0x0E96, 0x0EA0, 0x0EA8,
-        0x0E90, 0x0E96, 0x0EA0, 0x0EA8, 0x0EB0, 0x0EB2, 0xE140, 0xE147,
+        0x0EB0, 0x0EB2, 0xE140, 0xE147, 0xE150, 0xE187, 0xE1A0, 0xE1A9,
-        0xE150, 0xE187, 0xE1A0, 0xE1A9, 0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7,
+        0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7, 0xE1D0, 0xE1D1, 0xE200, 0xE201,
-        0xE1D0, 0xE1D1, 0xE200, 0xE201, 0xE210, 0xE21C, 0xE240, 0xE268,
+        0xE210, 0xE21C, 0xE240, 0xE268, 0xE000, 0xE006, 0xE010, 0xE09A,
-        0xE000, 0xE006, 0xE010, 0xE09A, 0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB,
+        0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB, 0xE100, 0xE105, 0xE380, 0xE38F,
-        0xE100, 0xE105, 0xE380, 0xE38F, 0xE3B0, 0xE3B0, 0xE400, 0xE405,
+        0xE3B0, 0xE3B0, 0xE400, 0xE405, 0xE408, 0xE4E9, 0xE4F0, 0xE4F0,
-        0xE408, 0xE4E9, 0xE4F0, 0xE4F0, 0xE280, 0xE280, 0xE282, 0xE2A3,
+        0xE280, 0xE280, 0xE282, 0xE2A3, 0xE2A5, 0xE2C2, 0xE940, 0xE947,
-        0xE2A5, 0xE2C2, 0xE940, 0xE947, 0xE950, 0xE987, 0xE9A0, 0xE9A9,
+        0xE950, 0xE987, 0xE9A0, 0xE9A9, 0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7,
-        0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7, 0xE9D0, 0xE9D1, 0xEA00, 0xEA01,
+        0xE9D0, 0xE9D1, 0xEA00, 0xEA01, 0xEA10, 0xEA1C, 0xEA40, 0xEA68,
-        0xEA10, 0xEA1C, 0xEA40, 0xEA68, 0xE800, 0xE806, 0xE810, 0xE89A,
+        0xE800, 0xE806, 0xE810, 0xE89A, 0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB,
-        0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB, 0xE900, 0xE905, 0xEB80, 0xEB8F,
+        0xE900, 0xE905, 0xEB80, 0xEB8F, 0xEBB0, 0xEBB0, 0xEC00, 0xEC05,
-        0xEBB0, 0xEBB0, 0xEC00, 0xEC05, 0xEC08, 0xECE9, 0xECF0, 0xECF0,
+        0xEC08, 0xECE9, 0xECF0, 0xECF0, 0xEA80, 0xEA80, 0xEA82, 0xEAA3,
-        0xEA80, 0xEA80, 0xEA82, 0xEAA3, 0xEAA5, 0xEAC2, 0xA800, 0xA8FF,
+        0xEAA5, 0xEAC2, 0xA800, 0xA8FF, 0xAC60, 0xAC60, 0xB000, 0xB97F,
-        0xAC60, 0xAC60, 0xB000, 0xB97F, 0xB9A0, 0xB9BF,
+        0xB9A0, 0xB9BF, ~0
-        ~0
 };
 static void a5xx_dump(struct msm_gpu *gpu)
@@ -1020,7 +964,14 @@ static void a5xx_show(struct msm_gpu *gpu, struct seq_file *m)
 {
        seq_printf(m, "status:   %08x\n",
                        gpu_read(gpu, REG_A5XX_RBBM_STATUS));
+        /*
+         * Temporarily disable hardware clock gating before going into
+         * adreno_show to avoid issues while reading the registers
+         */
+        a5xx_set_hwcg(gpu, false);
        adreno_show(gpu, m);
+        a5xx_set_hwcg(gpu, true);
 }
 #endif
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
index 6638bc85645d..1137092241d5 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
@@ -36,8 +36,6 @@ struct a5xx_gpu {
        uint32_t gpmu_dwords;
        uint32_t lm_leakage;
-        struct device zap_dev;
 };
 #define to_a5xx_gpu(x) container_of(x, struct a5xx_gpu, base)
@@ -59,5 +57,6 @@ static inline int spin_usecs(struct msm_gpu *gpu, uint32_t usecs,
 }
 bool a5xx_idle(struct msm_gpu *gpu);
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state);
 #endif /* __A5XX_GPU_H__ */
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index f1ab2703674a..7414c6bbd582 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -48,8 +48,15 @@ int adreno_get_param(struct msm_gpu *gpu, uint32_t param, uint64_t *value)
                *value = adreno_gpu->base.fast_rate;
                return 0;
        case MSM_PARAM_TIMESTAMP:
-                if (adreno_gpu->funcs->get_timestamp)
+                if (adreno_gpu->funcs->get_timestamp) {
-                        return adreno_gpu->funcs->get_timestamp(gpu, value);
+                        int ret;
+                        pm_runtime_get_sync(&gpu->pdev->dev);
+                        ret = adreno_gpu->funcs->get_timestamp(gpu, value);
+                        pm_runtime_put_autosuspend(&gpu->pdev->dev);
+                        return ret;
+                }
                return -EINVAL;
        default:
                DBG("%s: invalid param: %u", gpu->name, param);
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 9e9c5696bc03..c7b612c3d771 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -2137,6 +2137,13 @@ void msm_dsi_host_get_phy_clk_req(struct mipi_dsi_host *host,
        struct msm_dsi_phy_clk_request *clk_req)
 {
        struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+        int ret;
+        ret = dsi_calc_clk_rate(msm_host);
+        if (ret) {
+                pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
+                return;
+        }
        clk_req->bitclk_rate = msm_host->byte_clk_rate * 8;
        clk_req->escclk_rate = msm_host->esc_clk_rate;
@@ -2280,7 +2287,6 @@ int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
                                        struct drm_display_mode *mode)
 {
        struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
-        int ret;
        if (msm_host->mode) {
                drm_mode_destroy(msm_host->dev, msm_host->mode);
@@ -2293,12 +2299,6 @@ int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
                return -ENOMEM;
        }
-        ret = dsi_calc_clk_rate(msm_host);
-        if (ret) {
-                pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
-                return ret;
-        }
        return 0;
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index cb5415d6c04b..735a87a699fa 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -221,8 +221,8 @@ static void blend_setup(struct drm_crtc *crtc)
        struct mdp5_ctl *ctl = mdp5_cstate->ctl;
        uint32_t blend_op, fg_alpha, bg_alpha, ctl_blend_flags = 0;
        unsigned long flags;
-        enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { SSPP_NONE };
+        enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
-        enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { SSPP_NONE };
+        enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
        int i, plane_cnt = 0;
        bool bg_alpha_enabled = false;
        u32 mixer_op_mode = 0;
@@ -753,6 +753,7 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
        if (!handle) {
                DBG("Cursor off");
                cursor_enable = false;
+                mdp5_enable(mdp5_kms);
                goto set_cursor;
        }
@@ -776,6 +777,8 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
        get_roi(crtc, &roi_w, &roi_h);
+        mdp5_enable(mdp5_kms);
        mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_STRIDE(lm), stride);
        mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_FORMAT(lm),
                        MDP5_LM_CURSOR_FORMAT_FORMAT(CURSOR_FMT_ARGB8888));
@@ -804,6 +807,7 @@ set_cursor:
        crtc_flush(crtc, flush_mask);
 end:
+        mdp5_disable(mdp5_kms);
        if (old_bo) {
                drm_flip_work_queue(&mdp5_crtc->unref_cursor_work, old_bo);
                /* enable vblank to complete cursor work: */
@@ -836,6 +840,8 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
        get_roi(crtc, &roi_w, &roi_h);
+        mdp5_enable(mdp5_kms);
        spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
        mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(lm),
                        MDP5_LM_CURSOR_SIZE_ROI_H(roi_h) |
@@ -847,6 +853,8 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
        crtc_flush(crtc, flush_mask);
+        mdp5_disable(mdp5_kms);
        return 0;
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
index 97f3294fbfc6..70bef51245af 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
@@ -299,7 +299,7 @@ static void mdp5_encoder_enable(struct drm_encoder *encoder)
        struct mdp5_interface *intf = mdp5_encoder->intf;
        if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
-                mdp5_cmd_encoder_disable(encoder);
+                mdp5_cmd_encoder_enable(encoder);
        else
                mdp5_vid_encoder_enable(encoder);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 5d13fa5381ee..1c603aef3c59 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -502,7 +502,7 @@ static int get_clk(struct platform_device *pdev, struct clk **clkp,
                const char *name, bool mandatory)
 {
        struct device *dev = &pdev->dev;
-        struct clk *clk = devm_clk_get(dev, name);
+        struct clk *clk = msm_clk_get(pdev, name);
        if (IS_ERR(clk) && mandatory) {
                dev_err(dev, "failed to get %s (%ld)\n", name, PTR_ERR(clk));
                return PTR_ERR(clk);
@@ -887,21 +887,21 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)
        }
        /* mandatory clocks: */
-        ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus", true);
        if (ret)
                goto fail;
-        ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface", true);
        if (ret)
                goto fail;
-        ret = get_clk(pdev, &mdp5_kms->core_clk, "core_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->core_clk, "core", true);
        if (ret)
                goto fail;
-        ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync", true);
        if (ret)
                goto fail;
        /* optional clocks: */
-        get_clk(pdev, &mdp5_kms->lut_clk, "lut_clk", false);
+        get_clk(pdev, &mdp5_kms->lut_clk, "lut", false);
        /* we need to set a default rate before enabling.  Set a safe
         * rate first, then figure out hw revision, and then set a
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index fe3a4de1a433..61f39c86dd09 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -890,8 +890,8 @@ static int mdp5_plane_mode_set(struct drm_plane *plane,
        struct mdp5_hw_pipe *right_hwpipe;
        const struct mdp_format *format;
        uint32_t nplanes, config = 0;
-        struct phase_step step = { 0 };
+        struct phase_step step = { { 0 } };
-        struct pixel_ext pe = { 0 };
+        struct pixel_ext pe = { { 0 } };
        uint32_t hdecm = 0, vdecm = 0;
        uint32_t pix_format;
        unsigned int rotation;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 65f35544c1ec..a0c60e738db8 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -383,8 +383,10 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
                struct page **pages;
                vma = add_vma(obj, aspace);
-                if (IS_ERR(vma))
+                if (IS_ERR(vma)) {
-                        return PTR_ERR(vma);
+                        ret = PTR_ERR(vma);
+                        goto unlock;
+                }
                pages = get_pages(obj);
                if (IS_ERR(pages)) {
@@ -405,7 +407,7 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
 fail:
        del_vma(vma);
+unlock:
        mutex_unlock(&msm_obj->lock);
        return ret;
 }
@@ -928,8 +930,12 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
        if (use_vram) {
                struct msm_gem_vma *vma;
                struct page **pages;
+                struct msm_gem_object *msm_obj = to_msm_bo(obj);
+                mutex_lock(&msm_obj->lock);
                vma = add_vma(obj, NULL);
+                mutex_unlock(&msm_obj->lock);
                if (IS_ERR(vma)) {
                        ret = PTR_ERR(vma);
                        goto fail;
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 6bfca7470141..8a75c0bd8a78 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -34,8 +34,8 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
                struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds)
 {
        struct msm_gem_submit *submit;
-        uint64_t sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) +
+        uint64_t sz = sizeof(*submit) + ((u64)nr_bos * sizeof(submit->bos[0])) +
-                (nr_cmds * sizeof(submit->cmd[0]));
+                ((u64)nr_cmds * sizeof(submit->cmd[0]));
        if (sz > SIZE_MAX)
                return NULL;
@@ -451,7 +451,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
        if (ret)
                goto out;
-        if (!(args->fence & MSM_SUBMIT_NO_IMPLICIT)) {
+        if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
                ret = submit_fence_sync(submit);
                if (ret)
                        goto out;
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index c36321bc8714..d34e331554f3 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -42,7 +42,7 @@ void
 msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                struct msm_gem_vma *vma, struct sg_table *sgt)
 {
-        if (!vma->iova)
+        if (!aspace || !vma->iova)
                return;
        if (aspace->mmu) {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
index c7c84d34d97e..88582af8bd89 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
@@ -267,6 +267,8 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
        /* Create output path objects for each VBIOS display path. */
        i = -1;
        while ((data = dcb_outp_parse(bios, ++i, &ver, &hdr, &dcbE))) {
+                if (ver < 0x40) /* No support for chipsets prior to NV50. */
+                        break;
                if (dcbE.type == DCB_OUTPUT_UNUSED)
                        continue;
                if (dcbE.type == DCB_OUTPUT_EOL)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 5d450332c2fd..2900f1410d95 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -500,7 +500,7 @@ static void vop_line_flag_irq_disable(struct vop *vop)
 static int vop_enable(struct drm_crtc *crtc)
 {
        struct vop *vop = to_vop(crtc);
-        int ret;
+        int ret, i;
        ret = pm_runtime_get_sync(vop->dev);
        if (ret < 0) {
@@ -533,6 +533,20 @@ static int vop_enable(struct drm_crtc *crtc)
        }
        memcpy(vop->regs, vop->regsbak, vop->len);
+        /*
+         * We need to make sure that all windows are disabled before we
+         * enable the crtc. Otherwise we might try to scan from a destroyed
+         * buffer later.
+         */
+        for (i = 0; i < vop->data->win_size; i++) {
+                struct vop_win *vop_win = &vop->win[i];
+                const struct vop_win_data *win = vop_win->data;
+                spin_lock(&vop->reg_lock);
+                VOP_WIN_SET(vop, win, enable, 0);
+                spin_unlock(&vop->reg_lock);
+        }
        vop_cfg_done(vop);
        /*
@@ -566,28 +580,11 @@ err_put_pm_runtime:
 static void vop_crtc_disable(struct drm_crtc *crtc)
 {
        struct vop *vop = to_vop(crtc);
-        int i;
        WARN_ON(vop->event);
        rockchip_drm_psr_deactivate(&vop->crtc);
-        /*
-         * We need to make sure that all windows are disabled before we
-         * disable that crtc. Otherwise we might try to scan from a destroyed
-         * buffer later.
-         */
-        for (i = 0; i < vop->data->win_size; i++) {
-                struct vop_win *vop_win = &vop->win[i];
-                const struct vop_win_data *win = vop_win->data;
-                spin_lock(&vop->reg_lock);
-                VOP_WIN_SET(vop, win, enable, 0);
-                spin_unlock(&vop->reg_lock);
-        }
-        vop_cfg_done(vop);
        drm_crtc_vblank_off(crtc);
        /*
@@ -682,8 +679,10 @@ static int vop_plane_atomic_check(struct drm_plane *plane,
         * Src.x1 can be odd when do clip, but yuv plane start point
         * need align with 2 pixel.
         */
-        if (is_yuv_support(fb->format->format) && ((state->src.x1 >> 16) % 2))
+        if (is_yuv_support(fb->format->format) && ((state->src.x1 >> 16) % 2)) {
+                DRM_ERROR("Invalid Source: Yuv format not support odd xpos\n");
                return -EINVAL;
+        }
        return 0;
 }
@@ -764,7 +763,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
        spin_lock(&vop->reg_lock);
        VOP_WIN_SET(vop, win, format, format);
-        VOP_WIN_SET(vop, win, yrgb_vir, fb->pitches[0] >> 2);
+        VOP_WIN_SET(vop, win, yrgb_vir, DIV_ROUND_UP(fb->pitches[0], 4));
        VOP_WIN_SET(vop, win, yrgb_mst, dma_addr);
        if (is_yuv_support(fb->format->format)) {
                int hsub = drm_format_horz_chroma_subsampling(fb->format->format);
@@ -778,7 +777,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
                offset += (src->y1 >> 16) * fb->pitches[1] / vsub;
                dma_addr = rk_uv_obj->dma_addr + offset + fb->offsets[1];
-                VOP_WIN_SET(vop, win, uv_vir, fb->pitches[1] >> 2);
+                VOP_WIN_SET(vop, win, uv_vir, DIV_ROUND_UP(fb->pitches[1], 4));
                VOP_WIN_SET(vop, win, uv_mst, dma_addr);
        }
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 9979fd0c2282..27eefbfcf3d0 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -282,6 +282,9 @@ static inline uint16_t scl_get_bili_dn_vskip(int src_h, int dst_h,
        act_height = (src_h + vskiplines - 1) / vskiplines;
+        if (act_height == dst_h)
+                return GET_SCL_FT_BILI_DN(src_h, dst_h) / vskiplines;
        return GET_SCL_FT_BILI_DN(act_height, dst_h);
 }
diff --git a/drivers/gpu/drm/stm/Kconfig b/drivers/gpu/drm/stm/Kconfig
index 2c4817fb0890..8fe5b184b4e8 100644
--- a/drivers/gpu/drm/stm/Kconfig
+++ b/drivers/gpu/drm/stm/Kconfig
@@ -7,7 +7,6 @@ config DRM_STM
        select DRM_PANEL
        select VIDEOMODE_HELPERS
        select FB_PROVIDE_GET_FB_UNMAPPED_AREA
-        default y
        help
          Enable support for the on-chip display controller on
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 1006b230b236..65fa29591d21 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -983,7 +983,7 @@ config I2C_UNIPHIER_F
 config I2C_VERSATILE
        tristate "ARM Versatile/Realview I2C bus support"
-        depends on ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || COMPILE_TEST
+        depends on ARCH_MPS2 || ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS || COMPILE_TEST
        select I2C_ALGOBIT
        help
          Say yes if you want to support the I2C serial bus on ARMs Versatile
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 2ea6d0d25a01..143a8fd582b4 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -298,6 +298,9 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
        }
        acpi_speed = i2c_acpi_find_bus_speed(&pdev->dev);
+        /* Some broken DSTDs use 1MiHz instead of 1MHz */
+        if (acpi_speed == 1048576)
+                acpi_speed = 1000000;
        /*
         * Find bus speed from the "clock-frequency" device property, ACPI
         * or by using fast mode if neither is set.
@@ -319,7 +322,8 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
        if (dev->clk_freq != 100000 && dev->clk_freq != 400000
            && dev->clk_freq != 1000000 && dev->clk_freq != 3400000) {
                dev_err(&pdev->dev,
-                        "Only 100kHz, 400kHz, 1MHz and 3.4MHz supported");
+                        "%d Hz is unsupported, only 100kHz, 400kHz, 1MHz and 3.4MHz are supported\n",
+                        dev->clk_freq);
                ret = -EINVAL;
                goto exit_reset;
        }
diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 4842ec3a5451..a9126b3cda61 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -230,6 +230,16 @@ void i2c_acpi_register_devices(struct i2c_adapter *adap)
                dev_warn(&adap->dev, "failed to enumerate I2C slaves\n");
 }
+const struct acpi_device_id *
+i2c_acpi_match_device(const struct acpi_device_id *matches,
+                      struct i2c_client *client)
+{
+        if (!(client && matches))
+                return NULL;
+        return acpi_match_device(matches, &client->dev);
+}
 static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level,
                                           void *data, void **return_value)
 {
@@ -289,7 +299,7 @@ u32 i2c_acpi_find_bus_speed(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(i2c_acpi_find_bus_speed);
-static int i2c_acpi_match_adapter(struct device *dev, void *data)
+static int i2c_acpi_find_match_adapter(struct device *dev, void *data)
 {
        struct i2c_adapter *adapter = i2c_verify_adapter(dev);
@@ -299,7 +309,7 @@ static int i2c_acpi_match_adapter(struct device *dev, void *data)
        return ACPI_HANDLE(dev) == (acpi_handle)data;
 }
-static int i2c_acpi_match_device(struct device *dev, void *data)
+static int i2c_acpi_find_match_device(struct device *dev, void *data)
 {
        return ACPI_COMPANION(dev) == data;
 }
@@ -309,7 +319,7 @@ static struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle)
        struct device *dev;
        dev = bus_find_device(&i2c_bus_type, NULL, handle,
-                              i2c_acpi_match_adapter);
+                              i2c_acpi_find_match_adapter);
        return dev ? i2c_verify_adapter(dev) : NULL;
 }
@@ -317,7 +327,8 @@ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev)
 {
        struct device *dev;
-        dev = bus_find_device(&i2c_bus_type, NULL, adev, i2c_acpi_match_device);
+        dev = bus_find_device(&i2c_bus_type, NULL, adev,
+                              i2c_acpi_find_match_device);
        return dev ? i2c_verify_client(dev) : NULL;
 }
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index c89dac7fd2e7..12822a4b8f8f 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -357,6 +357,7 @@ static int i2c_device_probe(struct device *dev)
         * Tree match table entry is supplied for the probing device.
         */
        if (!driver->id_table &&
+            !i2c_acpi_match_device(dev->driver->acpi_match_table, client) &&
            !i2c_of_match_device(dev->driver->of_match_table, client))
                return -ENODEV;
diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h
index 3b63f5e5b89c..3d3d9bf02101 100644
--- a/drivers/i2c/i2c-core.h
+++ b/drivers/i2c/i2c-core.h
@@ -31,9 +31,18 @@ int i2c_check_addr_validity(unsigned addr, unsigned short flags);
 int i2c_check_7bit_addr_validity_strict(unsigned short addr);
 #ifdef CONFIG_ACPI
+const struct acpi_device_id *
+i2c_acpi_match_device(const struct acpi_device_id *matches,
+                      struct i2c_client *client);
 void i2c_acpi_register_devices(struct i2c_adapter *adap);
 #else /* CONFIG_ACPI */
 static inline void i2c_acpi_register_devices(struct i2c_adapter *adap) { }
+static inline const struct acpi_device_id *
+i2c_acpi_match_device(const struct acpi_device_id *matches,
+                      struct i2c_client *client)
+{
+        return NULL;
+}
 #endif /* CONFIG_ACPI */
 extern struct notifier_block i2c_acpi_notifier;
diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
index 2c64d0e0740f..17121329bb79 100644
--- a/drivers/i2c/muxes/Kconfig
+++ b/drivers/i2c/muxes/Kconfig
@@ -83,7 +83,7 @@ config I2C_MUX_PINCTRL
          different sets of pins at run-time.
          This driver can also be built as a module. If so, the module will be
-          called pinctrl-i2cmux.
+          called i2c-mux-pinctrl.
 config I2C_MUX_REG
        tristate "Register-based I2C multiplexer"
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index 6b5d3be283c4..807299dd45eb 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -193,7 +193,6 @@ struct bmc150_accel_data {
        struct regmap *regmap;
        int irq;
        struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
-        atomic_t active_intr;
        struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
        struct mutex mutex;
        u8 fifo_mode, watermark;
@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i,
                goto out_fix_power_state;
        }
-        if (state)
-                atomic_inc(&data->active_intr);
-        else
-                atomic_dec(&data->active_intr);
        return 0;
 out_fix_power_state:
@@ -1710,8 +1704,7 @@ static int bmc150_accel_resume(struct device *dev)
        struct bmc150_accel_data *data = iio_priv(indio_dev);
        mutex_lock(&data->mutex);
-        if (atomic_read(&data->active_intr))
+        bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
-                bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
        bmc150_accel_fifo_set_mode(data);
        mutex_unlock(&data->mutex);
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 07d1489cd457..e44f62bf9caa 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -166,6 +166,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_ihl = 0x02,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
@@ -234,6 +238,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_od = 0x40,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
@@ -316,6 +324,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                                .en_mask = 0x08,
                        },
                },
+                .sim = {
+                        .addr = 0x24,
+                        .value = BIT(0),
+                },
                .multi_read_bit = false,
                .bootime = 2,
        },
@@ -379,6 +391,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_int1 = 0x04,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                .multi_read_bit = true,
                .bootime = 2, /* guess */
        },
@@ -437,6 +453,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_od = 0x40,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(7),
+                },
                .multi_read_bit = false,
                .bootime = 2, /* guess */
        },
@@ -499,6 +519,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .addr_ihl = 0x22,
                        .mask_ihl = 0x80,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
@@ -547,6 +571,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_int1 = 0x04,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                .multi_read_bit = false,
                .bootime = 2,
        },
@@ -614,6 +642,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                        .mask_ihl = 0x02,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                .multi_read_bit = true,
                .bootime = 2,
        },
diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index e0ea411a0b2d..c02b23d675cb 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -22,6 +22,7 @@
 #include <linux/iio/iio.h>
 #include <linux/iio/driver.h>
+#include <linux/iopoll.h>
 #define ASPEED_RESOLUTION_BITS          10
 #define ASPEED_CLOCKS_PER_SAMPLE        12
@@ -38,11 +39,17 @@
 #define ASPEED_ENGINE_ENABLE            BIT(0)
+#define ASPEED_ADC_CTRL_INIT_RDY        BIT(8)
+#define ASPEED_ADC_INIT_POLLING_TIME    500
+#define ASPEED_ADC_INIT_TIMEOUT         500000
 struct aspeed_adc_model_data {
        const char *model_name;
        unsigned int min_sampling_rate; // Hz
        unsigned int max_sampling_rate; // Hz
        unsigned int vref_voltage;      // mV
+        bool wait_init_sequence;
 };
 struct aspeed_adc_data {
@@ -211,6 +218,24 @@ static int aspeed_adc_probe(struct platform_device *pdev)
                goto scaler_error;
        }
+        model_data = of_device_get_match_data(&pdev->dev);
+        if (model_data->wait_init_sequence) {
+                /* Enable engine in normal mode. */
+                writel(ASPEED_OPERATION_MODE_NORMAL | ASPEED_ENGINE_ENABLE,
+                       data->base + ASPEED_REG_ENGINE_CONTROL);
+                /* Wait for initial sequence complete. */
+                ret = readl_poll_timeout(data->base + ASPEED_REG_ENGINE_CONTROL,
+                                         adc_engine_control_reg_val,
+                                         adc_engine_control_reg_val &
+                                         ASPEED_ADC_CTRL_INIT_RDY,
+                                         ASPEED_ADC_INIT_POLLING_TIME,
+                                         ASPEED_ADC_INIT_TIMEOUT);
+                if (ret)
+                        goto scaler_error;
+        }
        /* Start all channels in normal mode. */
        ret = clk_prepare_enable(data->clk_scaler->clk);
        if (ret)
@@ -274,6 +299,7 @@ static const struct aspeed_adc_model_data ast2500_model_data = {
        .vref_voltage = 1800, // mV
        .min_sampling_rate = 1,
        .max_sampling_rate = 1000000,
+        .wait_init_sequence = true,
 };
 static const struct of_device_id aspeed_adc_matches[] = {
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 64799ad7ebad..462a99c13e7a 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -28,6 +28,8 @@
 #include <linux/iio/driver.h>
 #define AXP288_ADC_EN_MASK              0xF1
+#define AXP288_ADC_TS_PIN_GPADC         0xF2
+#define AXP288_ADC_TS_PIN_ON            0xF3
 enum axp288_adc_id {
        AXP288_ADC_TS,
@@ -121,6 +123,26 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
        return IIO_VAL_INT;
 }
+static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+                                unsigned long address)
+{
+        int ret;
+        /* channels other than GPADC do not need to switch TS pin */
+        if (address != AXP288_GP_ADC_H)
+                return 0;
+        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        if (ret)
+                return ret;
+        /* When switching to the GPADC pin give things some time to settle */
+        if (mode == AXP288_ADC_TS_PIN_GPADC)
+                usleep_range(6000, 10000);
+        return 0;
+}
 static int axp288_adc_read_raw(struct iio_dev *indio_dev,
                        struct iio_chan_spec const *chan,
                        int *val, int *val2, long mask)
@@ -131,7 +153,16 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
        mutex_lock(&indio_dev->mlock);
        switch (mask) {
        case IIO_CHAN_INFO_RAW:
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                                        chan->address)) {
+                        dev_err(&indio_dev->dev, "GPADC mode\n");
+                        ret = -EINVAL;
+                        break;
+                }
                ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                                                chan->address))
+                        dev_err(&indio_dev->dev, "TS pin restore\n");
                break;
        default:
                ret = -EINVAL;
@@ -141,6 +172,15 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
        return ret;
 }
+static int axp288_adc_set_state(struct regmap *regmap)
+{
+        /* ADC should be always enabled for internal FG to function */
+        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+                return -EIO;
+        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+}
 static const struct iio_info axp288_adc_iio_info = {
        .read_raw = &axp288_adc_read_raw,
        .driver_module = THIS_MODULE,
@@ -169,7 +209,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
         * Set ADC to enabled state at all time, including system suspend.
         * otherwise internal fuel gauge functionality may be affected.
         */
-        ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        ret = axp288_adc_set_state(axp20x->regmap);
        if (ret) {
                dev_err(&pdev->dev, "unable to enable ADC device\n");
                return ret;
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index 81d4c39e414a..137f577d9432 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -256,6 +256,7 @@ static int sun4i_gpadc_read(struct iio_dev *indio_dev, int channel, int *val,
 err:
        pm_runtime_put_autosuspend(indio_dev->dev.parent);
+        disable_irq(irq);
        mutex_unlock(&info->mutex);
        return ret;
@@ -365,7 +366,6 @@ static irqreturn_t sun4i_gpadc_temp_data_irq_handler(int irq, void *dev_id)
                complete(&info->completion);
 out:
-        disable_irq_nosync(info->temp_data_irq);
        return IRQ_HANDLED;
 }
@@ -380,7 +380,6 @@ static irqreturn_t sun4i_gpadc_fifo_data_irq_handler(int irq, void *dev_id)
                complete(&info->completion);
 out:
-        disable_irq_nosync(info->fifo_data_irq);
        return IRQ_HANDLED;
 }
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 01fc76f7d660..c168e0db329a 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -77,7 +77,7 @@
 #define VF610_ADC_ADSTS_MASK            0x300
 #define VF610_ADC_ADLPC_EN              0x80
 #define VF610_ADC_ADHSC_EN              0x400
-#define VF610_ADC_REFSEL_VALT           0x100
+#define VF610_ADC_REFSEL_VALT           0x800
 #define VF610_ADC_REFSEL_VBG            0x1000
 #define VF610_ADC_ADTRG_HARD            0x2000
 #define VF610_ADC_AVGS_8                0x4000
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 79c8c7cd70d5..6e6a1ecc99dd 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -550,6 +550,31 @@ out:
 }
 EXPORT_SYMBOL(st_sensors_read_info_raw);
+static int st_sensors_init_interface_mode(struct iio_dev *indio_dev,
+                        const struct st_sensor_settings *sensor_settings)
+{
+        struct st_sensor_data *sdata = iio_priv(indio_dev);
+        struct device_node *np = sdata->dev->of_node;
+        struct st_sensors_platform_data *pdata;
+        pdata = (struct st_sensors_platform_data *)sdata->dev->platform_data;
+        if (((np && of_property_read_bool(np, "spi-3wire")) ||
+             (pdata && pdata->spi_3wire)) && sensor_settings->sim.addr) {
+                int err;
+                err = sdata->tf->write_byte(&sdata->tb, sdata->dev,
+                                            sensor_settings->sim.addr,
+                                            sensor_settings->sim.value);
+                if (err < 0) {
+                        dev_err(&indio_dev->dev,
+                                "failed to init interface mode\n");
+                        return err;
+                }
+        }
+        return 0;
+}
 int st_sensors_check_device_support(struct iio_dev *indio_dev,
                        int num_sensors_list,
                        const struct st_sensor_settings *sensor_settings)
@@ -574,6 +599,10 @@ int st_sensors_check_device_support(struct iio_dev *indio_dev,
                return -ENODEV;
        }
+        err = st_sensors_init_interface_mode(indio_dev, &sensor_settings[i]);
+        if (err < 0)
+                return err;
        if (sensor_settings[i].wai_addr) {
                err = sdata->tf->read_byte(&sdata->tb, sdata->dev,
                                           sensor_settings[i].wai_addr, &wai);
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
index e7d4ea75e007..7599693f7fe9 100644
--- a/drivers/iio/light/tsl2563.c
+++ b/drivers/iio/light/tsl2563.c
@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler(int irq, void *private)
        struct tsl2563_chip *chip = iio_priv(dev_info);
        iio_push_event(dev_info,
-                       IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+                       IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
                                            0,
                                            IIO_EV_TYPE_THRESH,
                                            IIO_EV_DIR_EITHER),
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index aa61ec15c139..f1bce05ffa13 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -456,7 +456,7 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                        .mask_od = 0x40,
                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                },
-                .multi_read_bit = true,
+                .multi_read_bit = false,
                .bootime = 2,
        },
 };
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 01236cef7bfb..437522ca97b4 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -61,6 +61,7 @@ struct addr_req {
        void (*callback)(int status, struct sockaddr *src_addr,
                         struct rdma_dev_addr *addr, void *context);
        unsigned long timeout;
+        struct delayed_work work;
        int status;
        u32 seq;
 };
@@ -295,7 +296,7 @@ int rdma_translate_ip(const struct sockaddr *addr,
 }
 EXPORT_SYMBOL(rdma_translate_ip);
-static void set_timeout(unsigned long time)
+static void set_timeout(struct delayed_work *delayed_work, unsigned long time)
 {
        unsigned long delay;
@@ -303,7 +304,7 @@ static void set_timeout(unsigned long time)
        if ((long)delay < 0)
                delay = 0;
-        mod_delayed_work(addr_wq, &work, delay);
+        mod_delayed_work(addr_wq, delayed_work, delay);
 }
 static void queue_req(struct addr_req *req)
@@ -318,8 +319,7 @@ static void queue_req(struct addr_req *req)
        list_add(&req->list, &temp_req->list);
-        if (req_list.next == &req->list)
+        set_timeout(&req->work, req->timeout);
-                set_timeout(req->timeout);
        mutex_unlock(&lock);
 }
@@ -574,6 +574,37 @@ static int addr_resolve(struct sockaddr *src_in,
        return ret;
 }
+static void process_one_req(struct work_struct *_work)
+{
+        struct addr_req *req;
+        struct sockaddr *src_in, *dst_in;
+        mutex_lock(&lock);
+        req = container_of(_work, struct addr_req, work.work);
+        if (req->status == -ENODATA) {
+                src_in = (struct sockaddr *)&req->src_addr;
+                dst_in = (struct sockaddr *)&req->dst_addr;
+                req->status = addr_resolve(src_in, dst_in, req->addr,
+                                           true, req->seq);
+                if (req->status && time_after_eq(jiffies, req->timeout)) {
+                        req->status = -ETIMEDOUT;
+                } else if (req->status == -ENODATA) {
+                        /* requeue the work for retrying again */
+                        set_timeout(&req->work, req->timeout);
+                        mutex_unlock(&lock);
+                        return;
+                }
+        }
+        list_del(&req->list);
+        mutex_unlock(&lock);
+        req->callback(req->status, (struct sockaddr *)&req->src_addr,
+                req->addr, req->context);
+        put_client(req->client);
+        kfree(req);
+}
 static void process_req(struct work_struct *work)
 {
        struct addr_req *req, *temp_req;
@@ -591,20 +622,23 @@ static void process_req(struct work_struct *work)
                                                   true, req->seq);
                        if (req->status && time_after_eq(jiffies, req->timeout))
                                req->status = -ETIMEDOUT;
-                        else if (req->status == -ENODATA)
+                        else if (req->status == -ENODATA) {
+                                set_timeout(&req->work, req->timeout);
                                continue;
+                        }
                }
                list_move_tail(&req->list, &done_list);
        }
-        if (!list_empty(&req_list)) {
-                req = list_entry(req_list.next, struct addr_req, list);
-                set_timeout(req->timeout);
-        }
        mutex_unlock(&lock);
        list_for_each_entry_safe(req, temp_req, &done_list, list) {
                list_del(&req->list);
+                /* It is safe to cancel other work items from this work item
+                 * because at a time there can be only one work item running
+                 * with this single threaded work queue.
+                 */
+                cancel_delayed_work(&req->work);
                req->callback(req->status, (struct sockaddr *) &req->src_addr,
                        req->addr, req->context);
                put_client(req->client);
@@ -647,6 +681,7 @@ int rdma_resolve_ip(struct rdma_addr_client *client,
        req->context = context;
        req->client = client;
        atomic_inc(&client->refcount);
+        INIT_DELAYED_WORK(&req->work, process_one_req);
        req->seq = (u32)atomic_inc_return(&ib_nl_addr_request_seq);
        req->status = addr_resolve(src_in, dst_in, addr, true, req->seq);
@@ -701,7 +736,7 @@ void rdma_addr_cancel(struct rdma_dev_addr *addr)
                        req->status = -ECANCELED;
                        req->timeout = jiffies;
                        list_move(&req->list, &req_list);
-                        set_timeout(req->timeout);
+                        set_timeout(&req->work, req->timeout);
                        break;
                }
        }
@@ -807,9 +842,8 @@ static int netevent_callback(struct notifier_block *self, unsigned long event,
        if (event == NETEVENT_NEIGH_UPDATE) {
                struct neighbour *neigh = ctx;
-                if (neigh->nud_state & NUD_VALID) {
+                if (neigh->nud_state & NUD_VALID)
-                        set_timeout(jiffies);
+                        set_timeout(&work, jiffies);
-                }
        }
        return 0;
 }
@@ -820,7 +854,7 @@ static struct notifier_block nb = {
 int addr_init(void)
 {
-        addr_wq = alloc_workqueue("ib_addr", WQ_MEM_RECLAIM, 0);
+        addr_wq = alloc_ordered_workqueue("ib_addr", WQ_MEM_RECLAIM);
        if (!addr_wq)
                return -ENOMEM;
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a5dfab6adf49..221468f77128 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -537,10 +537,11 @@ void ib_unregister_device(struct ib_device *device)
        }
        up_read(&lists_rwsem);
-        mutex_unlock(&device_mutex);
        ib_device_unregister_rdmacg(device);
        ib_device_unregister_sysfs(device);
+        mutex_unlock(&device_mutex);
        ib_cache_cleanup_one(device);
        ib_security_destroy_port_pkey_list(device);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 2c98533a0203..c551d2b275fd 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1153,7 +1153,7 @@ ssize_t ib_uverbs_resize_cq(struct ib_uverbs_file *file,
                            int out_len)
 {
        struct ib_uverbs_resize_cq      cmd;
-        struct ib_uverbs_resize_cq_resp resp;
+        struct ib_uverbs_resize_cq_resp resp = {};
        struct ib_udata                 udata;
        struct ib_cq                    *cq;
        int                             ret = -EINVAL;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 3d2609608f58..5e530d2bee44 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -250,6 +250,7 @@ void ib_uverbs_release_file(struct kref *ref)
        if (atomic_dec_and_test(&file->device->refcount))
                ib_uverbs_comp_dev(file->device);
+        kobject_put(&file->device->kobj);
        kfree(file);
 }
@@ -917,7 +918,6 @@ err:
 static int ib_uverbs_close(struct inode *inode, struct file *filp)
 {
        struct ib_uverbs_file *file = filp->private_data;
-        struct ib_uverbs_device *dev = file->device;
        mutex_lock(&file->cleanup_mutex);
        if (file->ucontext) {
@@ -939,7 +939,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
                         ib_uverbs_release_async_event_file);
        kref_put(&file->ref, ib_uverbs_release_file);
-        kobject_put(&dev->kobj);
        return 0;
 }
@@ -1154,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                kref_get(&file->ref);
                mutex_unlock(&uverbs_dev->lists_mutex);
-                ib_uverbs_event_handler(&file->event_handler, &event);
                mutex_lock(&file->cleanup_mutex);
                ucontext = file->ucontext;
@@ -1171,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                         * for example due to freeing the resources
                         * (e.g mmput).
                         */
+                        ib_uverbs_event_handler(&file->event_handler, &event);
                        ib_dev->disassociate_ucontext(ucontext);
                        mutex_lock(&file->cleanup_mutex);
                        ib_uverbs_cleanup_ucontext(file, ucontext, true);
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index fb98ed67d5bc..7f8fe443df46 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -895,7 +895,6 @@ static const struct {
 } qp_state_table[IB_QPS_ERR + 1][IB_QPS_ERR + 1] = {
        [IB_QPS_RESET] = {
                [IB_QPS_RESET] = { .valid = 1 },
-                [IB_QPS_ERR] =   { .valid = 1 },
                [IB_QPS_INIT]  = {
                        .valid = 1,
                        .req_param = {
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 5332f06b99ba..c2fba76becd4 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -661,7 +661,7 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
        rhp = php->rhp;
        if (mr_type != IB_MR_TYPE_MEM_REG ||
-            max_num_sg > t4_max_fr_depth(&rhp->rdev.lldi.ulptx_memwrite_dsgl &&
+            max_num_sg > t4_max_fr_depth(rhp->rdev.lldi.ulptx_memwrite_dsgl &&
                                         use_dsgl))
                return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index f78a733a63ec..d545302b8ef8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,8 +64,10 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
        } else {
                u8 *dmac = rdma_ah_retrieve_dmac(ah_attr);
-                if (!dmac)
+                if (!dmac) {
+                        kfree(ah);
                        return ERR_PTR(-EINVAL);
+                }
                memcpy(ah->av.mac, dmac, ETH_ALEN);
        }
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index 23fad6d96944..2540b65e242c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -733,7 +733,7 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
                        continue;
                free_mr->mr_free_qp[i] = hns_roce_v1_create_lp_qp(hr_dev, pd);
-                if (IS_ERR(free_mr->mr_free_qp[i])) {
+                if (!free_mr->mr_free_qp[i]) {
                        dev_err(dev, "Create loop qp failed!\n");
                        goto create_lp_qp_failed;
                }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 9ec1ae9a82c9..a49ff2eb6fb3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -130,20 +130,32 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
        u64 base = 0;
        u32 i, j;
        u32 k = 0;
-        u32 low;
        /* copy base values in obj_info */
-        for (i = I40IW_HMC_IW_QP, j = 0;
+        for (i = I40IW_HMC_IW_QP, j = 0; i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+                if ((i == I40IW_HMC_IW_SRQ) ||
+                        (i == I40IW_HMC_IW_FSIMC) ||
+                        (i == I40IW_HMC_IW_FSIAV)) {
+                        info[i].base = 0;
+                        info[i].cnt = 0;
+                        continue;
+                }
                get_64bit_val(buf, j, &temp);
                info[i].base = RS_64_1(temp, 32) * 512;
                if (info[i].base > base) {
                        base = info[i].base;
                        k = i;
                }
-                low = (u32)(temp);
+                if (i == I40IW_HMC_IW_APBVT_ENTRY) {
-                if (low)
+                        info[i].cnt = 1;
-                        info[i].cnt = low;
+                        continue;
+                }
+                if (i == I40IW_HMC_IW_QP)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+                else if (i == I40IW_HMC_IW_CQ)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+                else
+                        info[i].cnt = (u32)(temp);
        }
        size = info[k].cnt * info[k].size + info[k].base;
        if (size & 0x1FFFFF)
@@ -155,6 +167,31 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
 }
 /**
+ * i40iw_sc_decode_fpm_query() - Decode a 64 bit value into max count and size
+ * @buf: ptr to fpm query buffer
+ * @buf_idx: index into buf
+ * @info: ptr to i40iw_hmc_obj_info struct
+ * @rsrc_idx: resource index into info
+ *
+ * Decode a 64 bit value from fpm query buffer into max count and size
+ */
+static u64 i40iw_sc_decode_fpm_query(u64 *buf,
+                                            u32 buf_idx,
+                                            struct i40iw_hmc_obj_info *obj_info,
+                                            u32 rsrc_idx)
+{
+        u64 temp;
+        u32 size;
+        get_64bit_val(buf, buf_idx, &temp);
+        obj_info[rsrc_idx].max_cnt = (u32)temp;
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[rsrc_idx].size = LS_64_1(1, size);
+        return temp;
+}
+/**
 * i40iw_sc_parse_fpm_query_buf() - parses fpm query buffer
 * @buf: ptr to fpm query buffer
 * @info: ptr to i40iw_hmc_obj_info struct
@@ -168,9 +205,9 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
                                struct i40iw_hmc_info *hmc_info,
                                struct i40iw_hmc_fpm_misc *hmc_fpm_misc)
 {
-        u64 temp;
        struct i40iw_hmc_obj_info *obj_info;
-        u32 i, j, size;
+        u64 temp;
+        u32 size;
        u16 max_pe_sds;
        obj_info = hmc_info->hmc_obj;
@@ -185,41 +222,52 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
        hmc_fpm_misc->max_sds = max_pe_sds;
        hmc_info->sd_table.sd_cnt = max_pe_sds + hmc_info->first_sd_index;
-        for (i = I40IW_HMC_IW_QP, j = 8;
+        get_64bit_val(buf, 8, &temp);
-             i <= I40IW_HMC_IW_ARP; i++, j += 8) {
+        obj_info[I40IW_HMC_IW_QP].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                get_64bit_val(buf, j, &temp);
+        size = (u32)RS_64_1(temp, 32);
-                if (i == I40IW_HMC_IW_QP)
+        obj_info[I40IW_HMC_IW_QP].size = LS_64_1(1, size);
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                else if (i == I40IW_HMC_IW_CQ)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-                else
-                        obj_info[i].max_cnt = (u32)temp;
-                size = (u32)RS_64_1(temp, 32);
+        get_64bit_val(buf, 16, &temp);
-                obj_info[i].size = ((u64)1 << size);
+        obj_info[I40IW_HMC_IW_CQ].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-        }
+        size = (u32)RS_64_1(temp, 32);
-        for (i = I40IW_HMC_IW_MR, j = 48;
+        obj_info[I40IW_HMC_IW_CQ].size = LS_64_1(1, size);
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
+        i40iw_sc_decode_fpm_query(buf, 32, obj_info, I40IW_HMC_IW_HTE);
-                obj_info[i].max_cnt = (u32)temp;
+        i40iw_sc_decode_fpm_query(buf, 40, obj_info, I40IW_HMC_IW_ARP);
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = LS_64_1(1, size);
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        }
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
+        i40iw_sc_decode_fpm_query(buf, 48, obj_info, I40IW_HMC_IW_MR);
+        i40iw_sc_decode_fpm_query(buf, 56, obj_info, I40IW_HMC_IW_XF);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
        get_64bit_val(buf, 64, &temp);
+        obj_info[I40IW_HMC_IW_XFFL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_XFFL].size = 4;
        hmc_fpm_misc->xf_block_size = RS_64(temp, I40IW_QUERY_FPM_XFBLOCKSIZE);
        if (!hmc_fpm_misc->xf_block_size)
                return I40IW_ERR_INVALID_SIZE;
+        i40iw_sc_decode_fpm_query(buf, 72, obj_info, I40IW_HMC_IW_Q1);
        get_64bit_val(buf, 80, &temp);
+        obj_info[I40IW_HMC_IW_Q1FL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_Q1FL].size = 4;
        hmc_fpm_misc->q1_block_size = RS_64(temp, I40IW_QUERY_FPM_Q1BLOCKSIZE);
        if (!hmc_fpm_misc->q1_block_size)
                return I40IW_ERR_INVALID_SIZE;
+        i40iw_sc_decode_fpm_query(buf, 88, obj_info, I40IW_HMC_IW_TIMER);
+        get_64bit_val(buf, 112, &temp);
+        obj_info[I40IW_HMC_IW_PBLE].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_PBLE].size = 8;
+        get_64bit_val(buf, 120, &temp);
+        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
+        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
+        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
        return 0;
 }
@@ -3392,13 +3440,6 @@ enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev, u8 hmc_fn_
                hmc_info->sd_table.sd_entry = virt_mem.va;
        }
-        /* fill size of objects which are fixed */
-        hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_PBLE].size = 8;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
        return ret_code;
 }
@@ -4840,7 +4881,7 @@ void i40iw_vsi_stats_free(struct i40iw_sc_vsi *vsi)
 {
        u8 fcn_id = vsi->fcn_id;
-        if ((vsi->stats_fcn_id_alloc) && (fcn_id != I40IW_INVALID_FCN_ID))
+        if (vsi->stats_fcn_id_alloc && fcn_id < I40IW_MAX_STATS_COUNT)
                vsi->dev->fcn_id_array[fcn_id] = false;
        i40iw_hw_stats_stop_timer(vsi);
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
index a39ac12b6a7e..2ebaadbed379 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
@@ -1507,8 +1507,8 @@ enum {
        I40IW_CQ0_ALIGNMENT_MASK =              (256 - 1),
        I40IW_HOST_CTX_ALIGNMENT_MASK =         (4 - 1),
        I40IW_SHADOWAREA_MASK =                 (128 - 1),
-        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    0,
+        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    (4 - 1),
-        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   0
+        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   (4 - 1)
 };
 enum i40iw_alignment {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index 71050c5d29a0..7f5583d83622 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -685,7 +685,7 @@ static enum i40iw_status_code i40iw_puda_cq_create(struct i40iw_puda_rsrc *rsrc)
        cqsize = rsrc->cq_size * (sizeof(struct i40iw_cqe));
        tsize = cqsize + sizeof(struct i40iw_cq_shadow_area);
        ret = i40iw_allocate_dma_mem(dev->hw, &rsrc->cqmem, tsize,
-                                     I40IW_CQ0_ALIGNMENT_MASK);
+                                     I40IW_CQ0_ALIGNMENT);
        if (ret)
                return ret;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h
index 91c421762f06..f7013f11d808 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_status.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_status.h
@@ -62,7 +62,7 @@ enum i40iw_status_code {
        I40IW_ERR_INVALID_ALIGNMENT = -23,
        I40IW_ERR_FLUSHED_QUEUE = -24,
        I40IW_ERR_INVALID_PUSH_PAGE_INDEX = -25,
-        I40IW_ERR_INVALID_IMM_DATA_SIZE = -26,
+        I40IW_ERR_INVALID_INLINE_DATA_SIZE = -26,
        I40IW_ERR_TIMEOUT = -27,
        I40IW_ERR_OPCODE_MISMATCH = -28,
        I40IW_ERR_CQP_COMPL_ERROR = -29,
diff --git a/drivers/infiniband/hw/i40iw/i40iw_uk.c b/drivers/infiniband/hw/i40iw/i40iw_uk.c
index b0d3a0e8a9b5..1060725d18bc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_uk.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_uk.c
@@ -435,7 +435,7 @@ static enum i40iw_status_code i40iw_inline_rdma_write(struct i40iw_qp_uk *qp,
        op_info = &info->op.inline_rdma_write;
        if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
        if (ret_code)
@@ -511,7 +511,7 @@ static enum i40iw_status_code i40iw_inline_send(struct i40iw_qp_uk *qp,
        op_info = &info->op.inline_send;
        if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
        if (ret_code)
@@ -784,7 +784,7 @@ static enum i40iw_status_code i40iw_cq_poll_completion(struct i40iw_cq_uk *cq,
        get_64bit_val(cqe, 0, &qword0);
        get_64bit_val(cqe, 16, &qword2);
-        info->tcp_seq_num = (u8)RS_64(qword0, I40IWCQ_TCPSEQNUM);
+        info->tcp_seq_num = (u32)RS_64(qword0, I40IWCQ_TCPSEQNUM);
        info->qp_id = (u32)RS_64(qword2, I40IWCQ_QPID);
@@ -1187,7 +1187,7 @@ enum i40iw_status_code i40iw_inline_data_size_to_wqesize(u32 data_size,
                                                         u8 *wqe_size)
 {
        if (data_size > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        if (data_size <= 16)
                *wqe_size = I40IW_QP_WQE_MIN_SIZE;
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index ae0746754008..3d701c7a4c91 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -939,7 +939,7 @@ static int mlx5_ib_mr_initiator_pfault_handler(
        if (qp->ibqp.qp_type != IB_QPT_RC) {
                av = *wqe;
-                if (av->dqp_dct & be32_to_cpu(MLX5_WQE_AV_EXT))
+                if (av->dqp_dct & cpu_to_be32(MLX5_EXTENDED_UD_AV))
                        *wqe += sizeof(struct mlx5_av);
                else
                        *wqe += sizeof(struct mlx5_base_av);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 69bda611d313..90aa326fd7c0 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -65,13 +65,28 @@ int pvrdma_req_notify_cq(struct ib_cq *ibcq,
        struct pvrdma_dev *dev = to_vdev(ibcq->device);
        struct pvrdma_cq *cq = to_vcq(ibcq);
        u32 val = cq->cq_handle;
+        unsigned long flags;
+        int has_data = 0;
        val |= (notify_flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED ?
                PVRDMA_UAR_CQ_ARM_SOL : PVRDMA_UAR_CQ_ARM;
+        spin_lock_irqsave(&cq->cq_lock, flags);
        pvrdma_write_uar_cq(dev, val);
-        return 0;
+        if (notify_flags & IB_CQ_REPORT_MISSED_EVENTS) {
+                unsigned int head;
+                has_data = pvrdma_idx_ring_has_data(&cq->ring_state->rx,
+                                                    cq->ibcq.cqe, &head);
+                if (unlikely(has_data == PVRDMA_INVALID_IDX))
+                        dev_err(&dev->pdev->dev, "CQ ring state invalid\n");
+        }
+        spin_unlock_irqrestore(&cq->cq_lock, flags);
+        return has_data;
 }
 /**
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index ff50a7bd66d8..7ac25059c40f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -336,6 +336,7 @@ struct ipoib_dev_priv {
        unsigned long flags;
        struct rw_semaphore vlan_rwsem;
+        struct mutex mcast_mutex;
        struct rb_root  path_tree;
        struct list_head path_list;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index f87d104837dc..d69410c2ed97 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -511,7 +511,6 @@ static int ipoib_cm_rx_handler(struct ib_cm_id *cm_id,
        case IB_CM_REQ_RECEIVED:
                return ipoib_cm_req_handler(cm_id, event);
        case IB_CM_DREQ_RECEIVED:
-                p = cm_id->context;
                ib_send_cm_drep(cm_id, NULL, 0);
                /* Fall through */
        case IB_CM_REJ_RECEIVED:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index 7871379342f4..184a22f48027 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -52,7 +52,8 @@ static const struct ipoib_stats ipoib_gstrings_stats[] = {
        IPOIB_NETDEV_STAT(tx_bytes),
        IPOIB_NETDEV_STAT(tx_errors),
        IPOIB_NETDEV_STAT(rx_dropped),
-        IPOIB_NETDEV_STAT(tx_dropped)
+        IPOIB_NETDEV_STAT(tx_dropped),
+        IPOIB_NETDEV_STAT(multicast),
 };
 #define IPOIB_GLOBAL_STATS_LEN  ARRAY_SIZE(ipoib_gstrings_stats)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 57a9655e844d..2e075377242e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -256,6 +256,8 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
        ++dev->stats.rx_packets;
        dev->stats.rx_bytes += skb->len;
+        if (skb->pkt_type == PACKET_MULTICAST)
+                dev->stats.multicast++;
        skb->dev = dev;
        if ((dev->features & NETIF_F_RXCSUM) &&
@@ -709,6 +711,27 @@ static int recvs_pending(struct net_device *dev)
        return pending;
 }
+static void check_qp_movement_and_print(struct ipoib_dev_priv *priv,
+                                        struct ib_qp *qp,
+                                        enum ib_qp_state new_state)
+{
+        struct ib_qp_attr qp_attr;
+        struct ib_qp_init_attr query_init_attr;
+        int ret;
+        ret = ib_query_qp(qp, &qp_attr, IB_QP_STATE, &query_init_attr);
+        if (ret) {
+                ipoib_warn(priv, "%s: Failed to query QP\n", __func__);
+                return;
+        }
+        /* print according to the new-state and the previous state.*/
+        if (new_state == IB_QPS_ERR && qp_attr.qp_state == IB_QPS_RESET)
+                ipoib_dbg(priv, "Failed modify QP, IB_QPS_RESET to IB_QPS_ERR, acceptable\n");
+        else
+                ipoib_warn(priv, "Failed to modify QP to state: %d from state: %d\n",
+                           new_state, qp_attr.qp_state);
+}
 int ipoib_ib_dev_stop_default(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
@@ -728,7 +751,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
         */
        qp_attr.qp_state = IB_QPS_ERR;
        if (ib_modify_qp(priv->qp, &qp_attr, IB_QP_STATE))
-                ipoib_warn(priv, "Failed to modify QP to ERROR state\n");
+                check_qp_movement_and_print(priv, priv->qp, IB_QPS_ERR);
        /* Wait for all sends and receives to complete */
        begin = jiffies;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 4ce315c92b48..6c77df34869d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1560,6 +1560,7 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
        int i, wait_flushed = 0;
        init_completion(&priv->ntbl.flushed);
+        set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
        spin_lock_irqsave(&priv->lock, flags);
@@ -1604,7 +1605,6 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
        ipoib_dbg(priv, "ipoib_neigh_hash_uninit\n");
        init_completion(&priv->ntbl.deleted);
-        set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
        /* Stop GC if called at init fail need to cancel work */
        stopped = test_and_set_bit(IPOIB_STOP_NEIGH_GC, &priv->flags);
@@ -1847,6 +1847,7 @@ static const struct net_device_ops ipoib_netdev_ops_vf = {
        .ndo_tx_timeout          = ipoib_timeout,
        .ndo_set_rx_mode         = ipoib_set_mcast_list,
        .ndo_get_iflink          = ipoib_get_iflink,
+        .ndo_get_stats64         = ipoib_get_stats,
 };
 void ipoib_setup_common(struct net_device *dev)
@@ -1877,6 +1878,7 @@ static void ipoib_build_priv(struct net_device *dev)
        priv->dev = dev;
        spin_lock_init(&priv->lock);
        init_rwsem(&priv->vlan_rwsem);
+        mutex_init(&priv->mcast_mutex);
        INIT_LIST_HEAD(&priv->path_list);
        INIT_LIST_HEAD(&priv->child_intfs);
@@ -2173,14 +2175,14 @@ static struct net_device *ipoib_add_port(const char *format,
        priv->dev->dev_id = port - 1;
        result = ib_query_port(hca, port, &attr);
-        if (!result)
+        if (result) {
-                priv->max_ib_mtu = ib_mtu_enum_to_int(attr.max_mtu);
-        else {
                printk(KERN_WARNING "%s: ib_query_port %d failed\n",
                       hca->name, port);
                goto device_init_failed;
        }
+        priv->max_ib_mtu = ib_mtu_enum_to_int(attr.max_mtu);
        /* MTU will be reset when mcast join happens */
        priv->dev->mtu  = IPOIB_UD_MTU(priv->max_ib_mtu);
        priv->mcast_mtu  = priv->admin_mtu = priv->dev->mtu;
@@ -2211,12 +2213,14 @@ static struct net_device *ipoib_add_port(const char *format,
                printk(KERN_WARNING "%s: ib_query_gid port %d failed (ret = %d)\n",
                       hca->name, port, result);
                goto device_init_failed;
-        } else
+        }
-                memcpy(priv->dev->dev_addr + 4, priv->local_gid.raw, sizeof (union ib_gid));
+        memcpy(priv->dev->dev_addr + 4, priv->local_gid.raw,
+               sizeof(union ib_gid));
        set_bit(IPOIB_FLAG_DEV_ADDR_SET, &priv->flags);
        result = ipoib_dev_init(priv->dev, hca, port);
-        if (result < 0) {
+        if (result) {
                printk(KERN_WARNING "%s: failed to initialize port %d (ret = %d)\n",
                       hca->name, port, result);
                goto device_init_failed;
@@ -2365,6 +2369,7 @@ static int __init ipoib_init_module(void)
        ipoib_sendq_size = max3(ipoib_sendq_size, 2 * MAX_SEND_CQE, IPOIB_MIN_QUEUE_SIZE);
 #ifdef CONFIG_INFINIBAND_IPOIB_CM
        ipoib_max_conn_qp = min(ipoib_max_conn_qp, IPOIB_CM_MAX_CONN_QP);
+        ipoib_max_conn_qp = max(ipoib_max_conn_qp, 0);
 #endif
        /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 057f58e6afca..93e149efc1f5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -684,15 +684,10 @@ void ipoib_mcast_start_thread(struct net_device *dev)
 int ipoib_mcast_stop_thread(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
-        unsigned long flags;
        ipoib_dbg_mcast(priv, "stopping multicast thread\n");
-        spin_lock_irqsave(&priv->lock, flags);
+        cancel_delayed_work_sync(&priv->mcast_task);
-        cancel_delayed_work(&priv->mcast_task);
-        spin_unlock_irqrestore(&priv->lock, flags);
-        flush_workqueue(priv->wq);
        return 0;
 }
@@ -748,6 +743,14 @@ void ipoib_mcast_remove_list(struct list_head *remove_list)
 {
        struct ipoib_mcast *mcast, *tmcast;
+        /*
+         * make sure the in-flight joins have finished before we attempt
+         * to leave
+         */
+        list_for_each_entry_safe(mcast, tmcast, remove_list, list)
+                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
+                        wait_for_completion(&mcast->done);
        list_for_each_entry_safe(mcast, tmcast, remove_list, list) {
                ipoib_mcast_leave(mcast->dev, mcast);
                ipoib_mcast_free(mcast);
@@ -838,6 +841,7 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
        struct ipoib_mcast *mcast, *tmcast;
        unsigned long flags;
+        mutex_lock(&priv->mcast_mutex);
        ipoib_dbg_mcast(priv, "flushing multicast list\n");
        spin_lock_irqsave(&priv->lock, flags);
@@ -856,15 +860,8 @@ void ipoib_mcast_dev_flush(struct net_device *dev)
        spin_unlock_irqrestore(&priv->lock, flags);
-        /*
-         * make sure the in-flight joins have finished before we attempt
-         * to leave
-         */
-        list_for_each_entry_safe(mcast, tmcast, &remove_list, list)
-                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                        wait_for_completion(&mcast->done);
        ipoib_mcast_remove_list(&remove_list);
+        mutex_unlock(&priv->mcast_mutex);
 }
 static int ipoib_mcast_addr_is_valid(const u8 *addr, const u8 *broadcast)
@@ -982,14 +979,6 @@ void ipoib_mcast_restart_task(struct work_struct *work)
        netif_addr_unlock(dev);
        local_irq_restore(flags);
-        /*
-         * make sure the in-flight joins have finished before we attempt
-         * to leave
-         */
-        list_for_each_entry_safe(mcast, tmcast, &remove_list, list)
-                if (test_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                        wait_for_completion(&mcast->done);
        ipoib_mcast_remove_list(&remove_list);
        /*
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 3b616cb7c67f..714cf7f9b138 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1248,6 +1248,10 @@ static const struct acpi_device_id elan_acpi_id[] = {
        { "ELAN0100", 0 },
        { "ELAN0600", 0 },
        { "ELAN0605", 0 },
+        { "ELAN0608", 0 },
+        { "ELAN0605", 0 },
+        { "ELAN0609", 0 },
+        { "ELAN060B", 0 },
        { "ELAN1000", 0 },
        { }
 };
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 922ea02edcc3..20b5b21c1bba 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -380,8 +380,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                return 0;
        if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data\n");
+                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
-                button_info = 0;
+                button_info = 0x33;
        }
        psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index b97188acc4f1..2d80fa8a0634 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1519,6 +1519,13 @@ static int arm_smmu_add_device(struct device *dev)
        if (using_legacy_binding) {
                ret = arm_smmu_register_legacy_master(dev, &smmu);
+                /*
+                 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
+                 * will allocate/initialise a new one. Thus we need to update fwspec for
+                 * later use.
+                 */
+                fwspec = dev->iommu_fwspec;
                if (ret)
                        goto out_free;
        } else if (fwspec && fwspec->ops == &arm_smmu_ops) {
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 28b26c80f4cf..072bd227b6c6 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -137,14 +137,14 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain)
 #define AT91_RTC_IMR           0x28
 #define AT91_RTC_IRQ_MASK      0x1f
-void __init aic_common_rtc_irq_fixup(struct device_node *root)
+void __init aic_common_rtc_irq_fixup(void)
 {
        struct device_node *np;
        void __iomem *regs;
-        np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+        np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
        if (!np)
-                np = of_find_compatible_node(root, NULL,
+                np = of_find_compatible_node(NULL, NULL,
                                             "atmel,at91sam9x5-rtc");
        if (!np)
@@ -165,7 +165,7 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root)
 #define AT91_RTT_ALMIEN         (1 << 16)               /* Alarm Interrupt Enable */
 #define AT91_RTT_RTTINCIEN      (1 << 17)               /* Real Time Timer Increment Interrupt Enable */
-void __init aic_common_rtt_irq_fixup(struct device_node *root)
+void __init aic_common_rtt_irq_fixup(void)
 {
        struct device_node *np;
        void __iomem *regs;
@@ -196,11 +196,10 @@ static void __init aic_common_irq_fixup(const struct of_device_id *matches)
                return;
        match = of_match_node(matches, root);
-        of_node_put(root);
        if (match) {
-                void (*fixup)(struct device_node *) = match->data;
+                void (*fixup)(void) = match->data;
-                fixup(root);
+                fixup();
        }
        of_node_put(root);
diff --git a/drivers/irqchip/irq-atmel-aic-common.h b/drivers/irqchip/irq-atmel-aic-common.h
index af60376d50de..242e62c1851e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.h
+++ b/drivers/irqchip/irq-atmel-aic-common.h
@@ -33,8 +33,8 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                                             const char *name, int nirqs,
                                             const struct of_device_id *matches);
-void __init aic_common_rtc_irq_fixup(struct device_node *root);
+void __init aic_common_rtc_irq_fixup(void);
-void __init aic_common_rtt_irq_fixup(struct device_node *root);
+void __init aic_common_rtt_irq_fixup(void);
 #endif /* __IRQ_ATMEL_AIC_COMMON_H */
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 37f952dd9fc9..bb1ad451392f 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -209,20 +209,20 @@ static const struct irq_domain_ops aic_irq_ops = {
        .xlate  = aic_irq_domain_xlate,
 };
-static void __init at91rm9200_aic_irq_fixup(struct device_node *root)
+static void __init at91rm9200_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
-static void __init at91sam9260_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9260_aic_irq_fixup(void)
 {
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
-static void __init at91sam9g45_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9g45_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
 static const struct of_device_id aic_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index c04ee9a23d09..6acad2ea0fb3 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -305,9 +305,9 @@ static const struct irq_domain_ops aic5_irq_ops = {
        .xlate  = aic5_irq_domain_xlate,
 };
-static void __init sama5d3_aic_irq_fixup(struct device_node *root)
+static void __init sama5d3_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 static const struct of_device_id aic5_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index bddf169c4b37..b009b916a292 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
        ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
        ct->chip.irq_resume = brcmstb_l2_intc_resume;
+        ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
        if (data->can_wake) {
                /* This IRQ chip can wake the system, set all child interrupts
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 249240d9a425..833a90fe33ae 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -43,6 +43,7 @@ static int of_pmsi_get_dev_id(struct irq_domain *domain, struct device *dev,
                        *dev_id = args.args[0];
                        break;
                }
+                index++;
        } while (!ret);
        return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 68932873eebc..284738add89b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1835,7 +1835,7 @@ static int __init its_of_probe(struct device_node *node)
 #define ACPI_GICV3_ITS_MEM_SIZE (SZ_128K)
-#if defined(CONFIG_ACPI_NUMA) && (ACPI_CA_VERSION >= 0x20170531)
+#ifdef CONFIG_ACPI_NUMA
 struct its_srat_map {
        /* numa node id */
        u32     numa_node;
@@ -1843,7 +1843,7 @@ struct its_srat_map {
        u32     its_id;
 };
-static struct its_srat_map its_srat_maps[MAX_NUMNODES] __initdata;
+static struct its_srat_map *its_srat_maps __initdata;
 static int its_in_srat __initdata;
 static int __init acpi_get_its_numa_node(u32 its_id)
@@ -1857,6 +1857,12 @@ static int __init acpi_get_its_numa_node(u32 its_id)
        return NUMA_NO_NODE;
 }
+static int __init gic_acpi_match_srat_its(struct acpi_subtable_header *header,
+                                          const unsigned long end)
+{
+        return 0;
+}
 static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                         const unsigned long end)
 {
@@ -1873,12 +1879,6 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                return -EINVAL;
        }
-        if (its_in_srat >= MAX_NUMNODES) {
-                pr_err("SRAT: ITS affinity exceeding max count[%d]\n",
-                                MAX_NUMNODES);
-                return -EINVAL;
-        }
        node = acpi_map_pxm_to_node(its_affinity->proximity_domain);
        if (node == NUMA_NO_NODE || node >= MAX_NUMNODES) {
@@ -1897,14 +1897,37 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
 static void __init acpi_table_parse_srat_its(void)
 {
+        int count;
+        count = acpi_table_parse_entries(ACPI_SIG_SRAT,
+                        sizeof(struct acpi_table_srat),
+                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
+                        gic_acpi_match_srat_its, 0);
+        if (count <= 0)
+                return;
+        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
+                                GFP_KERNEL);
+        if (!its_srat_maps) {
+                pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
+                return;
+        }
        acpi_table_parse_entries(ACPI_SIG_SRAT,
                        sizeof(struct acpi_table_srat),
                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
                        gic_acpi_parse_srat_its, 0);
 }
+/* free the its_srat_maps after ITS probing */
+static void __init acpi_its_srat_maps_free(void)
+{
+        kfree(its_srat_maps);
+}
 #else
 static void __init acpi_table_parse_srat_its(void)      { }
 static int __init acpi_get_its_numa_node(u32 its_id) { return NUMA_NO_NODE; }
+static void __init acpi_its_srat_maps_free(void) { }
 #endif
 static int __init gic_acpi_parse_madt_its(struct acpi_subtable_header *header,
@@ -1951,6 +1974,7 @@ static void __init its_acpi_probe(void)
        acpi_table_parse_srat_its();
        acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_TRANSLATOR,
                              gic_acpi_parse_madt_its, 0);
+        acpi_its_srat_maps_free();
 }
 #else
 static void __init its_acpi_probe(void) { }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index dbffb7ab6203..984c3ecfd22c 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -353,6 +353,8 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
                        if (static_key_true(&supports_deactivate))
                                gic_write_eoir(irqnr);
+                        else
+                                isb();
                        err = handle_domain_irq(gic_data.domain, irqnr, regs);
                        if (err) {
@@ -640,11 +642,16 @@ static void gic_smp_init(void)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                            bool force)
 {
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        unsigned int cpu;
        void __iomem *reg;
        int enabled;
        u64 val;
+        if (force)
+                cpu = cpumask_first(mask_val);
+        else
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
        if (cpu >= nr_cpu_ids)
                return -EINVAL;
@@ -831,8 +838,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        if (ret)
                return ret;
-        for (i = 0; i < nr_irqs; i++)
+        for (i = 0; i < nr_irqs; i++) {
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1b1df4f770bd..d3e7c43718b8 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -361,6 +361,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
                if (likely(irqnr > 15 && irqnr < 1020)) {
                        if (static_key_true(&supports_deactivate))
                                writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+                        isb();
                        handle_domain_irq(gic->domain, irqnr, regs);
                        continue;
                }
@@ -401,10 +402,12 @@ static void gic_handle_cascade_irq(struct irq_desc *desc)
                goto out;
        cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
-        if (unlikely(gic_irq < 32 || gic_irq > 1020))
+        if (unlikely(gic_irq < 32 || gic_irq > 1020)) {
                handle_bad_irq(desc);
-        else
+        } else {
+                isb();
                generic_handle_irq(cascade_irq);
+        }
 out:
        chained_irq_exit(chip, desc);
@@ -1027,8 +1030,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        if (ret)
                return ret;
-        for (i = 0; i < nr_irqs; i++)
+        for (i = 0; i < nr_irqs; i++) {
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
diff --git a/drivers/isdn/hysdn/hysdn_proclog.c b/drivers/isdn/hysdn/hysdn_proclog.c
index 7b5fd8fb1761..aaca0b3d662e 100644
--- a/drivers/isdn/hysdn/hysdn_proclog.c
+++ b/drivers/isdn/hysdn/hysdn_proclog.c
@@ -44,7 +44,6 @@ struct procdata {
        char log_name[15];      /* log filename */
        struct log_data *log_head, *log_tail;   /* head and tail for queue */
        int if_used;            /* open count for interface */
-        int volatile del_lock;  /* lock for delete operations */
        unsigned char logtmp[LOG_MAX_LINELEN];
        wait_queue_head_t rd_queue;
 };
@@ -102,7 +101,6 @@ put_log_buffer(hysdn_card *card, char *cp)
 {
        struct log_data *ib;
        struct procdata *pd = card->proclog;
-        int i;
        unsigned long flags;
        if (!pd)
@@ -126,21 +124,21 @@ put_log_buffer(hysdn_card *card, char *cp)
        else
                pd->log_tail->next = ib;        /* follows existing messages */
        pd->log_tail = ib;      /* new tail */
-        i = pd->del_lock++;     /* get lock state */
-        spin_unlock_irqrestore(&card->hysdn_lock, flags);
        /* delete old entrys */
-        if (!i)
+        while (pd->log_head->next) {
-                while (pd->log_head->next) {
+                if ((pd->log_head->usage_cnt <= 0) &&
-                        if ((pd->log_head->usage_cnt <= 0) &&
+                    (pd->log_head->next->usage_cnt <= 0)) {
-                            (pd->log_head->next->usage_cnt <= 0)) {
+                        ib = pd->log_head;
-                                ib = pd->log_head;
+                        pd->log_head = pd->log_head->next;
-                                pd->log_head = pd->log_head->next;
+                        kfree(ib);
-                                kfree(ib);
+                } else {
-                        } else
+                        break;
-                                break;
+                }
-                }               /* pd->log_head->next */
+        }               /* pd->log_head->next */
-        pd->del_lock--;         /* release lock level */
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
        wake_up_interruptible(&(pd->rd_queue));         /* announce new entry */
 }                               /* put_log_buffer */
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index 78fc5d5e9051..92e6570b1143 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -26,7 +26,7 @@
 #define FSM_TIMER_DEBUG 0
-void
+int
 mISDN_FsmNew(struct Fsm *fsm,
             struct FsmNode *fnlist, int fncount)
 {
@@ -34,6 +34,8 @@ mISDN_FsmNew(struct Fsm *fsm,
        fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
                                  fsm->event_count, GFP_KERNEL);
+        if (fsm->jumpmatrix == NULL)
+                return -ENOMEM;
        for (i = 0; i < fncount; i++)
                if ((fnlist[i].state >= fsm->state_count) ||
@@ -45,6 +47,7 @@ mISDN_FsmNew(struct Fsm *fsm,
                } else
                        fsm->jumpmatrix[fsm->state_count * fnlist[i].event +
                                        fnlist[i].state] = (FSMFNPTR) fnlist[i].routine;
+        return 0;
 }
 EXPORT_SYMBOL(mISDN_FsmNew);
diff --git a/drivers/isdn/mISDN/fsm.h b/drivers/isdn/mISDN/fsm.h
index 928f5be192c1..e1def8490221 100644
--- a/drivers/isdn/mISDN/fsm.h
+++ b/drivers/isdn/mISDN/fsm.h
@@ -55,7 +55,7 @@ struct FsmTimer {
        void *arg;
 };
-extern void mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
+extern int mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
 extern void mISDN_FsmFree(struct Fsm *);
 extern int mISDN_FsmEvent(struct FsmInst *, int , void *);
 extern void mISDN_FsmChangeState(struct FsmInst *, int);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index bebc57b72138..3192b0eb3944 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -414,8 +414,7 @@ l1_init(u_int *deb)
        l1fsm_s.event_count = L1_EVENT_COUNT;
        l1fsm_s.strEvent = strL1Event;
        l1fsm_s.strState = strL1SState;
-        mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
+        return mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
-        return 0;
 }
 void
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 7243a6746f8b..9ff0903a0e89 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2247,15 +2247,26 @@ static struct Bprotocol X75SLP = {
 int
 Isdnl2_Init(u_int *deb)
 {
+        int res;
        debug = deb;
        mISDN_register_Bprotocol(&X75SLP);
        l2fsm.state_count = L2_STATE_COUNT;
        l2fsm.event_count = L2_EVENT_COUNT;
        l2fsm.strEvent = strL2Event;
        l2fsm.strState = strL2State;
-        mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
+        res = mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
-        TEIInit(deb);
+        if (res)
+                goto error;
+        res = TEIInit(deb);
+        if (res)
+                goto error_fsm;
        return 0;
+error_fsm:
+        mISDN_FsmFree(&l2fsm);
+error:
+        mISDN_unregister_Bprotocol(&X75SLP);
+        return res;
 }
 void
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 908127efccf8..12d9e5f4beb1 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -1387,23 +1387,37 @@ create_teimanager(struct mISDNdevice *dev)
 int TEIInit(u_int *deb)
 {
+        int res;
        debug = deb;
        teifsmu.state_count = TEI_STATE_COUNT;
        teifsmu.event_count = TEI_EVENT_COUNT;
        teifsmu.strEvent = strTeiEvent;
        teifsmu.strState = strTeiState;
-        mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        res = mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        if (res)
+                goto error;
        teifsmn.state_count = TEI_STATE_COUNT;
        teifsmn.event_count = TEI_EVENT_COUNT;
        teifsmn.strEvent = strTeiEvent;
        teifsmn.strState = strTeiState;
-        mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        res = mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        if (res)
+                goto error_smn;
        deactfsm.state_count =  DEACT_STATE_COUNT;
        deactfsm.event_count = DEACT_EVENT_COUNT;
        deactfsm.strEvent = strDeactEvent;
        deactfsm.strState = strDeactState;
-        mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        res = mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        if (res)
+                goto error_deact;
        return 0;
+error_deact:
+        mISDN_FsmFree(&teifsmn);
+error_smn:
+        mISDN_FsmFree(&teifsmu);
+error:
+        return res;
 }
 void TEIFree(void)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c99634612fc4..b01e458d31e9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7996,7 +7996,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
        if (mddev->safemode == 1)
                mddev->safemode = 0;
        /* sync_checkers is always 0 when writes_pending is in per-cpu mode */
-        if (mddev->in_sync || !mddev->sync_checkers) {
+        if (mddev->in_sync || mddev->sync_checkers) {
                spin_lock(&mddev->lock);
                if (mddev->in_sync) {
                        mddev->in_sync = 0;
@@ -8656,6 +8656,9 @@ void md_check_recovery(struct mddev *mddev)
        if (mddev_trylock(mddev)) {
                int spares = 0;
+                if (!mddev->external && mddev->safemode == 1)
+                        mddev->safemode = 0;
                if (mddev->ro) {
                        struct md_rdev *rdev;
                        if (!mddev->external && mddev->in_sync)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index bfa1e907c472..2dcbafa8e66c 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -236,9 +236,10 @@ struct r5l_io_unit {
        bool need_split_bio;
        struct bio *split_bio;
-        unsigned int has_flush:1;      /* include flush request */
+        unsigned int has_flush:1;               /* include flush request */
-        unsigned int has_fua:1;        /* include fua request */
+        unsigned int has_fua:1;                 /* include fua request */
-        unsigned int has_null_flush:1; /* include empty flush request */
+        unsigned int has_null_flush:1;          /* include null flush request */
+        unsigned int has_flush_payload:1;       /* include flush payload  */
        /*
         * io isn't sent yet, flush/fua request can only be submitted till it's
         * the first IO in running_ios list
@@ -571,6 +572,8 @@ static void r5l_log_endio(struct bio *bio)
        struct r5l_io_unit *io_deferred;
        struct r5l_log *log = io->log;
        unsigned long flags;
+        bool has_null_flush;
+        bool has_flush_payload;
        if (bio->bi_status)
                md_error(log->rdev->mddev, log->rdev);
@@ -580,6 +583,16 @@ static void r5l_log_endio(struct bio *bio)
        spin_lock_irqsave(&log->io_list_lock, flags);
        __r5l_set_io_unit_state(io, IO_UNIT_IO_END);
+        /*
+         * if the io doesn't not have null_flush or flush payload,
+         * it is not safe to access it after releasing io_list_lock.
+         * Therefore, it is necessary to check the condition with
+         * the lock held.
+         */
+        has_null_flush = io->has_null_flush;
+        has_flush_payload = io->has_flush_payload;
        if (log->need_cache_flush && !list_empty(&io->stripe_list))
                r5l_move_to_end_ios(log);
        else
@@ -600,19 +613,23 @@ static void r5l_log_endio(struct bio *bio)
        if (log->need_cache_flush)
                md_wakeup_thread(log->rdev->mddev->thread);
-        if (io->has_null_flush) {
+        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_null_flush) {
                struct bio *bi;
                WARN_ON(bio_list_empty(&io->flush_barriers));
                while ((bi = bio_list_pop(&io->flush_barriers)) != NULL) {
                        bio_endio(bi);
-                        atomic_dec(&io->pending_stripe);
+                        if (atomic_dec_and_test(&io->pending_stripe)) {
+                                __r5l_stripe_write_finished(io);
+                                return;
+                        }
                }
        }
+        /* decrease pending_stripe for flush payload */
-        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_flush_payload)
-        if (atomic_read(&io->pending_stripe) == 0)
+                if (atomic_dec_and_test(&io->pending_stripe))
-                __r5l_stripe_write_finished(io);
+                        __r5l_stripe_write_finished(io);
 }
 static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
@@ -881,6 +898,11 @@ static void r5l_append_flush_payload(struct r5l_log *log, sector_t sect)
        payload->size = cpu_to_le32(sizeof(__le64));
        payload->flush_stripes[0] = cpu_to_le64(sect);
        io->meta_offset += meta_size;
+        /* multiple flush payloads count as one pending_stripe */
+        if (!io->has_flush_payload) {
+                io->has_flush_payload = 1;
+                atomic_inc(&io->pending_stripe);
+        }
        mutex_unlock(&log->io_mutex);
 }
@@ -2540,23 +2562,32 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
 */
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
-        struct r5conf *conf = mddev->private;
+        struct r5conf *conf;
-        struct r5l_log *log = conf->log;
+        int err;
-        if (!log)
-                return -ENODEV;
        if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
            mode > R5C_JOURNAL_MODE_WRITE_BACK)
                return -EINVAL;
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+        conf = mddev->private;
+        if (!conf || !conf->log) {
+                mddev_unlock(mddev);
+                return -ENODEV;
+        }
        if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK)
+            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+                mddev_unlock(mddev);
                return -EINVAL;
+        }
        mddev_suspend(mddev);
        conf->log->r5c_journal_mode = mode;
        mddev_resume(mddev);
+        mddev_unlock(mddev);
        pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                 mdname(mddev), mode, r5c_journal_mode_str[mode]);
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 8621a198a2ce..bac33311f55a 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -216,6 +216,12 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, dev);
        /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+        /*
        * For not wake-able HW runtime pm framework
        * can't be used on pci device level.
        * Use domain runtime pm callbacks instead.
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index f811cd524468..e38a5f144373 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -138,6 +138,12 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        pci_set_drvdata(pdev, dev);
        /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+        /*
        * For not wake-able HW runtime pm framework
        * can't be used on pci device level.
        * Use domain runtime pm callbacks instead.
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index e5938c791330..f1bbfd389367 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2170,7 +2170,9 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)
                 * from being accepted.
                 */
                card = md->queue.card;
+                spin_lock_irq(md->queue.queue->queue_lock);
                queue_flag_set(QUEUE_FLAG_BYPASS, md->queue.queue);
+                spin_unlock_irq(md->queue.queue->queue_lock);
                blk_set_queue_dying(md->queue.queue);
                mmc_cleanup_queue(&md->queue);
                if (md->disk->flags & GENHD_FL_UP) {
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 4ffea14b7eb6..2bae69e39544 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1289,7 +1289,7 @@ out_err:
 static int mmc_select_hs400es(struct mmc_card *card)
 {
        struct mmc_host *host = card->host;
-        int err = 0;
+        int err = -EINVAL;
        u8 val;
        if (!(host->caps & MMC_CAP_8_BIT_DATA)) {
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 04ff3c97a535..2ab4788d021f 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2086,7 +2086,7 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
        mmc->max_seg_size = mmc->max_req_size;
        mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
-                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE;
+                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
        mmc->caps |= mmc_pdata(host)->caps;
        if (mmc->caps & MMC_CAP_8_BIT_DATA)
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index f336a9b85576..9ec8f033ac5f 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -113,6 +113,7 @@ static blk_status_t do_blktrans_request(struct mtd_blktrans_ops *tr,
                for (; nsect > 0; nsect--, block++, buf += tr->blksize)
                        if (tr->writesect(dev, block, buf))
                                return BLK_STS_IOERR;
+                return BLK_STS_OK;
        default:
                return BLK_STS_IOERR;
        }
diff --git a/drivers/mtd/nand/atmel/nand-controller.c b/drivers/mtd/nand/atmel/nand-controller.c
index d922a88e407f..2c8baa0c2c4e 100644
--- a/drivers/mtd/nand/atmel/nand-controller.c
+++ b/drivers/mtd/nand/atmel/nand-controller.c
@@ -1201,7 +1201,7 @@ static int atmel_smc_nand_prepare_smcconf(struct atmel_nand *nand,
         * tRC < 30ns implies EDO mode. This controller does not support this
         * mode.
         */
-        if (conf->timings.sdr.tRC_min < 30)
+        if (conf->timings.sdr.tRC_min < 30000)
                return -ENOTSUPP;
        atmel_smc_cs_conf_init(smcconf);
diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
index 55a8ee5306ea..8c210a5776bc 100644
--- a/drivers/mtd/nand/atmel/pmecc.c
+++ b/drivers/mtd/nand/atmel/pmecc.c
@@ -945,6 +945,7 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *userdev)
                 */
                struct platform_device *pdev = to_platform_device(userdev);
                const struct atmel_pmecc_caps *caps;
+                const struct of_device_id *match;
                /* No PMECC engine available. */
                if (!of_property_read_bool(userdev->of_node,
@@ -953,21 +954,11 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *userdev)
                caps = &at91sam9g45_caps;
-                /*
+                /* Find the caps associated to the NAND dev node. */
-                 * Try to find the NFC subnode and extract the associated caps
+                match = of_match_node(atmel_pmecc_legacy_match,
-                 * from there.
+                                      userdev->of_node);
-                 */
+                if (match && match->data)
-                np = of_find_compatible_node(userdev->of_node, NULL,
+                        caps = match->data;
-                                             "atmel,sama5d3-nfc");
-                if (np) {
-                        const struct of_device_id *match;
-                        match = of_match_node(atmel_pmecc_legacy_match, np);
-                        if (match && match->data)
-                                caps = match->data;
-                        of_node_put(np);
-                }
                pmecc = atmel_pmecc_create(pdev, caps, 1, 2);
        }
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 5fa5ddc94834..c6c18b82f8f4 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -65,8 +65,14 @@ static int nand_ooblayout_ecc_sp(struct mtd_info *mtd, int section,
        if (!section) {
                oobregion->offset = 0;
-                oobregion->length = 4;
+                if (mtd->oobsize == 16)
+                        oobregion->length = 4;
+                else
+                        oobregion->length = 3;
        } else {
+                if (mtd->oobsize == 8)
+                        return -ERANGE;
                oobregion->offset = 6;
                oobregion->length = ecc->total - 4;
        }
@@ -1125,7 +1131,9 @@ static int nand_setup_data_interface(struct nand_chip *chip, int chipnr)
         * Ensure the timing mode has been changed on the chip side
         * before changing timings on the controller side.
         */
-        if (chip->onfi_version) {
+        if (chip->onfi_version &&
+            (le16_to_cpu(chip->onfi_params.opt_cmd) &
+             ONFI_OPT_CMD_SET_GET_FEATURES)) {
                u8 tmode_param[ONFI_SUBFEATURE_PARAM_LEN] = {
                        chip->onfi_timing_mode_default,
                };
@@ -2741,7 +2749,6 @@ static int nand_write_page_syndrome(struct mtd_info *mtd,
 * @buf: the data to write
 * @oob_required: must write chip->oob_poi to OOB
 * @page: page number to write
- * @cached: cached programming
 * @raw: use _raw version of write_page
 */
 static int nand_write_page(struct mtd_info *mtd, struct nand_chip *chip,
diff --git a/drivers/mtd/nand/nand_timings.c b/drivers/mtd/nand/nand_timings.c
index f06312df3669..7e36d7d13c26 100644
--- a/drivers/mtd/nand/nand_timings.c
+++ b/drivers/mtd/nand/nand_timings.c
@@ -311,9 +311,9 @@ int onfi_init_data_interface(struct nand_chip *chip,
                struct nand_sdr_timings *timings = &iface->timings.sdr;
                /* microseconds -> picoseconds */
-                timings->tPROG_max = 1000000UL * le16_to_cpu(params->t_prog);
+                timings->tPROG_max = 1000000ULL * le16_to_cpu(params->t_prog);
-                timings->tBERS_max = 1000000UL * le16_to_cpu(params->t_bers);
+                timings->tBERS_max = 1000000ULL * le16_to_cpu(params->t_bers);
-                timings->tR_max = 1000000UL * le16_to_cpu(params->t_r);
+                timings->tR_max = 1000000ULL * le16_to_cpu(params->t_r);
                /* nanoseconds -> picoseconds */
                timings->tCCS_min = 1000UL * le16_to_cpu(params->t_ccs);
diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
index d0b6f8f9f297..6abd142b1324 100644
--- a/drivers/mtd/nand/sunxi_nand.c
+++ b/drivers/mtd/nand/sunxi_nand.c
@@ -1728,6 +1728,10 @@ static int sunxi_nfc_setup_data_interface(struct mtd_info *mtd, int csline,
         */
        chip->clk_rate = NSEC_PER_SEC / min_clk_period;
        real_clk_rate = clk_round_rate(nfc->mod_clk, chip->clk_rate);
+        if (real_clk_rate <= 0) {
+                dev_err(nfc->dev, "Unable to round clk %lu\n", chip->clk_rate);
+                return -EINVAL;
+        }
        /*
         * ONFI specification 3.1, paragraph 4.15.2 dictates that EDO data
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9bee6c1c70cc..fc63992ab0e0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1569,7 +1569,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        new_slave->delay = 0;
        new_slave->link_failure_count = 0;
-        if (bond_update_speed_duplex(new_slave))
+        if (bond_update_speed_duplex(new_slave) &&
+            bond_needs_speed_duplex(bond))
                new_slave->link = BOND_LINK_DOWN;
        new_slave->last_rx = jiffies -
@@ -2140,11 +2141,13 @@ static void bond_miimon_commit(struct bonding *bond)
                        continue;
                case BOND_LINK_UP:
-                        if (bond_update_speed_duplex(slave)) {
+                        if (bond_update_speed_duplex(slave) &&
+                            bond_needs_speed_duplex(bond)) {
                                slave->link = BOND_LINK_DOWN;
-                                netdev_warn(bond->dev,
+                                if (net_ratelimit())
-                                            "failed to get link speed/duplex for %s\n",
+                                        netdev_warn(bond->dev,
-                                            slave->dev->name);
+                                                    "failed to get link speed/duplex for %s\n",
+                                                    slave->dev->name);
                                continue;
                        }
                        bond_set_slave_link_state(slave, BOND_LINK_UP,
diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 1e46418a3b74..264b281eb86b 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -625,6 +625,44 @@ static void mt7530_adjust_link(struct dsa_switch *ds, int port,
                 * all finished.
                 */
                mt7623_pad_clk_setup(ds);
+        } else {
+                u16 lcl_adv = 0, rmt_adv = 0;
+                u8 flowctrl;
+                u32 mcr = PMCR_USERP_LINK | PMCR_FORCE_MODE;
+                switch (phydev->speed) {
+                case SPEED_1000:
+                        mcr |= PMCR_FORCE_SPEED_1000;
+                        break;
+                case SPEED_100:
+                        mcr |= PMCR_FORCE_SPEED_100;
+                        break;
+                };
+                if (phydev->link)
+                        mcr |= PMCR_FORCE_LNK;
+                if (phydev->duplex) {
+                        mcr |= PMCR_FORCE_FDX;
+                        if (phydev->pause)
+                                rmt_adv = LPA_PAUSE_CAP;
+                        if (phydev->asym_pause)
+                                rmt_adv |= LPA_PAUSE_ASYM;
+                        if (phydev->advertising & ADVERTISED_Pause)
+                                lcl_adv |= ADVERTISE_PAUSE_CAP;
+                        if (phydev->advertising & ADVERTISED_Asym_Pause)
+                                lcl_adv |= ADVERTISE_PAUSE_ASYM;
+                        flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
+                        if (flowctrl & FLOW_CTRL_TX)
+                                mcr |= PMCR_TX_FC_EN;
+                        if (flowctrl & FLOW_CTRL_RX)
+                                mcr |= PMCR_RX_FC_EN;
+                }
+                mt7530_write(priv, MT7530_PMCR_P(port), mcr);
        }
 }
diff --git a/drivers/net/dsa/mt7530.h b/drivers/net/dsa/mt7530.h
index b83d76b99802..74db9822eb40 100644
--- a/drivers/net/dsa/mt7530.h
+++ b/drivers/net/dsa/mt7530.h
@@ -151,6 +151,7 @@ enum mt7530_stp_state {
 #define  PMCR_TX_FC_EN                  BIT(5)
 #define  PMCR_RX_FC_EN                  BIT(4)
 #define  PMCR_FORCE_SPEED_1000          BIT(3)
+#define  PMCR_FORCE_SPEED_100           BIT(2)
 #define  PMCR_FORCE_FDX                 BIT(1)
 #define  PMCR_FORCE_LNK                 BIT(0)
 #define  PMCR_COMMON_LINK               (PMCR_IFG_XMIT(1) | PMCR_MAC_MODE | \
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 86058a9f3417..1d307f2def2d 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1785,9 +1785,9 @@ static int xgene_enet_get_resources(struct xgene_enet_pdata *pdata)
        xgene_enet_gpiod_get(pdata);
-        if (pdata->phy_mode != PHY_INTERFACE_MODE_SGMII) {
+        pdata->clk = devm_clk_get(&pdev->dev, NULL);
-                pdata->clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(pdata->clk)) {
-                if (IS_ERR(pdata->clk)) {
+                if (pdata->phy_mode != PHY_INTERFACE_MODE_SGMII) {
                        /* Abort if the clock is defined but couldn't be
                         * retrived. Always abort if the clock is missing on
                         * DT system as the driver can't cope with this case.
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index f411936b744c..a1125d10c825 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2368,6 +2368,7 @@ static int b44_init_one(struct ssb_device *sdev,
        bp->msg_enable = netif_msg_init(b44_debug, B44_DEF_MSG_ENABLE);
        spin_lock_init(&bp->lock);
+        u64_stats_init(&bp->hw_stats.syncp);
        bp->rx_pending = B44_DEF_RX_RING_PENDING;
        bp->tx_pending = B44_DEF_TX_RING_PENDING;
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 5333601f855f..dc3052751bc1 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -449,6 +449,10 @@ static void bcm_sysport_get_stats(struct net_device *dev,
                        p = (char *)&dev->stats;
                else
                        p = (char *)priv;
+                if (priv->is_lite && !bcm_sysport_lite_stat_valid(s->type))
+                        continue;
                p += s->stat_offset;
                data[j] = *(unsigned long *)p;
                j++;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ef4be781fd05..09ea62ee96d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -529,6 +529,7 @@ enum {                                 /* adapter flags */
        USING_SOFT_PARAMS  = (1 << 6),
        MASTER_PF          = (1 << 7),
        FW_OFLD_CONN       = (1 << 9),
+        ROOT_NO_RELAXED_ORDERING = (1 << 10),
 };
 enum {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e403fa18f1b1..33bb8678833a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4654,11 +4654,6 @@ static void print_port_info(const struct net_device *dev)
                    dev->name, adap->params.vpd.id, adap->name, buf);
 }
-static void enable_pcie_relaxed_ordering(struct pci_dev *dev)
-{
-        pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
-}
 /*
 * Free the following resources:
 * - memory used for tables
@@ -4908,7 +4903,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        pci_enable_pcie_error_reporting(pdev);
-        enable_pcie_relaxed_ordering(pdev);
        pci_set_master(pdev);
        pci_save_state(pdev);
@@ -4947,6 +4941,23 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        adapter->msg_enable = DFLT_MSG_ENABLE;
        memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
        spin_lock_init(&adapter->stats_lock);
        spin_lock_init(&adapter->tid_release_lock);
        spin_lock_init(&adapter->win0_lock);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ede12209f20b..4ef68f69b58c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2719,6 +2719,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
        struct fw_iq_cmd c;
        struct sge *s = &adap->sge;
        struct port_info *pi = netdev_priv(dev);
+        int relaxed = !(adap->flags & ROOT_NO_RELAXED_ORDERING);
        /* Size needs to be multiple of 16, including status entry. */
        iq->size = roundup(iq->size, 16);
@@ -2772,8 +2773,8 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
                flsz = fl->size / 8 + s->stat_len / sizeof(struct tx_desc);
                c.iqns_to_fl0congen |= htonl(FW_IQ_CMD_FL0PACKEN_F |
-                                             FW_IQ_CMD_FL0FETCHRO_F |
+                                             FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
-                                             FW_IQ_CMD_FL0DATARO_F |
+                                             FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                             FW_IQ_CMD_FL0PADEN_F);
                if (cong >= 0)
                        c.iqns_to_fl0congen |=
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 109bc630408b..08c6ddb84a04 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -408,6 +408,7 @@ enum { /* adapter flags */
        USING_MSI          = (1UL << 1),
        USING_MSIX         = (1UL << 2),
        QUEUES_BOUND       = (1UL << 3),
+        ROOT_NO_RELAXED_ORDERING = (1UL << 4),
 };
 /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index ac7a150c54e9..2b85b874fd0d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2888,6 +2888,24 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
         */
        adapter->name = pci_name(pdev);
        adapter->msg_enable = DFLT_MSG_ENABLE;
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
        err = adap_init0(adapter);
        if (err)
                goto err_unmap_bar;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index e37dde2ba97f..05498e7f2840 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -2205,6 +2205,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
        struct port_info *pi = netdev_priv(dev);
        struct fw_iq_cmd cmd, rpl;
        int ret, iqandst, flsz = 0;
+        int relaxed = !(adapter->flags & ROOT_NO_RELAXED_ORDERING);
        /*
         * If we're using MSI interrupts and we're not initializing the
@@ -2300,6 +2301,8 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                        cpu_to_be32(
                                FW_IQ_CMD_FL0HOSTFCMODE_V(SGE_HOSTFCMODE_NONE) |
                                FW_IQ_CMD_FL0PACKEN_F |
+                                FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                FW_IQ_CMD_FL0PADEN_F);
                /* In T6, for egress queue type FL there is internal overhead
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index a3e694679635..c45e8e3b82d3 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -111,6 +111,7 @@ static void send_request_map(struct ibmvnic_adapter *, dma_addr_t, __be32, u8);
 static void send_request_unmap(struct ibmvnic_adapter *, u8);
 static void send_login(struct ibmvnic_adapter *adapter);
 static void send_cap_queries(struct ibmvnic_adapter *adapter);
+static int init_sub_crqs(struct ibmvnic_adapter *);
 static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter);
 static int ibmvnic_init(struct ibmvnic_adapter *);
 static void release_crq_queue(struct ibmvnic_adapter *);
@@ -651,6 +652,7 @@ static int ibmvnic_login(struct net_device *netdev)
        struct ibmvnic_adapter *adapter = netdev_priv(netdev);
        unsigned long timeout = msecs_to_jiffies(30000);
        struct device *dev = &adapter->vdev->dev;
+        int rc;
        do {
                if (adapter->renegotiate) {
@@ -664,6 +666,18 @@ static int ibmvnic_login(struct net_device *netdev)
                                dev_err(dev, "Capabilities query timeout\n");
                                return -1;
                        }
+                        rc = init_sub_crqs(adapter);
+                        if (rc) {
+                                dev_err(dev,
+                                        "Initialization of SCRQ's failed\n");
+                                return -1;
+                        }
+                        rc = init_sub_crq_irqs(adapter);
+                        if (rc) {
+                                dev_err(dev,
+                                        "Initialization of SCRQ's irqs failed\n");
+                                return -1;
+                        }
                }
                reinit_completion(&adapter->init_done);
@@ -3004,7 +3018,6 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
                         *req_value,
                         (long int)be64_to_cpu(crq->request_capability_rsp.
                                               number), name);
-                release_sub_crqs(adapter);
                *req_value = be64_to_cpu(crq->request_capability_rsp.number);
                ibmvnic_send_req_caps(adapter, 1);
                return;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index b936febc315a..2194960d5855 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1113,6 +1113,8 @@ int i40e_setup_tx_descriptors(struct i40e_ring *tx_ring)
        if (!tx_ring->tx_bi)
                goto err;
+        u64_stats_init(&tx_ring->syncp);
        /* round up to nearest 4K */
        tx_ring->size = tx_ring->count * sizeof(struct i40e_tx_desc);
        /* add u32 for head writeback, align after this takes care of
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 084c53582793..032f8ac06357 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -2988,6 +2988,8 @@ int ixgbevf_setup_tx_resources(struct ixgbevf_ring *tx_ring)
        if (!tx_ring->tx_buffer_info)
                goto err;
+        u64_stats_init(&tx_ring->syncp);
        /* round up to nearest 4K */
        tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
        tx_ring->size = ALIGN(tx_ring->size, 4096);
@@ -3046,6 +3048,8 @@ int ixgbevf_setup_rx_resources(struct ixgbevf_ring *rx_ring)
        if (!rx_ring->rx_buffer_info)
                goto err;
+        u64_stats_init(&rx_ring->syncp);
        /* Round up to nearest 4K */
        rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
        rx_ring->size = ALIGN(rx_ring->size, 4096);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index c751a1d434ad..3d4e4a5d00d1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -223,6 +223,7 @@ static void mlx4_en_get_wol(struct net_device *netdev,
                            struct ethtool_wolinfo *wol)
 {
        struct mlx4_en_priv *priv = netdev_priv(netdev);
+        struct mlx4_caps *caps = &priv->mdev->dev->caps;
        int err = 0;
        u64 config = 0;
        u64 mask;
@@ -235,24 +236,24 @@ static void mlx4_en_get_wol(struct net_device *netdev,
        mask = (priv->port == 1) ? MLX4_DEV_CAP_FLAG_WOL_PORT1 :
                MLX4_DEV_CAP_FLAG_WOL_PORT2;
-        if (!(priv->mdev->dev->caps.flags & mask)) {
+        if (!(caps->flags & mask)) {
                wol->supported = 0;
                wol->wolopts = 0;
                return;
        }
+        if (caps->wol_port[priv->port])
+                wol->supported = WAKE_MAGIC;
+        else
+                wol->supported = 0;
        err = mlx4_wol_read(priv->mdev->dev, &config, priv->port);
        if (err) {
                en_err(priv, "Failed to get WoL information\n");
                return;
        }
-        if (config & MLX4_EN_WOL_MAGIC)
+        if ((config & MLX4_EN_WOL_ENABLED) && (config & MLX4_EN_WOL_MAGIC))
-                wol->supported = WAKE_MAGIC;
-        else
-                wol->supported = 0;
-        if (config & MLX4_EN_WOL_ENABLED)
                wol->wolopts = WAKE_MAGIC;
        else
                wol->wolopts = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 436f7689a032..bf1638044a7a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -574,16 +574,21 @@ static inline __wsum get_fixed_vlan_csum(__wsum hw_checksum,
 * header, the HW adds it. To address that, we are subtracting the pseudo
 * header checksum from the checksum value provided by the HW.
 */
-static void get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
+static int get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
-                                struct iphdr *iph)
+                               struct iphdr *iph)
 {
        __u16 length_for_csum = 0;
        __wsum csum_pseudo_header = 0;
+        __u8 ipproto = iph->protocol;
+        if (unlikely(ipproto == IPPROTO_SCTP))
+                return -1;
        length_for_csum = (be16_to_cpu(iph->tot_len) - (iph->ihl << 2));
        csum_pseudo_header = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                                length_for_csum, iph->protocol, 0);
+                                                length_for_csum, ipproto, 0);
        skb->csum = csum_sub(hw_checksum, csum_pseudo_header);
+        return 0;
 }
 #if IS_ENABLED(CONFIG_IPV6)
@@ -594,17 +599,20 @@ static void get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
 static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
                               struct ipv6hdr *ipv6h)
 {
+        __u8 nexthdr = ipv6h->nexthdr;
        __wsum csum_pseudo_hdr = 0;
-        if (unlikely(ipv6h->nexthdr == IPPROTO_FRAGMENT ||
+        if (unlikely(nexthdr == IPPROTO_FRAGMENT ||
-                     ipv6h->nexthdr == IPPROTO_HOPOPTS))
+                     nexthdr == IPPROTO_HOPOPTS ||
+                     nexthdr == IPPROTO_SCTP))
                return -1;
-        hw_checksum = csum_add(hw_checksum, (__force __wsum)htons(ipv6h->nexthdr));
+        hw_checksum = csum_add(hw_checksum, (__force __wsum)htons(nexthdr));
        csum_pseudo_hdr = csum_partial(&ipv6h->saddr,
                                       sizeof(ipv6h->saddr) + sizeof(ipv6h->daddr), 0);
        csum_pseudo_hdr = csum_add(csum_pseudo_hdr, (__force __wsum)ipv6h->payload_len);
-        csum_pseudo_hdr = csum_add(csum_pseudo_hdr, (__force __wsum)ntohs(ipv6h->nexthdr));
+        csum_pseudo_hdr = csum_add(csum_pseudo_hdr,
+                                   (__force __wsum)htons(nexthdr));
        skb->csum = csum_sub(hw_checksum, csum_pseudo_hdr);
        skb->csum = csum_add(skb->csum, csum_partial(ipv6h, sizeof(struct ipv6hdr), 0));
@@ -627,11 +635,10 @@ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va,
        }
        if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPV4))
-                get_fixed_ipv4_csum(hw_checksum, skb, hdr);
+                return get_fixed_ipv4_csum(hw_checksum, skb, hdr);
 #if IS_ENABLED(CONFIG_IPV6)
-        else if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPV6))
+        if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPV6))
-                if (unlikely(get_fixed_ipv6_csum(hw_checksum, skb, hdr)))
+                return get_fixed_ipv6_csum(hw_checksum, skb, hdr);
-                        return -1;
 #endif
        return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 37e84a59e751..041c0ed65929 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -159,8 +159,9 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                [32] = "Loopback source checks support",
                [33] = "RoCEv2 support",
                [34] = "DMFS Sniffer support (UC & MC)",
-                [35] = "QinQ VST mode support",
+                [35] = "Diag counters per port",
-                [36] = "sl to vl mapping table change event support"
+                [36] = "QinQ VST mode support",
+                [37] = "sl to vl mapping table change event support",
        };
        int i;
@@ -764,6 +765,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 #define QUERY_DEV_CAP_CQ_TS_SUPPORT_OFFSET      0x3e
 #define QUERY_DEV_CAP_MAX_PKEY_OFFSET           0x3f
 #define QUERY_DEV_CAP_EXT_FLAGS_OFFSET          0x40
+#define QUERY_DEV_CAP_WOL_OFFSET                0x43
 #define QUERY_DEV_CAP_FLAGS_OFFSET              0x44
 #define QUERY_DEV_CAP_RSVD_UAR_OFFSET           0x48
 #define QUERY_DEV_CAP_UAR_SZ_OFFSET             0x49
@@ -920,6 +922,9 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
        MLX4_GET(ext_flags, outbox, QUERY_DEV_CAP_EXT_FLAGS_OFFSET);
        MLX4_GET(flags, outbox, QUERY_DEV_CAP_FLAGS_OFFSET);
        dev_cap->flags = flags | (u64)ext_flags << 32;
+        MLX4_GET(field, outbox, QUERY_DEV_CAP_WOL_OFFSET);
+        dev_cap->wol_port[1] = !!(field & 0x20);
+        dev_cap->wol_port[2] = !!(field & 0x40);
        MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_UAR_OFFSET);
        dev_cap->reserved_uars = field >> 4;
        MLX4_GET(field, outbox, QUERY_DEV_CAP_UAR_SZ_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.h b/drivers/net/ethernet/mellanox/mlx4/fw.h
index 5343a0599253..b52ba01aa486 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -129,6 +129,7 @@ struct mlx4_dev_cap {
        u32 dmfs_high_rate_qpn_range;
        struct mlx4_rate_limit_caps rl_caps;
        struct mlx4_port_cap port_cap[MLX4_MAX_PORTS + 1];
+        bool wol_port[MLX4_MAX_PORTS + 1];
 };
 struct mlx4_func_cap {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index a27c9c13a36e..09b9bc17bce9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -424,6 +424,8 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
        dev->caps.stat_rate_support  = dev_cap->stat_rate_support;
        dev->caps.max_gso_sz         = dev_cap->max_gso_sz;
        dev->caps.max_rss_tbl_sz     = dev_cap->max_rss_tbl_sz;
+        dev->caps.wol_port[1]          = dev_cap->wol_port[1];
+        dev->caps.wol_port[2]          = dev_cap->wol_port[2];
        /* Save uar page shift */
        if (!mlx4_is_slave(dev)) {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 656b2d3f1bee..5eb1606765c5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -626,8 +626,8 @@ static int mlxsw_sp_port_attr_br_flags_set(struct mlxsw_sp_port *mlxsw_sp_port,
        bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp_port->mlxsw_sp->bridge,
                                                orig_dev);
-        if (WARN_ON(!bridge_port))
+        if (!bridge_port)
-                return -EINVAL;
+                return 0;
        err = mlxsw_sp_bridge_port_flood_table_set(mlxsw_sp_port, bridge_port,
                                                   MLXSW_SP_FLOOD_TYPE_UC,
@@ -711,8 +711,8 @@ static int mlxsw_sp_port_attr_mc_router_set(struct mlxsw_sp_port *mlxsw_sp_port,
        bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp_port->mlxsw_sp->bridge,
                                                orig_dev);
-        if (WARN_ON(!bridge_port))
+        if (!bridge_port)
-                return -EINVAL;
+                return 0;
        if (!bridge_port->bridge_device->multicast_enabled)
                return 0;
@@ -1283,15 +1283,15 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
                return 0;
        bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
-        if (WARN_ON(!bridge_port))
+        if (!bridge_port)
-                return -EINVAL;
+                return 0;
        bridge_device = bridge_port->bridge_device;
        mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_bridge(mlxsw_sp_port,
                                                               bridge_device,
                                                               mdb->vid);
-        if (WARN_ON(!mlxsw_sp_port_vlan))
+        if (!mlxsw_sp_port_vlan)
-                return -EINVAL;
+                return 0;
        fid_index = mlxsw_sp_fid_index(mlxsw_sp_port_vlan->fid);
@@ -1407,15 +1407,15 @@ static int mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
        int err = 0;
        bridge_port = mlxsw_sp_bridge_port_find(mlxsw_sp->bridge, orig_dev);
-        if (WARN_ON(!bridge_port))
+        if (!bridge_port)
-                return -EINVAL;
+                return 0;
        bridge_device = bridge_port->bridge_device;
        mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_bridge(mlxsw_sp_port,
                                                               bridge_device,
                                                               mdb->vid);
-        if (WARN_ON(!mlxsw_sp_port_vlan))
+        if (!mlxsw_sp_port_vlan)
-                return -EINVAL;
+                return 0;
        fid_index = mlxsw_sp_fid_index(mlxsw_sp_port_vlan->fid);
@@ -1974,6 +1974,17 @@ static void mlxsw_sp_fdb_fini(struct mlxsw_sp *mlxsw_sp)
 }
+static void mlxsw_sp_mids_fini(struct mlxsw_sp *mlxsw_sp)
+{
+        struct mlxsw_sp_mid *mid, *tmp;
+        list_for_each_entry_safe(mid, tmp, &mlxsw_sp->bridge->mids_list, list) {
+                list_del(&mid->list);
+                clear_bit(mid->mid, mlxsw_sp->bridge->mids_bitmap);
+                kfree(mid);
+        }
+}
 int mlxsw_sp_switchdev_init(struct mlxsw_sp *mlxsw_sp)
 {
        struct mlxsw_sp_bridge *bridge;
@@ -1996,7 +2007,7 @@ int mlxsw_sp_switchdev_init(struct mlxsw_sp *mlxsw_sp)
 void mlxsw_sp_switchdev_fini(struct mlxsw_sp *mlxsw_sp)
 {
        mlxsw_sp_fdb_fini(mlxsw_sp);
-        WARN_ON(!list_empty(&mlxsw_sp->bridge->mids_list));
+        mlxsw_sp_mids_fini(mlxsw_sp);
        WARN_ON(!list_empty(&mlxsw_sp->bridge->bridges_list));
        kfree(mlxsw_sp->bridge);
 }
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index dd7fa9cf225f..b0837b58c3a1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -115,14 +115,10 @@ nfp_flower_cmsg_portmod_rx(struct nfp_app *app, struct sk_buff *skb)
                return;
        }
-        if (link) {
+        if (link)
                netif_carrier_on(netdev);
-                rtnl_lock();
+        else
-                dev_set_mtu(netdev, be16_to_cpu(msg->mtu));
-                rtnl_unlock();
-        } else {
                netif_carrier_off(netdev);
-        }
        rcu_read_unlock();
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 18750ff0ede6..4631ca8b8eb2 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -513,6 +513,7 @@ nfp_net_tx_ring_init(struct nfp_net_tx_ring *tx_ring,
        tx_ring->idx = idx;
        tx_ring->r_vec = r_vec;
        tx_ring->is_xdp = is_xdp;
+        u64_stats_init(&tx_ring->r_vec->tx_sync);
        tx_ring->qcidx = tx_ring->idx * nn->stride_tx;
        tx_ring->qcp_q = nn->tx_bar + NFP_QCP_QUEUE_OFF(tx_ring->qcidx);
@@ -532,6 +533,7 @@ nfp_net_rx_ring_init(struct nfp_net_rx_ring *rx_ring,
        rx_ring->idx = idx;
        rx_ring->r_vec = r_vec;
+        u64_stats_init(&rx_ring->r_vec->rx_sync);
        rx_ring->fl_qcidx = rx_ring->idx * nn->stride_rx;
        rx_ring->qcp_fl = nn->rx_bar + NFP_QCP_QUEUE_OFF(rx_ring->fl_qcidx);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 9da91045d167..3eb241657368 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -253,7 +253,7 @@ int qed_mcp_cmd_init(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
        size = MFW_DRV_MSG_MAX_DWORDS(p_info->mfw_mb_length) * sizeof(u32);
        p_info->mfw_mb_cur = kzalloc(size, GFP_KERNEL);
        p_info->mfw_mb_shadow = kzalloc(size, GFP_KERNEL);
-        if (!p_info->mfw_mb_shadow || !p_info->mfw_mb_addr)
+        if (!p_info->mfw_mb_cur || !p_info->mfw_mb_shadow)
                goto err;
        return 0;
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index c905971c5f3a..990a63d7fcb7 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -938,7 +938,6 @@ enum efx_stats_action {
 static int efx_mcdi_mac_stats(struct efx_nic *efx,
                              enum efx_stats_action action, int clear)
 {
-        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        MCDI_DECLARE_BUF(inbuf, MC_CMD_MAC_STATS_IN_LEN);
        int rc;
        int change = action == EFX_STATS_PULL ? 0 : 1;
@@ -960,7 +959,12 @@ static int efx_mcdi_mac_stats(struct efx_nic *efx,
                              MAC_STATS_IN_PERIODIC_NOEVENT, 1,
                              MAC_STATS_IN_PERIOD_MS, period);
        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
-        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
+                struct efx_ef10_nic_data *nic_data = efx->nic_data;
+                MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        }
        rc = efx_mcdi_rpc_quiet(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
                                NULL, 0, NULL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index db157a47000c..72ec711fcba2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -204,6 +204,7 @@ int stmmac_mdio_register(struct net_device *ndev)
        struct stmmac_priv *priv = netdev_priv(ndev);
        struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
        struct device_node *mdio_node = priv->plat->mdio_node;
+        struct device *dev = ndev->dev.parent;
        int addr, found;
        if (!mdio_bus_data)
@@ -237,7 +238,7 @@ int stmmac_mdio_register(struct net_device *ndev)
        else
                err = mdiobus_register(new_bus);
        if (err != 0) {
-                netdev_err(ndev, "Cannot register the MDIO bus\n");
+                dev_err(dev, "Cannot register the MDIO bus\n");
                goto bus_register_fail;
        }
@@ -285,14 +286,12 @@ int stmmac_mdio_register(struct net_device *ndev)
                        irq_str = irq_num;
                        break;
                }
-                netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
+                phy_attached_info(phydev);
-                            phydev->phy_id, addr, irq_str, phydev_name(phydev),
-                            act ? " active" : "");
                found = 1;
        }
        if (!found && !mdio_node) {
-                netdev_warn(ndev, "No PHY found\n");
+                dev_warn(dev, "No PHY found\n");
                mdiobus_unregister(new_bus);
                mdiobus_free(new_bus);
                return -ENODEV;
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index 32279d21c836..c2121d214f08 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -31,9 +31,18 @@
 #include "cpts.h"
+#define CPTS_SKB_TX_WORK_TIMEOUT 1 /* jiffies */
+struct cpts_skb_cb_data {
+        unsigned long tmo;
+};
 #define cpts_read32(c, r)       readl_relaxed(&c->reg->r)
 #define cpts_write32(c, v, r)   writel_relaxed(v, &c->reg->r)
+static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
+                      u16 ts_seqid, u8 ts_msgtype);
 static int event_expired(struct cpts_event *event)
 {
        return time_after(jiffies, event->tmo);
@@ -77,6 +86,47 @@ static int cpts_purge_events(struct cpts *cpts)
        return removed ? 0 : -1;
 }
+static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event)
+{
+        struct sk_buff *skb, *tmp;
+        u16 seqid;
+        u8 mtype;
+        bool found = false;
+        mtype = (event->high >> MESSAGE_TYPE_SHIFT) & MESSAGE_TYPE_MASK;
+        seqid = (event->high >> SEQUENCE_ID_SHIFT) & SEQUENCE_ID_MASK;
+        /* no need to grab txq.lock as access is always done under cpts->lock */
+        skb_queue_walk_safe(&cpts->txq, skb, tmp) {
+                struct skb_shared_hwtstamps ssh;
+                unsigned int class = ptp_classify_raw(skb);
+                struct cpts_skb_cb_data *skb_cb =
+                                        (struct cpts_skb_cb_data *)skb->cb;
+                if (cpts_match(skb, class, seqid, mtype)) {
+                        u64 ns = timecounter_cyc2time(&cpts->tc, event->low);
+                        memset(&ssh, 0, sizeof(ssh));
+                        ssh.hwtstamp = ns_to_ktime(ns);
+                        skb_tstamp_tx(skb, &ssh);
+                        found = true;
+                        __skb_unlink(skb, &cpts->txq);
+                        dev_consume_skb_any(skb);
+                        dev_dbg(cpts->dev, "match tx timestamp mtype %u seqid %04x\n",
+                                mtype, seqid);
+                } else if (time_after(jiffies, skb_cb->tmo)) {
+                        /* timeout any expired skbs over 1s */
+                        dev_dbg(cpts->dev,
+                                "expiring tx timestamp mtype %u seqid %04x\n",
+                                mtype, seqid);
+                        __skb_unlink(skb, &cpts->txq);
+                        dev_consume_skb_any(skb);
+                }
+        }
+        return found;
+}
 /*
 * Returns zero if matching event type was found.
 */
@@ -101,9 +151,15 @@ static int cpts_fifo_read(struct cpts *cpts, int match)
                event->low = lo;
                type = event_type(event);
                switch (type) {
+                case CPTS_EV_TX:
+                        if (cpts_match_tx_ts(cpts, event)) {
+                                /* if the new event matches an existing skb,
+                                 * then don't queue it
+                                 */
+                                break;
+                        }
                case CPTS_EV_PUSH:
                case CPTS_EV_RX:
-                case CPTS_EV_TX:
                        list_del_init(&event->list);
                        list_add_tail(&event->list, &cpts->events);
                        break;
@@ -224,6 +280,24 @@ static int cpts_ptp_enable(struct ptp_clock_info *ptp,
        return -EOPNOTSUPP;
 }
+static long cpts_overflow_check(struct ptp_clock_info *ptp)
+{
+        struct cpts *cpts = container_of(ptp, struct cpts, info);
+        unsigned long delay = cpts->ov_check_period;
+        struct timespec64 ts;
+        unsigned long flags;
+        spin_lock_irqsave(&cpts->lock, flags);
+        ts = ns_to_timespec64(timecounter_read(&cpts->tc));
+        if (!skb_queue_empty(&cpts->txq))
+                delay = CPTS_SKB_TX_WORK_TIMEOUT;
+        spin_unlock_irqrestore(&cpts->lock, flags);
+        pr_debug("cpts overflow check at %lld.%09lu\n", ts.tv_sec, ts.tv_nsec);
+        return (long)delay;
+}
 static struct ptp_clock_info cpts_info = {
        .owner          = THIS_MODULE,
        .name           = "CTPS timer",
@@ -236,18 +310,9 @@ static struct ptp_clock_info cpts_info = {
        .gettime64      = cpts_ptp_gettime,
        .settime64      = cpts_ptp_settime,
        .enable         = cpts_ptp_enable,
+        .do_aux_work    = cpts_overflow_check,
 };
-static void cpts_overflow_check(struct work_struct *work)
-{
-        struct timespec64 ts;
-        struct cpts *cpts = container_of(work, struct cpts, overflow_work.work);
-        cpts_ptp_gettime(&cpts->info, &ts);
-        pr_debug("cpts overflow check at %lld.%09lu\n", ts.tv_sec, ts.tv_nsec);
-        schedule_delayed_work(&cpts->overflow_work, cpts->ov_check_period);
-}
 static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
                      u16 ts_seqid, u8 ts_msgtype)
 {
@@ -299,7 +364,7 @@ static u64 cpts_find_ts(struct cpts *cpts, struct sk_buff *skb, int ev_type)
                return 0;
        spin_lock_irqsave(&cpts->lock, flags);
-        cpts_fifo_read(cpts, CPTS_EV_PUSH);
+        cpts_fifo_read(cpts, -1);
        list_for_each_safe(this, next, &cpts->events) {
                event = list_entry(this, struct cpts_event, list);
                if (event_expired(event)) {
@@ -317,6 +382,19 @@ static u64 cpts_find_ts(struct cpts *cpts, struct sk_buff *skb, int ev_type)
                        break;
                }
        }
+        if (ev_type == CPTS_EV_TX && !ns) {
+                struct cpts_skb_cb_data *skb_cb =
+                                (struct cpts_skb_cb_data *)skb->cb;
+                /* Not found, add frame to queue for processing later.
+                 * The periodic FIFO check will handle this.
+                 */
+                skb_get(skb);
+                /* get the timestamp for timeouts */
+                skb_cb->tmo = jiffies + msecs_to_jiffies(100);
+                __skb_queue_tail(&cpts->txq, skb);
+                ptp_schedule_worker(cpts->clock, 0);
+        }
        spin_unlock_irqrestore(&cpts->lock, flags);
        return ns;
@@ -358,6 +436,7 @@ int cpts_register(struct cpts *cpts)
 {
        int err, i;
+        skb_queue_head_init(&cpts->txq);
        INIT_LIST_HEAD(&cpts->events);
        INIT_LIST_HEAD(&cpts->pool);
        for (i = 0; i < CPTS_MAX_EVENTS; i++)
@@ -378,7 +457,7 @@ int cpts_register(struct cpts *cpts)
        }
        cpts->phc_index = ptp_clock_index(cpts->clock);
-        schedule_delayed_work(&cpts->overflow_work, cpts->ov_check_period);
+        ptp_schedule_worker(cpts->clock, cpts->ov_check_period);
        return 0;
 err_ptp:
@@ -392,14 +471,15 @@ void cpts_unregister(struct cpts *cpts)
        if (WARN_ON(!cpts->clock))
                return;
-        cancel_delayed_work_sync(&cpts->overflow_work);
        ptp_clock_unregister(cpts->clock);
        cpts->clock = NULL;
        cpts_write32(cpts, 0, int_enable);
        cpts_write32(cpts, 0, control);
+        /* Drop all packet */
+        skb_queue_purge(&cpts->txq);
        clk_disable(cpts->refclk);
 }
 EXPORT_SYMBOL_GPL(cpts_unregister);
@@ -476,7 +556,6 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
        cpts->dev = dev;
        cpts->reg = (struct cpsw_cpts __iomem *)regs;
        spin_lock_init(&cpts->lock);
-        INIT_DELAYED_WORK(&cpts->overflow_work, cpts_overflow_check);
        ret = cpts_of_parse(cpts, node);
        if (ret)
diff --git a/drivers/net/ethernet/ti/cpts.h b/drivers/net/ethernet/ti/cpts.h
index 01ea82ba9cdc..73d73faf0f38 100644
--- a/drivers/net/ethernet/ti/cpts.h
+++ b/drivers/net/ethernet/ti/cpts.h
@@ -119,13 +119,13 @@ struct cpts {
        u32 cc_mult; /* for the nominal frequency */
        struct cyclecounter cc;
        struct timecounter tc;
-        struct delayed_work overflow_work;
        int phc_index;
        struct clk *refclk;
        struct list_head events;
        struct list_head pool;
        struct cpts_event pool_data[CPTS_MAX_EVENTS];
        unsigned long ov_check_period;
+        struct sk_buff_head txq;
 };
 void cpts_rx_timestamp(struct cpts *cpts, struct sk_buff *skb);
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index de8156c6b292..2bbda71818ad 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1091,7 +1091,7 @@ static int geneve_validate(struct nlattr *tb[], struct nlattr *data[],
        if (data[IFLA_GENEVE_ID]) {
                __u32 vni =  nla_get_u32(data[IFLA_GENEVE_ID]);
-                if (vni >= GENEVE_VID_MASK)
+                if (vni >= GENEVE_N_VID)
                        return -ERANGE;
        }
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 1542e837fdfa..f38e32a7ec9c 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -364,7 +364,7 @@ static int gtp_dev_init(struct net_device *dev)
        gtp->dev = dev;
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
        if (!dev->tstats)
                return -ENOMEM;
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index d6c25580f8dd..12cc64bfcff8 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -765,7 +765,8 @@ struct netvsc_device {
        u32 max_chn;
        u32 num_chn;
-        refcount_t sc_offered;
+        atomic_t open_chn;
+        wait_queue_head_t subchan_open;
        struct rndis_device *extension;
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 0a9167dd72fb..d18c3326a1f7 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -78,6 +78,7 @@ static struct netvsc_device *alloc_net_device(void)
        net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
        net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
        init_completion(&net_device->channel_init_wait);
+        init_waitqueue_head(&net_device->subchan_open);
        return net_device;
 }
@@ -1302,6 +1303,8 @@ int netvsc_device_add(struct hv_device *device,
                struct netvsc_channel *nvchan = &net_device->chan_table[i];
                nvchan->channel = device->channel;
+                u64_stats_init(&nvchan->tx_stats.syncp);
+                u64_stats_init(&nvchan->rx_stats.syncp);
        }
        /* Enable NAPI handler before init callbacks */
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 85c00e1c52b6..d6308ffda53e 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1048,8 +1048,8 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
        else
                netif_napi_del(&nvchan->napi);
-        if (refcount_dec_and_test(&nvscdev->sc_offered))
+        atomic_inc(&nvscdev->open_chn);
-                complete(&nvscdev->channel_init_wait);
+        wake_up(&nvscdev->subchan_open);
 }
 int rndis_filter_device_add(struct hv_device *dev,
@@ -1090,8 +1090,6 @@ int rndis_filter_device_add(struct hv_device *dev,
        net_device->max_chn = 1;
        net_device->num_chn = 1;
-        refcount_set(&net_device->sc_offered, 0);
        net_device->extension = rndis_device;
        rndis_device->ndev = net;
@@ -1221,11 +1219,11 @@ int rndis_filter_device_add(struct hv_device *dev,
                rndis_device->ind_table[i] = ethtool_rxfh_indir_default(i,
                                                        net_device->num_chn);
+        atomic_set(&net_device->open_chn, 1);
        num_rss_qs = net_device->num_chn - 1;
        if (num_rss_qs == 0)
                return 0;
-        refcount_set(&net_device->sc_offered, num_rss_qs);
        vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open);
        init_packet = &net_device->channel_init_pkt;
@@ -1242,15 +1240,19 @@ int rndis_filter_device_add(struct hv_device *dev,
        if (ret)
                goto out;
+        wait_for_completion(&net_device->channel_init_wait);
        if (init_packet->msg.v5_msg.subchn_comp.status != NVSP_STAT_SUCCESS) {
                ret = -ENODEV;
                goto out;
        }
-        wait_for_completion(&net_device->channel_init_wait);
        net_device->num_chn = 1 +
                init_packet->msg.v5_msg.subchn_comp.num_subchannels;
+        /* wait for all sub channels to open */
+        wait_event(net_device->subchan_open,
+                   atomic_read(&net_device->open_chn) == net_device->num_chn);
        /* ignore failues from setting rss parameters, still have channels */
        rndis_filter_set_rss_param(rndis_device, netvsc_hash_key,
                                   net_device->num_chn);
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f37e3c1fd4e7..8dab74a81303 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -192,7 +192,7 @@ static int ipvlan_init(struct net_device *dev)
        netdev_lockdep_set_classes(dev);
-        ipvlan->pcpu_stats = alloc_percpu(struct ipvl_pcpu_stats);
+        ipvlan->pcpu_stats = netdev_alloc_pcpu_stats(struct ipvl_pcpu_stats);
        if (!ipvlan->pcpu_stats)
                return -ENOMEM;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index bd4303944e44..a404552555d4 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1915,21 +1915,23 @@ static void __ppp_channel_push(struct channel *pch)
        spin_unlock(&pch->downl);
        /* see if there is anything from the attached unit to be sent */
        if (skb_queue_empty(&pch->file.xq)) {
-                read_lock(&pch->upl);
                ppp = pch->ppp;
                if (ppp)
-                        ppp_xmit_process(ppp);
+                        __ppp_xmit_process(ppp);
-                read_unlock(&pch->upl);
        }
 }
 static void ppp_channel_push(struct channel *pch)
 {
-        local_bh_disable();
+        read_lock_bh(&pch->upl);
+        if (pch->ppp) {
-        __ppp_channel_push(pch);
+                (*this_cpu_ptr(pch->ppp->xmit_recursion))++;
+                __ppp_channel_push(pch);
-        local_bh_enable();
+                (*this_cpu_ptr(pch->ppp->xmit_recursion))--;
+        } else {
+                __ppp_channel_push(pch);
+        }
+        read_unlock_bh(&pch->upl);
 }
 /*
diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h
index d1092421aaa7..9a4171b90947 100644
--- a/drivers/net/usb/asix.h
+++ b/drivers/net/usb/asix.h
@@ -209,6 +209,7 @@ void asix_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value,
 int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                           struct asix_rx_fixup_info *rx);
 int asix_rx_fixup_common(struct usbnet *dev, struct sk_buff *skb);
+void asix_rx_fixup_common_free(struct asix_common_private *dp);
 struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                              gfp_t flags);
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 7847436c441e..522d2900cd1d 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -75,6 +75,27 @@ void asix_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index,
                               value, index, data, size);
 }
+static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)
+{
+        /* Reset the variables that have a lifetime outside of
+         * asix_rx_fixup_internal() so that future processing starts from a
+         * known set of initial conditions.
+         */
+        if (rx->ax_skb) {
+                /* Discard any incomplete Ethernet frame in the netdev buffer */
+                kfree_skb(rx->ax_skb);
+                rx->ax_skb = NULL;
+        }
+        /* Assume the Data header 32-bit word is at the start of the current
+         * or next URB socket buffer so reset all the state variables.
+         */
+        rx->remaining = 0;
+        rx->split_head = false;
+        rx->header = 0;
+}
 int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                           struct asix_rx_fixup_info *rx)
 {
@@ -99,15 +120,7 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                if (size != ((~rx->header >> 16) & 0x7ff)) {
                        netdev_err(dev->net, "asix_rx_fixup() Data Header synchronisation was lost, remaining %d\n",
                                   rx->remaining);
-                        if (rx->ax_skb) {
+                        reset_asix_rx_fixup_info(rx);
-                                kfree_skb(rx->ax_skb);
-                                rx->ax_skb = NULL;
-                                /* Discard the incomplete netdev Ethernet frame
-                                 * and assume the Data header is at the start of
-                                 * the current URB socket buffer.
-                                 */
-                        }
-                        rx->remaining = 0;
                }
        }
@@ -139,11 +152,13 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                        if (size != ((~rx->header >> 16) & 0x7ff)) {
                                netdev_err(dev->net, "asix_rx_fixup() Bad Header Length 0x%x, offset %d\n",
                                           rx->header, offset);
+                                reset_asix_rx_fixup_info(rx);
                                return 0;
                        }
                        if (size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) {
                                netdev_dbg(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
                                           size);
+                                reset_asix_rx_fixup_info(rx);
                                return 0;
                        }
@@ -168,8 +183,10 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
                if (rx->ax_skb) {
                        skb_put_data(rx->ax_skb, skb->data + offset,
                                     copy_length);
-                        if (!rx->remaining)
+                        if (!rx->remaining) {
                                usbnet_skb_return(dev, rx->ax_skb);
+                                rx->ax_skb = NULL;
+                        }
                }
                offset += (copy_length + 1) & 0xfffe;
@@ -178,6 +195,7 @@ int asix_rx_fixup_internal(struct usbnet *dev, struct sk_buff *skb,
        if (skb->len != offset) {
                netdev_err(dev->net, "asix_rx_fixup() Bad SKB Length %d, %d\n",
                           skb->len, offset);
+                reset_asix_rx_fixup_info(rx);
                return 0;
        }
@@ -192,6 +210,21 @@ int asix_rx_fixup_common(struct usbnet *dev, struct sk_buff *skb)
        return asix_rx_fixup_internal(dev, skb, rx);
 }
+void asix_rx_fixup_common_free(struct asix_common_private *dp)
+{
+        struct asix_rx_fixup_info *rx;
+        if (!dp)
+                return;
+        rx = &dp->rx_fixup_info;
+        if (rx->ax_skb) {
+                kfree_skb(rx->ax_skb);
+                rx->ax_skb = NULL;
+        }
+}
 struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                              gfp_t flags)
 {
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index a3aa0a27dfe5..b2ff88e69a81 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -764,6 +764,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
 static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
+        asix_rx_fixup_common_free(dev->driver_priv);
        kfree(dev->driver_priv);
 }
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5833f7e2a127..b99a7fb09f8e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2367,9 +2367,6 @@ static int lan78xx_reset(struct lan78xx_net *dev)
        /* Init LTM */
        lan78xx_init_ltm(dev);
-        dev->net->hard_header_len += TX_OVERHEAD;
-        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
        if (dev->udev->speed == USB_SPEED_SUPER) {
                buf = DEFAULT_BURST_CAP_SIZE / SS_USB_PKT_SIZE;
                dev->rx_urb_size = DEFAULT_BURST_CAP_SIZE;
@@ -2855,16 +2852,19 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
                return ret;
        }
+        dev->net->hard_header_len += TX_OVERHEAD;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
        /* Init all registers */
        ret = lan78xx_reset(dev);
-        lan78xx_mdio_init(dev);
+        ret = lan78xx_mdio_init(dev);
        dev->net->flags |= IFF_MULTICAST;
        pdata->wol = WAKE_MAGIC;
-        return 0;
+        return ret;
 }
 static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf)
@@ -3525,11 +3525,11 @@ static int lan78xx_probe(struct usb_interface *intf,
        udev = interface_to_usbdev(intf);
        udev = usb_get_dev(udev);
-        ret = -ENOMEM;
        netdev = alloc_etherdev(sizeof(struct lan78xx_net));
        if (!netdev) {
-                        dev_err(&intf->dev, "Error: OOM\n");
+                dev_err(&intf->dev, "Error: OOM\n");
-                        goto out1;
+                ret = -ENOMEM;
+                goto out1;
        }
        /* netdev_printk() needs this */
@@ -3610,7 +3610,7 @@ static int lan78xx_probe(struct usb_interface *intf,
        ret = register_netdev(netdev);
        if (ret != 0) {
                netif_err(dev, probe, netdev, "couldn't register the device\n");
-                goto out2;
+                goto out3;
        }
        usb_set_intfdata(intf, dev);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 5894e3c9468f..8c3733608271 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1175,6 +1175,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x1428, 2)},    /* Telewell TW-LTE 4G v2 */
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
        {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
+        {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
        {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
@@ -1340,10 +1341,14 @@ static int qmi_wwan_probe(struct usb_interface *intf,
 static void qmi_wwan_disconnect(struct usb_interface *intf)
 {
        struct usbnet *dev = usb_get_intfdata(intf);
-        struct qmi_wwan_state *info = (void *)&dev->data;
+        struct qmi_wwan_state *info;
        struct list_head *iter;
        struct net_device *ldev;
+        /* called twice if separate control and data intf */
+        if (!dev)
+                return;
+        info = (void *)&dev->data;
        if (info->flags & QMI_WWAN_FLAG_MUX) {
                if (!rtnl_trylock()) {
                        restart_syscall();
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 96aa7e6cf214..e17baac70f43 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -623,6 +623,7 @@ static struct sk_buff **vxlan_gro_receive(struct sock *sk,
 out:
        skb_gro_remcsum_cleanup(skb, &grc);
+        skb->remcsum_offload = 0;
        NAPI_GRO_CB(skb)->flush |= flush;
        return pp;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index d21258d277ce..f1b60740e020 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -159,8 +159,10 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
        brcmf_feat_firmware_capabilities(ifp);
        memset(&gscan_cfg, 0, sizeof(gscan_cfg));
-        brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
+        if (drvr->bus_if->chip != BRCM_CC_43430_CHIP_ID)
-                                  &gscan_cfg, sizeof(gscan_cfg));
+                brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN,
+                                          "pfn_gscan_cfg",
+                                          &gscan_cfg, sizeof(gscan_cfg));
        brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
        if (drvr->bus_if->wowl_supported)
                brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index b4ecd1fe1374..97208ce19f92 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -154,7 +154,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
 const struct iwl_cfg iwl9160_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9160",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -165,7 +165,7 @@ const struct iwl_cfg iwl9160_2ac_cfg = {
 const struct iwl_cfg iwl9260_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9260",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -176,7 +176,7 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
 const struct iwl_cfg iwl9270_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9270",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -186,8 +186,8 @@ const struct iwl_cfg iwl9270_2ac_cfg = {
 const struct iwl_cfg iwl9460_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9460",
-        .fw_name_pre = IWL9000_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -198,8 +198,8 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
 const struct iwl_cfg iwl9560_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9560",
-        .fw_name_pre = IWL9000_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 0fa8c473f1e2..c73a6438ce8f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -328,6 +328,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
 * @IWL_UCODE_TLV_CAPA_TX_POWER_ACK: reduced TX power API has larger
 *      command size (command version 4) that supports toggling ACK TX
 *      power reduction.
+ * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
 *
 * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
 */
@@ -373,6 +374,7 @@ enum iwl_ucode_tlv_capa {
        IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG        = (__force iwl_ucode_tlv_capa_t)80,
        IWL_UCODE_TLV_CAPA_LQM_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)81,
        IWL_UCODE_TLV_CAPA_TX_POWER_ACK                 = (__force iwl_ucode_tlv_capa_t)84,
+        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
        NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c52623cb7c2a..d19c74827fbb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -276,10 +276,10 @@ struct iwl_pwr_tx_backoff {
 * @fw_name_pre: Firmware filename prefix. The api version and extension
 *      (.ucode) will be added to filename before loading from disk. The
 *      filename is constructed as fw_name_pre<api>.ucode.
- * @fw_name_pre_next_step: same as @fw_name_pre, only for next step
+ * @fw_name_pre_b_or_c_step: same as @fw_name_pre, only for b or c steps
 *      (if supported)
- * @fw_name_pre_rf_next_step: same as @fw_name_pre_next_step, only for rf next
+ * @fw_name_pre_rf_next_step: same as @fw_name_pre_b_or_c_step, only for rf
- *      step. Supported only in integrated solutions.
+ *      next step. Supported only in integrated solutions.
 * @ucode_api_max: Highest version of uCode API supported by driver.
 * @ucode_api_min: Lowest version of uCode API supported by driver.
 * @max_inst_size: The maximal length of the fw inst section
@@ -330,7 +330,7 @@ struct iwl_cfg {
        /* params specific to an individual device within a device family */
        const char *name;
        const char *fw_name_pre;
-        const char *fw_name_pre_next_step;
+        const char *fw_name_pre_b_or_c_step;
        const char *fw_name_pre_rf_next_step;
        /* params not likely to change within a device family */
        const struct iwl_base_params *base_params;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 6fdb5921e17f..4e0f86fe0a6f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -216,8 +216,9 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
        const char *fw_pre_name;
        if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP)
+            (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP ||
-                fw_pre_name = cfg->fw_name_pre_next_step;
+             CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_C_STEP))
+                fw_pre_name = cfg->fw_name_pre_b_or_c_step;
        else if (drv->trans->cfg->integrated &&
                 CSR_HW_RFID_STEP(drv->trans->hw_rf_id) == SILICON_B_STEP &&
                 cfg->fw_name_pre_rf_next_step)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 5c08f4d40f6a..3ee6767392b6 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -785,7 +785,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                       int num_of_ch, __le32 *channels, u16 fw_mcc)
 {
        int ch_idx;
-        u16 ch_flags, prev_ch_flags = 0;
+        u16 ch_flags;
+        u32 reg_rule_flags, prev_reg_rule_flags = 0;
        const u8 *nvm_chan = cfg->ext_nvm ?
                             iwl_ext_nvm_channels : iwl_nvm_channels;
        struct ieee80211_regdomain *regd;
@@ -834,8 +835,11 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                        continue;
                }
+                reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                                                             ch_flags, cfg);
                /* we can't continue the same rule */
-                if (ch_idx == 0 || prev_ch_flags != ch_flags ||
+                if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
                    center_freq - prev_center_freq > 20) {
                        valid_rules++;
                        new_rule = true;
@@ -854,18 +858,17 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                rule->power_rule.max_eirp =
                        DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
-                rule->flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                rule->flags = reg_rule_flags;
-                                                          ch_flags, cfg);
                /* rely on auto-calculation to merge BW of contiguous chans */
                rule->flags |= NL80211_RRF_AUTO_BW;
                rule->freq_range.max_bandwidth_khz = 0;
-                prev_ch_flags = ch_flags;
                prev_center_freq = center_freq;
+                prev_reg_rule_flags = reg_rule_flags;
                IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x): Ad-Hoc %ssupported\n",
+                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x) reg_flags 0x%x: %s\n",
                              center_freq,
                              band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
                              CHECK_AND_PRINT_I(VALID),
@@ -877,10 +880,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                              CHECK_AND_PRINT_I(160MHZ),
                              CHECK_AND_PRINT_I(INDOOR_ONLY),
                              CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              ch_flags,
+                              ch_flags, reg_rule_flags,
                              ((ch_flags & NVM_CHANNEL_ACTIVE) &&
                               !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "" : "not ");
+                                         ? "Ad-Hoc" : "");
        }
        regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 79e7a7a285dc..82863e9273eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1275,8 +1275,10 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
                        entry = &wifi_pkg->package.elements[idx++];
                        if ((entry->type != ACPI_TYPE_INTEGER) ||
-                            (entry->integer.value > U8_MAX))
+                            (entry->integer.value > U8_MAX)) {
-                                return -EINVAL;
+                                ret = -EINVAL;
+                                goto out_free;
+                        }
                        mvm->geo_profiles[i].values[j] = entry->integer.value;
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index c7b1e58e3384..ce901be5fba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2597,8 +2597,18 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
        spin_lock_bh(&mvm_sta->lock);
        for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                tid_data = &mvm_sta->tid_data[i];
-                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames)))
+                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                        /*
+                         * The first deferred frame should've stopped the MAC
+                         * queues, so we should never get a second deferred
+                         * frame for the RA/TID.
+                         */
+                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
                        ieee80211_free_txskb(mvm->hw, skb);
+                }
        }
        spin_unlock_bh(&mvm_sta->lock);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 65beca3a457a..8999a1199d60 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1291,7 +1291,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         * first index into rate scale table.
         */
        if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len,
                                    reduced_txp);
@@ -1312,7 +1312,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                if (info->status.ampdu_ack_len == 0)
                        info->status.ampdu_len = 1;
-                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len);
@@ -1348,11 +1348,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                continue;
                        rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                            i < retries ? 0 : legacy_success,
                                            reduced_txp);
                        rs_collect_tlc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                            i < retries ? 0 : legacy_success);
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index f3e608196369..71c8b800ffa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -636,9 +636,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
        baid_data = rcu_dereference(mvm->baid_map[baid]);
        if (!baid_data) {
-                WARN(!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN),
+                IWL_DEBUG_RX(mvm,
-                     "Received baid %d, but no data exists for this BAID\n",
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
-                     baid);
+                              baid, reorder);
                return false;
        }
@@ -759,7 +759,9 @@ static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
        data = rcu_dereference(mvm->baid_map[baid]);
        if (!data) {
-                WARN_ON(!(reorder_data & IWL_RX_MPDU_REORDER_BA_OLD_SN));
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder_data);
                goto out;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index ab66b4394dfc..027ee5e72172 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -121,7 +121,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
                .add_modify = update ? 1 : 0,
                .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
-                                                 STA_FLG_MIMO_EN_MSK),
+                                                 STA_FLG_MIMO_EN_MSK |
+                                                 STA_FLG_RTS_MIMO_PROT),
                .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
        };
        int ret;
@@ -290,8 +291,8 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data)
                goto unlock;
        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-        ieee80211_stop_rx_ba_session_offl(mvm_sta->vif,
+        ieee80211_rx_ba_timer_expired(mvm_sta->vif,
-                                          sta->addr, ba_data->tid);
+                                      sta->addr, ba_data->tid);
 unlock:
        rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 60360ed73f26..5fcc9dd6be56 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -185,8 +185,14 @@ static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
        else
                udp_hdr(skb)->check = 0;
-        /* mac header len should include IV, size is in words */
+        /*
-        if (info->control.hw_key)
+         * mac header len should include IV, size is in words unless
+         * the IV is added by the firmware like in WEP.
+         * In new Tx API, the IV is always added by the firmware.
+         */
+        if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
                mh_len += info->control.hw_key->iv_len;
        mh_len /= 2;
        offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
@@ -1815,6 +1821,8 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
        struct iwl_mvm_tid_data *tid_data;
        struct iwl_mvm_sta *mvmsta;
+        ba_info.flags = IEEE80211_TX_STAT_AMPDU;
        if (iwl_mvm_has_new_tx_api(mvm)) {
                struct iwl_mvm_compressed_ba_notif *ba_res =
                        (void *)pkt->data;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f16c1bb9bf94..84f4ba01e14f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -510,9 +510,17 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 9000 Series */
        {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
@@ -527,10 +535,22 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index c49f1f8b2e57..37046ac2c441 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -336,7 +336,7 @@ static int nvme_get_stream_params(struct nvme_ctrl *ctrl,
        c.directive.opcode = nvme_admin_directive_recv;
        c.directive.nsid = cpu_to_le32(nsid);
-        c.directive.numd = cpu_to_le32(sizeof(*s));
+        c.directive.numd = cpu_to_le32((sizeof(*s) >> 2) - 1);
        c.directive.doper = NVME_DIR_RCV_ST_OP_PARAM;
        c.directive.dtype = NVME_DIR_STREAMS;
@@ -1509,7 +1509,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
        blk_queue_write_cache(q, vwc, vwc);
 }
-static void nvme_configure_apst(struct nvme_ctrl *ctrl)
+static int nvme_configure_apst(struct nvme_ctrl *ctrl)
 {
        /*
         * APST (Autonomous Power State Transition) lets us program a
@@ -1538,16 +1538,16 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
         * then don't do anything.
         */
        if (!ctrl->apsta)
-                return;
+                return 0;
        if (ctrl->npss > 31) {
                dev_warn(ctrl->device, "NPSS is invalid; not using APST\n");
-                return;
+                return 0;
        }
        table = kzalloc(sizeof(*table), GFP_KERNEL);
        if (!table)
-                return;
+                return 0;
        if (!ctrl->apst_enabled || ctrl->ps_max_latency_us == 0) {
                /* Turn off APST. */
@@ -1629,6 +1629,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                dev_err(ctrl->device, "failed to set APST feature (%d)\n", ret);
        kfree(table);
+        return ret;
 }
 static void nvme_set_latency_tolerance(struct device *dev, s32 val)
@@ -1835,13 +1836,16 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                 * In fabrics we need to verify the cntlid matches the
                 * admin connect
                 */
-                if (ctrl->cntlid != le16_to_cpu(id->cntlid))
+                if (ctrl->cntlid != le16_to_cpu(id->cntlid)) {
                        ret = -EINVAL;
+                        goto out_free;
+                }
                if (!ctrl->opts->discovery_nqn && !ctrl->kas) {
                        dev_err(ctrl->device,
                                "keep-alive support is mandatory for fabrics\n");
                        ret = -EINVAL;
+                        goto out_free;
                }
        } else {
                ctrl->cntlid = le16_to_cpu(id->cntlid);
@@ -1856,11 +1860,20 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
        else if (!ctrl->apst_enabled && prev_apst_enabled)
                dev_pm_qos_hide_latency_tolerance(ctrl->device);
-        nvme_configure_apst(ctrl);
+        ret = nvme_configure_apst(ctrl);
-        nvme_configure_directives(ctrl);
+        if (ret < 0)
+                return ret;
+        ret = nvme_configure_directives(ctrl);
+        if (ret < 0)
+                return ret;
        ctrl->identified = true;
+        return 0;
+out_free:
+        kfree(id);
        return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_init_identify);
@@ -2004,9 +2017,11 @@ static ssize_t wwid_show(struct device *dev, struct device_attribute *attr,
        if (memchr_inv(ns->eui, 0, sizeof(ns->eui)))
                return sprintf(buf, "eui.%8phN\n", ns->eui);
-        while (ctrl->serial[serial_len - 1] == ' ')
+        while (serial_len > 0 && (ctrl->serial[serial_len - 1] == ' ' ||
+                                  ctrl->serial[serial_len - 1] == '\0'))
                serial_len--;
-        while (ctrl->model[model_len - 1] == ' ')
+        while (model_len > 0 && (ctrl->model[model_len - 1] == ' ' ||
+                                 ctrl->model[model_len - 1] == '\0'))
                model_len--;
        return sprintf(buf, "nvme.%04x-%*phN-%*phN-%08x\n", ctrl->vid,
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 2e582a240943..5f5cd306f76d 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -794,7 +794,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts,
                int i;
                for (i = 0; i < ARRAY_SIZE(opt_tokens); i++) {
-                        if (opt_tokens[i].token & ~allowed_opts) {
+                        if ((opt_tokens[i].token & opts->mask) &&
+                            (opt_tokens[i].token & ~allowed_opts)) {
                                pr_warn("invalid parameter '%s'\n",
                                        opt_tokens[i].pattern);
                        }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index cd888a47d0fc..925467b31a33 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -801,6 +801,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
                return;
        }
+        nvmeq->cqe_seen = 1;
        req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
        nvme_end_request(req, cqe->status, cqe->result);
 }
@@ -830,10 +831,8 @@ static void nvme_process_cq(struct nvme_queue *nvmeq)
                consumed++;
        }
-        if (consumed) {
+        if (consumed)
                nvme_ring_cq_doorbell(nvmeq);
-                nvmeq->cqe_seen = 1;
-        }
 }
 static irqreturn_t nvme_irq(int irq, void *data)
@@ -1558,11 +1557,9 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
        if (dev->cmb) {
                iounmap(dev->cmb);
                dev->cmb = NULL;
-                if (dev->cmbsz) {
+                sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
-                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                             &dev_attr_cmb.attr, NULL);
-                                                     &dev_attr_cmb.attr, NULL);
+                dev->cmbsz = 0;
-                        dev->cmbsz = 0;
-                }
        }
 }
@@ -1953,16 +1950,14 @@ static int nvme_pci_enable(struct nvme_dev *dev)
        /*
         * CMBs can currently only exist on >=1.2 PCIe devices. We only
-         * populate sysfs if a CMB is implemented. Note that we add the
+         * populate sysfs if a CMB is implemented. Since nvme_dev_attrs_group
-         * CMB attribute to the nvme_ctrl kobj which removes the need to remove
+         * has no name we can pass NULL as final argument to
-         * it on exit. Since nvme_dev_attrs_group has no name we can pass
+         * sysfs_add_file_to_group.
-         * NULL as final argument to sysfs_add_file_to_group.
         */
        if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2, 0)) {
                dev->cmb = nvme_map_cmb(dev);
+                if (dev->cmb) {
-                if (dev->cmbsz) {
                        if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                    &dev_attr_cmb.attr, NULL))
                                dev_warn(dev->ctrl.device,
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2d7a98ab53fb..a53bb6635b83 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,12 +199,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
        copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
        copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
-        memset(id->mn, ' ', sizeof(id->mn));
-        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
-        memset(id->fr, ' ', sizeof(id->fr));
-        strncpy((char *)id->fr, UTS_RELEASE, sizeof(id->fr));
        id->rab = 6;
        /*
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 31ca55dfcb1d..309c84aa7595 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -114,6 +114,11 @@ struct nvmet_fc_tgtport {
        struct kref                     ref;
 };
+struct nvmet_fc_defer_fcp_req {
+        struct list_head                req_list;
+        struct nvmefc_tgt_fcp_req       *fcp_req;
+};
 struct nvmet_fc_tgt_queue {
        bool                            ninetypercent;
        u16                             qid;
@@ -132,6 +137,8 @@ struct nvmet_fc_tgt_queue {
        struct nvmet_fc_tgt_assoc       *assoc;
        struct nvmet_fc_fcp_iod         *fod;           /* array of fcp_iods */
        struct list_head                fod_list;
+        struct list_head                pending_cmd_list;
+        struct list_head                avail_defer_list;
        struct workqueue_struct         *work_q;
        struct kref                     ref;
 } __aligned(sizeof(unsigned long long));
@@ -223,6 +230,8 @@ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+                                        struct nvmet_fc_fcp_iod *fod);
 /* *********************** FC-NVME DMA Handling **************************** */
@@ -385,7 +394,7 @@ nvmet_fc_free_ls_iodlist(struct nvmet_fc_tgtport *tgtport)
 static struct nvmet_fc_ls_iod *
 nvmet_fc_alloc_ls_iod(struct nvmet_fc_tgtport *tgtport)
 {
-        static struct nvmet_fc_ls_iod *iod;
+        struct nvmet_fc_ls_iod *iod;
        unsigned long flags;
        spin_lock_irqsave(&tgtport->lock, flags);
@@ -462,10 +471,10 @@ nvmet_fc_destroy_fcp_iodlist(struct nvmet_fc_tgtport *tgtport,
 static struct nvmet_fc_fcp_iod *
 nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
 {
-        static struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_fcp_iod *fod;
-        unsigned long flags;
+        lockdep_assert_held(&queue->qlock);
-        spin_lock_irqsave(&queue->qlock, flags);
        fod = list_first_entry_or_null(&queue->fod_list,
                                        struct nvmet_fc_fcp_iod, fcp_list);
        if (fod) {
@@ -477,17 +486,37 @@ nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
                 * will "inherit" that reference.
                 */
        }
-        spin_unlock_irqrestore(&queue->qlock, flags);
        return fod;
 }
 static void
+nvmet_fc_queue_fcp_req(struct nvmet_fc_tgtport *tgtport,
+                       struct nvmet_fc_tgt_queue *queue,
+                       struct nvmefc_tgt_fcp_req *fcpreq)
+{
+        struct nvmet_fc_fcp_iod *fod = fcpreq->nvmet_fc_private;
+        /*
+         * put all admin cmds on hw queue id 0. All io commands go to
+         * the respective hw queue based on a modulo basis
+         */
+        fcpreq->hwqid = queue->qid ?
+                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
+        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
+                queue_work_on(queue->cpu, queue->work_q, &fod->work);
+        else
+                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+}
+static void
 nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
                        struct nvmet_fc_fcp_iod *fod)
 {
        struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
        struct nvmet_fc_tgtport *tgtport = fod->tgtport;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
        unsigned long flags;
        fc_dma_sync_single_for_cpu(tgtport->dev, fod->rspdma,
@@ -495,21 +524,56 @@ nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
        fcpreq->nvmet_fc_private = NULL;
-        spin_lock_irqsave(&queue->qlock, flags);
-        list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
        fod->active = false;
        fod->abort = false;
        fod->aborted = false;
        fod->writedataactive = false;
        fod->fcpreq = NULL;
+        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
+        spin_lock_irqsave(&queue->qlock, flags);
+        deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+        if (!deferfcp) {
+                list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+                /* Release reference taken at queue lookup and fod allocation */
+                nvmet_fc_tgt_q_put(queue);
+                return;
+        }
+        /* Re-use the fod for the next pending cmd that was deferred */
+        list_del(&deferfcp->req_list);
+        fcpreq = deferfcp->fcp_req;
+        /* deferfcp can be reused for another IO at a later date */
+        list_add_tail(&deferfcp->req_list, &queue->avail_defer_list);
        spin_unlock_irqrestore(&queue->qlock, flags);
+        /* Save NVME CMD IO in fod */
+        memcpy(&fod->cmdiubuf, fcpreq->rspaddr, fcpreq->rsplen);
+        /* Setup new fcpreq to be processed */
+        fcpreq->rspaddr = NULL;
+        fcpreq->rsplen  = 0;
+        fcpreq->nvmet_fc_private = fod;
+        fod->fcpreq = fcpreq;
+        fod->active = true;
+        /* inform LLDD IO is now being processed */
+        tgtport->ops->defer_rcv(&tgtport->fc_target_port, fcpreq);
+        /* Submit deferred IO for processing */
+        nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
        /*
-         * release the reference taken at queue lookup and fod allocation
+         * Leave the queue lookup get reference taken when
+         * fod was originally allocated.
         */
-        nvmet_fc_tgt_q_put(queue);
-        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
 }
 static int
@@ -569,6 +633,8 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
        queue->port = assoc->tgtport->port;
        queue->cpu = nvmet_fc_queue_to_cpu(assoc->tgtport, qid);
        INIT_LIST_HEAD(&queue->fod_list);
+        INIT_LIST_HEAD(&queue->avail_defer_list);
+        INIT_LIST_HEAD(&queue->pending_cmd_list);
        atomic_set(&queue->connected, 0);
        atomic_set(&queue->sqtail, 0);
        atomic_set(&queue->rsn, 1);
@@ -638,6 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
 {
        struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
        struct nvmet_fc_fcp_iod *fod = queue->fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
        unsigned long flags;
        int i, writedataactive;
        bool disconnect;
@@ -666,6 +733,36 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
                        }
                }
        }
+        /* Cleanup defer'ed IOs in queue */
+        list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
+                                req_list) {
+                list_del(&deferfcp->req_list);
+                kfree(deferfcp);
+        }
+        for (;;) {
+                deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+                if (!deferfcp)
+                        break;
+                list_del(&deferfcp->req_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+                tgtport->ops->defer_rcv(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+                tgtport->ops->fcp_abort(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+                tgtport->ops->fcp_req_release(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+                kfree(deferfcp);
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
        spin_unlock_irqrestore(&queue->qlock, flags);
        flush_workqueue(queue->work_q);
@@ -2172,11 +2269,38 @@ nvmet_fc_handle_fcp_rqst_work(struct work_struct *work)
 * Pass a FC-NVME FCP CMD IU received from the FC link to the nvmet-fc
 * layer for processing.
 *
- * The nvmet-fc layer will copy cmd payload to an internal structure for
+ * The nvmet_fc layer allocates a local job structure (struct
- * processing.  As such, upon completion of the routine, the LLDD may
+ * nvmet_fc_fcp_iod) from the queue for the io and copies the
- * immediately free/reuse the CMD IU buffer passed in the call.
+ * CMD IU buffer to the job structure. As such, on a successful
+ * completion (returns 0), the LLDD may immediately free/reuse
+ * the CMD IU buffer passed in the call.
 *
- * If this routine returns error, the lldd should abort the exchange.
+ * However, in some circumstances, due to the packetized nature of FC
+ * and the api of the FC LLDD which may issue a hw command to send the
+ * response, but the LLDD may not get the hw completion for that command
+ * and upcall the nvmet_fc layer before a new command may be
+ * asynchronously received - its possible for a command to be received
+ * before the LLDD and nvmet_fc have recycled the job structure. It gives
+ * the appearance of more commands received than fits in the sq.
+ * To alleviate this scenario, a temporary queue is maintained in the
+ * transport for pending LLDD requests waiting for a queue job structure.
+ * In these "overrun" cases, a temporary queue element is allocated
+ * the LLDD request and CMD iu buffer information remembered, and the
+ * routine returns a -EOVERFLOW status. Subsequently, when a queue job
+ * structure is freed, it is immediately reallocated for anything on the
+ * pending request list. The LLDDs defer_rcv() callback is called,
+ * informing the LLDD that it may reuse the CMD IU buffer, and the io
+ * is then started normally with the transport.
+ *
+ * The LLDD, when receiving an -EOVERFLOW completion status, is to treat
+ * the completion as successful but must not reuse the CMD IU buffer
+ * until the LLDD's defer_rcv() callback has been called for the
+ * corresponding struct nvmefc_tgt_fcp_req pointer.
+ *
+ * If there is any other condition in which an error occurs, the
+ * transport will return a non-zero status indicating the error.
+ * In all cases other than -EOVERFLOW, the transport has not accepted the
+ * request and the LLDD should abort the exchange.
 *
 * @target_port: pointer to the (registered) target port the FCP CMD IU
 *              was received on.
@@ -2194,6 +2318,8 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
        struct nvme_fc_cmd_iu *cmdiu = cmdiubuf;
        struct nvmet_fc_tgt_queue *queue;
        struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
+        unsigned long flags;
        /* validate iu, so the connection id can be used to find the queue */
        if ((cmdiubuf_len != sizeof(*cmdiu)) ||
@@ -2214,29 +2340,60 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
         * when the fod is freed.
         */
+        spin_lock_irqsave(&queue->qlock, flags);
        fod = nvmet_fc_alloc_fcp_iod(queue);
-        if (!fod) {
+        if (fod) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
+                fcpreq->nvmet_fc_private = fod;
+                fod->fcpreq = fcpreq;
+                memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
+                nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
+                return 0;
+        }
+        if (!tgtport->ops->defer_rcv) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
                /* release the queue lookup reference */
                nvmet_fc_tgt_q_put(queue);
                return -ENOENT;
        }
-        fcpreq->nvmet_fc_private = fod;
+        deferfcp = list_first_entry_or_null(&queue->avail_defer_list,
-        fod->fcpreq = fcpreq;
+                        struct nvmet_fc_defer_fcp_req, req_list);
-        /*
+        if (deferfcp) {
-         * put all admin cmds on hw queue id 0. All io commands go to
+                /* Just re-use one that was previously allocated */
-         * the respective hw queue based on a modulo basis
+                list_del(&deferfcp->req_list);
-         */
+        } else {
-        fcpreq->hwqid = queue->qid ?
+                spin_unlock_irqrestore(&queue->qlock, flags);
-                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
-        memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
-        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
+                /* Now we need to dynamically allocate one */
-                queue_work_on(queue->cpu, queue->work_q, &fod->work);
+                deferfcp = kmalloc(sizeof(*deferfcp), GFP_KERNEL);
-        else
+                if (!deferfcp) {
-                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+                        /* release the queue lookup reference */
+                        nvmet_fc_tgt_q_put(queue);
+                        return -ENOMEM;
+                }
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
-        return 0;
+        /* For now, use rspaddr / rsplen to save payload information */
+        fcpreq->rspaddr = cmdiubuf;
+        fcpreq->rsplen  = cmdiubuf_len;
+        deferfcp->fcp_req = fcpreq;
+        /* defer processing till a fod becomes available */
+        list_add_tail(&deferfcp->req_list, &queue->pending_cmd_list);
+        /* NOTE: the queue lookup reference is still valid */
+        spin_unlock_irqrestore(&queue->qlock, flags);
+        return -EOVERFLOW;
 }
 EXPORT_SYMBOL_GPL(nvmet_fc_rcv_fcp_req);
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 28c38c756f92..e0a28ea341fe 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -89,6 +89,7 @@ int of_dma_configure(struct device *dev, struct device_node *np)
        bool coherent;
        unsigned long offset;
        const struct iommu_ops *iommu;
+        u64 mask;
        /*
         * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
@@ -134,10 +135,9 @@ int of_dma_configure(struct device *dev, struct device_node *np)
         * Limit coherent and dma mask based on size and default mask
         * set by the driver.
         */
-        dev->coherent_dma_mask = min(dev->coherent_dma_mask,
+        mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
-                                     DMA_BIT_MASK(ilog2(dma_addr + size)));
+        dev->coherent_dma_mask &= mask;
-        *dev->dma_mask = min((*dev->dma_mask),
+        *dev->dma_mask &= mask;
-                             DMA_BIT_MASK(ilog2(dma_addr + size)));
        coherent = of_dma_is_coherent(np);
        dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 5c63b920b471..ed92c1254cff 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -956,7 +956,7 @@ static int __init dino_probe(struct parisc_device *dev)
        dino_dev->hba.dev = dev;
        dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-        dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
+        dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
        spin_lock_init(&dino_dev->dinosaur_pen);
        dino_dev->hba.iommu = ccio_get_iommu(dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index af0cc3456dc1..da5570cf5c6a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -522,10 +522,11 @@ struct pci_dev *pci_find_pcie_root_port(struct pci_dev *dev)
                bridge = pci_upstream_bridge(bridge);
        }
-        if (pci_pcie_type(highest_pcie_bridge) != PCI_EXP_TYPE_ROOT_PORT)
+        if (highest_pcie_bridge &&
-                return NULL;
+            pci_pcie_type(highest_pcie_bridge) == PCI_EXP_TYPE_ROOT_PORT)
+                return highest_pcie_bridge;
-        return highest_pcie_bridge;
+        return NULL;
 }
 EXPORT_SYMBOL(pci_find_pcie_root_port);
@@ -4260,6 +4261,41 @@ int pci_reset_function(struct pci_dev *dev)
 EXPORT_SYMBOL_GPL(pci_reset_function);
 /**
+ * pci_reset_function_locked - quiesce and reset a PCI device function
+ * @dev: PCI device to reset
+ *
+ * Some devices allow an individual function to be reset without affecting
+ * other functions in the same device.  The PCI device must be responsive
+ * to PCI config space in order to use this function.
+ *
+ * This function does not just reset the PCI portion of a device, but
+ * clears all the state associated with the device.  This function differs
+ * from __pci_reset_function() in that it saves and restores device state
+ * over the reset.  It also differs from pci_reset_function() in that it
+ * requires the PCI device lock to be held.
+ *
+ * Returns 0 if the device function was successfully reset or negative if the
+ * device doesn't support resetting a single function.
+ */
+int pci_reset_function_locked(struct pci_dev *dev)
+{
+        int rc;
+        rc = pci_probe_reset_function(dev);
+        if (rc)
+                return rc;
+        pci_dev_save_and_disable(dev);
+        rc = __pci_reset_function_locked(dev);
+        pci_dev_restore(dev);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(pci_reset_function_locked);
+/**
 * pci_try_reset_function - quiesce and reset a PCI device function
 * @dev: PCI device to reset
 *
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c31310db0404..e6a917b4acd3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1762,6 +1762,48 @@ static void pci_configure_extended_tags(struct pci_dev *dev)
                                         PCI_EXP_DEVCTL_EXT_TAG);
 }
+/**
+ * pcie_relaxed_ordering_enabled - Probe for PCIe relaxed ordering enable
+ * @dev: PCI device to query
+ *
+ * Returns true if the device has enabled relaxed ordering attribute.
+ */
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev)
+{
+        u16 v;
+        pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &v);
+        return !!(v & PCI_EXP_DEVCTL_RELAX_EN);
+}
+EXPORT_SYMBOL(pcie_relaxed_ordering_enabled);
+static void pci_configure_relaxed_ordering(struct pci_dev *dev)
+{
+        struct pci_dev *root;
+        /* PCI_EXP_DEVICE_RELAX_EN is RsvdP in VFs */
+        if (dev->is_virtfn)
+                return;
+        if (!pcie_relaxed_ordering_enabled(dev))
+                return;
+        /*
+         * For now, we only deal with Relaxed Ordering issues with Root
+         * Ports. Peer-to-Peer DMA is another can of worms.
+         */
+        root = pci_find_pcie_root_port(dev);
+        if (!root)
+                return;
+        if (root->dev_flags & PCI_DEV_FLAGS_NO_RELAXED_ORDERING) {
+                pcie_capability_clear_word(dev, PCI_EXP_DEVCTL,
+                                           PCI_EXP_DEVCTL_RELAX_EN);
+                dev_info(&dev->dev, "Disable Relaxed Ordering because the Root Port didn't support it\n");
+        }
+}
 static void pci_configure_device(struct pci_dev *dev)
 {
        struct hotplug_params hpp;
@@ -1769,6 +1811,7 @@ static void pci_configure_device(struct pci_dev *dev)
        pci_configure_mps(dev);
        pci_configure_extended_tags(dev);
+        pci_configure_relaxed_ordering(dev);
        memset(&hpp, 0, sizeof(hpp));
        ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6967c6b4cf6b..140760403f36 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4016,6 +4016,95 @@ DECLARE_PCI_FIXUP_CLASS_EARLY(0x1797, 0x6869, PCI_CLASS_NOT_DEFINED, 8,
                              quirk_tw686x_class);
 /*
+ * Some devices have problems with Transaction Layer Packets with the Relaxed
+ * Ordering Attribute set.  Such devices should mark themselves and other
+ * Device Drivers should check before sending TLPs with RO set.
+ */
+static void quirk_relaxedordering_disable(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_RELAXED_ORDERING;
+        dev_info(&dev->dev, "Disable Relaxed Ordering Attributes to avoid PCIe Completion erratum\n");
+}
+/*
+ * Intel Xeon processors based on Broadwell/Haswell microarchitecture Root
+ * Complex has a Flow Control Credit issue which can cause performance
+ * problems with Upstream Transaction Layer Packets with Relaxed Ordering set.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+/*
+ * The AMD ARM A1100 (AKA "SEATTLE") SoC has a bug in its PCIe Root Complex
+ * where Upstream Transaction Layer Packets with the Relaxed Ordering
+ * Attribute clear are allowed to bypass earlier TLPs with Relaxed Ordering
+ * set.  This is a violation of the PCIe 3.0 Transaction Ordering Rules
+ * outlined in Section 2.4.1 (PCI Express(r) Base Specification Revision 3.0
+ * November 10, 2010).  As a result, on this platform we can't use Relaxed
+ * Ordering for Upstream TLPs.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a00, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+/*
 * Per PCIe r3.0, sec 2.2.9, "Completion headers must supply the same
 * values for the Attribute as were supplied in the header of the
 * corresponding Request, except as explicitly allowed when IDO is used."
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 20f1b4493994..04e929fd0ffe 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1548,6 +1548,13 @@ static const struct dmi_system_id chv_no_valid_mask[] = {
                },
        },
        {
+                .ident = "HP Chromebook 11 G5 (Setzer)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Setzer"),
+                },
+        },
+        {
                .ident = "Acer Chromebook R11 (Cyan)",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index 4d4ef42a39b5..86c4b3fab7b0 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -343,9 +343,9 @@ static const struct pinctrl_pin_desc mrfld_pins[] = {
 static const unsigned int mrfld_sdio_pins[] = { 50, 51, 52, 53, 54, 55, 56 };
 static const unsigned int mrfld_spi5_pins[] = { 90, 91, 92, 93, 94, 95, 96 };
-static const unsigned int mrfld_uart0_pins[] = { 124, 125, 126, 127 };
+static const unsigned int mrfld_uart0_pins[] = { 115, 116, 117, 118 };
-static const unsigned int mrfld_uart1_pins[] = { 128, 129, 130, 131 };
+static const unsigned int mrfld_uart1_pins[] = { 119, 120, 121, 122 };
-static const unsigned int mrfld_uart2_pins[] = { 132, 133, 134, 135 };
+static const unsigned int mrfld_uart2_pins[] = { 123, 124, 125, 126 };
 static const unsigned int mrfld_pwm0_pins[] = { 144 };
 static const unsigned int mrfld_pwm1_pins[] = { 145 };
 static const unsigned int mrfld_pwm2_pins[] = { 132 };
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index f024e25787fc..0c6d7812d6fd 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -37,7 +37,7 @@
 #define IRQ_STATUS      0x10
 #define IRQ_WKUP        0x18
-#define NB_FUNCS 2
+#define NB_FUNCS 3
 #define GPIO_PER_REG    32
 /**
@@ -126,6 +126,16 @@ struct armada_37xx_pinctrl {
                .funcs = {_func1, "gpio"}       \
        }
+#define PIN_GRP_GPIO_3(_name, _start, _nr, _mask, _v1, _v2, _v3, _f1, _f2) \
+        {                                       \
+                .name = _name,                  \
+                .start_pin = _start,            \
+                .npins = _nr,                   \
+                .reg_mask = _mask,              \
+                .val = {_v1, _v2, _v3}, \
+                .funcs = {_f1, _f2, "gpio"}     \
+        }
 #define PIN_GRP_EXTRA(_name, _start, _nr, _mask, _v1, _v2, _start2, _nr2, \
                      _f1, _f2)                         \
        {                                               \
@@ -171,12 +181,13 @@ static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
        PIN_GRP_GPIO("usb32_drvvbus0", 0, 1, BIT(0), "drvbus"),
        PIN_GRP_GPIO("usb2_drvvbus1", 1, 1, BIT(1), "drvbus"),
        PIN_GRP_GPIO("sdio_sb", 24, 6, BIT(2), "sdio"),
-        PIN_GRP_EXTRA("rgmii", 6, 12, BIT(3), 0, BIT(3), 23, 1, "mii", "gpio"),
+        PIN_GRP_GPIO("rgmii", 6, 12, BIT(3), "mii"),
        PIN_GRP_GPIO("pcie1", 3, 2, BIT(4), "pcie"),
        PIN_GRP_GPIO("ptp", 20, 3, BIT(5), "ptp"),
        PIN_GRP("ptp_clk", 21, 1, BIT(6), "ptp", "mii"),
        PIN_GRP("ptp_trig", 22, 1, BIT(7), "ptp", "mii"),
-        PIN_GRP("mii_col", 23, 1, BIT(8), "mii", "mii_err"),
+        PIN_GRP_GPIO_3("mii_col", 23, 1, BIT(8) | BIT(14), 0, BIT(8), BIT(14),
+                       "mii", "mii_err"),
 };
 const struct armada_37xx_pin_data armada_37xx_pin_nb = {
@@ -187,7 +198,7 @@ const struct armada_37xx_pin_data armada_37xx_pin_nb = {
 };
 const struct armada_37xx_pin_data armada_37xx_pin_sb = {
-        .nr_pins = 29,
+        .nr_pins = 30,
        .name = "GPIO2",
        .groups = armada_37xx_sb_groups,
        .ngroups = ARRAY_SIZE(armada_37xx_sb_groups),
@@ -208,7 +219,7 @@ static int armada_37xx_get_func_reg(struct armada_37xx_pin_group *grp,
 {
        int f;
-        for (f = 0; f < NB_FUNCS; f++)
+        for (f = 0; (f < NB_FUNCS) && grp->funcs[f]; f++)
                if (!strcmp(grp->funcs[f], func))
                        return f;
@@ -795,7 +806,7 @@ static int armada_37xx_fill_group(struct armada_37xx_pinctrl *info)
                for (j = 0; j < grp->extra_npins; j++)
                        grp->pins[i+j] = grp->extra_pin + j;
-                for (f = 0; f < NB_FUNCS; f++) {
+                for (f = 0; (f < NB_FUNCS) && grp->funcs[f]; f++) {
                        int ret;
                        /* check for unique functions and count groups */
                        ret = armada_37xx_add_function(info->funcs, &funcsize,
@@ -847,7 +858,7 @@ static int armada_37xx_fill_func(struct armada_37xx_pinctrl *info)
                        struct armada_37xx_pin_group *gp = &info->groups[g];
                        int f;
-                        for (f = 0; f < NB_FUNCS; f++) {
+                        for (f = 0; (f < NB_FUNCS) && gp->funcs[f]; f++) {
                                if (strcmp(gp->funcs[f], name) == 0) {
                                        *groups = gp->name;
                                        groups++;
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 159580c04b14..47a392bc73c8 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -918,6 +918,7 @@ static const struct sunxi_desc_pin sun4i_a10_pins[] = {
                  SUNXI_FUNCTION_VARIANT(0x3, "emac",   /* ETXD1 */
                                         PINCTRL_SUN7I_A20),
                  SUNXI_FUNCTION(0x4, "keypad"),        /* IN6 */
+                  SUNXI_FUNCTION(0x5, "sim"),           /* DET */
                  SUNXI_FUNCTION_IRQ(0x6, 16),          /* EINT16 */
                  SUNXI_FUNCTION(0x7, "csi1")),         /* D16 */
        SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 17),
diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c
index a433a306a2d0..c75e094b2d90 100644
--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c
+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c
@@ -1084,7 +1084,7 @@ static const unsigned usb1_pins[] = {182, 183};
 static const int usb1_muxvals[] = {0, 0};
 static const unsigned usb2_pins[] = {184, 185};
 static const int usb2_muxvals[] = {0, 0};
-static const unsigned usb3_pins[] = {186, 187};
+static const unsigned usb3_pins[] = {187, 188};
 static const int usb3_muxvals[] = {0, 0};
 static const unsigned port_range0_pins[] = {
        300, 301, 302, 303, 304, 305, 306, 307,         /* PORT0x */
diff --git a/drivers/pinctrl/zte/pinctrl-zx.c b/drivers/pinctrl/zte/pinctrl-zx.c
index 787e3967bd5c..f828ee340a98 100644
--- a/drivers/pinctrl/zte/pinctrl-zx.c
+++ b/drivers/pinctrl/zte/pinctrl-zx.c
@@ -64,10 +64,8 @@ static int zx_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
        struct zx_pinctrl_soc_info *info = zpctl->info;
        const struct pinctrl_pin_desc *pindesc = info->pins + group_selector;
        struct zx_pin_data *data = pindesc->drv_data;
-        struct zx_mux_desc *mux = data->muxes;
+        struct zx_mux_desc *mux;
-        u32 mask = (1 << data->width) - 1;
+        u32 mask, offset, bitpos;
-        u32 offset = data->offset;
-        u32 bitpos = data->bitpos;
        struct function_desc *func;
        unsigned long flags;
        u32 val, mval;
@@ -76,6 +74,11 @@ static int zx_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
        if (!data)
                return -EINVAL;
+        mux = data->muxes;
+        mask = (1 << data->width) - 1;
+        offset = data->offset;
+        bitpos = data->bitpos;
        func = pinmux_generic_get_function(pctldev, func_selector);
        if (!func)
                return -EINVAL;
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index b77435783ef3..7eacc1c4b3b1 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <uapi/linux/sched/types.h>
 #include "ptp_private.h"
@@ -184,6 +185,19 @@ static void delete_ptp_clock(struct posix_clock *pc)
        kfree(ptp);
 }
+static void ptp_aux_kworker(struct kthread_work *work)
+{
+        struct ptp_clock *ptp = container_of(work, struct ptp_clock,
+                                             aux_work.work);
+        struct ptp_clock_info *info = ptp->info;
+        long delay;
+        delay = info->do_aux_work(info);
+        if (delay >= 0)
+                kthread_queue_delayed_work(ptp->kworker, &ptp->aux_work, delay);
+}
 /* public interface */
 struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
@@ -217,6 +231,20 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
        mutex_init(&ptp->pincfg_mux);
        init_waitqueue_head(&ptp->tsev_wq);
+        if (ptp->info->do_aux_work) {
+                char *worker_name = kasprintf(GFP_KERNEL, "ptp%d", ptp->index);
+                kthread_init_delayed_work(&ptp->aux_work, ptp_aux_kworker);
+                ptp->kworker = kthread_create_worker(0, worker_name ?
+                                                     worker_name : info->name);
+                kfree(worker_name);
+                if (IS_ERR(ptp->kworker)) {
+                        err = PTR_ERR(ptp->kworker);
+                        pr_err("failed to create ptp aux_worker %d\n", err);
+                        goto kworker_err;
+                }
+        }
        err = ptp_populate_pin_groups(ptp);
        if (err)
                goto no_pin_groups;
@@ -259,6 +287,9 @@ no_pps:
 no_device:
        ptp_cleanup_pin_groups(ptp);
 no_pin_groups:
+        if (ptp->kworker)
+                kthread_destroy_worker(ptp->kworker);
+kworker_err:
        mutex_destroy(&ptp->tsevq_mux);
        mutex_destroy(&ptp->pincfg_mux);
        ida_simple_remove(&ptp_clocks_map, index);
@@ -274,6 +305,11 @@ int ptp_clock_unregister(struct ptp_clock *ptp)
        ptp->defunct = 1;
        wake_up_interruptible(&ptp->tsev_wq);
+        if (ptp->kworker) {
+                kthread_cancel_delayed_work_sync(&ptp->aux_work);
+                kthread_destroy_worker(ptp->kworker);
+        }
        /* Release the clock's resources. */
        if (ptp->pps_source)
                pps_unregister_source(ptp->pps_source);
@@ -339,6 +375,12 @@ int ptp_find_pin(struct ptp_clock *ptp,
 }
 EXPORT_SYMBOL(ptp_find_pin);
+int ptp_schedule_worker(struct ptp_clock *ptp, unsigned long delay)
+{
+        return kthread_mod_delayed_work(ptp->kworker, &ptp->aux_work, delay);
+}
+EXPORT_SYMBOL(ptp_schedule_worker);
 /* module operations */
 static void __exit ptp_exit(void)
diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index d95888974d0c..b86f1bfecd6f 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -22,6 +22,7 @@
 #include <linux/cdev.h>
 #include <linux/device.h>
+#include <linux/kthread.h>
 #include <linux/mutex.h>
 #include <linux/posix-clock.h>
 #include <linux/ptp_clock.h>
@@ -56,6 +57,8 @@ struct ptp_clock {
        struct attribute_group pin_attr_group;
        /* 1st entry is a pointer to the real group, 2nd is NULL terminator */
        const struct attribute_group *pin_attr_groups[2];
+        struct kthread_worker *kworker;
+        struct kthread_delayed_work aux_work;
 };
 /*
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 8975cd321390..d42e758518ed 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2512,7 +2512,7 @@ static void qeth_l3_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
                struct rtable *rt = (struct rtable *) dst;
                __be32 *pkey = &ip_hdr(skb)->daddr;
-                if (rt->rt_gateway)
+                if (rt && rt->rt_gateway)
                        pkey = &rt->rt_gateway;
                /* IPv4 */
@@ -2523,7 +2523,7 @@ static void qeth_l3_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
                struct rt6_info *rt = (struct rt6_info *) dst;
                struct in6_addr *pkey = &ipv6_hdr(skb)->daddr;
-                if (!ipv6_addr_any(&rt->rt6i_gateway))
+                if (rt && !ipv6_addr_any(&rt->rt6i_gateway))
                        pkey = &rt->rt6i_gateway;
                /* IPv6 */
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 707ee2f5954d..4591113c49de 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -3198,10 +3198,11 @@ static int query_disk(struct aac_dev *dev, void __user *arg)
                return -EBUSY;
        if (copy_from_user(&qd, arg, sizeof (struct aac_query_disk)))
                return -EFAULT;
-        if (qd.cnum == -1)
+        if (qd.cnum == -1) {
+                if (qd.id < 0 || qd.id >= dev->maximum_num_containers)
+                        return -EINVAL;
                qd.cnum = qd.id;
-        else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1))
+        } else if ((qd.bus == -1) && (qd.id == -1) && (qd.lun == -1)) {
-        {
                if (qd.cnum < 0 || qd.cnum >= dev->maximum_num_containers)
                        return -EINVAL;
                qd.instance = dev->scsi_host_ptr->host_no;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 7dfe709a7138..6844ba361616 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -2624,12 +2624,11 @@ static struct fcoe_transport bnx2fc_transport = {
 };
 /**
- * bnx2fc_percpu_thread_create - Create a receive thread for an
+ * bnx2fc_cpu_online - Create a receive thread for an  online CPU
- *                               online CPU
 *
 * @cpu: cpu index for the online cpu
 */
-static void bnx2fc_percpu_thread_create(unsigned int cpu)
+static int bnx2fc_cpu_online(unsigned int cpu)
 {
        struct bnx2fc_percpu_s *p;
        struct task_struct *thread;
@@ -2639,15 +2638,17 @@ static void bnx2fc_percpu_thread_create(unsigned int cpu)
        thread = kthread_create_on_node(bnx2fc_percpu_io_thread,
                                        (void *)p, cpu_to_node(cpu),
                                        "bnx2fc_thread/%d", cpu);
+        if (IS_ERR(thread))
+                return PTR_ERR(thread);
        /* bind thread to the cpu */
-        if (likely(!IS_ERR(thread))) {
+        kthread_bind(thread, cpu);
-                kthread_bind(thread, cpu);
+        p->iothread = thread;
-                p->iothread = thread;
+        wake_up_process(thread);
-                wake_up_process(thread);
+        return 0;
-        }
 }
-static void bnx2fc_percpu_thread_destroy(unsigned int cpu)
+static int bnx2fc_cpu_offline(unsigned int cpu)
 {
        struct bnx2fc_percpu_s *p;
        struct task_struct *thread;
@@ -2661,7 +2662,6 @@ static void bnx2fc_percpu_thread_destroy(unsigned int cpu)
        thread = p->iothread;
        p->iothread = NULL;
        /* Free all work in the list */
        list_for_each_entry_safe(work, tmp, &p->work_list, list) {
                list_del_init(&work->list);
@@ -2673,20 +2673,6 @@ static void bnx2fc_percpu_thread_destroy(unsigned int cpu)
        if (thread)
                kthread_stop(thread);
-}
-static int bnx2fc_cpu_online(unsigned int cpu)
-{
-        printk(PFX "CPU %x online: Create Rx thread\n", cpu);
-        bnx2fc_percpu_thread_create(cpu);
-        return 0;
-}
-static int bnx2fc_cpu_dead(unsigned int cpu)
-{
-        printk(PFX "CPU %x offline: Remove Rx thread\n", cpu);
-        bnx2fc_percpu_thread_destroy(cpu);
        return 0;
 }
@@ -2761,30 +2747,16 @@ static int __init bnx2fc_mod_init(void)
                spin_lock_init(&p->fp_work_lock);
        }
-        get_online_cpus();
+        rc = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "scsi/bnx2fc:online",
+                               bnx2fc_cpu_online, bnx2fc_cpu_offline);
-        for_each_online_cpu(cpu)
-                bnx2fc_percpu_thread_create(cpu);
-        rc = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                       "scsi/bnx2fc:online",
-                                       bnx2fc_cpu_online, NULL);
        if (rc < 0)
-                goto stop_threads;
+                goto stop_thread;
        bnx2fc_online_state = rc;
-        cpuhp_setup_state_nocalls(CPUHP_SCSI_BNX2FC_DEAD, "scsi/bnx2fc:dead",
-                                  NULL, bnx2fc_cpu_dead);
-        put_online_cpus();
        cnic_register_driver(CNIC_ULP_FCOE, &bnx2fc_cnic_cb);
        return 0;
-stop_threads:
+stop_thread:
-        for_each_online_cpu(cpu)
-                bnx2fc_percpu_thread_destroy(cpu);
-        put_online_cpus();
        kthread_stop(l2_thread);
 free_wq:
        destroy_workqueue(bnx2fc_wq);
@@ -2803,7 +2775,6 @@ static void __exit bnx2fc_mod_exit(void)
        struct fcoe_percpu_s *bg;
        struct task_struct *l2_thread;
        struct sk_buff *skb;
-        unsigned int cpu = 0;
        /*
         * NOTE: Since cnic calls register_driver routine rtnl_lock,
@@ -2844,16 +2815,7 @@ static void __exit bnx2fc_mod_exit(void)
        if (l2_thread)
                kthread_stop(l2_thread);
-        get_online_cpus();
+        cpuhp_remove_state(bnx2fc_online_state);
-        /* Destroy per cpu threads */
-        for_each_online_cpu(cpu) {
-                bnx2fc_percpu_thread_destroy(cpu);
-        }
-        cpuhp_remove_state_nocalls(bnx2fc_online_state);
-        cpuhp_remove_state_nocalls(CPUHP_SCSI_BNX2FC_DEAD);
-        put_online_cpus();
        destroy_workqueue(bnx2fc_wq);
        /*
diff --git a/drivers/scsi/bnx2fc/bnx2fc_hwi.c b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
index 913c750205ce..26de61d65a4d 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_hwi.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_hwi.c
@@ -1008,6 +1008,28 @@ static struct bnx2fc_work *bnx2fc_alloc_work(struct bnx2fc_rport *tgt, u16 wqe)
        return work;
 }
+/* Pending work request completion */
+static void bnx2fc_pending_work(struct bnx2fc_rport *tgt, unsigned int wqe)
+{
+        unsigned int cpu = wqe % num_possible_cpus();
+        struct bnx2fc_percpu_s *fps;
+        struct bnx2fc_work *work;
+        fps = &per_cpu(bnx2fc_percpu, cpu);
+        spin_lock_bh(&fps->fp_work_lock);
+        if (fps->iothread) {
+                work = bnx2fc_alloc_work(tgt, wqe);
+                if (work) {
+                        list_add_tail(&work->list, &fps->work_list);
+                        wake_up_process(fps->iothread);
+                        spin_unlock_bh(&fps->fp_work_lock);
+                        return;
+                }
+        }
+        spin_unlock_bh(&fps->fp_work_lock);
+        bnx2fc_process_cq_compl(tgt, wqe);
+}
 int bnx2fc_process_new_cqes(struct bnx2fc_rport *tgt)
 {
        struct fcoe_cqe *cq;
@@ -1042,28 +1064,7 @@ int bnx2fc_process_new_cqes(struct bnx2fc_rport *tgt)
                        /* Unsolicited event notification */
                        bnx2fc_process_unsol_compl(tgt, wqe);
                } else {
-                        /* Pending work request completion */
+                        bnx2fc_pending_work(tgt, wqe);
-                        struct bnx2fc_work *work = NULL;
-                        struct bnx2fc_percpu_s *fps = NULL;
-                        unsigned int cpu = wqe % num_possible_cpus();
-                        fps = &per_cpu(bnx2fc_percpu, cpu);
-                        spin_lock_bh(&fps->fp_work_lock);
-                        if (unlikely(!fps->iothread))
-                                goto unlock;
-                        work = bnx2fc_alloc_work(tgt, wqe);
-                        if (work)
-                                list_add_tail(&work->list,
-                                              &fps->work_list);
-unlock:
-                        spin_unlock_bh(&fps->fp_work_lock);
-                        /* Pending work request completion */
-                        if (fps->iothread && work)
-                                wake_up_process(fps->iothread);
-                        else
-                                bnx2fc_process_cq_compl(tgt, wqe);
                        num_free_sqes++;
                }
                cqe++;
diff --git a/drivers/scsi/bnx2i/bnx2i_init.c b/drivers/scsi/bnx2i/bnx2i_init.c
index 86afc002814c..4ebcda8d9500 100644
--- a/drivers/scsi/bnx2i/bnx2i_init.c
+++ b/drivers/scsi/bnx2i/bnx2i_init.c
@@ -404,12 +404,11 @@ int bnx2i_get_stats(void *handle)
 /**
- * bnx2i_percpu_thread_create - Create a receive thread for an
+ * bnx2i_cpu_online - Create a receive thread for an online CPU
- *                              online CPU
 *
 * @cpu:        cpu index for the online cpu
 */
-static void bnx2i_percpu_thread_create(unsigned int cpu)
+static int bnx2i_cpu_online(unsigned int cpu)
 {
        struct bnx2i_percpu_s *p;
        struct task_struct *thread;
@@ -419,16 +418,17 @@ static void bnx2i_percpu_thread_create(unsigned int cpu)
        thread = kthread_create_on_node(bnx2i_percpu_io_thread, (void *)p,
                                        cpu_to_node(cpu),
                                        "bnx2i_thread/%d", cpu);
+        if (IS_ERR(thread))
+                return PTR_ERR(thread);
        /* bind thread to the cpu */
-        if (likely(!IS_ERR(thread))) {
+        kthread_bind(thread, cpu);
-                kthread_bind(thread, cpu);
+        p->iothread = thread;
-                p->iothread = thread;
+        wake_up_process(thread);
-                wake_up_process(thread);
+        return 0;
-        }
 }
+static int bnx2i_cpu_offline(unsigned int cpu)
-static void bnx2i_percpu_thread_destroy(unsigned int cpu)
 {
        struct bnx2i_percpu_s *p;
        struct task_struct *thread;
@@ -451,19 +451,6 @@ static void bnx2i_percpu_thread_destroy(unsigned int cpu)
        spin_unlock_bh(&p->p_work_lock);
        if (thread)
                kthread_stop(thread);
-}
-static int bnx2i_cpu_online(unsigned int cpu)
-{
-        pr_info("bnx2i: CPU %x online: Create Rx thread\n", cpu);
-        bnx2i_percpu_thread_create(cpu);
-        return 0;
-}
-static int bnx2i_cpu_dead(unsigned int cpu)
-{
-        pr_info("CPU %x offline: Remove Rx thread\n", cpu);
-        bnx2i_percpu_thread_destroy(cpu);
        return 0;
 }
@@ -511,27 +498,14 @@ static int __init bnx2i_mod_init(void)
                p->iothread = NULL;
        }
-        get_online_cpus();
+        err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "scsi/bnx2i:online",
+                                bnx2i_cpu_online, bnx2i_cpu_offline);
-        for_each_online_cpu(cpu)
-                bnx2i_percpu_thread_create(cpu);
-        err = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                       "scsi/bnx2i:online",
-                                       bnx2i_cpu_online, NULL);
        if (err < 0)
-                goto remove_threads;
+                goto unreg_driver;
        bnx2i_online_state = err;
-        cpuhp_setup_state_nocalls(CPUHP_SCSI_BNX2I_DEAD, "scsi/bnx2i:dead",
-                                  NULL, bnx2i_cpu_dead);
-        put_online_cpus();
        return 0;
-remove_threads:
+unreg_driver:
-        for_each_online_cpu(cpu)
-                bnx2i_percpu_thread_destroy(cpu);
-        put_online_cpus();
        cnic_unregister_driver(CNIC_ULP_ISCSI);
 unreg_xport:
        iscsi_unregister_transport(&bnx2i_iscsi_transport);
@@ -551,7 +525,6 @@ out:
 static void __exit bnx2i_mod_exit(void)
 {
        struct bnx2i_hba *hba;
-        unsigned cpu = 0;
        mutex_lock(&bnx2i_dev_lock);
        while (!list_empty(&adapter_list)) {
@@ -569,14 +542,7 @@ static void __exit bnx2i_mod_exit(void)
        }
        mutex_unlock(&bnx2i_dev_lock);
-        get_online_cpus();
+        cpuhp_remove_state(bnx2i_online_state);
-        for_each_online_cpu(cpu)
-                bnx2i_percpu_thread_destroy(cpu);
-        cpuhp_remove_state_nocalls(bnx2i_online_state);
-        cpuhp_remove_state_nocalls(CPUHP_SCSI_BNX2I_DEAD);
-        put_online_cpus();
        iscsi_unregister_transport(&bnx2i_iscsi_transport);
        cnic_unregister_driver(CNIC_ULP_ISCSI);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b0c68d24db01..da5bdbdcce52 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3351,6 +3351,16 @@ static void ipr_worker_thread(struct work_struct *work)
                return;
        }
+        if (ioa_cfg->scsi_unblock) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 0;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                scsi_unblock_requests(ioa_cfg->host);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                if (ioa_cfg->scsi_blocked)
+                        scsi_block_requests(ioa_cfg->host);
+        }
        if (!ioa_cfg->scan_enabled) {
                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                return;
@@ -7211,9 +7221,8 @@ static int ipr_ioa_bringdown_done(struct ipr_cmnd *ipr_cmd)
        ENTER;
        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
                ipr_trace;
-                spin_unlock_irq(ioa_cfg->host->host_lock);
+                ioa_cfg->scsi_unblock = 1;
-                scsi_unblock_requests(ioa_cfg->host);
+                schedule_work(&ioa_cfg->work_q);
-                spin_lock_irq(ioa_cfg->host->host_lock);
        }
        ioa_cfg->in_reset_reload = 0;
@@ -7287,13 +7296,7 @@ static int ipr_ioa_reset_done(struct ipr_cmnd *ipr_cmd)
        list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
        wake_up_all(&ioa_cfg->reset_wait_q);
-        spin_unlock(ioa_cfg->host->host_lock);
+        ioa_cfg->scsi_unblock = 1;
-        scsi_unblock_requests(ioa_cfg->host);
-        spin_lock(ioa_cfg->host->host_lock);
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds)
-                scsi_block_requests(ioa_cfg->host);
        schedule_work(&ioa_cfg->work_q);
        LEAVE;
        return IPR_RC_JOB_RETURN;
@@ -9249,8 +9252,11 @@ static void _ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                spin_unlock(&ioa_cfg->hrrq[i]._lock);
        }
        wmb();
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa)
+        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 1;
                scsi_block_requests(ioa_cfg->host);
+        }
        ipr_cmd = ipr_get_free_ipr_cmnd(ioa_cfg);
        ioa_cfg->reset_cmd = ipr_cmd;
@@ -9306,9 +9312,8 @@ static void ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                        wake_up_all(&ioa_cfg->reset_wait_q);
                        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
-                                spin_unlock_irq(ioa_cfg->host->host_lock);
+                                ioa_cfg->scsi_unblock = 1;
-                                scsi_unblock_requests(ioa_cfg->host);
+                                schedule_work(&ioa_cfg->work_q);
-                                spin_lock_irq(ioa_cfg->host->host_lock);
                        }
                        return;
                } else {
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index e98a87a65335..c7f0e9e3cd7d 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1488,6 +1488,8 @@ struct ipr_ioa_cfg {
        u8 cfg_locked:1;
        u8 clear_isr:1;
        u8 probe_done:1;
+        u8 scsi_unblock:1;
+        u8 scsi_blocked:1;
        u8 revid;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4ed48ed38e79..7ee1a94c0b33 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -205,8 +205,10 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                atomic_read(&tgtp->xmt_ls_rsp_error));
                len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Release %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
                                atomic_read(&tgtp->xmt_fcp_release),
                                atomic_read(&tgtp->rcv_fcp_cmd_drop));
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 5cc8b0f7d885..744f3f395b64 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -782,8 +782,11 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                atomic_read(&tgtp->xmt_ls_rsp_error));
                len += snprintf(buf + len, size - len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                atomic_read(&tgtp->rcv_fcp_cmd_drop));
                if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fbeec344c6cc..bbbd0f84160d 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -841,12 +841,31 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
+static void
+lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
+                     struct nvmefc_tgt_fcp_req *rsp)
+{
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct lpfc_nvmet_rcv_ctx *ctxp =
+                container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
+        struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
+        struct lpfc_hba *phba = ctxp->phba;
+        lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
+                         ctxp->oxid, ctxp->size, smp_processor_id());
+        tgtp = phba->targetport->private;
+        atomic_inc(&tgtp->rcv_fcp_cmd_defer);
+        lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
+}
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
        .targetport_delete = lpfc_nvmet_targetport_delete,
        .xmt_ls_rsp     = lpfc_nvmet_xmt_ls_rsp,
        .fcp_op         = lpfc_nvmet_xmt_fcp_op,
        .fcp_abort      = lpfc_nvmet_xmt_fcp_abort,
        .fcp_req_release = lpfc_nvmet_xmt_fcp_release,
+        .defer_rcv      = lpfc_nvmet_defer_rcv,
        .max_hw_queues  = 1,
        .max_sgl_segments = LPFC_NVMET_DEFAULT_SEGS,
@@ -1504,6 +1523,17 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                return;
        }
+        /* Processing of FCP command is deferred */
+        if (rc == -EOVERFLOW) {
+                lpfc_nvmeio_data(phba,
+                                 "NVMET RCV BUSY: xri x%x sz %d from %06x\n",
+                                 oxid, size, sid);
+                /* defer reposting rcv buffer till .defer_rcv callback */
+                ctxp->rqb_buffer = nvmebuf;
+                atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                return;
+        }
        atomic_inc(&tgtp->rcv_fcp_cmd_drop);
        lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                        "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index e675ef17be08..48a76788b003 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -49,6 +49,7 @@ struct lpfc_nvmet_tgtport {
        atomic_t rcv_fcp_cmd_in;
        atomic_t rcv_fcp_cmd_out;
        atomic_t rcv_fcp_cmd_drop;
+        atomic_t rcv_fcp_cmd_defer;
        atomic_t xmt_fcp_release;
        /* Stats counters - lpfc_nvmet_xmt_fcp_op */
diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h
index 4d038926a455..351f06dfc5a0 100644
--- a/drivers/scsi/qedf/qedf.h
+++ b/drivers/scsi/qedf/qedf.h
@@ -528,7 +528,8 @@ struct fip_vlan {
 #define QEDF_WRITE                    (1 << 0)
 #define MAX_FIBRE_LUNS                  0xffffffff
-#define QEDF_MAX_NUM_CQS                8
+#define MIN_NUM_CPUS_MSIX(x)    min_t(u32, x->dev_info.num_cqs, \
+                                        num_online_cpus())
 /*
 * PCI function probe defines
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 7786c97e033f..1d13c9ca517d 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2760,11 +2760,9 @@ static int qedf_set_fcoe_pf_param(struct qedf_ctx *qedf)
         * we allocation is the minimum off:
         *
         * Number of CPUs
-         * Number of MSI-X vectors
+         * Number allocated by qed for our PCI function
-         * Max number allocated in hardware (QEDF_MAX_NUM_CQS)
         */
-        qedf->num_queues = min((unsigned int)QEDF_MAX_NUM_CQS,
+        qedf->num_queues = MIN_NUM_CPUS_MSIX(qedf);
-            num_online_cpus());
        QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC, "Number of CQs is %d.\n",
                   qedf->num_queues);
@@ -2962,6 +2960,13 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
                goto err1;
        }
+        /* Learn information crucial for qedf to progress */
+        rc = qed_ops->fill_dev_info(qedf->cdev, &qedf->dev_info);
+        if (rc) {
+                QEDF_ERR(&(qedf->dbg_ctx), "Failed to dev info.\n");
+                goto err1;
+        }
        /* queue allocation code should come here
         * order should be
         *      slowpath_start
@@ -2977,13 +2982,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
        }
        qed_ops->common->update_pf_params(qedf->cdev, &qedf->pf_params);
-        /* Learn information crucial for qedf to progress */
-        rc = qed_ops->fill_dev_info(qedf->cdev, &qedf->dev_info);
-        if (rc) {
-                QEDF_ERR(&(qedf->dbg_ctx), "Failed to dev info.\n");
-                goto err1;
-        }
        /* Record BDQ producer doorbell addresses */
        qedf->bdq_primary_prod = qedf->dev_info.primary_dbq_rq_addr;
        qedf->bdq_secondary_prod = qedf->dev_info.secondary_bdq_rq_addr;
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 33142610882f..b18646d6057f 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -401,9 +401,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
                        if (req || !buf) {
                                length = req ?
                                    req->length : REQUEST_ENTRY_CNT_24XX;
@@ -418,9 +415,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
                        if (rsp || !buf) {
                                length = rsp ?
                                    rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -660,9 +654,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
                        if (req || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
@@ -675,9 +666,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
                        if (rsp || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index b20da0d27ad7..3f82ea1b72dc 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -500,7 +500,6 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
        struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
-        unsigned long flags;
        /*
         * Ensure that the complete FCP WRITE payload has been received.
@@ -508,17 +507,6 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
         */
        cmd->cmd_in_wq = 0;
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        cmd->data_work = 1;
-        if (cmd->aborted) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
        cmd->qpair->tgt_counters.qla_core_ret_ctio++;
        if (!cmd->write_data_transferred) {
                /*
@@ -765,31 +753,13 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
        qlt_xmit_tm_rsp(mcmd);
 }
-#define DATA_WORK_NOT_FREE(_cmd) (_cmd->data_work && !_cmd->data_work_free)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
        struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                struct qla_tgt_cmd, se_cmd);
-        unsigned long flags;
        if (qlt_abort_cmd(cmd))
                return;
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        if ((cmd->state == QLA_TGT_STATE_NEW)||
-            ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
-                DATA_WORK_NOT_FREE(cmd))) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-                /*
-                 * cmd has not reached fw, Use this trigger to free it.
-                 */
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-        return;
 }
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index f1cdf32d7514..8927f9f54ad9 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -99,7 +99,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
        ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                NULL, SES_TIMEOUT, SES_RETRIES, NULL);
-        if (unlikely(!ret))
+        if (unlikely(ret))
                return ret;
        recv_page_code = ((unsigned char *)buf)[0];
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 4fe606b000b4..d7ff71e0c85c 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -751,35 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
        return count;
 }
-static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
-{
-        switch (hp->dxfer_direction) {
-        case SG_DXFER_NONE:
-                if (hp->dxferp || hp->dxfer_len > 0)
-                        return false;
-                return true;
-        case SG_DXFER_FROM_DEV:
-                /*
-                 * for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp
-                 * can either be NULL or != NULL so there's no point in checking
-                 * it either. So just return true.
-                 */
-                return true;
-        case SG_DXFER_TO_DEV:
-        case SG_DXFER_TO_FROM_DEV:
-                if (!hp->dxferp || hp->dxfer_len == 0)
-                        return false;
-                return true;
-        case SG_DXFER_UNKNOWN:
-                if ((!hp->dxferp && hp->dxfer_len) ||
-                    (hp->dxferp && hp->dxfer_len == 0))
-                        return false;
-                return true;
-        default:
-                return false;
-        }
-}
 static int
 sg_common_write(Sg_fd * sfp, Sg_request * srp,
                unsigned char *cmnd, int timeout, int blocking)
@@ -800,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
                        "sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
                        (int) cmnd[0], (int) hp->cmd_len));
-        if (!sg_is_valid_dxfer(hp))
+        if (hp->dxfer_len >= SZ_256M)
                return -EINVAL;
        k = sg_start_req(srp, cmnd);
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 8e5013d9cad4..94e402ed30f6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4299,11 +4299,11 @@ static int st_probe(struct device *dev)
        kref_init(&tpnt->kref);
        tpnt->disk = disk;
        disk->private_data = &tpnt->driver;
-        disk->queue = SDp->request_queue;
        /* SCSI tape doesn't register this gendisk via add_disk().  Manually
         * take queue reference that release_disk() expects. */
-        if (!blk_get_queue(disk->queue))
+        if (!blk_get_queue(SDp->request_queue))
                goto out_put_disk;
+        disk->queue = SDp->request_queue;
        tpnt->driver = &st_template;
        tpnt->device = SDp;
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index 3039072911a5..afc7ecc3c187 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -200,16 +200,11 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
        domain->dev = &pdev->dev;
-        ret = pm_genpd_init(&domain->genpd, NULL, true);
-        if (ret) {
-                dev_err(domain->dev, "Failed to init power domain\n");
-                return ret;
-        }
        domain->regulator = devm_regulator_get_optional(domain->dev, "power");
        if (IS_ERR(domain->regulator)) {
                if (PTR_ERR(domain->regulator) != -ENODEV) {
-                        dev_err(domain->dev, "Failed to get domain's regulator\n");
+                        if (PTR_ERR(domain->regulator) != -EPROBE_DEFER)
+                                dev_err(domain->dev, "Failed to get domain's regulator\n");
                        return PTR_ERR(domain->regulator);
                }
        } else {
@@ -217,6 +212,12 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
                                      domain->voltage, domain->voltage);
        }
+        ret = pm_genpd_init(&domain->genpd, NULL, true);
+        if (ret) {
+                dev_err(domain->dev, "Failed to init power domain\n");
+                return ret;
+        }
        ret = of_genpd_add_provider_simple(domain->dev->of_node,
                                           &domain->genpd);
        if (ret) {
diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
index b0b283810e72..de31b9389e2e 100644
--- a/drivers/soc/ti/ti_sci_pm_domains.c
+++ b/drivers/soc/ti/ti_sci_pm_domains.c
@@ -176,6 +176,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
        ti_sci_pd->dev = dev;
+        ti_sci_pd->pd.name = "ti_sci_pd";
        ti_sci_pd->pd.attach_dev = ti_sci_pd_attach_dev;
        ti_sci_pd->pd.detach_dev = ti_sci_pd_detach_dev;
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index ca11be21f64b..34ca7823255d 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
                        continue;
                }
+                set_current_state(TASK_RUNNING);
                wp = async->buf_write_ptr;
                n1 = min(n, async->prealloc_bufsz - wp);
                n2 = n - n1;
@@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
                        }
                        continue;
                }
+                set_current_state(TASK_RUNNING);
                rp = async->buf_read_ptr;
                n1 = min(n, async->prealloc_bufsz - rp);
                n2 = n - n1;
diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c
index a6a8393d6664..3e00df74b18c 100644
--- a/drivers/staging/iio/resolver/ad2s1210.c
+++ b/drivers/staging/iio/resolver/ad2s1210.c
@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev,
                             long m)
 {
        struct ad2s1210_state *st = iio_priv(indio_dev);
-        bool negative;
+        u16 negative;
        int ret = 0;
        u16 pos;
        s16 vel;
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index e583dd8a418b..d4fa41be80f9 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -1510,11 +1510,13 @@ cxgbit_pass_open_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
        if (!cnp) {
                pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
        }
        cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
        cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 static void
@@ -1530,11 +1532,13 @@ cxgbit_close_listsrv_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
        if (!cnp) {
                pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
        }
        cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
        cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 static void
@@ -1819,12 +1823,16 @@ static void cxgbit_set_tcb_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
        struct tid_info *t = lldi->tids;
        csk = lookup_tid(t, tid);
-        if (unlikely(!csk))
+        if (unlikely(!csk)) {
                pr_err("can't find connection for tid %u.\n", tid);
-        else
+                goto rel_skb;
+        } else {
                cxgbit_wake_up(&csk->com.wr_wait, __func__, rpl->status);
+        }
        cxgbit_put_csk(csk);
+rel_skb:
+        __kfree_skb(skb);
 }
 static void cxgbit_rx_data(struct cxgbit_device *cdev, struct sk_buff *skb)
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index dda13f1af38e..514986b57c2d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -827,7 +827,7 @@ cxgbit_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
 static void
 cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
-                      unsigned int nents)
+                      unsigned int nents, u32 skip)
 {
        struct skb_seq_state st;
        const u8 *buf;
@@ -846,7 +846,7 @@ cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
                }
                consumed += sg_pcopy_from_buffer(sg, nents, (void *)buf,
-                                                 buf_len, consumed);
+                                                 buf_len, skip + consumed);
        }
 }
@@ -912,7 +912,7 @@ cxgbit_handle_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
                struct scatterlist *sg = &cmd->se_cmd.t_data_sg[0];
                u32 sg_nents = max(1UL, DIV_ROUND_UP(pdu_cb->dlen, PAGE_SIZE));
-                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents, 0);
        }
        cmd->write_data_done += pdu_cb->dlen;
@@ -1069,11 +1069,13 @@ static int cxgbit_handle_iscsi_dataout(struct cxgbit_sock *csk)
                  cmd->se_cmd.data_length);
        if (!(pdu_cb->flags & PDUCBF_RX_DATA_DDPD)) {
+                u32 skip = data_offset % PAGE_SIZE;
                sg_off = data_offset / PAGE_SIZE;
                sg_start = &cmd->se_cmd.t_data_sg[sg_off];
-                sg_nents = max(1UL, DIV_ROUND_UP(data_len, PAGE_SIZE));
+                sg_nents = max(1UL, DIV_ROUND_UP(skip + data_len, PAGE_SIZE));
-                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents, skip);
        }
 check_payload:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 74e4975dd1b1..5001261f5d69 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -418,6 +418,7 @@ int iscsit_reset_np_thread(
                return 0;
        }
        np->np_thread_state = ISCSI_NP_THREAD_RESET;
+        atomic_inc(&np->np_reset_count);
        if (np->np_thread) {
                spin_unlock_bh(&np->np_thread_lock);
@@ -2167,6 +2168,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
        cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
        cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
        cmd->data_direction     = DMA_NONE;
+        kfree(cmd->text_in_ptr);
        cmd->text_in_ptr        = NULL;
        return 0;
@@ -3487,9 +3489,9 @@ iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                return text_length;
        if (completed) {
-                hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+                hdr->flags = ISCSI_FLAG_CMD_FINAL;
        } else {
-                hdr->flags |= ISCSI_FLAG_TEXT_CONTINUE;
+                hdr->flags = ISCSI_FLAG_TEXT_CONTINUE;
                cmd->read_data_done += text_length;
                if (cmd->targ_xfer_tag == 0xFFFFFFFF)
                        cmd->targ_xfer_tag = session_get_next_ttt(conn->sess);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index e9bdc8b86e7d..dc13afbd4c88 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1243,9 +1243,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
        flush_signals(current);
        spin_lock_bh(&np->np_thread_lock);
-        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+        if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
                np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+                spin_unlock_bh(&np->np_thread_lock);
                complete(&np->np_restart_comp);
+                return 1;
        } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
                spin_unlock_bh(&np->np_thread_lock);
                goto exit;
@@ -1278,7 +1280,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                goto exit;
        } else if (rc < 0) {
                spin_lock_bh(&np->np_thread_lock);
-                if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+                if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+                        np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                        spin_unlock_bh(&np->np_thread_lock);
                        complete(&np->np_restart_comp);
                        iscsit_put_transport(conn->conn_transport);
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 36913734c6bc..02e8a5d86658 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl)
        mutex_lock(&tpg->acl_node_mutex);
        if (acl->dynamic_node_acl)
                acl->dynamic_node_acl = 0;
-        list_del(&acl->acl_list);
+        list_del_init(&acl->acl_list);
        mutex_unlock(&tpg->acl_node_mutex);
        target_shutdown_sessions(acl);
@@ -548,7 +548,7 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
         * in transport_deregister_session().
         */
        list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) {
-                list_del(&nacl->acl_list);
+                list_del_init(&nacl->acl_list);
                core_tpg_wait_for_nacl_pr_ref(nacl);
                core_free_device_list_for_node(nacl, se_tpg);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 97fed9a298bd..836d552b0385 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -466,7 +466,7 @@ static void target_complete_nacl(struct kref *kref)
        }
        mutex_lock(&se_tpg->acl_node_mutex);
-        list_del(&nacl->acl_list);
+        list_del_init(&nacl->acl_list);
        mutex_unlock(&se_tpg->acl_node_mutex);
        core_tpg_wait_for_nacl_pr_ref(nacl);
@@ -538,7 +538,7 @@ void transport_free_session(struct se_session *se_sess)
                        spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
                        if (se_nacl->dynamic_stop)
-                                list_del(&se_nacl->acl_list);
+                                list_del_init(&se_nacl->acl_list);
                }
                mutex_unlock(&se_tpg->acl_node_mutex);
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 80ee130f8253..942d094269fb 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -563,8 +563,6 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                        block_remaining);
                        to_offset = get_block_offset_user(udev, dbi,
                                        block_remaining);
-                        offset = DATA_BLOCK_SIZE - block_remaining;
-                        to += offset;
                        if (*iov_cnt != 0 &&
                            to_offset == iov_tail(*iov)) {
@@ -575,8 +573,10 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                (*iov)->iov_len = copy_bytes;
                        }
                        if (copy_data) {
-                                memcpy(to, from + sg->length - sg_remaining,
+                                offset = DATA_BLOCK_SIZE - block_remaining;
-                                        copy_bytes);
+                                memcpy(to + offset,
+                                       from + sg->length - sg_remaining,
+                                       copy_bytes);
                                tcmu_flush_dcache_range(to, copy_bytes);
                        }
                        sg_remaining -= copy_bytes;
@@ -637,9 +637,8 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
                        copy_bytes = min_t(size_t, sg_remaining,
                                        block_remaining);
                        offset = DATA_BLOCK_SIZE - block_remaining;
-                        from += offset;
                        tcmu_flush_dcache_range(from, copy_bytes);
-                        memcpy(to + sg->length - sg_remaining, from,
+                        memcpy(to + sg->length - sg_remaining, from + offset,
                                        copy_bytes);
                        sg_remaining -= copy_bytes;
@@ -1433,6 +1432,8 @@ static int tcmu_update_uio_info(struct tcmu_dev *udev)
        if (udev->dev_config[0])
                snprintf(str + used, size - used, "/%s", udev->dev_config);
+        /* If the old string exists, free it */
+        kfree(info->name);
        info->name = str;
        return 0;
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 308b6e17c88a..fe2f00ceafc5 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -333,6 +333,15 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
        int res;
        enum tb_port_type type;
+        /*
+         * Some DROMs list more ports than the controller actually has
+         * so we skip those but allow the parser to continue.
+         */
+        if (header->index > sw->config.max_port_number) {
+                dev_info_once(&sw->dev, "ignoring unnecessary extra entries in DROM\n");
+                return 0;
+        }
        port = &sw->ports[header->index];
        port->disabled = header->port_disabled;
        if (port->disabled)
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 284749fb0f6b..1fc80ea87c13 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -793,6 +793,7 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        struct tty_struct *tty;
        struct path *pts_path;
        struct dentry *dentry;
+        struct vfsmount *mnt;
        int retval;
        int index;
@@ -805,7 +806,7 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        if (retval)
                return retval;
-        fsi = devpts_acquire(filp);
+        fsi = devpts_acquire(filp, &mnt);
        if (IS_ERR(fsi)) {
                retval = PTR_ERR(fsi);
                goto out_free_file;
@@ -849,7 +850,7 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        pts_path = kmalloc(sizeof(struct path), GFP_KERNEL);
        if (!pts_path)
                goto err_release;
-        pts_path->mnt = filp->f_path.mnt;
+        pts_path->mnt = mnt;
        pts_path->dentry = dentry;
        path_get(pts_path);
        tty->link->driver_data = pts_path;
@@ -866,6 +867,7 @@ err_path_put:
        path_put(pts_path);
        kfree(pts_path);
 err_release:
+        mntput(mnt);
        tty_unlock(tty);
        // This will also put-ref the fsi
        tty_release(inode, filp);
@@ -874,6 +876,7 @@ out:
        devpts_kill_index(fsi, index);
 out_put_fsi:
        devpts_release(fsi);
+        mntput(mnt);
 out_free_file:
        tty_free_file(filp);
        return retval;
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b5def356af63..1aab3010fbfa 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1043,13 +1043,24 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                if (up->dl_write)
                        uart->dl_write = up->dl_write;
-                if (serial8250_isa_config != NULL)
+                if (uart->port.type != PORT_8250_CIR) {
-                        serial8250_isa_config(0, &uart->port,
+                        if (serial8250_isa_config != NULL)
-                                        &uart->capabilities);
+                                serial8250_isa_config(0, &uart->port,
+                                                &uart->capabilities);
+                        ret = uart_add_one_port(&serial8250_reg,
+                                                &uart->port);
+                        if (ret == 0)
+                                ret = uart->port.line;
+                } else {
+                        dev_info(uart->port.dev,
+                                "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+                                uart->port.iobase,
+                                (unsigned long long)uart->port.mapbase,
+                                uart->port.irq);
-                ret = uart_add_one_port(&serial8250_reg, &uart->port);
+                        ret = 0;
-                if (ret == 0)
+                }
-                        ret = uart->port.line;
        }
        mutex_unlock(&serial_mutex);
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8a857bb34fbb..1888d168a41c 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -142,15 +142,7 @@ static struct vendor_data vendor_sbsa = {
        .fixed_options          = true,
 };
-/*
+#ifdef CONFIG_ACPI_SPCR_TABLE
- * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
- * occasionally getting stuck as 1. To avoid the potential for a hang, check
- * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
- * implementations, so only do so if an affected platform is detected in
- * parse_spcr().
- */
-static bool qdf2400_e44_present = false;
 static struct vendor_data vendor_qdt_qdf2400_e44 = {
        .reg_offset             = pl011_std_offsets,
        .fr_busy                = UART011_FR_TXFE,
@@ -165,6 +157,7 @@ static struct vendor_data vendor_qdt_qdf2400_e44 = {
        .always_enabled         = true,
        .fixed_options          = true,
 };
+#endif
 static u16 pl011_st_offsets[REG_ARRAY_SIZE] = {
        [REG_DR] = UART01x_DR,
@@ -2375,12 +2368,14 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
        resource_size_t addr;
        int i;
-        if (strcmp(name, "qdf2400_e44") == 0) {
+        /*
-                pr_info_once("UART: Working around QDF2400 SoC erratum 44");
+         * Systems affected by the Qualcomm Technologies QDF2400 E44 erratum
-                qdf2400_e44_present = true;
+         * have a distinct console name, so make sure we check for that.
-        } else if (strcmp(name, "pl011") != 0) {
+         * The actual implementation of the erratum occurs in the probe
+         * function.
+         */
+        if ((strcmp(name, "qdf2400_e44") != 0) && (strcmp(name, "pl011") != 0))
                return -ENODEV;
-        }
        if (uart_parse_earlycon(options, &iotype, &addr, &options))
                return -ENODEV;
@@ -2734,11 +2729,17 @@ static int sbsa_uart_probe(struct platform_device *pdev)
        }
        uap->port.irq   = ret;
-        uap->reg_offset = vendor_sbsa.reg_offset;
+#ifdef CONFIG_ACPI_SPCR_TABLE
-        uap->vendor     = qdf2400_e44_present ?
+        if (qdf2400_e44_present) {
-                                        &vendor_qdt_qdf2400_e44 : &vendor_sbsa;
+                dev_info(&pdev->dev, "working around QDF2400 SoC erratum 44\n");
+                uap->vendor = &vendor_qdt_qdf2400_e44;
+        } else
+#endif
+                uap->vendor = &vendor_sbsa;
+        uap->reg_offset = uap->vendor->reg_offset;
        uap->fifosize   = 32;
-        uap->port.iotype = vendor_sbsa.access_32b ? UPIO_MEM32 : UPIO_MEM;
+        uap->port.iotype = uap->vendor->access_32b ? UPIO_MEM32 : UPIO_MEM;
        uap->port.ops   = &sbsa_uart_pops;
        uap->fixed_baud = baudrate;
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index ab1bb3b538ac..7f277b092b5b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1888,7 +1888,7 @@ void usb_hcd_flush_endpoint(struct usb_device *udev,
        /* No more submits can occur */
        spin_lock_irq(&hcd_urb_list_lock);
 rescan:
-        list_for_each_entry (urb, &ep->urb_list, urb_list) {
+        list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) {
                int     is_in;
                if (urb->unlinked)
@@ -2485,6 +2485,8 @@ void usb_hc_died (struct usb_hcd *hcd)
        }
        if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
                hcd = hcd->shared_hcd;
+                clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
+                set_bit(HCD_FLAG_DEAD, &hcd->flags);
                if (hcd->rh_registered) {
                        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 6e6797d145dd..822f8c50e423 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4725,7 +4725,8 @@ hub_power_remaining(struct usb_hub *hub)
 static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                u16 portchange)
 {
-        int status, i;
+        int status = -ENODEV;
+        int i;
        unsigned unit_load;
        struct usb_device *hdev = hub->hdev;
        struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
@@ -4929,9 +4930,10 @@ loop:
 done:
        hub_port_disable(hub, port1, 1);
-        if (hcd->driver->relinquish_port && !hub->hdev->parent)
+        if (hcd->driver->relinquish_port && !hub->hdev->parent) {
-                hcd->driver->relinquish_port(hcd, port1);
+                if (status != -ENOTCONN && status != -ENODEV)
+                        hcd->driver->relinquish_port(hcd, port1);
+        }
 }
 /* Handle physical or logical connection change events.
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 3116edfcdc18..574da2b4529c 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -150,6 +150,9 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* appletouch */
        { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
+        { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
        /* Avision AV600U */
        { USB_DEVICE(0x0638, 0x0a13), .driver_info =
          USB_QUIRK_STRING_FETCH_255 },
@@ -249,6 +252,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
        { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
        { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
        { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
+        { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
        /* Logitech Optical Mouse M90/M100 */
        { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6b299c7b7656..f064f1549333 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -896,9 +896,40 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                if (!node) {
                        trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS_FIRST;
+                        /*
+                         * USB Specification 2.0 Section 5.9.2 states that: "If
+                         * there is only a single transaction in the microframe,
+                         * only a DATA0 data packet PID is used.  If there are
+                         * two transactions per microframe, DATA1 is used for
+                         * the first transaction data packet and DATA0 is used
+                         * for the second transaction data packet.  If there are
+                         * three transactions per microframe, DATA2 is used for
+                         * the first transaction data packet, DATA1 is used for
+                         * the second, and DATA0 is used for the third."
+                         *
+                         * IOW, we should satisfy the following cases:
+                         *
+                         * 1) length <= maxpacket
+                         *      - DATA0
+                         *
+                         * 2) maxpacket < length <= (2 * maxpacket)
+                         *      - DATA1, DATA0
+                         *
+                         * 3) (2 * maxpacket) < length <= (3 * maxpacket)
+                         *      - DATA2, DATA1, DATA0
+                         */
                        if (speed == USB_SPEED_HIGH) {
                                struct usb_ep *ep = &dep->endpoint;
-                                trb->size |= DWC3_TRB_SIZE_PCM1(ep->mult - 1);
+                                unsigned int mult = ep->mult - 1;
+                                unsigned int maxp = usb_endpoint_maxp(ep->desc);
+                                if (length <= (2 * maxp))
+                                        mult--;
+                                if (length <= maxp)
+                                        mult--;
+                                trb->size |= DWC3_TRB_SIZE_PCM1(mult);
                        }
                } else {
                        trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 62dc9c7798e7..e1de8fe599a3 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -838,21 +838,32 @@ static struct renesas_usb3_request *usb3_get_request(struct renesas_usb3_ep
        return usb3_req;
 }
-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
-                              struct renesas_usb3_request *usb3_req, int status)
+                                struct renesas_usb3_request *usb3_req,
+                                int status)
 {
        struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
-        unsigned long flags;
        dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n",
                usb3_ep->num, usb3_req->req.length, usb3_req->req.actual,
                status);
        usb3_req->req.status = status;
-        spin_lock_irqsave(&usb3->lock, flags);
        usb3_ep->started = false;
        list_del_init(&usb3_req->queue);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+        spin_unlock(&usb3->lock);
        usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req);
+        spin_lock(&usb3->lock);
+}
+static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+                              struct renesas_usb3_request *usb3_req, int status)
+{
+        struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+        unsigned long flags;
+        spin_lock_irqsave(&usb3->lock, flags);
+        __usb3_request_done(usb3_ep, usb3_req, status);
+        spin_unlock_irqrestore(&usb3->lock, flags);
 }
 static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index c8989c62a262..c8f38649f749 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -98,6 +98,7 @@ enum amd_chipset_gen {
        AMD_CHIPSET_HUDSON2,
        AMD_CHIPSET_BOLTON,
        AMD_CHIPSET_YANGTZE,
+        AMD_CHIPSET_TAISHAN,
        AMD_CHIPSET_UNKNOWN,
 };
@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
                        pinfo->sb_type.gen = AMD_CHIPSET_SB700;
                else if (rev >= 0x40 && rev <= 0x4f)
                        pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+        }
+        pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                          0x145c, NULL);
+        if (pinfo->smbus_dev) {
+                pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
        } else {
                pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
                                PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev)
 {
        /* Make sure amd chipset type has already been initialized */
        usb_amd_find_chipset_info();
-        if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
+        if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
-                return 0;
+            amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
+                dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
-        dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+                return 1;
-        return 1;
+        }
+        return 0;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
@@ -1150,3 +1157,23 @@ static void quirk_usb_early_handoff(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
                        PCI_CLASS_SERIAL_USB, 8, quirk_usb_early_handoff);
+bool usb_xhci_needs_pci_reset(struct pci_dev *pdev)
+{
+        /*
+         * Our dear uPD72020{1,2} friend only partially resets when
+         * asked to via the XHCI interface, and may end up doing DMA
+         * at the wrong addresses, as it keeps the top 32bit of some
+         * addresses from its previous programming under obscure
+         * circumstances.
+         * Give it a good wack at probe time. Unfortunately, this
+         * needs to happen before we've had a chance to discover any
+         * quirk, or the system will be in a rather bad state.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+            (pdev->device == 0x0014 || pdev->device == 0x0015))
+                return true;
+        return false;
+}
+EXPORT_SYMBOL_GPL(usb_xhci_needs_pci_reset);
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 655994480198..5582cbafecd4 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,7 @@ void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev);
 void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
+bool usb_xhci_needs_pci_reset(struct pci_dev *pdev);
 #else
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5b0fa553c8bc..8071c8fdd15e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -284,6 +284,13 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
        driver = (struct hc_driver *)id->driver_data;
+        /* For some HW implementation, a XHCI reset is just not enough... */
+        if (usb_xhci_needs_pci_reset(dev)) {
+                dev_info(&dev->dev, "Resetting\n");
+                if (pci_reset_function_locked(dev))
+                        dev_warn(&dev->dev, "Reset failed");
+        }
        /* Prevent runtime suspending between USB-2 and USB-3 initialization */
        pm_runtime_get_noresume(&dev->dev);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 76decb8011eb..3344ffd5bb13 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
                                "Could not flush host TX%d fifo: csr: %04x\n",
                                ep->epnum, csr))
                        return;
+                mdelay(1);
        }
 }
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 8fb86a5f458e..3d0dd2f97415 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -197,6 +197,7 @@ struct msm_otg {
        struct regulator *v3p3;
        struct regulator *v1p8;
        struct regulator *vddcx;
+        struct regulator_bulk_data supplies[3];
        struct reset_control *phy_rst;
        struct reset_control *link_rst;
@@ -1731,7 +1732,6 @@ static int msm_otg_reboot_notify(struct notifier_block *this,
 static int msm_otg_probe(struct platform_device *pdev)
 {
-        struct regulator_bulk_data regs[3];
        int ret = 0;
        struct device_node *np = pdev->dev.of_node;
        struct msm_otg_platform_data *pdata;
@@ -1817,17 +1817,18 @@ static int msm_otg_probe(struct platform_device *pdev)
                return motg->irq;
        }
-        regs[0].supply = "vddcx";
+        motg->supplies[0].supply = "vddcx";
-        regs[1].supply = "v3p3";
+        motg->supplies[1].supply = "v3p3";
-        regs[2].supply = "v1p8";
+        motg->supplies[2].supply = "v1p8";
-        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(regs), regs);
+        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(motg->supplies),
+                                      motg->supplies);
        if (ret)
                return ret;
-        motg->vddcx = regs[0].consumer;
+        motg->vddcx = motg->supplies[0].consumer;
-        motg->v3p3  = regs[1].consumer;
+        motg->v3p3  = motg->supplies[1].consumer;
-        motg->v1p8  = regs[2].consumer;
+        motg->v1p8  = motg->supplies[2].consumer;
        clk_set_rate(motg->clk, 60000000);
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 93fba9033b00..2c8161bcf5b5 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -639,14 +639,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
        struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
        struct usbhs_pipe *pipe;
        unsigned long flags;
-        int ret = 0;
        spin_lock_irqsave(&uep->lock, flags);
        pipe = usbhsg_uep_to_pipe(uep);
-        if (!pipe) {
+        if (!pipe)
-                ret = -EINVAL;
                goto out;
-        }
        usbhsg_pipe_disable(uep);
        usbhs_pipe_free(pipe);
diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
index d544b331c9f2..02b67abfc2a1 100644
--- a/drivers/usb/renesas_usbhs/rcar3.c
+++ b/drivers/usb/renesas_usbhs/rcar3.c
@@ -20,9 +20,13 @@
 /* Low Power Status register (LPSTS) */
 #define LPSTS_SUSPM     0x4000
-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */
+/*
+ * USB General control register 2 (UGCTRL2)
+ * Remarks: bit[31:11] and bit[9:6] should be 0
+ */
 #define UGCTRL2_RESERVED_3      0x00000001      /* bit[3:0] should be B'0001 */
 #define UGCTRL2_USB0SEL_OTG     0x00000030
+#define UGCTRL2_VBUSSEL         0x00000400
 static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data)
 {
@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
 {
        struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
-        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
+        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG |
+                      UGCTRL2_VBUSSEL);
        if (enable) {
                usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f64e914a8985..2d945c9f975c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -142,6 +142,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
        { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
        { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+        { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ebe51f11105d..fe123153b1a5 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2025,6 +2025,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },                   /* D-Link DWM-158 */
        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),                     /* D-Link DWM-221 B1 */
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c9ebefd8f35f..a585b477415d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -52,6 +52,8 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
                .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
+        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485),
+                .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
        { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
        { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 09d9be88209e..3b5a15d1dc0d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
+#define ATEN_PRODUCT_UC485      0x2021
 #define ATEN_PRODUCT_ID2        0x2118
 #define IODATA_VENDOR_ID        0x04bb
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index cbea9f329e71..cde115359793 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
 /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
 UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
                "Initio Corporation",
-                "",
+                "INIC-3069",
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_ATA_1X),
+                US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 06615934fed1..0dceb9fa3a06 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -315,6 +315,7 @@ static int usb_stor_control_thread(void * __us)
 {
        struct us_data *us = (struct us_data *)__us;
        struct Scsi_Host *host = us_to_host(us);
+        struct scsi_cmnd *srb;
        for (;;) {
                usb_stor_dbg(us, "*** thread sleeping\n");
@@ -330,6 +331,7 @@ static int usb_stor_control_thread(void * __us)
                scsi_lock(host);
                /* When we are called with no command pending, we're done */
+                srb = us->srb;
                if (us->srb == NULL) {
                        scsi_unlock(host);
                        mutex_unlock(&us->dev_mutex);
@@ -398,14 +400,11 @@ static int usb_stor_control_thread(void * __us)
                /* lock access to the state */
                scsi_lock(host);
-                /* indicate that the command is done */
+                /* was the command aborted? */
-                if (us->srb->result != DID_ABORT << 16) {
+                if (us->srb->result == DID_ABORT << 16) {
-                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
-                                     us->srb->result);
-                        us->srb->scsi_done(us->srb);
-                } else {
 SkipForAbort:
                        usb_stor_dbg(us, "scsi command aborted\n");
+                        srb = NULL;     /* Don't call srb->scsi_done() */
                }
                /*
@@ -429,6 +428,13 @@ SkipForAbort:
                /* unlock the device pointers */
                mutex_unlock(&us->dev_mutex);
+                /* now that the locks are released, notify the SCSI core */
+                if (srb) {
+                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
+                                        srb->result);
+                        srb->scsi_done(srb);
+                }
        } /* for (;;) */
        /* Wait until we are told to stop */
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index ff01bed7112f..1e784adb89b1 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -17,6 +17,7 @@
 #include <asm/efi.h>
 static bool request_mem_succeeded = false;
+static bool nowc = false;
 static struct fb_var_screeninfo efifb_defined = {
        .activate               = FB_ACTIVATE_NOW,
@@ -99,6 +100,8 @@ static int efifb_setup(char *options)
                                screen_info.lfb_height = simple_strtoul(this_opt+7, NULL, 0);
                        else if (!strncmp(this_opt, "width:", 6))
                                screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
+                        else if (!strcmp(this_opt, "nowc"))
+                                nowc = true;
                }
        }
@@ -255,7 +258,10 @@ static int efifb_probe(struct platform_device *dev)
        info->apertures->ranges[0].base = efifb_fix.smem_start;
        info->apertures->ranges[0].size = size_remap;
-        info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
+        if (nowc)
+                info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
+        else
+                info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
        if (!info->screen_base) {
                pr_err("efifb: abort, cannot ioremap video memory 0x%x @ 0x%lx\n",
                        efifb_fix.smem_len, efifb_fix.smem_start);
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index c166e0725be5..ba82f97fb42b 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
        imxfb_disable_controller(fbi);
        unregister_framebuffer(info);
+        fb_dealloc_cmap(&info->cmap);
        pdata = dev_get_platdata(&pdev->dev);
        if (pdata && pdata->exit)
                pdata->exit(fbi->pdev);
-        fb_dealloc_cmap(&info->cmap);
-        kfree(info->pseudo_palette);
-        framebuffer_release(info);
        dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
                    fbi->map_dma);
        iounmap(fbi->regs);
        release_mem_region(res->start, resource_size(res));
+        kfree(info->pseudo_palette);
+        framebuffer_release(info);
        return 0;
 }
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/core.c b/drivers/video/fbdev/omap2/omapfb/dss/core.c
index eecf695c16f4..09e5bb013d28 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/core.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/core.c
@@ -193,7 +193,6 @@ static struct notifier_block omap_dss_pm_notif_block = {
 static int __init omap_dss_probe(struct platform_device *pdev)
 {
-        struct omap_dss_board_info *pdata = pdev->dev.platform_data;
        int r;
        core.pdev = pdev;
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
        unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
        unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
 #else
        /*
         * XXX: Add support for merging bio_vec when using different page
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index bae1f5d36c26..2d43118077e4 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -574,7 +574,7 @@ static void shutdown_pirq(struct irq_data *data)
 static void enable_pirq(struct irq_data *data)
 {
-        startup_pirq(data);
+        enable_dynirq(data);
 }
 static void disable_pirq(struct irq_data *data)
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index e46080214955..3e59590c7254 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -857,6 +857,8 @@ static int xenwatch_thread(void *unused)
        struct list_head *ent;
        struct xs_watch_event *event;
+        xenwatch_pid = current->pid;
        for (;;) {
                wait_event_interruptible(watch_events_waitq,
                                         !list_empty(&watch_events));
@@ -925,7 +927,6 @@ int xs_init(void)
        task = kthread_run(xenwatch_thread, NULL, "xenwatch");
        if (IS_ERR(task))
                return PTR_ERR(task);
-        xenwatch_pid = task->pid;
        /* shutdown watches for kexec boot */
        xs_reset_watches();
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 879ff9c7ffd0..6466153f2bf0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -664,8 +664,7 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
 {
        unsigned long random_variable = 0;
-        if ((current->flags & PF_RANDOMIZE) &&
+        if (current->flags & PF_RANDOMIZE) {
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
                random_variable = get_random_long();
                random_variable &= STACK_RND_MASK;
                random_variable <<= PAGE_SHIFT;
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 108df2e3602c..44dfbca9306f 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -133,7 +133,7 @@ static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
        return sb->s_fs_info;
 }
-struct pts_fs_info *devpts_acquire(struct file *filp)
+struct pts_fs_info *devpts_acquire(struct file *filp, struct vfsmount **ptsmnt)
 {
        struct pts_fs_info *result;
        struct path path;
@@ -142,6 +142,7 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
        path = filp->f_path;
        path_get(&path);
+        *ptsmnt = NULL;
        /* Has the devpts filesystem already been found? */
        sb = path.mnt->mnt_sb;
@@ -165,6 +166,7 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
         * pty code needs to hold extra references in case of last /dev/tty close
         */
        atomic_inc(&sb->s_active);
+        *ptsmnt = mntget(path.mnt);
        result = DEVPTS_SB(sb);
 out:
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 3ee4fdc3da9e..ab60051be6e5 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
 {
        struct fuse_file *ff;
-        ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
+        ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
        if (unlikely(!ff))
                return NULL;
@@ -609,7 +609,7 @@ static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req)
        struct fuse_io_priv *io = req->io;
        ssize_t pos = -1;
-        fuse_release_user_pages(req, !io->write);
+        fuse_release_user_pages(req, io->should_dirty);
        if (io->write) {
                if (req->misc.write.in.size != req->misc.write.out.size)
@@ -1316,7 +1316,6 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                       loff_t *ppos, int flags)
 {
        int write = flags & FUSE_DIO_WRITE;
-        bool should_dirty = !write && iter_is_iovec(iter);
        int cuse = flags & FUSE_DIO_CUSE;
        struct file *file = io->file;
        struct inode *inode = file->f_mapping->host;
@@ -1346,6 +1345,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                        inode_unlock(inode);
        }
+        io->should_dirty = !write && iter_is_iovec(iter);
        while (count) {
                size_t nres;
                fl_owner_t owner = current->files;
@@ -1360,7 +1360,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                        nres = fuse_send_read(req, io, pos, nbytes, owner);
                if (!io->async)
-                        fuse_release_user_pages(req, should_dirty);
+                        fuse_release_user_pages(req, io->should_dirty);
                if (req->out.h.error) {
                        err = req->out.h.error;
                        break;
@@ -1669,6 +1669,7 @@ err_nofile:
 err_free:
        fuse_request_free(req);
 err:
+        mapping_set_error(page->mapping, error);
        end_page_writeback(page);
        return error;
 }
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 1bd7ffdad593..bd4d2a3e1ec1 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -249,6 +249,7 @@ struct fuse_io_priv {
        size_t size;
        __u64 offset;
        bool write;
+        bool should_dirty;
        int err;
        struct kiocb *iocb;
        struct file *file;
diff --git a/fs/iomap.c b/fs/iomap.c
index 039266128b7f..59cc98ad7577 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -278,7 +278,7 @@ iomap_dirty_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
                unsigned long bytes;    /* Bytes to write to page */
                offset = (pos & (PAGE_SIZE - 1));
-                bytes = min_t(unsigned long, PAGE_SIZE - offset, length);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, length);
                rpage = __iomap_read_page(inode, pos);
                if (IS_ERR(rpage))
@@ -373,7 +373,7 @@ iomap_zero_range_actor(struct inode *inode, loff_t pos, loff_t count,
                unsigned offset, bytes;
                offset = pos & (PAGE_SIZE - 1); /* Within page */
-                bytes = min_t(unsigned, PAGE_SIZE - offset, count);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, count);
                if (IS_DAX(inode))
                        status = iomap_dax_zero(pos, offset, bytes, iomap);
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 69d02cf8cf37..5f93cfacb3d1 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -121,6 +121,7 @@ config PNFS_FILE_LAYOUT
 config PNFS_BLOCK
        tristate
        depends on NFS_V4_1 && BLK_DEV_DM
+        depends on 64BIT || LBDAF
        default NFS_V4
 config PNFS_FLEXFILE_LAYOUT
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 6df7a0cf5660..f32c58bbe556 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -32,6 +32,7 @@ void nfs4_ff_layout_free_deviceid(struct nfs4_ff_layout_ds *mirror_ds)
 {
        nfs4_print_deviceid(&mirror_ds->id_node.deviceid);
        nfs4_pnfs_ds_put(mirror_ds->ds);
+        kfree(mirror_ds->ds_versions);
        kfree_rcu(mirror_ds, id_node.rcu);
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ffd2e712595d..d90132642340 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2553,9 +2553,8 @@ static int nfs41_check_open_stateid(struct nfs4_state *state)
                clear_bit(NFS_O_RDWR_STATE, &state->flags);
                clear_bit(NFS_OPEN_STATE, &state->flags);
                stateid->type = NFS4_INVALID_STATEID_TYPE;
-        }
-        if (status != NFS_OK)
                return status;
+        }
        if (nfs_open_stateid_recover_openmode(state))
                return -NFS4ERR_OPENMODE;
        return NFS_OK;
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 8a428498d6b2..509a61668d90 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -106,13 +106,13 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                    global_node_page_state(NR_FILE_MAPPED));
        show_val_kb(m, "Shmem:          ", i.sharedram);
        show_val_kb(m, "Slab:           ",
-                    global_page_state(NR_SLAB_RECLAIMABLE) +
+                    global_node_page_state(NR_SLAB_RECLAIMABLE) +
-                    global_page_state(NR_SLAB_UNRECLAIMABLE));
+                    global_node_page_state(NR_SLAB_UNRECLAIMABLE));
        show_val_kb(m, "SReclaimable:   ",
-                    global_page_state(NR_SLAB_RECLAIMABLE));
+                    global_node_page_state(NR_SLAB_RECLAIMABLE));
        show_val_kb(m, "SUnreclaim:     ",
-                    global_page_state(NR_SLAB_UNRECLAIMABLE));
+                    global_node_page_state(NR_SLAB_UNRECLAIMABLE));
        seq_printf(m, "KernelStack:    %8lu kB\n",
                   global_page_state(NR_KERNEL_STACK_KB));
        show_val_kb(m, "PageTables:     ",
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index b836fd61ed87..fe8f3265e877 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -16,9 +16,10 @@
 #include <linux/mmu_notifier.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/uaccess.h>
 #include <asm/elf.h>
-#include <linux/uaccess.h>
+#include <asm/tlb.h>
 #include <asm/tlbflush.h>
 #include "internal.h"
@@ -1008,6 +1009,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
        struct mm_struct *mm;
        struct vm_area_struct *vma;
        enum clear_refs_types type;
+        struct mmu_gather tlb;
        int itype;
        int rv;
@@ -1054,6 +1056,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                }
                down_read(&mm->mmap_sem);
+                tlb_gather_mmu(&tlb, mm, 0, -1);
                if (type == CLEAR_REFS_SOFT_DIRTY) {
                        for (vma = mm->mmap; vma; vma = vma->vm_next) {
                                if (!(vma->vm_flags & VM_SOFTDIRTY))
@@ -1075,7 +1078,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                walk_page_range(0, mm->highest_vm_end, &clear_refs_walk);
                if (type == CLEAR_REFS_SOFT_DIRTY)
                        mmu_notifier_invalidate_range_end(mm, 0, -1);
-                flush_tlb_mm(mm);
+                tlb_finish_mmu(&tlb, 0, -1);
                up_read(&mm->mmap_sem);
 out_mm:
                mmput(mm);
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 53a17496c5c5..566e6ef99f07 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1124,6 +1124,10 @@ void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
                WARN_ON_ONCE(1);
                dquot->dq_dqb.dqb_rsvspace = 0;
        }
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
+                dquot->dq_dqb.dqb_btime = (time64_t) 0;
+        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
 static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
@@ -1145,7 +1149,8 @@ static void dquot_decr_space(struct dquot *dquot, qsize_t number)
                dquot->dq_dqb.dqb_curspace -= number;
        else
                dquot->dq_dqb.dqb_curspace = 0;
-        if (dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
                dquot->dq_dqb.dqb_btime = (time64_t) 0;
        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
@@ -1381,14 +1386,18 @@ static int info_idq_free(struct dquot *dquot, qsize_t inodes)
 static int info_bdq_free(struct dquot *dquot, qsize_t space)
 {
+        qsize_t tspace;
+        tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace;
        if (test_bit(DQ_FAKE_B, &dquot->dq_flags) ||
-            dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+            tspace <= dquot->dq_dqb.dqb_bsoftlimit)
                return QUOTA_NL_NOWARN;
-        if (dquot->dq_dqb.dqb_curspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (tspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
                return QUOTA_NL_BSOFTBELOW;
-        if (dquot->dq_dqb.dqb_curspace >= dquot->dq_dqb.dqb_bhardlimit &&
+        if (tspace >= dquot->dq_dqb.dqb_bhardlimit &&
-            dquot->dq_dqb.dqb_curspace - space < dquot->dq_dqb.dqb_bhardlimit)
+            tspace - space < dquot->dq_dqb.dqb_bhardlimit)
                return QUOTA_NL_BHARDBELOW;
        return QUOTA_NL_NOWARN;
 }
@@ -2681,7 +2690,7 @@ static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
        if (check_blim) {
                if (!dm->dqb_bsoftlimit ||
-                    dm->dqb_curspace < dm->dqb_bsoftlimit) {
+                    dm->dqb_curspace + dm->dqb_rsvspace < dm->dqb_bsoftlimit) {
                        dm->dqb_btime = 0;
                        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
                } else if (!(di->d_fieldmask & QC_SPC_TIMER))
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 06ea26b8c996..b0d5897bc4e6 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1600,7 +1600,7 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx,
                                   uffdio_copy.len);
                mmput(ctx->mm);
        } else {
-                return -ENOSPC;
+                return -ESRCH;
        }
        if (unlikely(put_user(ret, &user_uffdio_copy->copy)))
                return -EFAULT;
@@ -1647,7 +1647,7 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx,
                                     uffdio_zeropage.range.len);
                mmput(ctx->mm);
        } else {
-                return -ENOSPC;
+                return -ESRCH;
        }
        if (unlikely(put_user(ret, &user_uffdio_zeropage->zeropage)))
                return -EFAULT;
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index ffd5a15d1bb6..abf5beaae907 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1246,13 +1246,13 @@ xfs_dialloc_ag_inobt(
                        /* free inodes to the left? */
                        if (useleft && trec.ir_freecount) {
-                                rec = trec;
                                xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
                                cur = tcur;
                                pag->pagl_leftrec = trec.ir_startino;
                                pag->pagl_rightrec = rec.ir_startino;
                                pag->pagl_pagino = pagino;
+                                rec = trec;
                                goto alloc_inode;
                        }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index ceef77c0416a..ff48f0096810 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -874,7 +874,6 @@ xfs_ialloc(
        case S_IFREG:
        case S_IFDIR:
                if (pip && (pip->i_d.di_flags & XFS_DIFLAG_ANY)) {
-                        uint64_t        di_flags2 = 0;
                        uint            di_flags = 0;
                        if (S_ISDIR(mode)) {
@@ -911,20 +910,23 @@ xfs_ialloc(
                                di_flags |= XFS_DIFLAG_NODEFRAG;
                        if (pip->i_d.di_flags & XFS_DIFLAG_FILESTREAM)
                                di_flags |= XFS_DIFLAG_FILESTREAM;
-                        if (pip->i_d.di_flags2 & XFS_DIFLAG2_DAX)
-                                di_flags2 |= XFS_DIFLAG2_DAX;
                        ip->i_d.di_flags |= di_flags;
-                        ip->i_d.di_flags2 |= di_flags2;
                }
                if (pip &&
                    (pip->i_d.di_flags2 & XFS_DIFLAG2_ANY) &&
                    pip->i_d.di_version == 3 &&
                    ip->i_d.di_version == 3) {
+                        uint64_t        di_flags2 = 0;
                        if (pip->i_d.di_flags2 & XFS_DIFLAG2_COWEXTSIZE) {
-                                ip->i_d.di_flags2 |= XFS_DIFLAG2_COWEXTSIZE;
+                                di_flags2 |= XFS_DIFLAG2_COWEXTSIZE;
                                ip->i_d.di_cowextsize = pip->i_d.di_cowextsize;
                        }
+                        if (pip->i_d.di_flags2 & XFS_DIFLAG2_DAX)
+                                di_flags2 |= XFS_DIFLAG2_DAX;
+                        ip->i_d.di_flags2 |= di_flags2;
                }
                /* FALLTHROUGH */
        case S_IFLNK:
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 0053bcf2b10a..4ebd0bafc914 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -749,9 +749,20 @@ xfs_log_mount_finish(
                return 0;
        }
+        /*
+         * During the second phase of log recovery, we need iget and
+         * iput to behave like they do for an active filesystem.
+         * xfs_fs_drop_inode needs to be able to prevent the deletion
+         * of inodes before we're done replaying log items on those
+         * inodes.  Turn it off immediately after recovery finishes
+         * so that we don't leak the quota inodes if subsequent mount
+         * activities fail.
+         */
+        mp->m_super->s_flags |= MS_ACTIVE;
        error = xlog_recover_finish(mp->m_log);
        if (!error)
                xfs_log_work_queue(mp);
+        mp->m_super->s_flags &= ~MS_ACTIVE;
        return error;
 }
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index fbe72b134bef..43aa42a3a5d3 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -539,6 +539,7 @@ xlog_discard_endio(
        INIT_WORK(&ctx->discard_endio_work, xlog_discard_endio_work);
        queue_work(xfs_discard_wq, &ctx->discard_endio_work);
+        bio_put(bio);
 }
 static void
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 40d4e8b4e193..ea7d4b4e50d0 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -945,15 +945,6 @@ xfs_mountfs(
        }
        /*
-         * During the second phase of log recovery, we need iget and
-         * iput to behave like they do for an active filesystem.
-         * xfs_fs_drop_inode needs to be able to prevent the deletion
-         * of inodes before we're done replaying log items on those
-         * inodes.
-         */
-        mp->m_super->s_flags |= MS_ACTIVE;
-        /*
         * Finish recovering the file system.  This part needed to be delayed
         * until after the root and real-time bitmap inodes were consistently
         * read in.
@@ -1028,12 +1019,13 @@ xfs_mountfs(
 out_quota:
        xfs_qm_unmount_quotas(mp);
 out_rtunmount:
-        mp->m_super->s_flags &= ~MS_ACTIVE;
        xfs_rtunmount_inodes(mp);
 out_rele_rip:
        IRELE(rip);
        cancel_delayed_work_sync(&mp->m_reclaim_work);
        xfs_reclaim_inodes(mp, SYNC_WAIT);
+        /* Clean out dquots that might be in memory after quotacheck. */
+        xfs_qm_unmount(mp);
 out_log_dealloc:
        mp->m_flags |= XFS_MOUNT_UNMOUNTING;
        xfs_log_mount_cancel(mp);
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 8afa4335e5b2..faddde44de8c 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -112,10 +112,11 @@ struct mmu_gather {
 #define HAVE_GENERIC_MMU_GATHER
-void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end);
+void arch_tlb_gather_mmu(struct mmu_gather *tlb,
+        struct mm_struct *mm, unsigned long start, unsigned long end);
 void tlb_flush_mmu(struct mmu_gather *tlb);
-void tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start,
+void arch_tlb_finish_mmu(struct mmu_gather *tlb,
-                                                        unsigned long end);
+                         unsigned long start, unsigned long end, bool force);
 extern bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page,
                                   int page_size);
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index c749eef1daa1..27b4b6615263 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -1209,6 +1209,7 @@ static inline bool acpi_has_watchdog(void) { return false; }
 #endif
 #ifdef CONFIG_ACPI_SPCR_TABLE
+extern bool qdf2400_e44_present;
 int parse_spcr(bool earlycon);
 #else
 static inline int parse_spcr(bool earlycon) { return 0; }
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index b56573bf440d..82b30e638430 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -39,8 +39,6 @@ enum cpuhp_state {
        CPUHP_PCI_XGENE_DEAD,
        CPUHP_IOMMU_INTEL_DEAD,
        CPUHP_LUSTRE_CFS_DEAD,
-        CPUHP_SCSI_BNX2FC_DEAD,
-        CPUHP_SCSI_BNX2I_DEAD,
        CPUHP_WORKQUEUE_PREP,
        CPUHP_POWER_NUMA_PREPARE,
        CPUHP_HRTIMERS_PREPARE,
diff --git a/include/linux/device.h b/include/linux/device.h
index 723cd54b94da..beabdbc08420 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -843,7 +843,7 @@ struct dev_links_info {
 *              hibernation, system resume and during runtime PM transitions
 *              along with subsystem-level and driver-level callbacks.
 * @pins:       For device pin management.
- *              See Documentation/pinctrl.txt for details.
+ *              See Documentation/driver-api/pinctl.rst for details.
 * @msi_list:   Hosts MSI descriptors
 * @msi_domain: The generic MSI domain this device is using.
 * @numa_node:  NUMA node this device is close to.
diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
index 277ab9af9ac2..7883e901f65c 100644
--- a/include/linux/devpts_fs.h
+++ b/include/linux/devpts_fs.h
@@ -19,7 +19,7 @@
 struct pts_fs_info;
-struct pts_fs_info *devpts_acquire(struct file *);
+struct pts_fs_info *devpts_acquire(struct file *, struct vfsmount **ptsmnt);
 void devpts_release(struct pts_fs_info *);
 int devpts_new_index(struct pts_fs_info *);
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 00ca5b86a753..d501d3956f13 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -689,7 +689,8 @@ i2c_unlock_adapter(struct i2c_adapter *adapter)
 #define I2C_CLASS_HWMON         (1<<0)  /* lm_sensors, ... */
 #define I2C_CLASS_DDC           (1<<3)  /* DDC bus on graphics adapters */
 #define I2C_CLASS_SPD           (1<<7)  /* Memory modules */
-#define I2C_CLASS_DEPRECATED    (1<<8)  /* Warn users that adapter will stop using classes */
+/* Warn users that the adapter doesn't support classes anymore */
+#define I2C_CLASS_DEPRECATED    (1<<8)
 /* Internal numbers to terminate lists */
 #define I2C_CLIENT_END          0xfffeU
diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
index 497f2b3a5a62..97f1b465d04f 100644
--- a/include/linux/iio/common/st_sensors.h
+++ b/include/linux/iio/common/st_sensors.h
@@ -105,6 +105,11 @@ struct st_sensor_fullscale {
        struct st_sensor_fullscale_avl fs_avl[ST_SENSORS_FULLSCALE_AVL_MAX];
 };
+struct st_sensor_sim {
+        u8 addr;
+        u8 value;
+};
 /**
 * struct st_sensor_bdu - ST sensor device block data update
 * @addr: address of the register.
@@ -197,6 +202,7 @@ struct st_sensor_transfer_function {
 * @bdu: Block data update register.
 * @das: Data Alignment Selection register.
 * @drdy_irq: Data ready register of the sensor.
+ * @sim: SPI serial interface mode register of the sensor.
 * @multi_read_bit: Use or not particular bit for [I2C/SPI] multi-read.
 * @bootime: samples to discard when sensor passing from power-down to power-up.
 */
@@ -213,6 +219,7 @@ struct st_sensor_settings {
        struct st_sensor_bdu bdu;
        struct st_sensor_das das;
        struct st_sensor_data_ready_irq drdy_irq;
+        struct st_sensor_sim sim;
        bool multi_read_bit;
        unsigned int bootime;
 };
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 77d427974f57..bae11c7e7bf3 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -61,6 +61,7 @@ extern int memblock_debug;
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
 #define __init_memblock __meminit
 #define __initdata_memblock __meminitdata
+void memblock_discard(void);
 #else
 #define __init_memblock
 #define __initdata_memblock
@@ -74,8 +75,6 @@ phys_addr_t memblock_find_in_range_node(phys_addr_t size, phys_addr_t align,
                                        int nid, ulong flags);
 phys_addr_t memblock_find_in_range(phys_addr_t start, phys_addr_t end,
                                   phys_addr_t size, phys_addr_t align);
-phys_addr_t get_allocated_memblock_reserved_regions_info(phys_addr_t *addr);
-phys_addr_t get_allocated_memblock_memory_regions_info(phys_addr_t *addr);
 void memblock_allow_resize(void);
 int memblock_add_node(phys_addr_t base, phys_addr_t size, int nid);
 int memblock_add(phys_addr_t base, phys_addr_t size);
@@ -110,6 +109,9 @@ void __next_mem_range_rev(u64 *idx, int nid, ulong flags,
 void __next_reserved_mem_region(u64 *idx, phys_addr_t *out_start,
                                phys_addr_t *out_end);
+void __memblock_free_early(phys_addr_t base, phys_addr_t size);
+void __memblock_free_late(phys_addr_t base, phys_addr_t size);
 /**
 * for_each_mem_range - iterate through memblock areas from type_a and not
 * included in type_b. Or just type_a if type_b is NULL.
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 3914e3dd6168..9b15a4bcfa77 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -484,7 +484,8 @@ bool mem_cgroup_oom_synchronize(bool wait);
 extern int do_swap_account;
 #endif
-void lock_page_memcg(struct page *page);
+struct mem_cgroup *lock_page_memcg(struct page *page);
+void __unlock_page_memcg(struct mem_cgroup *memcg);
 void unlock_page_memcg(struct page *page);
 static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
@@ -809,7 +810,12 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 {
 }
-static inline void lock_page_memcg(struct page *page)
+static inline struct mem_cgroup *lock_page_memcg(struct page *page)
+{
+        return NULL;
+}
+static inline void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
 }
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index aad5d81dfb44..b54517c05e9a 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -620,6 +620,7 @@ struct mlx4_caps {
        u32                     dmfs_high_rate_qpn_base;
        u32                     dmfs_high_rate_qpn_range;
        u32                     vf_caps;
+        bool                    wol_port[MLX4_MAX_PORTS + 1];
        struct mlx4_rate_limit_caps rl_caps;
 };
diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
index 6f41270d80c0..f378dc0e7eaf 100644
--- a/include/linux/mlx5/qp.h
+++ b/include/linux/mlx5/qp.h
@@ -212,7 +212,6 @@ struct mlx5_wqe_ctrl_seg {
 #define MLX5_WQE_CTRL_OPCODE_MASK 0xff
 #define MLX5_WQE_CTRL_WQE_INDEX_MASK 0x00ffff00
 #define MLX5_WQE_CTRL_WQE_INDEX_SHIFT 8
-#define MLX5_WQE_AV_EXT 0x80000000
 enum {
        MLX5_ETH_WQE_L3_INNER_CSUM      = 1 << 4,
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 7f384bb62d8e..3cadee0a3508 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -487,14 +487,12 @@ struct mm_struct {
        /* numa_scan_seq prevents two threads setting pte_numa */
        int numa_scan_seq;
 #endif
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
        /*
         * An operation with batched TLB flushing is going on. Anything that
         * can move process memory needs to flush the TLB when moving a
         * PROT_NONE or PROT_NUMA mapped page.
         */
-        bool tlb_flush_pending;
+        atomic_t tlb_flush_pending;
-#endif
 #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
        /* See flush_tlb_batched_pending() */
        bool tlb_flush_batched;
@@ -522,46 +520,60 @@ static inline cpumask_t *mm_cpumask(struct mm_struct *mm)
        return mm->cpu_vm_mask_var;
 }
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+struct mmu_gather;
+extern void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                                unsigned long start, unsigned long end);
+extern void tlb_finish_mmu(struct mmu_gather *tlb,
+                                unsigned long start, unsigned long end);
 /*
 * Memory barriers to keep this state in sync are graciously provided by
 * the page table locks, outside of which no page table modifications happen.
- * The barriers below prevent the compiler from re-ordering the instructions
+ * The barriers are used to ensure the order between tlb_flush_pending updates,
- * around the memory barriers that are already present in the code.
+ * which happen while the lock is not taken, and the PTE updates, which happen
+ * while the lock is taken, are serialized.
 */
 static inline bool mm_tlb_flush_pending(struct mm_struct *mm)
 {
-        barrier();
+        return atomic_read(&mm->tlb_flush_pending) > 0;
-        return mm->tlb_flush_pending;
+}
+/*
+ * Returns true if there are two above TLB batching threads in parallel.
+ */
+static inline bool mm_tlb_flush_nested(struct mm_struct *mm)
+{
+        return atomic_read(&mm->tlb_flush_pending) > 1;
+}
+static inline void init_tlb_flush_pending(struct mm_struct *mm)
+{
+        atomic_set(&mm->tlb_flush_pending, 0);
 }
-static inline void set_tlb_flush_pending(struct mm_struct *mm)
+static inline void inc_tlb_flush_pending(struct mm_struct *mm)
 {
-        mm->tlb_flush_pending = true;
+        atomic_inc(&mm->tlb_flush_pending);
        /*
-         * Guarantee that the tlb_flush_pending store does not leak into the
+         * Guarantee that the tlb_flush_pending increase does not leak into the
         * critical section updating the page tables
         */
        smp_mb__before_spinlock();
 }
 /* Clearing is done after a TLB flush, which also provides a barrier. */
-static inline void clear_tlb_flush_pending(struct mm_struct *mm)
+static inline void dec_tlb_flush_pending(struct mm_struct *mm)
-{
-        barrier();
-        mm->tlb_flush_pending = false;
-}
-#else
-static inline bool mm_tlb_flush_pending(struct mm_struct *mm)
-{
-        return false;
-}
-static inline void set_tlb_flush_pending(struct mm_struct *mm)
-{
-}
-static inline void clear_tlb_flush_pending(struct mm_struct *mm)
 {
+        /*
+         * Guarantee that the tlb_flush_pending does not not leak into the
+         * critical section, since we must order the PTE change and changes to
+         * the pending TLB flush indication. We could have relied on TLB flush
+         * as a memory barrier, but this behavior is not clearly documented.
+         */
+        smp_mb__before_atomic();
+        atomic_dec(&mm->tlb_flush_pending);
 }
-#endif
 struct vm_fault;
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 892148c448cc..5216d2eb2289 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -681,10 +681,10 @@ struct nand_buffers {
 * @tWW_min: WP# transition to WE# low
 */
 struct nand_sdr_timings {
-        u32 tBERS_max;
+        u64 tBERS_max;
        u32 tCCS_min;
-        u32 tPROG_max;
+        u64 tPROG_max;
-        u32 tR_max;
+        u64 tR_max;
        u32 tALH_min;
        u32 tADL_min;
        u32 tALS_min;
diff --git a/include/linux/net.h b/include/linux/net.h
index dda2cc939a53..ebeb48c92005 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -37,7 +37,7 @@ struct net;
 /* Historically, SOCKWQ_ASYNC_NOSPACE & SOCKWQ_ASYNC_WAITDATA were located
 * in sock->flags, but moved into sk->sk_wq->flags to be RCU protected.
- * Eventually all flags will be in sk->sk_wq_flags.
+ * Eventually all flags will be in sk->sk_wq->flags.
 */
 #define SOCKWQ_ASYNC_NOSPACE    0
 #define SOCKWQ_ASYNC_WAITDATA   1
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 8aa01fd859fb..a36abe2da13e 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -168,6 +168,14 @@ extern int sysctl_hardlockup_all_cpu_backtrace;
 #define sysctl_softlockup_all_cpu_backtrace 0
 #define sysctl_hardlockup_all_cpu_backtrace 0
 #endif
+#if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
+    defined(CONFIG_HARDLOCKUP_DETECTOR)
+void watchdog_update_hrtimer_threshold(u64 period);
+#else
+static inline void watchdog_update_hrtimer_threshold(u64 period) { }
+#endif
 extern bool is_hardlockup(void);
 struct ctl_table;
 extern int proc_watchdog(struct ctl_table *, int ,
diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
index 6c8c5d8041b7..2591878c1d48 100644
--- a/include/linux/nvme-fc-driver.h
+++ b/include/linux/nvme-fc-driver.h
@@ -346,6 +346,11 @@ struct nvme_fc_remote_port {
 *       indicating an FC transport Aborted status.
 *       Entrypoint is Mandatory.
 *
+ * @defer_rcv:  Called by the transport to signal the LLLD that it has
+ *       begun processing of a previously received NVME CMD IU. The LLDD
+ *       is now free to re-use the rcv buffer associated with the
+ *       nvmefc_tgt_fcp_req.
+ *
 * @max_hw_queues:  indicates the maximum number of hw queues the LLDD
 *       supports for cpu affinitization.
 *       Value is Mandatory. Must be at least 1.
@@ -846,6 +851,8 @@ struct nvmet_fc_target_template {
                                struct nvmefc_tgt_fcp_req *fcpreq);
        void (*fcp_req_release)(struct nvmet_fc_target_port *tgtport,
                                struct nvmefc_tgt_fcp_req *fcpreq);
+        void (*defer_rcv)(struct nvmet_fc_target_port *tgtport,
+                                struct nvmefc_tgt_fcp_req *fcpreq);
        u32     max_hw_queues;
        u16     max_sgl_segments;
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 8a266e2be5a6..76aac4ce39bc 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -6,6 +6,8 @@
 #include <linux/types.h>
 #include <linux/nodemask.h>
 #include <uapi/linux/oom.h>
+#include <linux/sched/coredump.h> /* MMF_* */
+#include <linux/mm.h> /* VM_FAULT* */
 struct zonelist;
 struct notifier_block;
@@ -63,6 +65,26 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk)
        return tsk->signal->oom_mm;
 }
+/*
+ * Checks whether a page fault on the given mm is still reliable.
+ * This is no longer true if the oom reaper started to reap the
+ * address space which is reflected by MMF_UNSTABLE flag set in
+ * the mm. At that moment any !shared mapping would lose the content
+ * and could cause a memory corruption (zero pages instead of the
+ * original content).
+ *
+ * User should call this before establishing a page table entry for
+ * a !shared mapping and under the proper page table lock.
+ *
+ * Return 0 when the PF is safe VM_FAULT_SIGBUS otherwise.
+ */
+static inline int check_stable_address_space(struct mm_struct *mm)
+{
+        if (unlikely(test_bit(MMF_UNSTABLE, &mm->flags)))
+                return VM_FAULT_SIGBUS;
+        return 0;
+}
 extern unsigned long oom_badness(struct task_struct *p,
                struct mem_cgroup *memcg, const nodemask_t *nodemask,
                unsigned long totalpages);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 4869e66dd659..f958d0732af6 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -188,6 +188,8 @@ enum pci_dev_flags {
         * the direct_complete optimization.
         */
        PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
+        /* Don't use Relaxed Ordering for TLPs directed at this device */
+        PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 12),
 };
 enum pci_irq_reroute_variant {
@@ -1067,6 +1069,7 @@ void pcie_flr(struct pci_dev *dev);
 int __pci_reset_function(struct pci_dev *dev);
 int __pci_reset_function_locked(struct pci_dev *dev);
 int pci_reset_function(struct pci_dev *dev);
+int pci_reset_function_locked(struct pci_dev *dev);
 int pci_try_reset_function(struct pci_dev *dev);
 int pci_probe_reset_slot(struct pci_slot *slot);
 int pci_reset_slot(struct pci_slot *slot);
@@ -1125,6 +1128,7 @@ bool pci_check_pme_status(struct pci_dev *dev);
 void pci_pme_wakeup_bus(struct pci_bus *bus);
 void pci_d3cold_enable(struct pci_dev *dev);
 void pci_d3cold_disable(struct pci_dev *dev);
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev);
 /* PCI Virtual Channel */
 int pci_save_vc_state(struct pci_dev *dev);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index a3b873fc59e4..b14095bcf4bb 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -310,8 +310,8 @@ struct pmu {
         * Notification that the event was mapped or unmapped.  Called
         * in the context of the mapping task.
         */
-        void (*event_mapped)            (struct perf_event *event); /*optional*/
+        void (*event_mapped)            (struct perf_event *event, struct mm_struct *mm); /* optional */
-        void (*event_unmapped)          (struct perf_event *event); /*optional*/
+        void (*event_unmapped)          (struct perf_event *event, struct mm_struct *mm); /* optional */
        /*
         * Flags for ->add()/->del()/ ->start()/->stop(). There are
diff --git a/include/linux/pinctrl/pinconf-generic.h b/include/linux/pinctrl/pinconf-generic.h
index 231d3075815a..e91d1b6a260d 100644
--- a/include/linux/pinctrl/pinconf-generic.h
+++ b/include/linux/pinctrl/pinconf-generic.h
@@ -81,8 +81,8 @@
 *      it.
 * @PIN_CONFIG_OUTPUT: this will configure the pin as an output and drive a
 *      value on the line. Use argument 1 to indicate high level, argument 0 to
- *      indicate low level. (Please see Documentation/pinctrl.txt, section
+ *      indicate low level. (Please see Documentation/driver-api/pinctl.rst,
- *      "GPIO mode pitfalls" for a discussion around this parameter.)
+ *      section "GPIO mode pitfalls" for a discussion around this parameter.)
 * @PIN_CONFIG_POWER_SOURCE: if the pin can select between different power
 *      supplies, the argument to this parameter (on a custom format) tells
 *      the driver which alternative power source to use.
diff --git a/include/linux/platform_data/st_sensors_pdata.h b/include/linux/platform_data/st_sensors_pdata.h
index 79b0e4cdb814..f8274b0c6888 100644
--- a/include/linux/platform_data/st_sensors_pdata.h
+++ b/include/linux/platform_data/st_sensors_pdata.h
@@ -17,10 +17,12 @@
 *      Available only for accelerometer and pressure sensors.
 *      Accelerometer DRDY on LSM330 available only on pin 1 (see datasheet).
 * @open_drain: set the interrupt line to be open drain if possible.
+ * @spi_3wire: enable spi-3wire mode.
 */
 struct st_sensors_platform_data {
        u8 drdy_int_pin;
        bool open_drain;
+        bool spi_3wire;
 };
 #endif /* ST_SENSORS_PDATA_H */
diff --git a/include/linux/ptp_clock_kernel.h b/include/linux/ptp_clock_kernel.h
index a026bfd089db..51349d124ee5 100644
--- a/include/linux/ptp_clock_kernel.h
+++ b/include/linux/ptp_clock_kernel.h
@@ -99,6 +99,11 @@ struct system_device_crosststamp;
 *            parameter func: the desired function to use.
 *            parameter chan: the function channel index to use.
 *
+ * @do_work:  Request driver to perform auxiliary (periodic) operations
+ *            Driver should return delay of the next auxiliary work scheduling
+ *            time (>=0) or negative value in case further scheduling
+ *            is not required.
+ *
 * Drivers should embed their ptp_clock_info within a private
 * structure, obtaining a reference to it using container_of().
 *
@@ -126,6 +131,7 @@ struct ptp_clock_info {
                      struct ptp_clock_request *request, int on);
        int (*verify)(struct ptp_clock_info *ptp, unsigned int pin,
                      enum ptp_pin_function func, unsigned int chan);
+        long (*do_aux_work)(struct ptp_clock_info *ptp);
 };
 struct ptp_clock;
@@ -211,6 +217,16 @@ extern int ptp_clock_index(struct ptp_clock *ptp);
 int ptp_find_pin(struct ptp_clock *ptp,
                 enum ptp_pin_function func, unsigned int chan);
+/**
+ * ptp_schedule_worker() - schedule ptp auxiliary work
+ *
+ * @ptp:    The clock obtained from ptp_clock_register().
+ * @delay:  number of jiffies to wait before queuing
+ *          See kthread_queue_delayed_work() for more info.
+ */
+int ptp_schedule_worker(struct ptp_clock *ptp, unsigned long delay);
 #else
 static inline struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
                                                   struct device *parent)
@@ -225,6 +241,10 @@ static inline int ptp_clock_index(struct ptp_clock *ptp)
 static inline int ptp_find_pin(struct ptp_clock *ptp,
                               enum ptp_pin_function func, unsigned int chan)
 { return -1; }
+static inline int ptp_schedule_worker(struct ptp_clock *ptp,
+                                      unsigned long delay)
+{ return -EOPNOTSUPP; }
 #endif
 #endif
diff --git a/include/linux/sync_file.h b/include/linux/sync_file.h
index 5726107963b2..0ad87c434ae6 100644
--- a/include/linux/sync_file.h
+++ b/include/linux/sync_file.h
@@ -43,12 +43,13 @@ struct sync_file {
 #endif
        wait_queue_head_t       wq;
+        unsigned long           flags;
        struct dma_fence        *fence;
        struct dma_fence_cb cb;
 };
-#define POLL_ENABLED DMA_FENCE_FLAG_USER_BITS
+#define POLL_ENABLED 0
 struct sync_file *sync_file_create(struct dma_fence *fence);
 struct dma_fence *sync_file_get_fence(int fd);
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 5b74e36c0ca8..dc19880c02f5 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -757,6 +757,43 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_entry_t *);
        __ret;                                                                  \
 })
+#define __wait_event_killable_timeout(wq_head, condition, timeout)              \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_KILLABLE, 0, timeout,                                \
+                      __ret = schedule_timeout(__ret))
+/**
+ * wait_event_killable_timeout - sleep until a condition gets true or a timeout elapses
+ * @wq_head: the waitqueue to wait on
+ * @condition: a C expression for the event to wait for
+ * @timeout: timeout, in jiffies
+ *
+ * The process is put to sleep (TASK_KILLABLE) until the
+ * @condition evaluates to true or a kill signal is received.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
+ *
+ * wake_up() has to be called after changing any variable that could
+ * change the result of the wait condition.
+ *
+ * Returns:
+ * 0 if the @condition evaluated to %false after the @timeout elapsed,
+ * 1 if the @condition evaluated to %true after the @timeout elapsed,
+ * the remaining jiffies (at least 1) if the @condition evaluated
+ * to %true before the @timeout elapsed, or -%ERESTARTSYS if it was
+ * interrupted by a kill signal.
+ *
+ * Only kill signals interrupt this process.
+ */
+#define wait_event_killable_timeout(wq_head, condition, timeout)                \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_killable_timeout(wq_head,                  \
+                                                condition, timeout);            \
+        __ret;                                                                  \
+})
 #define __wait_event_lock_irq(wq_head, condition, lock, cmd)                    \
        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 6df79e96a780..f44ff2476758 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -336,6 +336,16 @@ static inline void in6_dev_put(struct inet6_dev *idev)
                in6_dev_finish_destroy(idev);
 }
+static inline void in6_dev_put_clear(struct inet6_dev **pidev)
+{
+        struct inet6_dev *idev = *pidev;
+        if (idev) {
+                in6_dev_put(idev);
+                *pidev = NULL;
+        }
+}
 static inline void __in6_dev_put(struct inet6_dev *idev)
 {
        refcount_dec(&idev->refcnt);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index b00508d22e0a..b2e68657a216 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -277,6 +277,11 @@ static inline bool bond_is_lb(const struct bonding *bond)
               BOND_MODE(bond) == BOND_MODE_ALB;
 }
+static inline bool bond_needs_speed_duplex(const struct bonding *bond)
+{
+        return BOND_MODE(bond) == BOND_MODE_8023AD || bond_is_lb(bond);
+}
 static inline bool bond_is_nondyn_tlb(const struct bonding *bond)
 {
        return (BOND_MODE(bond) == BOND_MODE_TLB)  &&
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 8ffd434676b7..71c72a939bf8 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -29,18 +29,18 @@
 #include <linux/sched/signal.h>
 #include <net/ip.h>
-#ifdef CONFIG_NET_RX_BUSY_POLL
-struct napi_struct;
-extern unsigned int sysctl_net_busy_read __read_mostly;
-extern unsigned int sysctl_net_busy_poll __read_mostly;
 /*              0 - Reserved to indicate value not set
 *     1..NR_CPUS - Reserved for sender_cpu
 *  NR_CPUS+1..~0 - Region available for NAPI IDs
 */
 #define MIN_NAPI_ID ((unsigned int)(NR_CPUS + 1))
+#ifdef CONFIG_NET_RX_BUSY_POLL
+struct napi_struct;
+extern unsigned int sysctl_net_busy_read __read_mostly;
+extern unsigned int sysctl_net_busy_poll __read_mostly;
 static inline bool net_busy_loop_on(void)
 {
        return sysctl_net_busy_poll;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b2b5419467cc..f8149ca192b4 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -5499,6 +5499,21 @@ static inline void ieee80211_stop_rx_ba_session_offl(struct ieee80211_vif *vif,
        ieee80211_manage_rx_ba_offl(vif, addr, tid + IEEE80211_NUM_TIDS);
 }
+/**
+ * ieee80211_rx_ba_timer_expired - stop a Rx BA session due to timeout
+ *
+ * Some device drivers do not offload AddBa/DelBa negotiation, but handle rx
+ * buffer reording internally, and therefore also handle the session timer.
+ *
+ * Trigger the timeout flow, which sends a DelBa.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
+ * @addr: station mac address
+ * @tid: the rx tid
+ */
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid);
 /* Rate control API */
 /**
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 70483296157f..ada65e767b28 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1916,6 +1916,16 @@ extern void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq,
                             u64 xmit_time);
 extern void tcp_rack_reo_timeout(struct sock *sk);
+/* At how many usecs into the future should the RTO fire? */
+static inline s64 tcp_rto_delta_us(const struct sock *sk)
+{
+        const struct sk_buff *skb = tcp_write_queue_head(sk);
+        u32 rto = inet_csk(sk)->icsk_rto;
+        u64 rto_time_stamp_us = skb->skb_mstamp + jiffies_to_usecs(rto);
+        return rto_time_stamp_us - tcp_sk(sk)->tcp_mstamp;
+}
 /*
 * Save and compile IPv4 options, return a pointer to it
 */
diff --git a/include/net/udp.h b/include/net/udp.h
index cc8036987dcb..586de4b811b5 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -366,12 +366,13 @@ static inline bool udp_skb_is_linear(struct sk_buff *skb)
 static inline int copy_linear_skb(struct sk_buff *skb, int len, int off,
                                  struct iov_iter *to)
 {
-        int n, copy = len - off;
+        int n;
-        n = copy_to_iter(skb->data + off, copy, to);
+        n = copy_to_iter(skb->data + off, len, to);
-        if (n == copy)
+        if (n == len)
                return 0;
+        iov_iter_revert(to, n);
        return -EFAULT;
 }
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 0ca1fb08805b..fb87d32f5e51 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -786,6 +786,7 @@ struct iscsi_np {
        int                     np_sock_type;
        enum np_thread_state_table np_thread_state;
        bool                    enabled;
+        atomic_t                np_reset_count;
        enum iscsi_timer_flags_table np_login_timer_flags;
        u32                     np_exports;
        enum np_flags_table     np_flags;
diff --git a/include/uapi/drm/msm_drm.h b/include/uapi/drm/msm_drm.h
index 26c54f6d595d..ad4eb2863e70 100644
--- a/include/uapi/drm/msm_drm.h
+++ b/include/uapi/drm/msm_drm.h
@@ -171,7 +171,7 @@ struct drm_msm_gem_submit_cmd {
        __u32 size;           /* in, cmdstream size */
        __u32 pad;
        __u32 nr_relocs;      /* in, number of submit_reloc's */
-        __u64 __user relocs;  /* in, ptr to array of submit_reloc's */
+        __u64 relocs;         /* in, ptr to array of submit_reloc's */
 };
 /* Each buffer referenced elsewhere in the cmdstream submit (ie. the
@@ -215,8 +215,8 @@ struct drm_msm_gem_submit {
        __u32 fence;          /* out */
        __u32 nr_bos;         /* in, number of submit_bo's */
        __u32 nr_cmds;        /* in, number of submit_cmd's */
-        __u64 __user bos;     /* in, ptr to array of submit_bo's */
+        __u64 bos;            /* in, ptr to array of submit_bo's */
-        __u64 __user cmds;    /* in, ptr to array of submit_cmd's */
+        __u64 cmds;           /* in, ptr to array of submit_cmd's */
        __s32 fence_fd;       /* in/out fence fd (see MSM_SUBMIT_FENCE_FD_IN/OUT) */
 };
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 62d686d96581..9eb8b3511636 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -66,7 +66,7 @@ static struct fsnotify_group *audit_watch_group;
 /* fsnotify events we care about. */
 #define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
-                        FS_MOVE_SELF | FS_EVENT_ON_CHILD)
+                        FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)
 static void audit_free_parent(struct audit_parent *parent)
 {
@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audit_krule *krule)
        list_del(&krule->rlist);
        if (list_empty(&watch->rules)) {
+                /*
+                 * audit_remove_watch() drops our reference to 'parent' which
+                 * can get freed. Grab our own reference to be safe.
+                 */
+                audit_get_parent(parent);
                audit_remove_watch(watch);
+                if (list_empty(&parent->watches))
-                if (list_empty(&parent->watches)) {
-                        audit_get_parent(parent);
                        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
-                        audit_put_parent(parent);
+                audit_put_parent(parent);
-                }
        }
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 426c2ffba16d..ee20d4c546b5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2217,6 +2217,33 @@ static int group_can_go_on(struct perf_event *event,
        return can_add_hw;
 }
+/*
+ * Complement to update_event_times(). This computes the tstamp_* values to
+ * continue 'enabled' state from @now, and effectively discards the time
+ * between the prior tstamp_stopped and now (as we were in the OFF state, or
+ * just switched (context) time base).
+ *
+ * This further assumes '@event->state == INACTIVE' (we just came from OFF) and
+ * cannot have been scheduled in yet. And going into INACTIVE state means
+ * '@event->tstamp_stopped = @now'.
+ *
+ * Thus given the rules of update_event_times():
+ *
+ *   total_time_enabled = tstamp_stopped - tstamp_enabled
+ *   total_time_running = tstamp_stopped - tstamp_running
+ *
+ * We can insert 'tstamp_stopped == now' and reverse them to compute new
+ * tstamp_* values.
+ */
+static void __perf_event_enable_time(struct perf_event *event, u64 now)
+{
+        WARN_ON_ONCE(event->state != PERF_EVENT_STATE_INACTIVE);
+        event->tstamp_stopped = now;
+        event->tstamp_enabled = now - event->total_time_enabled;
+        event->tstamp_running = now - event->total_time_running;
+}
 static void add_event_to_ctx(struct perf_event *event,
                               struct perf_event_context *ctx)
 {
@@ -2224,9 +2251,12 @@ static void add_event_to_ctx(struct perf_event *event,
        list_add_event(event, ctx);
        perf_group_attach(event);
-        event->tstamp_enabled = tstamp;
+        /*
-        event->tstamp_running = tstamp;
+         * We can be called with event->state == STATE_OFF when we create with
-        event->tstamp_stopped = tstamp;
+         * .disabled = 1. In that case the IOC_ENABLE will call this function.
+         */
+        if (event->state == PERF_EVENT_STATE_INACTIVE)
+                __perf_event_enable_time(event, tstamp);
 }
 static void ctx_sched_out(struct perf_event_context *ctx,
@@ -2471,10 +2501,11 @@ static void __perf_event_mark_enabled(struct perf_event *event)
        u64 tstamp = perf_event_time(event);
        event->state = PERF_EVENT_STATE_INACTIVE;
-        event->tstamp_enabled = tstamp - event->total_time_enabled;
+        __perf_event_enable_time(event, tstamp);
        list_for_each_entry(sub, &event->sibling_list, group_entry) {
+                /* XXX should not be > INACTIVE if event isn't */
                if (sub->state >= PERF_EVENT_STATE_INACTIVE)
-                        sub->tstamp_enabled = tstamp - sub->total_time_enabled;
+                        __perf_event_enable_time(sub, tstamp);
        }
 }
@@ -5090,7 +5121,7 @@ static void perf_mmap_open(struct vm_area_struct *vma)
                atomic_inc(&event->rb->aux_mmap_count);
        if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
 }
 static void perf_pmu_output_stop(struct perf_event *event);
@@ -5113,7 +5144,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
        unsigned long size = perf_data_size(rb);
        if (event->pmu->event_unmapped)
-                event->pmu->event_unmapped(event);
+                event->pmu->event_unmapped(event, vma->vm_mm);
        /*
         * rb->aux_mmap_count will always drop before rb->mmap_count and
@@ -5411,7 +5442,7 @@ aux_unlock:
        vma->vm_ops = &perf_mmap_vmops;
        if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
        return ret;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 17921b0390b4..e075b7780421 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -807,7 +807,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
        mm_init_aio(mm);
        mm_init_owner(mm, p);
        mmu_notifier_mm_init(mm);
-        clear_tlb_flush_pending(mm);
+        init_tlb_flush_pending(mm);
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
        mm->pmd_huge_pte = NULL;
 #endif
diff --git a/kernel/futex.c b/kernel/futex.c
index 16dbe4c93895..f50b434756c1 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -670,13 +670,14 @@ again:
                 * this reference was taken by ihold under the page lock
                 * pinning the inode in place so i_lock was unnecessary. The
                 * only way for this check to fail is if the inode was
-                 * truncated in parallel so warn for now if this happens.
+                 * truncated in parallel which is almost certainly an
+                 * application bug. In such a case, just retry.
                 *
                 * We are not calling into get_futex_key_refs() in file-backed
                 * cases, therefore a successful atomic_inc return below will
                 * guarantee that get_futex_key() will still imply smp_mb(); (B).
                 */
-                if (WARN_ON_ONCE(!atomic_inc_not_zero(&inode->i_count))) {
+                if (!atomic_inc_not_zero(&inode->i_count)) {
                        rcu_read_unlock();
                        put_page(page);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index a3cc37c0c85e..3675c6004f2a 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1000,7 +1000,7 @@ EXPORT_SYMBOL_GPL(irq_set_chip_and_handler_name);
 void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
-        unsigned long flags;
+        unsigned long flags, trigger, tmp;
        struct irq_desc *desc = irq_get_desc_lock(irq, &flags, 0);
        if (!desc)
@@ -1014,6 +1014,8 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
        irq_settings_clr_and_set(desc, clr, set);
+        trigger = irqd_get_trigger_type(&desc->irq_data);
        irqd_clear(&desc->irq_data, IRQD_NO_BALANCING | IRQD_PER_CPU |
                   IRQD_TRIGGER_MASK | IRQD_LEVEL | IRQD_MOVE_PCNTXT);
        if (irq_settings_has_no_balance_set(desc))
@@ -1025,7 +1027,11 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
        if (irq_settings_is_level(desc))
                irqd_set(&desc->irq_data, IRQD_LEVEL);
-        irqd_set(&desc->irq_data, irq_settings_get_trigger_mask(desc));
+        tmp = irq_settings_get_trigger_mask(desc);
+        if (tmp != IRQ_TYPE_NONE)
+                trigger = tmp;
+        irqd_set(&desc->irq_data, trigger);
        irq_put_desc_unlock(desc, flags);
 }
diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index 1a9abc1c8ea0..259a22aa9934 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -165,7 +165,7 @@ irq_hw_number_t ipi_get_hwirq(unsigned int irq, unsigned int cpu)
        struct irq_data *data = irq_get_irq_data(irq);
        struct cpumask *ipimask = data ? irq_data_get_affinity_mask(data) : NULL;
-        if (!data || !ipimask || cpu > nr_cpu_ids)
+        if (!data || !ipimask || cpu >= nr_cpu_ids)
                return INVALID_HWIRQ;
        if (!cpumask_test_cpu(cpu, ipimask))
@@ -195,7 +195,7 @@ static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,
        if (!chip->ipi_send_single && !chip->ipi_send_mask)
                return -EINVAL;
-        if (cpu > nr_cpu_ids)
+        if (cpu >= nr_cpu_ids)
                return -EINVAL;
        if (dest) {
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6d016c5d97c8..2f37acde640b 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -71,6 +71,18 @@ static atomic_t kmod_concurrent_max = ATOMIC_INIT(MAX_KMOD_CONCURRENT);
 static DECLARE_WAIT_QUEUE_HEAD(kmod_wq);
 /*
+ * This is a restriction on having *all* MAX_KMOD_CONCURRENT threads
+ * running at the same time without returning. When this happens we
+ * believe you've somehow ended up with a recursive module dependency
+ * creating a loop.
+ *
+ * We have no option but to fail.
+ *
+ * Userspace should proactively try to detect and prevent these.
+ */
+#define MAX_KMOD_ALL_BUSY_TIMEOUT 5
+/*
        modprobe_path is set via /proc/sys.
 */
 char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
@@ -167,8 +179,17 @@ int __request_module(bool wait, const char *fmt, ...)
                pr_warn_ratelimited("request_module: kmod_concurrent_max (%u) close to 0 (max_modprobes: %u), for module %s, throttling...",
                                    atomic_read(&kmod_concurrent_max),
                                    MAX_KMOD_CONCURRENT, module_name);
-                wait_event_interruptible(kmod_wq,
+                ret = wait_event_killable_timeout(kmod_wq,
-                                         atomic_dec_if_positive(&kmod_concurrent_max) >= 0);
+                                                  atomic_dec_if_positive(&kmod_concurrent_max) >= 0,
+                                                  MAX_KMOD_ALL_BUSY_TIMEOUT * HZ);
+                if (!ret) {
+                        pr_warn_ratelimited("request_module: modprobe %s cannot be processed, kmod busy with %d threads for more than %d seconds now",
+                                            module_name, MAX_KMOD_CONCURRENT, MAX_KMOD_ALL_BUSY_TIMEOUT);
+                        return -ETIME;
+                } else if (ret == -ERESTARTSYS) {
+                        pr_warn_ratelimited("request_module: sigkill sent for modprobe %s, giving up", module_name);
+                        return ret;
+                }
        }
        trace_module_request(module_name, wait, _RET_IP_);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 222317721c5a..0972a8e09d08 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1650,7 +1650,7 @@ static unsigned long minimum_image_size(unsigned long saveable)
 {
        unsigned long size;
-        size = global_page_state(NR_SLAB_RECLAIMABLE)
+        size = global_node_page_state(NR_SLAB_RECLAIMABLE)
                + global_node_page_state(NR_ACTIVE_ANON)
                + global_node_page_state(NR_INACTIVE_ANON)
                + global_node_page_state(NR_ACTIVE_FILE)
diff --git a/kernel/signal.c b/kernel/signal.c
index 7e33f8c583e6..ed804a470dcd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1194,7 +1194,11 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
                        recalc_sigpending_and_wake(t);
                }
        }
-        if (action->sa.sa_handler == SIG_DFL)
+        /*
+         * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect
+         * debugging to leave init killable.
+         */
+        if (action->sa.sa_handler == SIG_DFL && !t->ptrace)
                t->signal->flags &= ~SIGNAL_UNKILLABLE;
        ret = specific_send_sig_info(sig, info, t);
        spin_unlock_irqrestore(&t->sighand->siglock, flags);
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 37385193a608..dc498b605d5d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -204,10 +204,36 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
                fmt_cnt++;
        }
-        return __trace_printk(1/* fake ip will not be printed */, fmt,
+/* Horrid workaround for getting va_list handling working with different
-                              mod[0] == 2 ? arg1 : mod[0] == 1 ? (long) arg1 : (u32) arg1,
+ * argument type combinations generically for 32 and 64 bit archs.
-                              mod[1] == 2 ? arg2 : mod[1] == 1 ? (long) arg2 : (u32) arg2,
+ */
-                              mod[2] == 2 ? arg3 : mod[2] == 1 ? (long) arg3 : (u32) arg3);
+#define __BPF_TP_EMIT() __BPF_ARG3_TP()
+#define __BPF_TP(...)                                                   \
+        __trace_printk(1 /* Fake ip will not be printed. */,            \
+                       fmt, ##__VA_ARGS__)
+#define __BPF_ARG1_TP(...)                                              \
+        ((mod[0] == 2 || (mod[0] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_TP(arg1, ##__VA_ARGS__)                               \
+          : ((mod[0] == 1 || (mod[0] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_TP((long)arg1, ##__VA_ARGS__)                     \
+              : __BPF_TP((u32)arg1, ##__VA_ARGS__)))
+#define __BPF_ARG2_TP(...)                                              \
+        ((mod[1] == 2 || (mod[1] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG1_TP(arg2, ##__VA_ARGS__)                          \
+          : ((mod[1] == 1 || (mod[1] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG1_TP((long)arg2, ##__VA_ARGS__)                \
+              : __BPF_ARG1_TP((u32)arg2, ##__VA_ARGS__)))
+#define __BPF_ARG3_TP(...)                                              \
+        ((mod[2] == 2 || (mod[2] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG2_TP(arg3, ##__VA_ARGS__)                          \
+          : ((mod[2] == 1 || (mod[2] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG2_TP((long)arg3, ##__VA_ARGS__)                \
+              : __BPF_ARG2_TP((u32)arg3, ##__VA_ARGS__)))
+        return __BPF_TP_EMIT();
 }
 static const struct bpf_func_proto bpf_trace_printk_proto = {
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 06d3389bca0d..f5d52024f6b7 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -240,6 +240,7 @@ static void set_sample_period(void)
         * hardlockup detector generates a warning
         */
        sample_period = get_softlockup_thresh() * ((u64)NSEC_PER_SEC / 5);
+        watchdog_update_hrtimer_threshold(sample_period);
 }
 /* Commands for resetting the watchdog */
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 295a0d84934c..3a09ea1b1d3d 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -37,6 +37,62 @@ void arch_touch_nmi_watchdog(void)
 }
 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
+#ifdef CONFIG_HARDLOCKUP_CHECK_TIMESTAMP
+static DEFINE_PER_CPU(ktime_t, last_timestamp);
+static DEFINE_PER_CPU(unsigned int, nmi_rearmed);
+static ktime_t watchdog_hrtimer_sample_threshold __read_mostly;
+void watchdog_update_hrtimer_threshold(u64 period)
+{
+        /*
+         * The hrtimer runs with a period of (watchdog_threshold * 2) / 5
+         *
+         * So it runs effectively with 2.5 times the rate of the NMI
+         * watchdog. That means the hrtimer should fire 2-3 times before
+         * the NMI watchdog expires. The NMI watchdog on x86 is based on
+         * unhalted CPU cycles, so if Turbo-Mode is enabled the CPU cycles
+         * might run way faster than expected and the NMI fires in a
+         * smaller period than the one deduced from the nominal CPU
+         * frequency. Depending on the Turbo-Mode factor this might be fast
+         * enough to get the NMI period smaller than the hrtimer watchdog
+         * period and trigger false positives.
+         *
+         * The sample threshold is used to check in the NMI handler whether
+         * the minimum time between two NMI samples has elapsed. That
+         * prevents false positives.
+         *
+         * Set this to 4/5 of the actual watchdog threshold period so the
+         * hrtimer is guaranteed to fire at least once within the real
+         * watchdog threshold.
+         */
+        watchdog_hrtimer_sample_threshold = period * 2;
+}
+static bool watchdog_check_timestamp(void)
+{
+        ktime_t delta, now = ktime_get_mono_fast_ns();
+        delta = now - __this_cpu_read(last_timestamp);
+        if (delta < watchdog_hrtimer_sample_threshold) {
+                /*
+                 * If ktime is jiffies based, a stalled timer would prevent
+                 * jiffies from being incremented and the filter would look
+                 * at a stale timestamp and never trigger.
+                 */
+                if (__this_cpu_inc_return(nmi_rearmed) < 10)
+                        return false;
+        }
+        __this_cpu_write(nmi_rearmed, 0);
+        __this_cpu_write(last_timestamp, now);
+        return true;
+}
+#else
+static inline bool watchdog_check_timestamp(void)
+{
+        return true;
+}
+#endif
 static struct perf_event_attr wd_hw_attr = {
        .type           = PERF_TYPE_HARDWARE,
        .config         = PERF_COUNT_HW_CPU_CYCLES,
@@ -61,6 +117,9 @@ static void watchdog_overflow_callback(struct perf_event *event,
                return;
        }
+        if (!watchdog_check_timestamp())
+                return;
        /* check for a hardlockup
         * This is done by making sure our timer interrupt
         * is incrementing.  The timer interrupt should have
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 98fe715522e8..c617b9d1d6cb 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -798,6 +798,13 @@ config HARDLOCKUP_DETECTOR_PERF
        select SOFTLOCKUP_DETECTOR
 #
+# Enables a timestamp based low pass filter to compensate for perf based
+# hard lockup detection which runs too fast due to turbo modes.
+#
+config HARDLOCKUP_CHECK_TIMESTAMP
+        bool
+#
 # arch/ can define HAVE_HARDLOCKUP_DETECTOR_ARCH to provide their own hard
 # lockup detector rather than the perf based detector.
 #
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index 7d315fdb9f13..cf7b129b0b2b 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -110,10 +110,12 @@ bool should_fail(struct fault_attr *attr, ssize_t size)
        if (in_task()) {
                unsigned int fail_nth = READ_ONCE(current->fail_nth);
-                if (fail_nth && !WRITE_ONCE(current->fail_nth, fail_nth - 1))
+                if (fail_nth) {
-                        goto fail;
+                        if (!WRITE_ONCE(current->fail_nth, fail_nth - 1))
+                                goto fail;
-                return false;
+                        return false;
+                }
        }
        /* No need to check any other properties if the probability is 0 */
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index 6c1d678bcf8b..ff9148969b92 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -485,7 +485,7 @@ static ssize_t config_show(struct device *dev,
                                config->test_driver);
        else
                len += snprintf(buf+len, PAGE_SIZE - len,
-                                "driver:\tEMTPY\n");
+                                "driver:\tEMPTY\n");
        if (config->test_fs)
                len += snprintf(buf+len, PAGE_SIZE - len,
@@ -493,7 +493,7 @@ static ssize_t config_show(struct device *dev,
                                config->test_fs);
        else
                len += snprintf(buf+len, PAGE_SIZE - len,
-                                "fs:\tEMTPY\n");
+                                "fs:\tEMPTY\n");
        mutex_unlock(&test_dev->config_mutex);
@@ -746,11 +746,11 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev,
                                                      strlen(test_str));
                break;
        case TEST_KMOD_FS_TYPE:
-                break;
                kfree_const(config->test_fs);
                config->test_driver = NULL;
                copied = config_copy_test_fs(config, test_str,
                                             strlen(test_str));
+                break;
        default:
                mutex_unlock(&test_dev->config_mutex);
                return -EINVAL;
@@ -880,10 +880,10 @@ static int test_dev_config_update_uint_sync(struct kmod_test_device *test_dev,
                                            int (*test_sync)(struct kmod_test_device *test_dev))
 {
        int ret;
-        long new;
+        unsigned long new;
        unsigned int old_val;
-        ret = kstrtol(buf, 10, &new);
+        ret = kstrtoul(buf, 10, &new);
        if (ret)
                return ret;
@@ -918,9 +918,9 @@ static int test_dev_config_update_uint_range(struct kmod_test_device *test_dev,
                                             unsigned int max)
 {
        int ret;
-        long new;
+        unsigned long new;
-        ret = kstrtol(buf, 10, &new);
+        ret = kstrtoul(buf, 10, &new);
        if (ret)
                return ret;
@@ -1146,7 +1146,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
        struct kmod_test_device *test_dev = NULL;
        int ret;
-        mutex_unlock(&reg_dev_mutex);
+        mutex_lock(&reg_dev_mutex);
        /* int should suffice for number of devices, test for wrap */
        if (unlikely(num_test_devs + 1) < 0) {
diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
index 9075aa54e955..b06d9fe23a28 100644
--- a/mm/balloon_compaction.c
+++ b/mm/balloon_compaction.c
@@ -24,7 +24,7 @@ struct page *balloon_page_enqueue(struct balloon_dev_info *b_dev_info)
 {
        unsigned long flags;
        struct page *page = alloc_page(balloon_mapping_gfp_mask() |
-                                __GFP_NOMEMALLOC | __GFP_NORETRY | __GFP_ZERO);
+                                       __GFP_NOMEMALLOC | __GFP_NORETRY);
        if (!page)
                return NULL;
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 595b757bef72..c03ccbc405a0 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -167,7 +167,7 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
        char name[16];
        int u32s;
-        sprintf(name, "cma-%s", cma->name);
+        scnprintf(name, sizeof(name), "cma-%s", cma->name);
        tmp = debugfs_create_dir(name, cma_debugfs_root);
diff --git a/mm/debug.c b/mm/debug.c
index db1cd26d8752..5715448ab0b5 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -124,9 +124,7 @@ void dump_mm(const struct mm_struct *mm)
 #ifdef CONFIG_NUMA_BALANCING
                "numa_next_scan %lu numa_scan_offset %lu numa_scan_seq %d\n"
 #endif
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
                "tlb_flush_pending %d\n"
-#endif
                "def_flags: %#lx(%pGv)\n",
                mm, mm->mmap, mm->vmacache_seqnum, mm->task_size,
@@ -158,9 +156,7 @@ void dump_mm(const struct mm_struct *mm)
 #ifdef CONFIG_NUMA_BALANCING
                mm->numa_next_scan, mm->numa_scan_offset, mm->numa_scan_seq,
 #endif
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+                atomic_read(&mm->tlb_flush_pending),
-                mm->tlb_flush_pending,
-#endif
                mm->def_flags, &mm->def_flags
        );
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 86975dec0ba1..90731e3b7e58 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -32,6 +32,7 @@
 #include <linux/userfaultfd_k.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/oom.h>
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -550,6 +551,7 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        struct mem_cgroup *memcg;
        pgtable_t pgtable;
        unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
+        int ret = 0;
        VM_BUG_ON_PAGE(!PageCompound(page), page);
@@ -561,9 +563,8 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        pgtable = pte_alloc_one(vma->vm_mm, haddr);
        if (unlikely(!pgtable)) {
-                mem_cgroup_cancel_charge(page, memcg, true);
+                ret = VM_FAULT_OOM;
-                put_page(page);
+                goto release;
-                return VM_FAULT_OOM;
        }
        clear_huge_page(page, haddr, HPAGE_PMD_NR);
@@ -576,13 +577,14 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
        if (unlikely(!pmd_none(*vmf->pmd))) {
-                spin_unlock(vmf->ptl);
+                goto unlock_release;
-                mem_cgroup_cancel_charge(page, memcg, true);
-                put_page(page);
-                pte_free(vma->vm_mm, pgtable);
        } else {
                pmd_t entry;
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock_release;
                /* Deliver the page fault to userland */
                if (userfaultfd_missing(vma)) {
                        int ret;
@@ -610,6 +612,15 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        }
        return 0;
+unlock_release:
+        spin_unlock(vmf->ptl);
+release:
+        if (pgtable)
+                pte_free(vma->vm_mm, pgtable);
+        mem_cgroup_cancel_charge(page, memcg, true);
+        put_page(page);
+        return ret;
 }
 /*
@@ -688,7 +699,10 @@ int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                ret = 0;
                set = false;
                if (pmd_none(*vmf->pmd)) {
-                        if (userfaultfd_missing(vma)) {
+                        ret = check_stable_address_space(vma->vm_mm);
+                        if (ret) {
+                                spin_unlock(vmf->ptl);
+                        } else if (userfaultfd_missing(vma)) {
                                spin_unlock(vmf->ptl);
                                ret = handle_userfault(vmf, VM_UFFD_MISSING);
                                VM_BUG_ON(ret & VM_FAULT_FALLBACK);
@@ -1496,6 +1510,13 @@ int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
        }
        /*
+         * The page_table_lock above provides a memory barrier
+         * with change_protection_range.
+         */
+        if (mm_tlb_flush_pending(vma->vm_mm))
+                flush_tlb_range(vma, haddr, haddr + HPAGE_PMD_SIZE);
+        /*
         * Migrate the THP to the requested node, returns with page unlocked
         * and access rights restored.
         */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a1a0ac0ad6f6..31e207cb399b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4062,9 +4062,9 @@ out:
        return ret;
 out_release_unlock:
        spin_unlock(ptl);
-out_release_nounlock:
        if (vm_shared)
                unlock_page(page);
+out_release_nounlock:
        put_page(page);
        goto out;
 }
diff --git a/mm/ksm.c b/mm/ksm.c
index 4dc92f138786..db20f8436bc3 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1038,7 +1038,8 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
                goto out_unlock;
        if (pte_write(*pvmw.pte) || pte_dirty(*pvmw.pte) ||
-            (pte_protnone(*pvmw.pte) && pte_savedwrite(*pvmw.pte))) {
+            (pte_protnone(*pvmw.pte) && pte_savedwrite(*pvmw.pte)) ||
+                                                mm_tlb_flush_pending(mm)) {
                pte_t entry;
                swapped = PageSwapCache(page);
diff --git a/mm/memblock.c b/mm/memblock.c
index 2cb25fe4452c..bf14aea6ab70 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -285,31 +285,27 @@ static void __init_memblock memblock_remove_region(struct memblock_type *type, u
 }
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
+/**
-phys_addr_t __init_memblock get_allocated_memblock_reserved_regions_info(
+ * Discard memory and reserved arrays if they were allocated
-                                        phys_addr_t *addr)
+ */
-{
+void __init memblock_discard(void)
-        if (memblock.reserved.regions == memblock_reserved_init_regions)
-                return 0;
-        *addr = __pa(memblock.reserved.regions);
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
-                          memblock.reserved.max);
-}
-phys_addr_t __init_memblock get_allocated_memblock_memory_regions_info(
-                                        phys_addr_t *addr)
 {
-        if (memblock.memory.regions == memblock_memory_init_regions)
+        phys_addr_t addr, size;
-                return 0;
-        *addr = __pa(memblock.memory.regions);
+        if (memblock.reserved.regions != memblock_reserved_init_regions) {
+                addr = __pa(memblock.reserved.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.reserved.max);
+                __memblock_free_late(addr, size);
+        }
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
+        if (memblock.memory.regions == memblock_memory_init_regions) {
-                          memblock.memory.max);
+                addr = __pa(memblock.memory.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.memory.max);
+                __memblock_free_late(addr, size);
+        }
 }
 #endif
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3df3c04d73ab..e09741af816f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1611,9 +1611,13 @@ cleanup:
 * @page: the page
 *
 * This function protects unlocked LRU pages from being moved to
- * another cgroup and stabilizes their page->mem_cgroup binding.
+ * another cgroup.
+ *
+ * It ensures lifetime of the returned memcg. Caller is responsible
+ * for the lifetime of the page; __unlock_page_memcg() is available
+ * when @page might get freed inside the locked section.
 */
-void lock_page_memcg(struct page *page)
+struct mem_cgroup *lock_page_memcg(struct page *page)
 {
        struct mem_cgroup *memcg;
        unsigned long flags;
@@ -1622,18 +1626,24 @@ void lock_page_memcg(struct page *page)
         * The RCU lock is held throughout the transaction.  The fast
         * path can get away without acquiring the memcg->move_lock
         * because page moving starts with an RCU grace period.
-         */
+         *
+         * The RCU lock also protects the memcg from being freed when
+         * the page state that is going to change is the only thing
+         * preventing the page itself from being freed. E.g. writeback
+         * doesn't hold a page reference and relies on PG_writeback to
+         * keep off truncation, migration and so forth.
+         */
        rcu_read_lock();
        if (mem_cgroup_disabled())
-                return;
+                return NULL;
 again:
        memcg = page->mem_cgroup;
        if (unlikely(!memcg))
-                return;
+                return NULL;
        if (atomic_read(&memcg->moving_account) <= 0)
-                return;
+                return memcg;
        spin_lock_irqsave(&memcg->move_lock, flags);
        if (memcg != page->mem_cgroup) {
@@ -1649,18 +1659,18 @@ again:
        memcg->move_lock_task = current;
        memcg->move_lock_flags = flags;
-        return;
+        return memcg;
 }
 EXPORT_SYMBOL(lock_page_memcg);
 /**
- * unlock_page_memcg - unlock a page->mem_cgroup binding
+ * __unlock_page_memcg - unlock and unpin a memcg
- * @page: the page
+ * @memcg: the memcg
+ *
+ * Unlock and unpin a memcg returned by lock_page_memcg().
 */
-void unlock_page_memcg(struct page *page)
+void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
-        struct mem_cgroup *memcg = page->mem_cgroup;
        if (memcg && memcg->move_lock_task == current) {
                unsigned long flags = memcg->move_lock_flags;
@@ -1672,6 +1682,15 @@ void unlock_page_memcg(struct page *page)
        rcu_read_unlock();
 }
+/**
+ * unlock_page_memcg - unlock a page->mem_cgroup binding
+ * @page: the page
+ */
+void unlock_page_memcg(struct page *page)
+{
+        __unlock_page_memcg(page->mem_cgroup);
+}
 EXPORT_SYMBOL(unlock_page_memcg);
 /*
diff --git a/mm/memory.c b/mm/memory.c
index f65beaad319b..fe2fba27ded2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -68,6 +68,7 @@
 #include <linux/debugfs.h>
 #include <linux/userfaultfd_k.h>
 #include <linux/dax.h>
+#include <linux/oom.h>
 #include <asm/io.h>
 #include <asm/mmu_context.h>
@@ -215,12 +216,8 @@ static bool tlb_next_batch(struct mmu_gather *tlb)
        return true;
 }
-/* tlb_gather_mmu
+void arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
- *      Called to initialize an (on-stack) mmu_gather structure for page-table
+                                unsigned long start, unsigned long end)
- *      tear-down from @mm. The @fullmm argument is used when @mm is without
- *      users and we're going to destroy the full address space (exit/execve).
- */
-void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
 {
        tlb->mm = mm;
@@ -275,10 +272,14 @@ void tlb_flush_mmu(struct mmu_gather *tlb)
 *      Called at the end of the shootdown operation to free up any resources
 *      that were required.
 */
-void tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+void arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
        struct mmu_gather_batch *batch, *next;
+        if (force)
+                __tlb_adjust_range(tlb, start, end - start);
        tlb_flush_mmu(tlb);
        /* keep the page table cache within bounds */
@@ -398,6 +399,34 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
 #endif /* CONFIG_HAVE_RCU_TABLE_FREE */
+/* tlb_gather_mmu
+ *      Called to initialize an (on-stack) mmu_gather structure for page-table
+ *      tear-down from @mm. The @fullmm argument is used when @mm is without
+ *      users and we're going to destroy the full address space (exit/execve).
+ */
+void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
+{
+        arch_tlb_gather_mmu(tlb, mm, start, end);
+        inc_tlb_flush_pending(tlb->mm);
+}
+void tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end)
+{
+        /*
+         * If there are parallel threads are doing PTE changes on same range
+         * under non-exclusive lock(e.g., mmap_sem read-side) but defer TLB
+         * flush by batching, a thread has stable TLB entry can fail to flush
+         * the TLB by observing pte_none|!pte_dirty, for example so flush TLB
+         * forcefully if we detect parallel PTE batching threads.
+         */
+        bool force = mm_tlb_flush_nested(tlb->mm);
+        arch_tlb_finish_mmu(tlb, start, end, force);
+        dec_tlb_flush_pending(tlb->mm);
+}
 /*
 * Note: this doesn't free the actual pages themselves. That
 * has been handled earlier when unmapping all the memory regions.
@@ -2865,6 +2894,7 @@ static int do_anonymous_page(struct vm_fault *vmf)
        struct vm_area_struct *vma = vmf->vma;
        struct mem_cgroup *memcg;
        struct page *page;
+        int ret = 0;
        pte_t entry;
        /* File mapping without ->vm_ops ? */
@@ -2897,6 +2927,9 @@ static int do_anonymous_page(struct vm_fault *vmf)
                                vmf->address, &vmf->ptl);
                if (!pte_none(*vmf->pte))
                        goto unlock;
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock;
                /* Deliver the page fault to userland, check inside PT lock */
                if (userfaultfd_missing(vma)) {
                        pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2931,6 +2964,10 @@ static int do_anonymous_page(struct vm_fault *vmf)
        if (!pte_none(*vmf->pte))
                goto release;
+        ret = check_stable_address_space(vma->vm_mm);
+        if (ret)
+                goto release;
        /* Deliver the page fault to userland, check inside PT lock */
        if (userfaultfd_missing(vma)) {
                pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2950,7 +2987,7 @@ setpte:
        update_mmu_cache(vma, vmf->address, vmf->pte);
 unlock:
        pte_unmap_unlock(vmf->pte, vmf->ptl);
-        return 0;
+        return ret;
 release:
        mem_cgroup_cancel_charge(page, memcg, false);
        put_page(page);
@@ -3224,7 +3261,7 @@ int alloc_set_pte(struct vm_fault *vmf, struct mem_cgroup *memcg,
 int finish_fault(struct vm_fault *vmf)
 {
        struct page *page;
-        int ret;
+        int ret = 0;
        /* Did we COW the page? */
        if ((vmf->flags & FAULT_FLAG_WRITE) &&
@@ -3232,7 +3269,15 @@ int finish_fault(struct vm_fault *vmf)
                page = vmf->cow_page;
        else
                page = vmf->page;
-        ret = alloc_set_pte(vmf, vmf->memcg, page);
+        /*
+         * check even for read faults because we might have lost our CoWed
+         * page
+         */
+        if (!(vmf->vma->vm_flags & VM_SHARED))
+                ret = check_stable_address_space(vmf->vma->vm_mm);
+        if (!ret)
+                ret = alloc_set_pte(vmf, vmf->memcg, page);
        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        return ret;
@@ -3872,19 +3917,6 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                        mem_cgroup_oom_synchronize(false);
        }
-        /*
-         * This mm has been already reaped by the oom reaper and so the
-         * refault cannot be trusted in general. Anonymous refaults would
-         * lose data and give a zero page instead e.g. This is especially
-         * problem for use_mm() because regular tasks will just die and
-         * the corrupted data will not be visible anywhere while kthread
-         * will outlive the oom victim and potentially propagate the date
-         * further.
-         */
-        if (unlikely((current->flags & PF_KTHREAD) && !(ret & VM_FAULT_ERROR)
-                                && test_bit(MMF_UNSTABLE, &vma->vm_mm->flags)))
-                ret = VM_FAULT_SIGBUS;
        return ret;
 }
 EXPORT_SYMBOL_GPL(handle_mm_fault);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d911fa5cb2a7..618ab125228b 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -861,11 +861,6 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
                *policy |= (pol->flags & MPOL_MODE_FLAGS);
        }
-        if (vma) {
-                up_read(&current->mm->mmap_sem);
-                vma = NULL;
-        }
        err = 0;
        if (nmask) {
                if (mpol_store_user_nodemask(pol)) {
diff --git a/mm/migrate.c b/mm/migrate.c
index 627671551873..e84eeb4e4356 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -41,6 +41,7 @@
 #include <linux/page_idle.h>
 #include <linux/page_owner.h>
 #include <linux/sched/mm.h>
+#include <linux/ptrace.h>
 #include <asm/tlbflush.h>
@@ -1652,7 +1653,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
                const int __user *, nodes,
                int __user *, status, int, flags)
 {
-        const struct cred *cred = current_cred(), *tcred;
        struct task_struct *task;
        struct mm_struct *mm;
        int err;
@@ -1676,14 +1676,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
        /*
         * Check if this process has the right to modify the specified
-         * process. The right exists if the process has administrative
+         * process. Use the regular "ptrace_may_access()" checks.
-         * capabilities, superuser privileges or the same
-         * userid as the target process.
         */
-        tcred = __task_cred(task);
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
-        if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
-            !uid_eq(cred->uid,  tcred->suid) && !uid_eq(cred->uid,  tcred->uid) &&
-            !capable(CAP_SYS_NICE)) {
                rcu_read_unlock();
                err = -EPERM;
                goto out;
@@ -1937,12 +1932,6 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                put_page(new_page);
                goto out_fail;
        }
-        /*
-         * We are not sure a pending tlb flush here is for a huge page
-         * mapping or not. Hence use the tlb range variant
-         */
-        if (mm_tlb_flush_pending(mm))
-                flush_tlb_range(vma, mmun_start, mmun_end);
        /* Prepare a page as a migration target */
        __SetPageLocked(new_page);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 4180ad8cc9c5..bd0f409922cb 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -244,7 +244,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
        BUG_ON(addr >= end);
        pgd = pgd_offset(mm, addr);
        flush_cache_range(vma, addr, end);
-        set_tlb_flush_pending(mm);
+        inc_tlb_flush_pending(mm);
        do {
                next = pgd_addr_end(addr, end);
                if (pgd_none_or_clear_bad(pgd))
@@ -256,7 +256,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
        /* Only flush the TLB if we actually modified any entries: */
        if (pages)
                flush_tlb_range(vma, start, end);
-        clear_tlb_flush_pending(mm);
+        dec_tlb_flush_pending(mm);
        return pages;
 }
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 36454d0f96ee..3637809a18d0 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -146,22 +146,6 @@ static unsigned long __init free_low_memory_core_early(void)
                                NULL)
                count += __free_memory_core(start, end);
-#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
-        {
-                phys_addr_t size;
-                /* Free memblock.reserved array if it was allocated */
-                size = get_allocated_memblock_reserved_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-                /* Free memblock.memory array if it was allocated */
-                size = get_allocated_memblock_memory_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-        }
-#endif
        return count;
 }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 96e93b214d31..bf050ab025b7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2724,9 +2724,12 @@ EXPORT_SYMBOL(clear_page_dirty_for_io);
 int test_clear_page_writeback(struct page *page)
 {
        struct address_space *mapping = page_mapping(page);
+        struct mem_cgroup *memcg;
+        struct lruvec *lruvec;
        int ret;
-        lock_page_memcg(page);
+        memcg = lock_page_memcg(page);
+        lruvec = mem_cgroup_page_lruvec(page, page_pgdat(page));
        if (mapping && mapping_use_writeback_tags(mapping)) {
                struct inode *inode = mapping->host;
                struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -2754,12 +2757,18 @@ int test_clear_page_writeback(struct page *page)
        } else {
                ret = TestClearPageWriteback(page);
        }
+        /*
+         * NOTE: Page might be free now! Writeback doesn't hold a page
+         * reference on its own, it relies on truncation to wait for
+         * the clearing of PG_writeback. The below can only access
+         * page state that is static across allocation cycles.
+         */
        if (ret) {
-                dec_lruvec_page_state(page, NR_WRITEBACK);
+                dec_lruvec_state(lruvec, NR_WRITEBACK);
                dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
                inc_node_page_state(page, NR_WRITTEN);
        }
-        unlock_page_memcg(page);
+        __unlock_page_memcg(memcg);
        return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fc32aa81f359..1bad301820c7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1584,6 +1584,10 @@ void __init page_alloc_init_late(void)
        /* Reinit limits that are based on free pages after the kernel is up */
        files_maxfiles_init();
 #endif
+#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
+        /* Discard memblock private memory */
+        memblock_discard();
+#endif
        for_each_populated_zone(zone)
                set_zone_contiguous(zone);
@@ -4458,8 +4462,9 @@ long si_mem_available(void)
         * Part of the reclaimable slab consists of items that are in use,
         * and cannot be freed. Cap this estimate at the low watermark.
         */
-        available += global_page_state(NR_SLAB_RECLAIMABLE) -
+        available += global_node_page_state(NR_SLAB_RECLAIMABLE) -
-                     min(global_page_state(NR_SLAB_RECLAIMABLE) / 2, wmark_low);
+                     min(global_node_page_state(NR_SLAB_RECLAIMABLE) / 2,
+                         wmark_low);
        if (available < 0)
                available = 0;
@@ -4602,8 +4607,8 @@ void show_free_areas(unsigned int filter, nodemask_t *nodemask)
                global_node_page_state(NR_FILE_DIRTY),
                global_node_page_state(NR_WRITEBACK),
                global_node_page_state(NR_UNSTABLE_NFS),
-                global_page_state(NR_SLAB_RECLAIMABLE),
+                global_node_page_state(NR_SLAB_RECLAIMABLE),
-                global_page_state(NR_SLAB_UNRECLAIMABLE),
+                global_node_page_state(NR_SLAB_UNRECLAIMABLE),
                global_node_page_state(NR_FILE_MAPPED),
                global_node_page_state(NR_SHMEM),
                global_page_state(NR_PAGETABLE),
@@ -7668,7 +7673,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
        /* Make sure the range is really isolated. */
        if (test_pages_isolated(outer_start, end, false)) {
-                pr_info("%s: [%lx, %lx) PFNs busy\n",
+                pr_info_ratelimited("%s: [%lx, %lx) PFNs busy\n",
                        __func__, outer_start, end);
                ret = -EBUSY;
                goto done;
diff --git a/mm/rmap.c b/mm/rmap.c
index c8993c63eb25..c1286d47aa1f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -888,10 +888,10 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                .flags = PVMW_SYNC,
        };
        int *cleaned = arg;
+        bool invalidation_needed = false;
        while (page_vma_mapped_walk(&pvmw)) {
                int ret = 0;
-                address = pvmw.address;
                if (pvmw.pte) {
                        pte_t entry;
                        pte_t *pte = pvmw.pte;
@@ -899,11 +899,11 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                        if (!pte_dirty(*pte) && !pte_write(*pte))
                                continue;
-                        flush_cache_page(vma, address, pte_pfn(*pte));
+                        flush_cache_page(vma, pvmw.address, pte_pfn(*pte));
-                        entry = ptep_clear_flush(vma, address, pte);
+                        entry = ptep_clear_flush(vma, pvmw.address, pte);
                        entry = pte_wrprotect(entry);
                        entry = pte_mkclean(entry);
-                        set_pte_at(vma->vm_mm, address, pte, entry);
+                        set_pte_at(vma->vm_mm, pvmw.address, pte, entry);
                        ret = 1;
                } else {
 #ifdef CONFIG_TRANSPARENT_HUGE_PAGECACHE
@@ -913,11 +913,11 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                        if (!pmd_dirty(*pmd) && !pmd_write(*pmd))
                                continue;
-                        flush_cache_page(vma, address, page_to_pfn(page));
+                        flush_cache_page(vma, pvmw.address, page_to_pfn(page));
-                        entry = pmdp_huge_clear_flush(vma, address, pmd);
+                        entry = pmdp_huge_clear_flush(vma, pvmw.address, pmd);
                        entry = pmd_wrprotect(entry);
                        entry = pmd_mkclean(entry);
-                        set_pmd_at(vma->vm_mm, address, pmd, entry);
+                        set_pmd_at(vma->vm_mm, pvmw.address, pmd, entry);
                        ret = 1;
 #else
                        /* unexpected pmd-mapped page? */
@@ -926,11 +926,16 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                }
                if (ret) {
-                        mmu_notifier_invalidate_page(vma->vm_mm, address);
                        (*cleaned)++;
+                        invalidation_needed = true;
                }
        }
+        if (invalidation_needed) {
+                mmu_notifier_invalidate_range(vma->vm_mm, address,
+                                address + (1UL << compound_order(page)));
+        }
        return true;
 }
@@ -1323,7 +1328,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
        };
        pte_t pteval;
        struct page *subpage;
-        bool ret = true;
+        bool ret = true, invalidation_needed = false;
        enum ttu_flags flags = (enum ttu_flags)arg;
        /* munlock has nothing to gain from examining un-locked vmas */
@@ -1363,11 +1368,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                VM_BUG_ON_PAGE(!pvmw.pte, page);
                subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
-                address = pvmw.address;
                if (!(flags & TTU_IGNORE_ACCESS)) {
-                        if (ptep_clear_flush_young_notify(vma, address,
+                        if (ptep_clear_flush_young_notify(vma, pvmw.address,
                                                pvmw.pte)) {
                                ret = false;
                                page_vma_mapped_walk_done(&pvmw);
@@ -1376,7 +1379,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                }
                /* Nuke the page table entry. */
-                flush_cache_page(vma, address, pte_pfn(*pvmw.pte));
+                flush_cache_page(vma, pvmw.address, pte_pfn(*pvmw.pte));
                if (should_defer_flush(mm, flags)) {
                        /*
                         * We clear the PTE but do not flush so potentially
@@ -1386,11 +1389,12 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         * transition on a cached TLB entry is written through
                         * and traps if the PTE is unmapped.
                         */
-                        pteval = ptep_get_and_clear(mm, address, pvmw.pte);
+                        pteval = ptep_get_and_clear(mm, pvmw.address,
+                                                    pvmw.pte);
                        set_tlb_ubc_flush_pending(mm, pte_dirty(pteval));
                } else {
-                        pteval = ptep_clear_flush(vma, address, pvmw.pte);
+                        pteval = ptep_clear_flush(vma, pvmw.address, pvmw.pte);
                }
                /* Move the dirty bit to the page. Now the pte is gone. */
@@ -1405,12 +1409,12 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                        if (PageHuge(page)) {
                                int nr = 1 << compound_order(page);
                                hugetlb_count_sub(nr, mm);
-                                set_huge_swap_pte_at(mm, address,
+                                set_huge_swap_pte_at(mm, pvmw.address,
                                                     pvmw.pte, pteval,
                                                     vma_mmu_pagesize(vma));
                        } else {
                                dec_mm_counter(mm, mm_counter(page));
-                                set_pte_at(mm, address, pvmw.pte, pteval);
+                                set_pte_at(mm, pvmw.address, pvmw.pte, pteval);
                        }
                } else if (pte_unused(pteval)) {
@@ -1434,7 +1438,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                        swp_pte = swp_entry_to_pte(entry);
                        if (pte_soft_dirty(pteval))
                                swp_pte = pte_swp_mksoft_dirty(swp_pte);
-                        set_pte_at(mm, address, pvmw.pte, swp_pte);
+                        set_pte_at(mm, pvmw.address, pvmw.pte, swp_pte);
                } else if (PageAnon(page)) {
                        swp_entry_t entry = { .val = page_private(subpage) };
                        pte_t swp_pte;
@@ -1460,7 +1464,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                                 * If the page was redirtied, it cannot be
                                 * discarded. Remap the page to page table.
                                 */
-                                set_pte_at(mm, address, pvmw.pte, pteval);
+                                set_pte_at(mm, pvmw.address, pvmw.pte, pteval);
                                SetPageSwapBacked(page);
                                ret = false;
                                page_vma_mapped_walk_done(&pvmw);
@@ -1468,7 +1472,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                        }
                        if (swap_duplicate(entry) < 0) {
-                                set_pte_at(mm, address, pvmw.pte, pteval);
+                                set_pte_at(mm, pvmw.address, pvmw.pte, pteval);
                                ret = false;
                                page_vma_mapped_walk_done(&pvmw);
                                break;
@@ -1484,14 +1488,18 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                        swp_pte = swp_entry_to_pte(entry);
                        if (pte_soft_dirty(pteval))
                                swp_pte = pte_swp_mksoft_dirty(swp_pte);
-                        set_pte_at(mm, address, pvmw.pte, swp_pte);
+                        set_pte_at(mm, pvmw.address, pvmw.pte, swp_pte);
                } else
                        dec_mm_counter(mm, mm_counter_file(page));
 discard:
                page_remove_rmap(subpage, PageHuge(page));
                put_page(page);
-                mmu_notifier_invalidate_page(mm, address);
+                invalidation_needed = true;
        }
+        if (invalidation_needed)
+                mmu_notifier_invalidate_range(mm, address,
+                                address + (1UL << compound_order(page)));
        return ret;
 }
diff --git a/mm/shmem.c b/mm/shmem.c
index b0aa6075d164..6540e5982444 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1022,7 +1022,11 @@ static int shmem_setattr(struct dentry *dentry, struct iattr *attr)
                         */
                        if (IS_ENABLED(CONFIG_TRANSPARENT_HUGE_PAGECACHE)) {
                                spin_lock(&sbinfo->shrinklist_lock);
-                                if (list_empty(&info->shrinklist)) {
+                                /*
+                                 * _careful to defend against unlocked access to
+                                 * ->shrink_list in shmem_unused_huge_shrink()
+                                 */
+                                if (list_empty_careful(&info->shrinklist)) {
                                        list_add_tail(&info->shrinklist,
                                                        &sbinfo->shrinklist);
                                        sbinfo->shrinklist_len++;
@@ -1817,7 +1821,11 @@ alloc_nohuge:		page = shmem_alloc_and_acct_page(gfp, info, sbinfo,
                         * to shrink under memory pressure.
                         */
                        spin_lock(&sbinfo->shrinklist_lock);
-                        if (list_empty(&info->shrinklist)) {
+                        /*
+                         * _careful to defend against unlocked access to
+                         * ->shrink_list in shmem_unused_huge_shrink()
+                         */
+                        if (list_empty_careful(&info->shrinklist)) {
                                list_add_tail(&info->shrinklist,
                                                &sbinfo->shrinklist);
                                sbinfo->shrinklist_len++;
diff --git a/mm/slub.c b/mm/slub.c
index 1d3f9835f4ea..e8b4e31162ca 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5642,13 +5642,14 @@ static void sysfs_slab_remove_workfn(struct work_struct *work)
                 * A cache is never shut down before deactivation is
                 * complete, so no need to worry about synchronization.
                 */
-                return;
+                goto out;
 #ifdef CONFIG_MEMCG
        kset_unregister(s->memcg_kset);
 #endif
        kobject_uevent(&s->kobj, KOBJ_REMOVE);
        kobject_del(&s->kobj);
+out:
        kobject_put(&s->kobj);
 }
diff --git a/mm/util.c b/mm/util.c
index 7b07ec852e01..9ecddf568fe3 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -633,7 +633,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
                 * which are reclaimable, under pressure.  The dentry
                 * cache and most inode caches should fall into this
                 */
-                free += global_page_state(NR_SLAB_RECLAIMABLE);
+                free += global_node_page_state(NR_SLAB_RECLAIMABLE);
                /*
                 * Leave reserved pages. The pages are not for anonymous pages.
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8698c1c86c4d..a47e3894c775 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1671,7 +1671,10 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
        struct page **pages;
        unsigned int nr_pages, array_size, i;
        const gfp_t nested_gfp = (gfp_mask & GFP_RECLAIM_MASK) | __GFP_ZERO;
-        const gfp_t alloc_mask = gfp_mask | __GFP_HIGHMEM | __GFP_NOWARN;
+        const gfp_t alloc_mask = gfp_mask | __GFP_NOWARN;
+        const gfp_t highmem_mask = (gfp_mask & (GFP_DMA | GFP_DMA32)) ?
+                                        0 :
+                                        __GFP_HIGHMEM;
        nr_pages = get_vm_area_size(area) >> PAGE_SHIFT;
        array_size = (nr_pages * sizeof(struct page *));
@@ -1679,7 +1682,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
        area->nr_pages = nr_pages;
        /* Please note that the recursion is strictly bounded. */
        if (array_size > PAGE_SIZE) {
-                pages = __vmalloc_node(array_size, 1, nested_gfp|__GFP_HIGHMEM,
+                pages = __vmalloc_node(array_size, 1, nested_gfp|highmem_mask,
                                PAGE_KERNEL, node, area->caller);
        } else {
                pages = kmalloc_node(array_size, nested_gfp, node);
@@ -1700,9 +1703,9 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                }
                if (node == NUMA_NO_NODE)
-                        page = alloc_page(alloc_mask);
+                        page = alloc_page(alloc_mask|highmem_mask);
                else
-                        page = alloc_pages_node(node, alloc_mask, 0);
+                        page = alloc_pages_node(node, alloc_mask|highmem_mask, 0);
                if (unlikely(!page)) {
                        /* Successfully allocated i pages, free them in __vunmap() */
@@ -1710,7 +1713,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                        goto fail;
                }
                area->pages[i] = page;
-                if (gfpflags_allow_blocking(gfp_mask))
+                if (gfpflags_allow_blocking(gfp_mask|highmem_mask))
                        cond_resched();
        }
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index e1133bc634b5..8a3ce79b1307 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1549,9 +1549,41 @@ batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry,
        return found;
 }
+/**
+ * batadv_tt_global_sync_flags - update TT sync flags
+ * @tt_global: the TT global entry to update sync flags in
+ *
+ * Updates the sync flag bits in the tt_global flag attribute with a logical
+ * OR of all sync flags from any of its TT orig entries.
+ */
+static void
+batadv_tt_global_sync_flags(struct batadv_tt_global_entry *tt_global)
+{
+        struct batadv_tt_orig_list_entry *orig_entry;
+        const struct hlist_head *head;
+        u16 flags = BATADV_NO_FLAGS;
+        rcu_read_lock();
+        head = &tt_global->orig_list;
+        hlist_for_each_entry_rcu(orig_entry, head, list)
+                flags |= orig_entry->flags;
+        rcu_read_unlock();
+        flags |= tt_global->common.flags & (~BATADV_TT_SYNC_MASK);
+        tt_global->common.flags = flags;
+}
+/**
+ * batadv_tt_global_orig_entry_add - add or update a TT orig entry
+ * @tt_global: the TT global entry to add an orig entry in
+ * @orig_node: the originator to add an orig entry for
+ * @ttvn: translation table version number of this changeset
+ * @flags: TT sync flags
+ */
 static void
 batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
-                                struct batadv_orig_node *orig_node, int ttvn)
+                                struct batadv_orig_node *orig_node, int ttvn,
+                                u8 flags)
 {
        struct batadv_tt_orig_list_entry *orig_entry;
@@ -1561,7 +1593,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
                 * was added during a "temporary client detection"
                 */
                orig_entry->ttvn = ttvn;
-                goto out;
+                orig_entry->flags = flags;
+                goto sync_flags;
        }
        orig_entry = kmem_cache_zalloc(batadv_tt_orig_cache, GFP_ATOMIC);
@@ -1573,6 +1606,7 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
        batadv_tt_global_size_inc(orig_node, tt_global->common.vid);
        orig_entry->orig_node = orig_node;
        orig_entry->ttvn = ttvn;
+        orig_entry->flags = flags;
        kref_init(&orig_entry->refcount);
        spin_lock_bh(&tt_global->list_lock);
@@ -1582,6 +1616,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
        spin_unlock_bh(&tt_global->list_lock);
        atomic_inc(&tt_global->orig_list_count);
+sync_flags:
+        batadv_tt_global_sync_flags(tt_global);
 out:
        if (orig_entry)
                batadv_tt_orig_list_entry_put(orig_entry);
@@ -1703,10 +1739,10 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                }
                /* the change can carry possible "attribute" flags like the
-                 * TT_CLIENT_WIFI, therefore they have to be copied in the
+                 * TT_CLIENT_TEMP, therefore they have to be copied in the
                 * client entry
                 */
-                common->flags |= flags;
+                common->flags |= flags & (~BATADV_TT_SYNC_MASK);
                /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
                 * one originator left in the list and we previously received a
@@ -1723,7 +1759,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
        }
 add_orig_entry:
        /* add the new orig_entry (if needed) or update it */
-        batadv_tt_global_orig_entry_add(tt_global_entry, orig_node, ttvn);
+        batadv_tt_global_orig_entry_add(tt_global_entry, orig_node, ttvn,
+                                        flags & BATADV_TT_SYNC_MASK);
        batadv_dbg(BATADV_DBG_TT, bat_priv,
                   "Creating new global tt entry: %pM (vid: %d, via %pM)\n",
@@ -1946,6 +1983,7 @@ batadv_tt_global_dump_subentry(struct sk_buff *msg, u32 portid, u32 seq,
                               struct batadv_tt_orig_list_entry *orig,
                               bool best)
 {
+        u16 flags = (common->flags & (~BATADV_TT_SYNC_MASK)) | orig->flags;
        void *hdr;
        struct batadv_orig_node_vlan *vlan;
        u8 last_ttvn;
@@ -1975,7 +2013,7 @@ batadv_tt_global_dump_subentry(struct sk_buff *msg, u32 portid, u32 seq,
            nla_put_u8(msg, BATADV_ATTR_TT_LAST_TTVN, last_ttvn) ||
            nla_put_u32(msg, BATADV_ATTR_TT_CRC32, crc) ||
            nla_put_u16(msg, BATADV_ATTR_TT_VID, common->vid) ||
-            nla_put_u32(msg, BATADV_ATTR_TT_FLAGS, common->flags))
+            nla_put_u32(msg, BATADV_ATTR_TT_FLAGS, flags))
                goto nla_put_failure;
        if (best && nla_put_flag(msg, BATADV_ATTR_FLAG_BEST))
@@ -2589,6 +2627,7 @@ static u32 batadv_tt_global_crc(struct batadv_priv *bat_priv,
                                unsigned short vid)
 {
        struct batadv_hashtable *hash = bat_priv->tt.global_hash;
+        struct batadv_tt_orig_list_entry *tt_orig;
        struct batadv_tt_common_entry *tt_common;
        struct batadv_tt_global_entry *tt_global;
        struct hlist_head *head;
@@ -2627,8 +2666,9 @@ static u32 batadv_tt_global_crc(struct batadv_priv *bat_priv,
                        /* find out if this global entry is announced by this
                         * originator
                         */
-                        if (!batadv_tt_global_entry_has_orig(tt_global,
+                        tt_orig = batadv_tt_global_orig_entry_find(tt_global,
-                                                             orig_node))
+                                                                   orig_node);
+                        if (!tt_orig)
                                continue;
                        /* use network order to read the VID: this ensures that
@@ -2640,10 +2680,12 @@ static u32 batadv_tt_global_crc(struct batadv_priv *bat_priv,
                        /* compute the CRC on flags that have to be kept in sync
                         * among nodes
                         */
-                        flags = tt_common->flags & BATADV_TT_SYNC_MASK;
+                        flags = tt_orig->flags;
                        crc_tmp = crc32c(crc_tmp, &flags, sizeof(flags));
                        crc ^= crc32c(crc_tmp, tt_common->addr, ETH_ALEN);
+                        batadv_tt_orig_list_entry_put(tt_orig);
                }
                rcu_read_unlock();
        }
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index ea43a6449247..a62795868794 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1260,6 +1260,7 @@ struct batadv_tt_global_entry {
 * struct batadv_tt_orig_list_entry - orig node announcing a non-mesh client
 * @orig_node: pointer to orig node announcing this non-mesh client
 * @ttvn: translation table version number which added the non-mesh client
+ * @flags: per orig entry TT sync flags
 * @list: list node for batadv_tt_global_entry::orig_list
 * @refcount: number of contexts the object is used
 * @rcu: struct used for freeing in an RCU-safe manner
@@ -1267,6 +1268,7 @@ struct batadv_tt_global_entry {
 struct batadv_tt_orig_list_entry {
        struct batadv_orig_node *orig_node;
        u8 ttvn;
+        u8 flags;
        struct hlist_node list;
        struct kref refcount;
        struct rcu_head rcu;
diff --git a/net/core/dev.c b/net/core/dev.c
index 8515f8fe0460..ce15a06d5558 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2739,7 +2739,7 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
 {
        if (tx_path)
                return skb->ip_summed != CHECKSUM_PARTIAL &&
-                       skb->ip_summed != CHECKSUM_NONE;
+                       skb->ip_summed != CHECKSUM_UNNECESSARY;
        return skb->ip_summed == CHECKSUM_NONE;
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index f44fc22fd45a..6280a602604c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3505,6 +3505,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                                              bpf_target_off(struct sk_buff, tc_index, 2,
                                                             target_size));
 #else
+                *target_size = 2;
                if (type == BPF_WRITE)
                        *insn++ = BPF_MOV64_REG(si->dst_reg, si->dst_reg);
                else
@@ -3520,6 +3521,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                *insn++ = BPF_JMP_IMM(BPF_JGE, si->dst_reg, MIN_NAPI_ID, 1);
                *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #else
+                *target_size = 4;
                *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #endif
                break;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 9fe25bf63296..86bc40ba6ba5 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -201,10 +201,7 @@ void dccp_destroy_sock(struct sock *sk)
 {
        struct dccp_sock *dp = dccp_sk(sk);
-        /*
+        __skb_queue_purge(&sk->sk_write_queue);
-         * DCCP doesn't use sk_write_queue, just sk_send_head
-         * for retransmissions
-         */
        if (sk->sk_send_head != NULL) {
                kfree_skb(sk->sk_send_head);
                sk->sk_send_head = NULL;
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index fab41de8e983..de66ca8e6201 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -42,6 +42,9 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
        padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
        if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
+                if (skb_put_padto(skb, skb->len + padlen))
+                        return NULL;
                nskb = skb;
        } else {
                nskb = alloc_skb(NET_IP_ALIGN + skb->len +
@@ -56,13 +59,15 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
                skb_set_transport_header(nskb,
                                         skb_transport_header(skb) - skb->head);
                skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
+                if (skb_put_padto(nskb, nskb->len + padlen)) {
+                        kfree_skb(nskb);
+                        return NULL;
+                }
                kfree_skb(skb);
        }
-        /* skb is freed when it fails */
-        if (skb_put_padto(nskb, nskb->len + padlen))
-                return NULL;
        tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
        tag[0] = 0;
        tag[1] = 1 << p->dp->index; /* destination port */
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 76c2077c3f5b..2e548eca3489 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1731,6 +1731,13 @@ static __net_init int inet_init_net(struct net *net)
        net->ipv4.sysctl_ip_prot_sock = PROT_SOCK;
 #endif
+        /* Some igmp sysctl, whose values are always used */
+        net->ipv4.sysctl_igmp_max_memberships = 20;
+        net->ipv4.sysctl_igmp_max_msf = 10;
+        /* IGMP reports for link-local multicast groups are enabled by default */
+        net->ipv4.sysctl_igmp_llm_reports = 1;
+        net->ipv4.sysctl_igmp_qrv = 2;
        return 0;
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index c4c6e1969ed0..2ae8f54cb321 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
        int taglen;
        for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
-                if (optptr[0] == IPOPT_CIPSO)
+                switch (optptr[0]) {
+                case IPOPT_CIPSO:
                        return optptr;
-                taglen = optptr[1];
+                case IPOPT_END:
+                        return NULL;
+                case IPOPT_NOOP:
+                        taglen = 1;
+                        break;
+                default:
+                        taglen = optptr[1];
+                }
                optlen -= taglen;
                optptr += taglen;
        }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b8d18171cca3..ec3a9ce281a6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1083,15 +1083,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
        fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
        if (!fi)
                goto failure;
-        fib_info_cnt++;
        if (cfg->fc_mx) {
                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-                if (!fi->fib_metrics)
+                if (unlikely(!fi->fib_metrics)) {
-                        goto failure;
+                        kfree(fi);
+                        return ERR_PTR(err);
+                }
                atomic_set(&fi->fib_metrics->refcnt, 1);
-        } else
+        } else {
                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
+        }
+        fib_info_cnt++;
        fi->fib_net = net;
        fi->fib_protocol = cfg->fc_protocol;
        fi->fib_scope = cfg->fc_scope;
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 8e0257d01200..1540db65241a 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -450,6 +450,7 @@ out_unlock:
 out:
        NAPI_GRO_CB(skb)->flush |= flush;
        skb_gro_remcsum_cleanup(skb, &grc);
+        skb->remcsum_offload = 0;
        return pp;
 }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 28f14afd0dd3..498706b072fb 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2974,12 +2974,6 @@ static int __net_init igmp_net_init(struct net *net)
                goto out_sock;
        }
-        /* Sysctl initialization */
-        net->ipv4.sysctl_igmp_max_memberships = 20;
-        net->ipv4.sysctl_igmp_max_msf = 10;
-        /* IGMP reports for link-local multicast groups are enabled by default */
-        net->ipv4.sysctl_igmp_llm_reports = 1;
-        net->ipv4.sysctl_igmp_qrv = 2;
        return 0;
 out_sock:
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 50c74cd890bc..e153c40c2436 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -965,11 +965,12 @@ static int __ip_append_data(struct sock *sk,
                csummode = CHECKSUM_PARTIAL;
        cork->length += length;
-        if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+        if ((skb && skb_is_gso(skb)) ||
-             (skb && skb_is_gso(skb))) &&
+            (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
                err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                         hh_len, fragheaderlen, transhdrlen,
                                         maxfraglen, flags);
@@ -1288,6 +1289,7 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                return -EINVAL;
        if ((size + skb->len > mtu) &&
+            (skb_queue_len(&sk->sk_write_queue) == 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO)) {
                if (skb->ip_summed != CHECKSUM_PARTIAL)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0383e66f59bc..7effa62beed3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2750,12 +2750,13 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                err = 0;
                if (IS_ERR(rt))
                        err = PTR_ERR(rt);
+                else
+                        skb_dst_set(skb, &rt->dst);
        }
        if (err)
                goto errout_free;
-        skb_dst_set(skb, &rt->dst);
        if (rtm->rtm_flags & RTM_F_NOTIFY)
                rt->rt_flags |= RTCF_NOTIFY;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2920e0cb09f8..53de1424c13c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -107,6 +107,7 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
 #define FLAG_ORIG_SACK_ACKED    0x200 /* Never retransmitted data are (s)acked  */
 #define FLAG_SND_UNA_ADVANCED   0x400 /* Snd_una was changed (!= FLAG_DATA_ACKED) */
 #define FLAG_DSACKING_ACK       0x800 /* SACK blocks contained D-SACK info */
+#define FLAG_SET_XMIT_TIMER     0x1000 /* Set TLP or RTO timer */
 #define FLAG_SACK_RENEGING      0x2000 /* snd_una advanced to a sacked seq */
 #define FLAG_UPDATE_TS_RECENT   0x4000 /* tcp_replace_ts_recent() */
 #define FLAG_NO_CHALLENGE_ACK   0x8000 /* do not call tcp_send_challenge_ack()  */
@@ -2520,8 +2521,8 @@ static inline void tcp_end_cwnd_reduction(struct sock *sk)
                return;
        /* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */
-        if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR ||
+        if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH &&
-            (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) {
+            (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || tp->undo_marker)) {
                tp->snd_cwnd = tp->snd_ssthresh;
                tp->snd_cwnd_stamp = tcp_jiffies32;
        }
@@ -3004,10 +3005,7 @@ void tcp_rearm_rto(struct sock *sk)
                /* Offset the time elapsed after installing regular RTO */
                if (icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
                    icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
-                        struct sk_buff *skb = tcp_write_queue_head(sk);
+                        s64 delta_us = tcp_rto_delta_us(sk);
-                        u64 rto_time_stamp = skb->skb_mstamp +
-                                             jiffies_to_usecs(rto);
-                        s64 delta_us = rto_time_stamp - tp->tcp_mstamp;
                        /* delta_us may not be positive if the socket is locked
                         * when the retrans timer fires and is rescheduled.
                         */
@@ -3019,6 +3017,13 @@ void tcp_rearm_rto(struct sock *sk)
        }
 }
+/* Try to schedule a loss probe; if that doesn't work, then schedule an RTO. */
+static void tcp_set_xmit_timer(struct sock *sk)
+{
+        if (!tcp_schedule_loss_probe(sk))
+                tcp_rearm_rto(sk);
+}
 /* If we get here, the whole TSO packet has not been acked. */
 static u32 tcp_tso_acked(struct sock *sk, struct sk_buff *skb)
 {
@@ -3180,7 +3185,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                                        ca_rtt_us, sack->rate);
        if (flag & FLAG_ACKED) {
-                tcp_rearm_rto(sk);
+                flag |= FLAG_SET_XMIT_TIMER;  /* set TLP or RTO timer */
                if (unlikely(icsk->icsk_mtup.probe_size &&
                             !after(tp->mtu_probe.probe_seq_end, tp->snd_una))) {
                        tcp_mtup_probe_success(sk);
@@ -3208,7 +3213,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                 * after when the head was last (re)transmitted. Otherwise the
                 * timeout may continue to extend in loss recovery.
                 */
-                tcp_rearm_rto(sk);
+                flag |= FLAG_SET_XMIT_TIMER;  /* set TLP or RTO timer */
        }
        if (icsk->icsk_ca_ops->pkts_acked) {
@@ -3580,9 +3585,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
        if (after(ack, tp->snd_nxt))
                goto invalid_ack;
-        if (icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)
-                tcp_rearm_rto(sk);
        if (after(ack, prior_snd_una)) {
                flag |= FLAG_SND_UNA_ADVANCED;
                icsk->icsk_retransmits = 0;
@@ -3647,18 +3649,20 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una, &acked,
                                    &sack_state);
+        if (tp->tlp_high_seq)
+                tcp_process_tlp_ack(sk, ack, flag);
+        /* If needed, reset TLP/RTO timer; RACK may later override this. */
+        if (flag & FLAG_SET_XMIT_TIMER)
+                tcp_set_xmit_timer(sk);
        if (tcp_ack_is_dubious(sk, flag)) {
                is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
        }
-        if (tp->tlp_high_seq)
-                tcp_process_tlp_ack(sk, ack, flag);
        if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
                sk_dst_confirm(sk);
-        if (icsk->icsk_pending == ICSK_TIME_RETRANS)
-                tcp_schedule_loss_probe(sk);
        delivered = tp->delivered - delivered;  /* freshly ACKed or SACKed */
        lost = tp->lost - lost;                 /* freshly marked lost */
        tcp_rate_gen(sk, delivered, lost, sack_state.rate);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a20e7f03d5f7..e9252c7df809 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1722,6 +1722,8 @@ process:
                 */
                sock_hold(sk);
                refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                nsk = tcp_check_req(sk, skb, req, false);
                if (!nsk) {
                        reqsk_put(req);
@@ -1729,8 +1731,6 @@ process:
                }
                if (nsk == sk) {
                        reqsk_put(req);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                } else if (tcp_child_process(sk, nsk, skb)) {
                        tcp_v4_send_reset(nsk, skb);
                        goto discard_and_relse;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 2f1588bf73da..b7661a68d498 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2377,24 +2377,15 @@ bool tcp_schedule_loss_probe(struct sock *sk)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
-        u32 timeout, tlp_time_stamp, rto_time_stamp;
        u32 rtt = usecs_to_jiffies(tp->srtt_us >> 3);
+        u32 timeout, rto_delta_us;
-        /* No consecutive loss probes. */
-        if (WARN_ON(icsk->icsk_pending == ICSK_TIME_LOSS_PROBE)) {
-                tcp_rearm_rto(sk);
-                return false;
-        }
        /* Don't do any loss probe on a Fast Open connection before 3WHS
         * finishes.
         */
        if (tp->fastopen_rsk)
                return false;
-        /* TLP is only scheduled when next timer event is RTO. */
-        if (icsk->icsk_pending != ICSK_TIME_RETRANS)
-                return false;
        /* Schedule a loss probe in 2*RTT for SACK capable connections
         * in Open state, that are either limited by cwnd or application.
         */
@@ -2417,14 +2408,10 @@ bool tcp_schedule_loss_probe(struct sock *sk)
                                (rtt + (rtt >> 1) + TCP_DELACK_MAX));
        timeout = max_t(u32, timeout, msecs_to_jiffies(10));
-        /* If RTO is shorter, just schedule TLP in its place. */
+        /* If the RTO formula yields an earlier time, then use that time. */
-        tlp_time_stamp = tcp_jiffies32 + timeout;
+        rto_delta_us = tcp_rto_delta_us(sk);  /* How far in future is RTO? */
-        rto_time_stamp = (u32)inet_csk(sk)->icsk_timeout;
+        if (rto_delta_us > 0)
-        if ((s32)(tlp_time_stamp - rto_time_stamp) > 0) {
+                timeout = min_t(u32, timeout, usecs_to_jiffies(rto_delta_us));
-                s32 delta = rto_time_stamp - tcp_jiffies32;
-                if (delta > 0)
-                        timeout = delta;
-        }
        inet_csk_reset_xmit_timer(sk, ICSK_TIME_LOSS_PROBE, timeout,
                                  TCP_RTO_MAX);
@@ -3449,6 +3436,10 @@ int tcp_connect(struct sock *sk)
        int err;
        tcp_call_bpf(sk, BPF_SOCK_OPS_TCP_CONNECT_CB);
+        if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
+                return -EHOSTUNREACH; /* Routing failure or similar. */
        tcp_connect_init(sk);
        if (unlikely(tp->repair)) {
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c0feeeef962a..e906014890b6 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -652,7 +652,8 @@ static void tcp_keepalive_timer (unsigned long data)
                goto death;
        }
-        if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
+        if (!sock_flag(sk, SOCK_KEEPOPEN) ||
+            ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)))
                goto out;
        elapsed = keepalive_time_when(tp);
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 2417f55374c5..6bb9e14c710a 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -122,14 +122,14 @@ int tcp_set_ulp(struct sock *sk, const char *name)
        ulp_ops = __tcp_ulp_find_autoload(name);
        if (!ulp_ops)
-                err = -ENOENT;
+                return -ENOENT;
-        else
-                err = ulp_ops->init(sk);
-        if (err)
+        err = ulp_ops->init(sk);
-                goto out;
+        if (err) {
+                module_put(ulp_ops->owner);
+                return err;
+        }
        icsk->icsk_ulp_ops = ulp_ops;
- out:
+        return 0;
-        return err;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index e6276fa3750b..a7c804f73990 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -802,7 +802,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
        if (is_udplite)                                  /*     UDP-Lite      */
                csum = udplite_csum(skb);
-        else if (sk->sk_no_check_tx) {   /* UDP csum disabled */
+        else if (sk->sk_no_check_tx && !skb_is_gso(skb)) {   /* UDP csum off */
                skb->ip_summed = CHECKSUM_NONE;
                goto send;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 781250151d40..0932c85b42af 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -235,7 +235,7 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
        if (uh->check == 0)
                uh->check = CSUM_MANGLED_0;
-        skb->ip_summed = CHECKSUM_NONE;
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
        /* If there is no outer header we can fake a checksum offload
         * due to the fact that we have already done the checksum in
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 162efba0d0cd..2dfe50d8d609 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1381,11 +1381,12 @@ emsgsize:
         */
        cork->length += length;
-        if ((((length + (skb ? skb->len : headersize)) > mtu) ||
+        if ((skb && skb_is_gso(skb)) ||
-             (skb && skb_is_gso(skb))) &&
+            (((length + (skb ? skb->len : headersize)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
                err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, exthdrlen,
                                          transhdrlen, mtu, flags, fl6);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4d30c96a819d..94d6a13d47f0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -417,14 +417,11 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
        struct net_device *loopback_dev =
                dev_net(dev)->loopback_dev;
-        if (dev != loopback_dev) {
+        if (idev && idev->dev != loopback_dev) {
-                if (idev && idev->dev == dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
-                        struct inet6_dev *loopback_idev =
+                if (loopback_idev) {
-                                in6_dev_get(loopback_dev);
+                        rt->rt6i_idev = loopback_idev;
-                        if (loopback_idev) {
+                        in6_dev_put(idev);
-                                rt->rt6i_idev = loopback_idev;
-                                in6_dev_put(idev);
-                        }
                }
        }
 }
@@ -2351,6 +2348,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
        if (on_link)
                nrt->rt6i_flags &= ~RTF_GATEWAY;
+        nrt->rt6i_protocol = RTPROT_REDIRECT;
        nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
        if (ip6_ins_rt(nrt))
@@ -2461,6 +2459,7 @@ static struct rt6_info *rt6_add_route_info(struct net *net,
                .fc_dst_len     = prefixlen,
                .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
                                  RTF_UP | RTF_PREF(pref),
+                .fc_protocol = RTPROT_RA,
                .fc_nlinfo.portid = 0,
                .fc_nlinfo.nlh = NULL,
                .fc_nlinfo.nl_net = net,
@@ -2513,6 +2512,7 @@ struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
                .fc_ifindex     = dev->ifindex,
                .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
                                  RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
+                .fc_protocol = RTPROT_RA,
                .fc_nlinfo.portid = 0,
                .fc_nlinfo.nlh = NULL,
                .fc_nlinfo.nl_net = dev_net(dev),
@@ -3424,14 +3424,6 @@ static int rt6_fill_node(struct net *net,
        rtm->rtm_flags = 0;
        rtm->rtm_scope = RT_SCOPE_UNIVERSE;
        rtm->rtm_protocol = rt->rt6i_protocol;
-        if (rt->rt6i_flags & RTF_DYNAMIC)
-                rtm->rtm_protocol = RTPROT_REDIRECT;
-        else if (rt->rt6i_flags & RTF_ADDRCONF) {
-                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ROUTEINFO))
-                        rtm->rtm_protocol = RTPROT_RA;
-                else
-                        rtm->rtm_protocol = RTPROT_KERNEL;
-        }
        if (rt->rt6i_flags & RTF_CACHE)
                rtm->rtm_flags |= RTM_F_CLONED;
@@ -3729,10 +3721,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                /* NETDEV_UNREGISTER could be fired for multiple times by
                 * netdev_wait_allrefs(). Make sure we only call this once.
                 */
-                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
-                in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
 #endif
        }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2521690d62d6..206210125fd7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1456,6 +1456,8 @@ process:
                }
                sock_hold(sk);
                refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                nsk = tcp_check_req(sk, skb, req, false);
                if (!nsk) {
                        reqsk_put(req);
@@ -1464,8 +1466,6 @@ process:
                if (nsk == sk) {
                        reqsk_put(req);
                        tcp_v6_restore_cb(skb);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                } else if (tcp_child_process(sk, nsk, skb)) {
                        tcp_v6_send_reset(nsk, skb);
                        goto discard_and_relse;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index a2267f80febb..e7d378c032cb 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -72,7 +72,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                if (uh->check == 0)
                        uh->check = CSUM_MANGLED_0;
-                skb->ip_summed = CHECKSUM_NONE;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
                /* If there is no outer header we can fake a checksum offload
                 * due to the fact that we have already done the checksum in
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ca9d3ae665e7..98f4d8211b9a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 #define BROADCAST_ONE           1
 #define BROADCAST_REGISTERED    2
 #define BROADCAST_PROMISC_ONLY  4
-static int pfkey_broadcast(struct sk_buff *skb,
+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                           int broadcast_flags, struct sock *one_sk,
                           struct net *net)
 {
@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb,
        rcu_read_unlock();
        if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
        kfree_skb(skb2);
        kfree_skb(skb);
@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
                hdr = (struct sadb_msg *) pfk->dump.skb->data;
                hdr->sadb_msg_seq = 0;
                hdr->sadb_msg_errno = rc;
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                &pfk->sk, sock_net(&pfk->sk));
                pfk->dump.skb = NULL;
        }
@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
                             sizeof(uint64_t));
-        pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
        return 0;
 }
@@ -1389,7 +1389,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
        xfrm_state_put(x);
-        pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+        pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
        return 0;
 }
@@ -1476,7 +1476,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
        hdr->sadb_msg_seq = c->seq;
        hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
        return 0;
 }
@@ -1589,7 +1589,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
        out_hdr->sadb_msg_reserved = 0;
        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
        return 0;
 }
@@ -1694,8 +1694,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
                return -ENOBUFS;
        }
-        pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
+        pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
+                        sock_net(sk));
        return 0;
 }
@@ -1712,7 +1712,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
        hdr->sadb_msg_errno = (uint8_t) 0;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
-        return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
+                               sock_net(sk));
 }
 static int key_notify_sa_flush(const struct km_event *c)
@@ -1733,7 +1734,7 @@ static int key_notify_sa_flush(const struct km_event *c)
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
        hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
        return 0;
 }
@@ -1790,7 +1791,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
        out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
        if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                &pfk->sk, sock_net(&pfk->sk));
        pfk->dump.skb = out_skb;
@@ -1878,7 +1879,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
                new_hdr->sadb_msg_errno = 0;
        }
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
        return 0;
 }
@@ -2206,7 +2207,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
        out_hdr->sadb_msg_errno = 0;
        out_hdr->sadb_msg_seq = c->seq;
        out_hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
        return 0;
 }
@@ -2426,7 +2427,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
        out_hdr->sadb_msg_errno = 0;
        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
        err = 0;
 out:
@@ -2682,7 +2683,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
        out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
        if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                &pfk->sk, sock_net(&pfk->sk));
        pfk->dump.skb = out_skb;
@@ -2739,7 +2740,7 @@ static int key_notify_policy_flush(const struct km_event *c)
        hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
        hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
        return 0;
 }
@@ -2803,7 +2804,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
        void *ext_hdrs[SADB_EXT_MAX];
        int err;
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
                        BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
        memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -3024,7 +3025,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
        out_hdr->sadb_msg_seq = 0;
        out_hdr->sadb_msg_pid = 0;
-        pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                        xs_net(x));
        return 0;
 }
@@ -3212,7 +3214,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
                       xfrm_ctx->ctx_len);
        }
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3408,7 +3411,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
        n_port->sadb_x_nat_t_port_port = sport;
        n_port->sadb_x_nat_t_port_reserved = 0;
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 #ifdef CONFIG_NET_KEY_MIGRATE
@@ -3599,7 +3603,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
        }
        /* broadcast migrate message to sockets */
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
        return 0;
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 8708cbe8af5b..2b36eff5d97e 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -7,7 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -466,3 +466,23 @@ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        rcu_read_lock();
+        sta = sta_info_get_bss(sdata, addr);
+        if (!sta)
+                goto unlock;
+        set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ unlock:
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 0615c2a950fa..008a45ca3112 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3700,14 +3700,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (optlen != sizeof(val))
                        return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
                if (val > INT_MAX)
                        return -EINVAL;
-                po->tp_reserve = val;
+                lock_sock(sk);
-                return 0;
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_reserve = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
        }
        case PACKET_LOSS:
        {
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index e10624aa6959..9722bf839d9d 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -1015,8 +1015,10 @@ void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic,
        if (rds_ib_ring_empty(&ic->i_recv_ring))
                rds_ib_stats_inc(s_ib_rx_ring_empty);
-        if (rds_ib_ring_low(&ic->i_recv_ring))
+        if (rds_ib_ring_low(&ic->i_recv_ring)) {
                rds_ib_recv_refill(conn, 0, GFP_NOWAIT);
+                rds_ib_stats_inc(s_ib_rx_refill_from_cq);
+        }
 }
 int rds_ib_recv_path(struct rds_conn_path *cp)
@@ -1029,6 +1031,7 @@ int rds_ib_recv_path(struct rds_conn_path *cp)
        if (rds_conn_up(conn)) {
                rds_ib_attempt_ack(ic);
                rds_ib_recv_refill(conn, 0, GFP_KERNEL);
+                rds_ib_stats_inc(s_ib_rx_refill_from_thread);
        }
        return ret;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 36f0ced9e60c..d516ba8178b8 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -36,8 +36,8 @@ static struct tc_action_ops act_ipt_ops;
 static unsigned int xt_net_id;
 static struct tc_action_ops act_xt_ops;
-static int ipt_init_target(struct xt_entry_target *t, char *table,
+static int ipt_init_target(struct net *net, struct xt_entry_target *t,
-                           unsigned int hook)
+                           char *table, unsigned int hook)
 {
        struct xt_tgchk_param par;
        struct xt_target *target;
@@ -49,8 +49,9 @@ static int ipt_init_target(struct xt_entry_target *t, char *table,
                return PTR_ERR(target);
        t->u.kernel.target = target;
+        memset(&par, 0, sizeof(par));
+        par.net       = net;
        par.table     = table;
-        par.entryinfo = NULL;
        par.target    = target;
        par.targinfo  = t->data;
        par.hook_mask = hook;
@@ -91,10 +92,11 @@ static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
        [TCA_IPT_TARG]  = { .len = sizeof(struct xt_entry_target) },
 };
-static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
+static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
                          struct nlattr *est, struct tc_action **a,
                          const struct tc_action_ops *ops, int ovr, int bind)
 {
+        struct tc_action_net *tn = net_generic(net, id);
        struct nlattr *tb[TCA_IPT_MAX + 1];
        struct tcf_ipt *ipt;
        struct xt_entry_target *td, *t;
@@ -159,7 +161,7 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
        if (unlikely(!t))
                goto err2;
-        err = ipt_init_target(t, tname, hook);
+        err = ipt_init_target(net, t, tname, hook);
        if (err < 0)
                goto err3;
@@ -193,18 +195,16 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla,
                        struct nlattr *est, struct tc_action **a, int ovr,
                        int bind)
 {
-        struct tc_action_net *tn = net_generic(net, ipt_net_id);
+        return __tcf_ipt_init(net, ipt_net_id, nla, est, a, &act_ipt_ops, ovr,
+                              bind);
-        return __tcf_ipt_init(tn, nla, est, a, &act_ipt_ops, ovr, bind);
 }
 static int tcf_xt_init(struct net *net, struct nlattr *nla,
                       struct nlattr *est, struct tc_action **a, int ovr,
                       int bind)
 {
-        struct tc_action_net *tn = net_generic(net, xt_net_id);
+        return __tcf_ipt_init(net, xt_net_id, nla, est, a, &act_xt_ops, ovr,
+                              bind);
-        return __tcf_ipt_init(tn, nla, est, a, &act_xt_ops, ovr, bind);
 }
 static int tcf_ipt(struct sk_buff *skb, const struct tc_action *a,
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bd24a550e0f9..a3fa144b8648 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -286,9 +286,6 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 void qdisc_hash_add(struct Qdisc *q, bool invisible)
 {
        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
-                struct Qdisc *root = qdisc_dev(q)->qdisc;
-                WARN_ON_ONCE(root == &noop_qdisc);
                ASSERT_RTNL();
                hash_add_rcu(qdisc_dev(q)->qdisc_hash, &q->hash, q->handle);
                if (invisible)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 572fe2584e48..c403c87aff7a 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -572,8 +572,10 @@ static void atm_tc_destroy(struct Qdisc *sch)
        struct atm_flow_data *flow, *tmp;
        pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
-        list_for_each_entry(flow, &p->flows, list)
+        list_for_each_entry(flow, &p->flows, list) {
                tcf_block_put(flow->block);
+                flow->block = NULL;
+        }
        list_for_each_entry_safe(flow, tmp, &p->flows, list) {
                if (flow->ref > 1)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 481036f6b54e..780db43300b1 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1431,8 +1431,10 @@ static void cbq_destroy(struct Qdisc *sch)
         * be bound to classes which have been destroyed already. --TGR '04
         */
        for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                        tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
        }
        for (h = 0; h < q->clhash.hashsize; h++) {
                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index b52f74610dc7..fd15200f8627 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1428,6 +1428,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                return err;
        q->eligible = RB_ROOT;
+        err = tcf_block_get(&q->root.block, &q->root.filter_list);
+        if (err)
+                goto err_tcf;
        q->root.cl_common.classid = sch->handle;
        q->root.refcnt  = 1;
        q->root.sched   = q;
@@ -1447,6 +1451,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
        qdisc_watchdog_init(&q->watchdog, sch);
        return 0;
+err_tcf:
+        qdisc_class_hash_destroy(&q->clhash);
+        return err;
 }
 static int
@@ -1522,8 +1530,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
        unsigned int i;
        for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode) {
                        tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
        }
        for (i = 0; i < q->clhash.hashsize; i++) {
                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 203286ab4427..5d65ec5207e9 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1258,8 +1258,10 @@ static void htb_destroy(struct Qdisc *sch)
        tcf_block_put(q->block);
        for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                        tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
        }
        for (i = 0; i < q->clhash.hashsize; i++) {
                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f80ea2cc5f1f..82469ef9655e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -437,6 +437,7 @@ congestion_drop:
                qdisc_drop(head, sch, to_free);
                slot_queue_add(slot, skb);
+                qdisc_tree_reduce_backlog(sch, 0, delta);
                return NET_XMIT_CN;
        }
@@ -468,8 +469,10 @@ enqueue:
        /* Return Congestion Notification only if we dropped a packet
         * from this flow.
         */
-        if (qlen != slot->qlen)
+        if (qlen != slot->qlen) {
+                qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb));
                return NET_XMIT_CN;
+        }
        /* As we dropped a packet, better let upper stack know this */
        qdisc_tree_reduce_backlog(sch, 1, dropped);
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index d174ee3254ee..767e0537dde5 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -596,7 +596,7 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
        rcu_read_lock();
        b = rcu_dereference_rtnl(dev->tipc_ptr);
        if (likely(b && test_bit(0, &b->up) &&
-                   (skb->pkt_type <= PACKET_BROADCAST))) {
+                   (skb->pkt_type <= PACKET_MULTICAST))) {
                skb->next = NULL;
                tipc_rcv(dev_net(dev), skb, b);
                rcu_read_unlock();
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ab3087687a32..dcd90e6fa7c3 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -513,6 +513,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
        /* Now reverse the concerned fields */
        msg_set_errcode(hdr, err);
+        msg_set_non_seq(hdr, 0);
        msg_set_origport(hdr, msg_destport(&ohdr));
        msg_set_destport(hdr, msg_origport(&ohdr));
        msg_set_destnode(hdr, msg_prevnode(&ohdr));
diff --git a/net/tipc/node.c b/net/tipc/node.c
index aeef8011ac7d..9b4dcb6a16b5 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1455,10 +1455,8 @@ static bool tipc_node_check_state(struct tipc_node *n, struct sk_buff *skb,
        /* Initiate synch mode if applicable */
        if ((usr == TUNNEL_PROTOCOL) && (mtyp == SYNCH_MSG) && (oseqno == 1)) {
                syncpt = iseqno + exp_pkts - 1;
-                if (!tipc_link_is_up(l)) {
+                if (!tipc_link_is_up(l))
-                        tipc_link_fsm_evt(l, LINK_ESTABLISH_EVT);
                        __tipc_node_link_up(n, bearer_id, xmitq);
-                }
                if (n->state == SELF_UP_PEER_UP) {
                        n->sync_point = syncpt;
                        tipc_link_fsm_evt(l, LINK_SYNCH_BEGIN_EVT);
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 3bd5f4f30235..bc443201d3ef 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -18,6 +18,7 @@ my $V = '0.26';
 use Getopt::Long qw(:config no_auto_abbrev);
 use Cwd;
+use File::Find;
 my $cur_path = fastgetcwd() . '/';
 my $lk_path = "./";
@@ -58,6 +59,7 @@ my $from_filename = 0;
 my $pattern_depth = 0;
 my $version = 0;
 my $help = 0;
+my $find_maintainer_files = 0;
 my $vcs_used = 0;
@@ -249,6 +251,7 @@ if (!GetOptions(
                'sections!' => \$sections,
                'fe|file-emails!' => \$file_emails,
                'f|file' => \$from_filename,
+                'find-maintainer-files' => \$find_maintainer_files,
                'v|version' => \$version,
                'h|help|usage' => \$help,
                )) {
@@ -307,36 +310,74 @@ if (!top_of_kernel_tree($lk_path)) {
 my @typevalue = ();
 my %keyword_hash;
+my @mfiles = ();
-open (my $maint, '<', "${lk_path}MAINTAINERS")
+sub read_maintainer_file {
-    or die "$P: Can't open MAINTAINERS: $!\n";
+    my ($file) = @_;
-while (<$maint>) {
-    my $line = $_;
+    open (my $maint, '<', "$file")
+        or die "$P: Can't open MAINTAINERS file '$file': $!\n";
-    if ($line =~ m/^([A-Z]):\s*(.*)/) {
+    while (<$maint>) {
-        my $type = $1;
+        my $line = $_;
-        my $value = $2;
+        if ($line =~ m/^([A-Z]):\s*(.*)/) {
-        ##Filename pattern matching
+            my $type = $1;
-        if ($type eq "F" || $type eq "X") {
+            my $value = $2;
-            $value =~ s@\.@\\\.@g;       ##Convert . to \.
-            $value =~ s/\*/\.\*/g;       ##Convert * to .*
+            ##Filename pattern matching
-            $value =~ s/\?/\./g;         ##Convert ? to .
+            if ($type eq "F" || $type eq "X") {
-            ##if pattern is a directory and it lacks a trailing slash, add one
+                $value =~ s@\.@\\\.@g;       ##Convert . to \.
-            if ((-d $value)) {
+                $value =~ s/\*/\.\*/g;       ##Convert * to .*
-                $value =~ s@([^/])$@$1/@;
+                $value =~ s/\?/\./g;         ##Convert ? to .
+                ##if pattern is a directory and it lacks a trailing slash, add one
+                if ((-d $value)) {
+                    $value =~ s@([^/])$@$1/@;
+                }
+            } elsif ($type eq "K") {
+                $keyword_hash{@typevalue} = $value;
            }
-        } elsif ($type eq "K") {
+            push(@typevalue, "$type:$value");
-            $keyword_hash{@typevalue} = $value;
+        } elsif (!(/^\s*$/ || /^\s*\#/)) {
+            $line =~ s/\n$//g;
+            push(@typevalue, $line);
        }
-        push(@typevalue, "$type:$value");
-    } elsif (!/^(\s)*$/) {
-        $line =~ s/\n$//g;
-        push(@typevalue, $line);
    }
+    close($maint);
+}
+sub find_is_maintainer_file {
+    my ($file) = $_;
+    return if ($file !~ m@/MAINTAINERS$@);
+    $file = $File::Find::name;
+    return if (! -f $file);
+    push(@mfiles, $file);
 }
-close($maint);
+sub find_ignore_git {
+    return grep { $_ !~ /^\.git$/; } @_;
+}
+if (-d "${lk_path}MAINTAINERS") {
+    opendir(DIR, "${lk_path}MAINTAINERS") or die $!;
+    my @files = readdir(DIR);
+    closedir(DIR);
+    foreach my $file (@files) {
+        push(@mfiles, "${lk_path}MAINTAINERS/$file") if ($file !~ /^\./);
+    }
+}
+if ($find_maintainer_files) {
+    find( { wanted => \&find_is_maintainer_file,
+            preprocess => \&find_ignore_git,
+            no_chdir => 1,
+        }, "${lk_path}");
+} else {
+    push(@mfiles, "${lk_path}MAINTAINERS") if -f "${lk_path}MAINTAINERS";
+}
+foreach my $file (@mfiles) {
+    read_maintainer_file("$file");
+}
 #
 # Read mail address map
@@ -873,7 +914,7 @@ sub top_of_kernel_tree {
    if (   (-f "${lk_path}COPYING")
        && (-f "${lk_path}CREDITS")
        && (-f "${lk_path}Kbuild")
-        && (-f "${lk_path}MAINTAINERS")
+        && (-e "${lk_path}MAINTAINERS")
        && (-f "${lk_path}Makefile")
        && (-f "${lk_path}README")
        && (-d "${lk_path}Documentation")
diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl
index a0fe34349b24..e40b53db7f9f 100644
--- a/scripts/parse-maintainers.pl
+++ b/scripts/parse-maintainers.pl
@@ -2,9 +2,9 @@
 use strict;
-my %map;
+my $P = $0;
-# sort comparison function
+# sort comparison functions
 sub by_category($$) {
    my ($a, $b) = @_;
@@ -15,20 +15,33 @@ sub by_category($$) {
    $a =~ s/THE REST/ZZZZZZ/g;
    $b =~ s/THE REST/ZZZZZZ/g;
-    $a cmp $b;
+    return $a cmp $b;
 }
-sub alpha_output {
+sub by_pattern($$) {
-    my $key;
+    my ($a, $b) = @_;
-    my $sort_method = \&by_category;
+    my $preferred_order = 'MRPLSWTQBCFXNK';
-    my $sep = "";
+    my $a1 = uc(substr($a, 0, 1));
-    foreach $key (sort $sort_method keys %map) {
+    my $b1 = uc(substr($b, 0, 1));
-        if ($key ne " ") {
-            print $sep . $key . "\n";
+    my $a_index = index($preferred_order, $a1);
-            $sep = "\n";
+    my $b_index = index($preferred_order, $b1);
-        }
-        print $map{$key};
+    $a_index = 1000 if ($a_index == -1);
+    $b_index = 1000 if ($b_index == -1);
+    if (($a1 =~ /^F$/ && $b1 =~ /^F$/) ||
+        ($a1 =~ /^X$/ && $b1 =~ /^X$/)) {
+        return $a cmp $b;
+    }
+    if ($a_index < $b_index) {
+        return -1;
+    } elsif ($a_index == $b_index) {
+        return 0;
+    } else {
+        return 1;
    }
 }
@@ -39,39 +52,77 @@ sub trim {
    return $s;
 }
+sub alpha_output {
+    my ($hashref, $filename) = (@_);
+    open(my $file, '>', "$filename") or die "$P: $filename: open failed - $!\n";
+    foreach my $key (sort by_category keys %$hashref) {
+        if ($key eq " ") {
+            chomp $$hashref{$key};
+            print $file $$hashref{$key};
+        } else {
+            print $file "\n" . $key . "\n";
+            foreach my $pattern (sort by_pattern split('\n', %$hashref{$key})) {
+                print $file ($pattern . "\n");
+            }
+        }
+    }
+    close($file);
+}
 sub file_input {
+    my ($hashref, $filename) = (@_);
    my $lastline = "";
    my $case = " ";
-    $map{$case} = "";
+    $$hashref{$case} = "";
+    open(my $file, '<', "$filename") or die "$P: $filename: open failed - $!\n";
-    while (<>) {
+    while (<$file>) {
        my $line = $_;
        # Pattern line?
        if ($line =~ m/^([A-Z]):\s*(.*)/) {
            $line = $1 . ":\t" . trim($2) . "\n";
            if ($lastline eq "") {
-                $map{$case} = $map{$case} . $line;
+                $$hashref{$case} = $$hashref{$case} . $line;
                next;
            }
            $case = trim($lastline);
-            exists $map{$case} and die "Header '$case' already exists";
+            exists $$hashref{$case} and die "Header '$case' already exists";
-            $map{$case} = $line;
+            $$hashref{$case} = $line;
            $lastline = "";
            next;
        }
        if ($case eq " ") {
-            $map{$case} = $map{$case} . $lastline;
+            $$hashref{$case} = $$hashref{$case} . $lastline;
            $lastline = $line;
            next;
        }
        trim($lastline) eq "" or die ("Odd non-pattern line '$lastline' for '$case'");
        $lastline = $line;
    }
-    $map{$case} = $map{$case} . $lastline;
+    $$hashref{$case} = $$hashref{$case} . $lastline;
+    close($file);
 }
-&file_input;
+my %hash;
-&alpha_output;
+my %new_hash;
+file_input(\%hash, "MAINTAINERS");
+foreach my $type (@ARGV) {
+    foreach my $key (keys %hash) {
+        if ($key =~ /$type/ || $hash{$key} =~ /$type/) {
+            $new_hash{$key} = $hash{$key};
+            delete $hash{$key};
+        }
+    }
+}
+alpha_output(\%hash, "MAINTAINERS.new");
+alpha_output(\%new_hash, "SECTION.new");
 exit(0);
diff --git a/sound/core/seq/Kconfig b/sound/core/seq/Kconfig
index a536760a94c2..45c1336c6597 100644
--- a/sound/core/seq/Kconfig
+++ b/sound/core/seq/Kconfig
@@ -47,10 +47,10 @@ config SND_SEQ_HRTIMER_DEFAULT
          timer.
 config SND_SEQ_MIDI_EVENT
-        def_tristate SND_RAWMIDI
+        tristate
 config SND_SEQ_MIDI
-        tristate
+        def_tristate SND_RAWMIDI
        select SND_SEQ_MIDI_EVENT
 config SND_SEQ_MIDI_EMUL
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 272c55fe17c8..ea2d0ae85bd3 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1502,16 +1502,11 @@ static int snd_seq_ioctl_unsubscribe_port(struct snd_seq_client *client,
 static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
 {
        struct snd_seq_queue_info *info = arg;
-        int result;
        struct snd_seq_queue *q;
-        result = snd_seq_queue_alloc(client->number, info->locked, info->flags);
+        q = snd_seq_queue_alloc(client->number, info->locked, info->flags);
-        if (result < 0)
+        if (IS_ERR(q))
-                return result;
+                return PTR_ERR(q);
-        q = queueptr(result);
-        if (q == NULL)
-                return -EINVAL;
        info->queue = q->queue;
        info->locked = q->locked;
@@ -1521,7 +1516,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
        if (!info->name[0])
                snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
        strlcpy(q->name, info->name, sizeof(q->name));
-        queuefree(q);
+        snd_use_lock_free(&q->use_lock);
        return 0;
 }
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 450c5187eecb..79e0c5604ef8 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -184,22 +184,26 @@ void __exit snd_seq_queues_delete(void)
 static void queue_use(struct snd_seq_queue *queue, int client, int use);
 /* allocate a new queue -
- * return queue index value or negative value for error
+ * return pointer to new queue or ERR_PTR(-errno) for error
+ * The new queue's use_lock is set to 1. It is the caller's responsibility to
+ * call snd_use_lock_free(&q->use_lock).
 */
-int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
 {
        struct snd_seq_queue *q;
        q = queue_new(client, locked);
        if (q == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
        q->info_flags = info_flags;
        queue_use(q, client, 1);
+        snd_use_lock_use(&q->use_lock);
        if (queue_list_add(q) < 0) {
+                snd_use_lock_free(&q->use_lock);
                queue_delete(q);
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
        }
-        return q->queue;
+        return q;
 }
 /* delete a queue - queue must be owned by the client */
diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h
index 30c8111477f6..719093489a2c 100644
--- a/sound/core/seq/seq_queue.h
+++ b/sound/core/seq/seq_queue.h
@@ -71,7 +71,7 @@ void snd_seq_queues_delete(void);
 /* create new queue (constructor) */
-int snd_seq_queue_alloc(int client, int locked, unsigned int flags);
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int flags);
 /* delete queue (destructor) */
 int snd_seq_queue_delete(int client, int queueid);
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index dc585959ca32..a2b56b188be4 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -698,10 +698,18 @@ static int copy_gctl(struct snd_emu10k1 *emu,
 {
        struct snd_emu10k1_fx8010_control_old_gpr __user *octl;
-        if (emu->support_tlv)
+        if (emu->support_tlv) {
-                return copy_from_user(gctl, &_gctl[idx], sizeof(*gctl));
+                if (in_kernel)
+                        memcpy(gctl, (void *)&_gctl[idx], sizeof(*gctl));
+                else if (copy_from_user(gctl, &_gctl[idx], sizeof(*gctl)))
+                        return -EFAULT;
+                return 0;
+        }
        octl = (struct snd_emu10k1_fx8010_control_old_gpr __user *)_gctl;
-        if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
+        if (in_kernel)
+                memcpy(gctl, (void *)&octl[idx], sizeof(*octl));
+        else if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
                return -EFAULT;
        gctl->tlv = NULL;
        return 0;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a91a9ef00c40..217bb582aff1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6647,7 +6647,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
        SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
                ALC225_STANDARD_PINS,
                {0x12, 0xb7a60130},
-                {0x13, 0xb8a61140},
                {0x17, 0x90170110}),
        {}
 };
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 082736c539bc..e630813c5008 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -542,6 +542,8 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag,
        if (size < sizeof(scale))
                return -ENOMEM;
+        if (cval->min_mute)
+                scale[0] = SNDRV_CTL_TLVT_DB_MINMAX_MUTE;
        scale[2] = cval->dBmin;
        scale[3] = cval->dBmax;
        if (copy_to_user(_tlv, scale, sizeof(scale)))
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 3417ef347e40..2b4b067646ab 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -64,6 +64,7 @@ struct usb_mixer_elem_info {
        int cached;
        int cache_val[MAX_CHANNELS];
        u8 initialized;
+        u8 min_mute;
        void *private_data;
 };
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index e3d1dec48ee4..e1e7ce9ab217 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1878,6 +1878,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
                if (unitid == 7 && cval->control == UAC_FU_VOLUME)
                        snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
                break;
+        /* lowest playback value is muted on C-Media devices */
+        case USB_ID(0x0d8c, 0x000c):
+        case USB_ID(0x0d8c, 0x0014):
+                if (strstr(kctl->id.name, "Playback"))
+                        cval->min_mute = 1;
+                break;
        }
 }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index d7b0b0a3a2db..6a03f9697039 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1142,6 +1142,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
        case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
        case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
        case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
        case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
        case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
        case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
@@ -1374,6 +1375,10 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                        }
                }
                break;
+        case USB_ID(0x16d0, 0x0a23):
+                if (fp->altsetting == 2)
+                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+                break;
        default:
                break;
diff --git a/tools/build/feature/test-bpf.c b/tools/build/feature/test-bpf.c
index 7598361ef1f1..da2172ff9662 100644
--- a/tools/build/feature/test-bpf.c
+++ b/tools/build/feature/test-bpf.c
@@ -11,6 +11,8 @@
 #  define __NR_bpf 280
 # elif defined(__sparc__)
 #  define __NR_bpf 349
+# elif defined(__s390__)
+#  define __NR_bpf 351
 # else
 #  error __NR_bpf not defined. libbpf does not support your arch.
 # endif
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 256f571f2ab5..e5bbb090bf88 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -39,6 +39,8 @@
 #  define __NR_bpf 280
 # elif defined(__sparc__)
 #  define __NR_bpf 349
+# elif defined(__s390__)
+#  define __NR_bpf 351
 # else
 #  error __NR_bpf not defined. libbpf does not support your arch.
 # endif
diff --git a/tools/testing/selftests/bpf/test_pkt_md_access.c b/tools/testing/selftests/bpf/test_pkt_md_access.c
index 71729d47eb85..7956302ecdf2 100644
--- a/tools/testing/selftests/bpf/test_pkt_md_access.c
+++ b/tools/testing/selftests/bpf/test_pkt_md_access.c
@@ -12,12 +12,23 @@
 int _version SEC("version") = 1;
+#if  __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
 #define TEST_FIELD(TYPE, FIELD, MASK)                                   \
        {                                                               \
                TYPE tmp = *(volatile TYPE *)&skb->FIELD;               \
                if (tmp != ((*(volatile __u32 *)&skb->FIELD) & MASK))   \
                        return TC_ACT_SHOT;                             \
        }
+#else
+#define TEST_FIELD_OFFSET(a, b) ((sizeof(a) - sizeof(b)) / sizeof(b))
+#define TEST_FIELD(TYPE, FIELD, MASK)                                   \
+        {                                                               \
+                TYPE tmp = *((volatile TYPE *)&skb->FIELD +             \
+                              TEST_FIELD_OFFSET(skb->FIELD, TYPE));     \
+                if (tmp != ((*(volatile __u32 *)&skb->FIELD) & MASK))   \
+                        return TC_ACT_SHOT;                             \
+        }
+#endif
 SEC("test1")
 int process(struct __sk_buff *skb)
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index addea82f76c9..d3ed7324105e 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -8,6 +8,7 @@
 * License as published by the Free Software Foundation.
 */
+#include <endian.h>
 #include <asm/types.h>
 #include <linux/types.h>
 #include <stdint.h>
@@ -1098,7 +1099,7 @@ static struct bpf_test tests[] = {
                "check skb->hash byte load permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct __sk_buff, hash)),
 #else
@@ -1135,7 +1136,7 @@ static struct bpf_test tests[] = {
                "check skb->hash byte load not permitted 3",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct __sk_buff, hash) + 3),
 #else
@@ -1244,7 +1245,7 @@ static struct bpf_test tests[] = {
                "check skb->hash half load permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct __sk_buff, hash)),
 #else
@@ -1259,7 +1260,7 @@ static struct bpf_test tests[] = {
                "check skb->hash half load not permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct __sk_buff, hash) + 2),
 #else
@@ -5422,7 +5423,7 @@ static struct bpf_test tests[] = {
                "check bpf_perf_event_data->sample_period byte load permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct bpf_perf_event_data, sample_period)),
 #else
@@ -5438,7 +5439,7 @@ static struct bpf_test tests[] = {
                "check bpf_perf_event_data->sample_period half load permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct bpf_perf_event_data, sample_period)),
 #else
@@ -5454,7 +5455,7 @@ static struct bpf_test tests[] = {
                "check bpf_perf_event_data->sample_period word load permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct bpf_perf_event_data, sample_period)),
 #else
@@ -5481,7 +5482,7 @@ static struct bpf_test tests[] = {
                "check skb->data half load not permitted",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct __sk_buff, data)),
 #else
@@ -5497,7 +5498,7 @@ static struct bpf_test tests[] = {
                "check skb->tc_classid half load not permitted for lwt prog",
                .insns = {
                        BPF_MOV64_IMM(BPF_REG_0, 0),
-#ifdef __LITTLE_ENDIAN
+#if __BYTE_ORDER == __LITTLE_ENDIAN
                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
                                    offsetof(struct __sk_buff, tc_classid)),
 #else
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index e2fbb890aef9..7c647f619d63 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -14,7 +14,7 @@ all:
        done
 override define RUN_TESTS
-        @if [ `dirname $(OUTPUT)` = $(PWD) ]; then ./run.sh; fi
+        $(OUTPUT)/run.sh
 endef
 override define INSTALL_RULE
diff --git a/tools/testing/selftests/kmod/kmod.sh b/tools/testing/selftests/kmod/kmod.sh
index 8cecae9a8bca..7956ea3be667 100644..100755
--- a/tools/testing/selftests/kmod/kmod.sh
+++ b/tools/testing/selftests/kmod/kmod.sh
@@ -473,8 +473,8 @@ usage()
        echo "    all     Runs all tests (default)"
        echo "    -t      Run test ID the number amount of times is recommended"
        echo "    -w      Watch test ID run until it runs into an error"
-        echo "    -c      Run test ID once"
+        echo "    -s      Run test ID once"
-        echo "    -s      Run test ID x test-count number of times"
+        echo "    -c      Run test ID x test-count number of times"
        echo "    -l      List all test ID list"
        echo " -h|--help  Help"
        echo
diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
index ec232c3cfcaa..ec232c3cfcaa 100644..100755
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
diff --git a/tools/testing/selftests/timers/freq-step.c b/tools/testing/selftests/timers/freq-step.c
index e8c61830825a..22312eb4c941 100644
--- a/tools/testing/selftests/timers/freq-step.c
+++ b/tools/testing/selftests/timers/freq-step.c
@@ -229,10 +229,9 @@ static void init_test(void)
        printf("CLOCK_MONOTONIC_RAW+CLOCK_MONOTONIC precision: %.0f ns\t\t",
               1e9 * precision);
-        if (precision > MAX_PRECISION) {
+        if (precision > MAX_PRECISION)
-                printf("[SKIP]\n");
+                ksft_exit_skip("precision: %.0f ns > MAX_PRECISION: %.0f ns\n",
-                ksft_exit_skip();
+                                1e9 * precision, 1e9 * MAX_PRECISION);
-        }
        printf("[OK]\n");
        srand(ts.tv_sec ^ ts.tv_nsec);
author	Radim Krčmář <rkrcmar@redhat.com>	2017-09-08 08:40:43 -0400
committer	Radim Krčmář <rkrcmar@redhat.com>	2017-09-08 08:40:43 -0400
commit	5f54c8b2d4fad95d1f8ecbe023ebe6038e6d3760 (patch)
tree	daca83ea5f9af1bd158504bd0b5af89c5a99b7fa
parent	78809a68490d84eb632a215be2121d4b44c86954 (diff)
parent	edd03602d97236e8fea13cd76886c576186aa307 (diff)