Merge remote-tracking branch 'tip/perf/urgent' into perf/core

Merge branch 'perf/urgent' into perf/core, to pick up fixes

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

423 files changed, 3678 insertions, 2306 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 15f79c27748d..0f5c3b4347c6 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -866,6 +866,15 @@
 
         dscc4.setup=    [NET]
 
+        dt_cpu_ftrs=    [PPC]
+                        Format: {"off" | "known"}
+                        Control how the dt_cpu_ftrs device-tree binding is
+                        used for CPU feature discovery and setup (if it
+                        exists).
+                        off: Do not use it, fall back to legacy cpu table.
+                        known: Do not pass through unknown features to guests
+                        or userspace, only those that the kernel is aware of.
+
         dump_apple_properties   [X86]
                         Dump name and content of EFI device properties on
                         x86 Macs.  Useful for driver authors to determine
diff --git a/Documentation/devicetree/bindings/net/dsa/marvell.txt b/Documentation/devicetree/bindings/net/dsa/marvell.txt
index 7ef9dbb08957..1d4d0f49c9d0 100644
--- a/Documentation/devicetree/bindings/net/dsa/marvell.txt
+++ b/Documentation/devicetree/bindings/net/dsa/marvell.txt
@@ -26,6 +26,10 @@ Optional properties:
 - interrupt-controller  : Indicates the switch is itself an interrupt
                           controller. This is used for the PHY interrupts.
 #interrupt-cells = <2>  : Controller uses two cells, number and flag
+- eeprom-length         : Set to the length of an EEPROM connected to the
+                          switch. Must be set if the switch can not detect
+                          the presence and/or size of a connected EEPROM,
+                          otherwise optional.
 - mdio                  : Container of PHY and devices on the switches MDIO
                           bus.
 - mdio?         : Container of PHYs and devices on the external MDIO
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index 00bea038639e..fcf199b64d3d 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -10,6 +10,7 @@ Required properties:
   - "rockchip,rk3288-usb", "rockchip,rk3066-usb", "snps,dwc2": for rk3288 Soc;
   - "lantiq,arx100-usb": The DWC2 USB controller instance in Lantiq ARX SoCs;
   - "lantiq,xrx200-usb": The DWC2 USB controller instance in Lantiq XRX SoCs;
+  - "amlogic,meson8-usb": The DWC2 USB controller instance in Amlogic Meson8 SoCs;
   - "amlogic,meson8b-usb": The DWC2 USB controller instance in Amlogic Meson8b SoCs;
   - "amlogic,meson-gxbb-usb": The DWC2 USB controller instance in Amlogic S905 SoCs;
   - "amcc,dwc-otg": The DWC2 USB controller instance in AMCC Canyonlands 460EX SoCs;
diff --git a/Documentation/networking/dpaa.txt b/Documentation/networking/dpaa.txt
new file mode 100644
index 000000000000..76e016d4d344
--- /dev/null
+++ b/Documentation/networking/dpaa.txt
@@ -0,0 +1,194 @@
+The QorIQ DPAA Ethernet Driver
+==============================
+
+Authors:
+Madalin Bucur <madalin.bucur@nxp.com>
+Camelia Groza <camelia.groza@nxp.com>
+
+Contents
+========
+
+        - DPAA Ethernet Overview
+        - DPAA Ethernet Supported SoCs
+        - Configuring DPAA Ethernet in your kernel
+        - DPAA Ethernet Frame Processing
+        - DPAA Ethernet Features
+        - Debugging
+
+DPAA Ethernet Overview
+======================
+
+DPAA stands for Data Path Acceleration Architecture and it is a
+set of networking acceleration IPs that are available on several
+generations of SoCs, both on PowerPC and ARM64.
+
+The Freescale DPAA architecture consists of a series of hardware blocks
+that support Ethernet connectivity. The Ethernet driver depends upon the
+following drivers in the Linux kernel:
+
+ - Peripheral Access Memory Unit (PAMU) (* needed only for PPC platforms)
+    drivers/iommu/fsl_*
+ - Frame Manager (FMan)
+    drivers/net/ethernet/freescale/fman
+ - Queue Manager (QMan), Buffer Manager (BMan)
+    drivers/soc/fsl/qbman
+
+A simplified view of the dpaa_eth interfaces mapped to FMan MACs:
+
+  dpaa_eth       /eth0\     ...       /ethN\
+  driver        |      |             |      |
+  -------------   ----   -----------   ----   -------------
+       -Ports  / Tx  Rx \    ...    / Tx  Rx \
+  FMan        |          |         |          |
+       -MACs  |   MAC0   |         |   MACN   |
+             /   dtsec0   \  ...  /   dtsecN   \ (or tgec)
+            /              \     /              \(or memac)
+  ---------  --------------  ---  --------------  ---------
+      FMan, FMan Port, FMan SP, FMan MURAM drivers
+  ---------------------------------------------------------
+      FMan HW blocks: MURAM, MACs, Ports, SP
+  ---------------------------------------------------------
+
+The dpaa_eth relation to the QMan, BMan and FMan:
+              ________________________________
+  dpaa_eth   /            eth0                \
+  driver    /                                  \
+  ---------   -^-   -^-   -^-   ---    ---------
+  QMan driver / \   / \   / \  \   /  | BMan    |
+             |Rx | |Rx | |Tx | |Tx |  | driver  |
+  ---------  |Dfl| |Err| |Cnf| |FQs|  |         |
+  QMan HW    |FQ | |FQ | |FQs| |   |  |         |
+             /   \ /   \ /   \  \ /   |         |
+  ---------   ---   ---   ---   -v-    ---------
+            |        FMan QMI         |         |
+            | FMan HW       FMan BMI  | BMan HW |
+              -----------------------   --------
+
+where the acronyms used above (and in the code) are:
+DPAA = Data Path Acceleration Architecture
+FMan = DPAA Frame Manager
+QMan = DPAA Queue Manager
+BMan = DPAA Buffers Manager
+QMI = QMan interface in FMan
+BMI = BMan interface in FMan
+FMan SP = FMan Storage Profiles
+MURAM = Multi-user RAM in FMan
+FQ = QMan Frame Queue
+Rx Dfl FQ = default reception FQ
+Rx Err FQ = Rx error frames FQ
+Tx Cnf FQ = Tx confirmation FQs
+Tx FQs = transmission frame queues
+dtsec = datapath three speed Ethernet controller (10/100/1000 Mbps)
+tgec = ten gigabit Ethernet controller (10 Gbps)
+memac = multirate Ethernet MAC (10/100/1000/10000)
+
+DPAA Ethernet Supported SoCs
+============================
+
+The DPAA drivers enable the Ethernet controllers present on the following SoCs:
+
+# PPC
+P1023
+P2041
+P3041
+P4080
+P5020
+P5040
+T1023
+T1024
+T1040
+T1042
+T2080
+T4240
+B4860
+
+# ARM
+LS1043A
+LS1046A
+
+Configuring DPAA Ethernet in your kernel
+========================================
+
+To enable the DPAA Ethernet driver, the following Kconfig options are required:
+
+# common for arch/arm64 and arch/powerpc platforms
+CONFIG_FSL_DPAA=y
+CONFIG_FSL_FMAN=y
+CONFIG_FSL_DPAA_ETH=y
+CONFIG_FSL_XGMAC_MDIO=y
+
+# for arch/powerpc only
+CONFIG_FSL_PAMU=y
+
+# common options needed for the PHYs used on the RDBs
+CONFIG_VITESSE_PHY=y
+CONFIG_REALTEK_PHY=y
+CONFIG_AQUANTIA_PHY=y
+
+DPAA Ethernet Frame Processing
+==============================
+
+On Rx, buffers for the incoming frames are retrieved from one of the three
+existing buffers pools. The driver initializes and seeds these, each with
+buffers of different sizes: 1KB, 2KB and 4KB.
+
+On Tx, all transmitted frames are returned to the driver through Tx
+confirmation frame queues. The driver is then responsible for freeing the
+buffers. In order to do this properly, a backpointer is added to the buffer
+before transmission that points to the skb. When the buffer returns to the
+driver on a confirmation FQ, the skb can be correctly consumed.
+
+DPAA Ethernet Features
+======================
+
+Currently the DPAA Ethernet driver enables the basic features required for
+a Linux Ethernet driver. The support for advanced features will be added
+gradually.
+
+The driver has Rx and Tx checksum offloading for UDP and TCP. Currently the Rx
+checksum offload feature is enabled by default and cannot be controlled through
+ethtool.
+
+The driver has support for multiple prioritized Tx traffic classes. Priorities
+range from 0 (lowest) to 3 (highest). These are mapped to HW workqueues with
+strict priority levels. Each traffic class contains NR_CPU TX queues. By
+default, only one traffic class is enabled and the lowest priority Tx queues
+are used. Higher priority traffic classes can be enabled with the mqprio
+qdisc. For example, all four traffic classes are enabled on an interface with
+the following command. Furthermore, skb priority levels are mapped to traffic
+classes as follows:
+
+        * priorities 0 to 3 - traffic class 0 (low priority)
+        * priorities 4 to 7 - traffic class 1 (medium-low priority)
+        * priorities 8 to 11 - traffic class 2 (medium-high priority)
+        * priorities 12 to 15 - traffic class 3 (high priority)
+
+tc qdisc add dev <int> root handle 1: \
+         mqprio num_tc 4 map 0 0 0 0 1 1 1 1 2 2 2 2 3 3 3 3 hw 1
+
+Debugging
+=========
+
+The following statistics are exported for each interface through ethtool:
+
+        - interrupt count per CPU
+        - Rx packets count per CPU
+        - Tx packets count per CPU
+        - Tx confirmed packets count per CPU
+        - Tx S/G frames count per CPU
+        - Tx error count per CPU
+        - Rx error count per CPU
+        - Rx error count per type
+        - congestion related statistics:
+                - congestion status
+                - time spent in congestion
+                - number of time the device entered congestion
+                - dropped packets count per cause
+
+The driver also exports the following information in sysfs:
+
+        - the FQ IDs for each FQ type
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/fqids
+
+        - the IDs of the buffer pools in use
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/bpids
diff --git a/Documentation/networking/tcp.txt b/Documentation/networking/tcp.txt
index bdc4c0db51e1..9c7139d57e57 100644
--- a/Documentation/networking/tcp.txt
+++ b/Documentation/networking/tcp.txt
@@ -1,7 +1,7 @@
 TCP protocol
 ============
 
-Last updated: 9 February 2008
+Last updated: 3 June 2017
 
 Contents
 ========
@@ -29,18 +29,19 @@ As of 2.6.13, Linux supports pluggable congestion control algorithms.
 A congestion control mechanism can be registered through functions in
 tcp_cong.c. The functions used by the congestion control mechanism are
 registered via passing a tcp_congestion_ops struct to
-tcp_register_congestion_control. As a minimum name, ssthresh,
-cong_avoid must be valid.
+tcp_register_congestion_control. As a minimum, the congestion control
+mechanism must provide a valid name and must implement either ssthresh,
+cong_avoid and undo_cwnd hooks or the "omnipotent" cong_control hook.
 
 Private data for a congestion control mechanism is stored in tp->ca_priv.
 tcp_ca(tp) returns a pointer to this space.  This is preallocated space - it
 is important to check the size of your private data will fit this space, or
-alternatively space could be allocated elsewhere and a pointer to it could
+alternatively, space could be allocated elsewhere and a pointer to it could
 be stored here.
 
 There are three kinds of congestion control algorithms currently: The
 simplest ones are derived from TCP reno (highspeed, scalable) and just
-provide an alternative the congestion window calculation. More complex
+provide an alternative congestion window calculation. More complex
 ones like BIC try to look at other events to provide better
 heuristics.  There are also round trip time based algorithms like
 Vegas and Westwood+.
@@ -49,21 +50,15 @@ Good TCP congestion control is a complex problem because the algorithm
 needs to maintain fairness and performance. Please review current
 research and RFC's before developing new modules.
 
-The method that is used to determine which congestion control mechanism is
-determined by the setting of the sysctl net.ipv4.tcp_congestion_control.
-The default congestion control will be the last one registered (LIFO);
-so if you built everything as modules, the default will be reno. If you
-build with the defaults from Kconfig, then CUBIC will be builtin (not a
-module) and it will end up the default.
+The default congestion control mechanism is chosen based on the
+DEFAULT_TCP_CONG Kconfig parameter. If you really want a particular default
+value then you can set it using sysctl net.ipv4.tcp_congestion_control. The
+module will be autoloaded if needed and you will get the expected protocol. If
+you ask for an unknown congestion method, then the sysctl attempt will fail.
 
-If you really want a particular default value then you will need
-to set it with the sysctl.  If you use a sysctl, the module will be autoloaded
-if needed and you will get the expected protocol. If you ask for an
-unknown congestion method, then the sysctl attempt will fail.
-
-If you remove a tcp congestion control module, then you will get the next
+If you remove a TCP congestion control module, then you will get the next
 available one. Since reno cannot be built as a module, and cannot be
-deleted, it will always be available.
+removed, it will always be available.
 
 How the new TCP output machine [nyi] works.
 ===========================================
diff --git a/MAINTAINERS b/MAINTAINERS
index 7a28acd7f525..09b5ab6a8a5c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1172,7 +1172,7 @@ N:	clps711x
 
 ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
-M:      Ryan Mallon <rmallon@gmail.com>
+M:      Alexander Sverdlin <alexander.sverdlin@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-ep93xx/
@@ -1489,13 +1489,15 @@ M:	Gregory Clement <gregory.clement@free-electrons.com>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-F:      arch/arm/mach-mvebu/
-F:      drivers/rtc/rtc-armada38x.c
 F:      arch/arm/boot/dts/armada*
 F:      arch/arm/boot/dts/kirkwood*
+F:      arch/arm/configs/mvebu_*_defconfig
+F:      arch/arm/mach-mvebu/
 F:      arch/arm64/boot/dts/marvell/armada*
 F:      drivers/cpufreq/mvebu-cpufreq.c
-F:      arch/arm/configs/mvebu_*_defconfig
+F:      drivers/irqchip/irq-armada-370-xp.c
+F:      drivers/irqchip/irq-mvebu-*
+F:      drivers/rtc/rtc-armada38x.c
 
 ARM/Marvell Berlin SoC support
 M:      Jisheng Zhang <jszhang@marvell.com>
@@ -1721,7 +1723,6 @@ N:	rockchip
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
-R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 Q:      https://patchwork.kernel.org/project/linux-samsung-soc/list/
@@ -1829,7 +1830,6 @@ F:	drivers/edac/altera_edac.
 ARM/STI ARCHITECTURE
 M:      Patrice Chotard <patrice.chotard@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      kernel@stlinux.com
 W:      http://www.stlinux.com
 S:      Maintained
 F:      arch/arm/mach-sti/
@@ -5622,7 +5622,7 @@ F:	scripts/get_maintainer.pl
 
 GENWQE (IBM Generic Workqueue Card)
 M:      Frank Haverkamp <haver@linux.vnet.ibm.com>
-M:      Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 S:      Supported
 F:      drivers/misc/genwqe/
 
@@ -5667,7 +5667,6 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
-M:      Alexandre Courbot <gnurou@gmail.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -7707,7 +7706,7 @@ F:	drivers/platform/x86/hp_accel.c
 
 LIVE PATCHING
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Jiri Kosina <jikos@kernel.org>
 M:      Miroslav Benes <mbenes@suse.cz>
 R:      Petr Mladek <pmladek@suse.com>
@@ -8508,7 +8507,7 @@ S:	Odd Fixes
 F:      drivers/media/radio/radio-miropcm20*
 
 MELLANOX MLX4 core VPI driver
-M:      Yishai Hadas <yishaih@mellanox.com>
+M:      Tariq Toukan <tariqt@mellanox.com>
 L:      netdev@vger.kernel.org
 L:      linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
@@ -8516,7 +8515,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx4/
 F:      include/linux/mlx4/
-F:      include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX4 IB driver
 M:      Yishai Hadas <yishaih@mellanox.com>
@@ -8526,6 +8524,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx4/
 F:      include/linux/mlx4/
+F:      include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX5 core VPI driver
 M:      Saeed Mahameed <saeedm@mellanox.com>
@@ -8538,7 +8537,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
-F:      include/uapi/rdma/mlx5-abi.h
 
 MELLANOX MLX5 IB driver
 M:      Matan Barak <matanb@mellanox.com>
@@ -8549,6 +8547,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx5/
 F:      include/linux/mlx5/
+F:      include/uapi/rdma/mlx5-abi.h
 
 MELEXIS MLX90614 DRIVER
 M:      Crt Mori <cmo@melexis.com>
@@ -8588,7 +8587,7 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/mn88473*
 
 MODULE SUPPORT
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Rusty Russell <rusty@rustcorp.com.au>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux.git modules-next
 S:      Maintained
@@ -11268,7 +11267,6 @@ F:	drivers/media/rc/serial_ir.c
 
 STI CEC DRIVER
 M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
-L:      kernel@stlinux.com
 S:      Maintained
 F:      drivers/staging/media/st-cec/
 F:      Documentation/devicetree/bindings/media/stih-cec.txt
@@ -11778,6 +11776,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git
 S:      Supported
 F:      arch/arm/mach-davinci/
 F:      drivers/i2c/busses/i2c-davinci.c
+F:      arch/arm/boot/dts/da850*
 
 TI DAVINCI SERIES MEDIA DRIVER
 M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
@@ -13861,7 +13860,7 @@ S:	Odd fixes
 F:      drivers/net/wireless/wl3501*
 
 WOLFSON MICROELECTRONICS DRIVERS
-L:      patches@opensource.wolfsonmicro.com
+L:      patches@opensource.cirrus.com
 T:      git https://github.com/CirrusLogic/linux-drivers.git
 W:      https://github.com/CirrusLogic/linux-drivers/wiki
 S:      Supported
diff --git a/Makefile b/Makefile
index 853ae9179af9..83f6d9972cab 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 561f27d8d922..9444a9a9ba10 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -3,6 +3,11 @@
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
 
+/* firmware-provided startup stubs live here, where the secondary CPUs are
+ * spinning.
+ */
+/memreserve/ 0x00000000 0x00001000;
+
 /* This include file covers the common peripherals and configuration between
  * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
  * bcm2835.dtsi and bcm2836.dtsi.
diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dts b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
index f18e1f1d0ce2..d2be8aa3370b 100644
--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dts
+++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
@@ -120,10 +120,16 @@
 
                 ethphy0: ethernet-phy@2 {
                         reg = <2>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET_REF>;
+                        clock-names = "rmii-ref";
                 };
 
                 ethphy1: ethernet-phy@1 {
                         reg = <1>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET2_REF>;
+                        clock-names = "rmii-ref";
                 };
         };
 };
diff --git a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
index b6f26824e83a..66f615a74118 100644
--- a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
@@ -137,8 +137,8 @@ netcp: netcp@26000000 {
         /* NetCP address range */
         ranges = <0 0x26000000 0x1000000>;
 
-        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>, <&clkosr>;
-        clock-names = "pa_clk", "ethss_clk", "cpts", "osr_clk";
+        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>;
+        clock-names = "pa_clk", "ethss_clk", "cpts";
         dma-coherent;
 
         ti,navigator-dmas = <&dma_gbe 0>,
diff --git a/arch/arm/boot/dts/keystone-k2l.dtsi b/arch/arm/boot/dts/keystone-k2l.dtsi
index b58e7ebc0919..148650406cf7 100644
--- a/arch/arm/boot/dts/keystone-k2l.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l.dtsi
@@ -232,6 +232,14 @@
                         };
                 };
 
+                osr: sram@70000000 {
+                        compatible = "mmio-sram";
+                        reg = <0x70000000 0x10000>;
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        clocks = <&clkosr>;
+                };
+
                 dspgpio0: keystone_dsp_gpio@02620240 {
                         compatible = "ti,keystone-dsp-gpio";
                         gpio-controller;
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 33a8eb28374e..06e2331f666d 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -1,4 +1,4 @@
-#include <versatile-ab.dts>
+#include "versatile-ab.dts"
 
 / {
         model = "ARM Versatile PB";
diff --git a/arch/arm/include/asm/device.h b/arch/arm/include/asm/device.h
index 36ec9c8f6e16..3234fe9bba6e 100644
--- a/arch/arm/include/asm/device.h
+++ b/arch/arm/include/asm/device.h
@@ -19,7 +19,8 @@ struct dev_archdata {
 #ifdef CONFIG_XEN
         const struct dma_map_ops *dev_dma_ops;
 #endif
-        bool dma_coherent;
+        unsigned int dma_coherent:1;
+        unsigned int dma_ops_setup:1;
 };
 
 struct omap_device;
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index 570ed4a9c261..5386528665b5 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -104,7 +104,6 @@ __do_hyp_init:
         @  - Write permission implies XN: disabled
         @  - Instruction cache: enabled
         @  - Data/Unified cache: enabled
-        @  - Memory alignment checks: enabled
         @  - MMU: enabled (this code must be run from an identity mapping)
         mrc     p15, 4, r0, c1, c0, 0   @ HSCR
         ldr     r2, =HSCTLR_MASK
@@ -112,8 +111,8 @@ __do_hyp_init:
         mrc     p15, 0, r1, c1, c0, 0   @ SCTLR
         ldr     r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C)
         and     r1, r1, r2
- ARM(   ldr     r2, =(HSCTLR_M | HSCTLR_A)                      )
- THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE)          )
+ ARM(   ldr     r2, =(HSCTLR_M)                                 )
+ THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_TE)                     )
         orr     r1, r1, r2
         orr     r0, r0, r1
         mcr     p15, 4, r0, c1, c0, 0   @ HSCR
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index 841e924143f9..cbd959b73654 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -1,6 +1,7 @@
 menuconfig ARCH_AT91
         bool "Atmel SoCs"
         depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V7
+        select ARM_CPU_SUSPEND if PM
         select COMMON_CLK_AT91
         select GPIOLIB
         select PINCTRL
diff --git a/arch/arm/mach-davinci/pm.c b/arch/arm/mach-davinci/pm.c
index efb80354f303..b5cc05dc2cb2 100644
--- a/arch/arm/mach-davinci/pm.c
+++ b/arch/arm/mach-davinci/pm.c
@@ -153,7 +153,8 @@ int __init davinci_pm_init(void)
         davinci_sram_suspend = sram_alloc(davinci_cpu_suspend_sz, NULL);
         if (!davinci_sram_suspend) {
                 pr_err("PM: cannot allocate SRAM memory\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto no_sram_mem;
         }
 
         davinci_sram_push(davinci_sram_suspend, davinci_cpu_suspend,
@@ -161,6 +162,10 @@ int __init davinci_pm_init(void)
 
         suspend_set_ops(&davinci_pm_ops);
 
+        return 0;
+
+no_sram_mem:
+        iounmap(pm_config.ddrpsc_reg_base);
 no_ddrpsc_mem:
         iounmap(pm_config.ddrpll_reg_base);
 no_ddrpll_mem:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c742dfd2967b..bd83c531828a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2311,7 +2311,14 @@ int arm_iommu_attach_device(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
 
-static void __arm_iommu_detach_device(struct device *dev)
+/**
+ * arm_iommu_detach_device
+ * @dev: valid struct device pointer
+ *
+ * Detaches the provided device from a previously attached map.
+ * This voids the dma operations (dma_map_ops pointer)
+ */
+void arm_iommu_detach_device(struct device *dev)
 {
         struct dma_iommu_mapping *mapping;
 
@@ -2324,22 +2331,10 @@ static void __arm_iommu_detach_device(struct device *dev)
         iommu_detach_device(mapping->domain, dev);
         kref_put(&mapping->kref, release_iommu_mapping);
         to_dma_iommu_mapping(dev) = NULL;
+        set_dma_ops(dev, NULL);
 
         pr_debug("Detached IOMMU controller from %s device.\n", dev_name(dev));
 }
-
-/**
- * arm_iommu_detach_device
- * @dev: valid struct device pointer
- *
- * Detaches the provided device from a previously attached map.
- * This voids the dma operations (dma_map_ops pointer)
- */
-void arm_iommu_detach_device(struct device *dev)
-{
-        __arm_iommu_detach_device(dev);
-        set_dma_ops(dev, NULL);
-}
 EXPORT_SYMBOL_GPL(arm_iommu_detach_device);
 
 static const struct dma_map_ops *arm_get_iommu_dma_map_ops(bool coherent)
@@ -2379,7 +2374,7 @@ static void arm_teardown_iommu_dma_ops(struct device *dev)
         if (!mapping)
                 return;
 
-        __arm_iommu_detach_device(dev);
+        arm_iommu_detach_device(dev);
         arm_iommu_release_mapping(mapping);
 }
 
@@ -2430,9 +2425,13 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                 dev->dma_ops = xen_dma_ops;
         }
 #endif
+        dev->archdata.dma_ops_setup = true;
 }
 
 void arch_teardown_dma_ops(struct device *dev)
 {
+        if (!dev->archdata.dma_ops_setup)
+                return;
+
         arm_teardown_iommu_dma_ops(dev);
 }
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 3dcd7ec69bca..b2024db225a9 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1084,10 +1084,6 @@ config SYSVIPC_COMPAT
         def_bool y
         depends on COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-        def_bool y
-        depends on COMPAT && KEYS
-
 endmenu
 
 menu "Power management options"
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
index ac8df5201cd6..b4bc42ece754 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
@@ -231,8 +231,7 @@
                         cpm_crypto: crypto@800000 {
                                 compatible = "inside-secure,safexcel-eip197";
                                 reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
-                                | IRQ_TYPE_LEVEL_HIGH)>,
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
index 7740a75a8230..6e2058847ddc 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
@@ -221,8 +221,7 @@
                         cps_crypto: crypto@800000 {
                                 compatible = "inside-secure,safexcel-eip197";
                                 reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
-                                | IRQ_TYPE_LEVEL_HIGH)>,
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 278 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 65cdd878cfbd..97c123e09e45 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -68,6 +68,7 @@ CONFIG_PCIE_QCOM=y
 CONFIG_PCIE_ARMADA_8K=y
 CONFIG_PCI_AARDVARK=y
 CONFIG_PCIE_RCAR=y
+CONFIG_PCIE_ROCKCHIP=m
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCI_XGENE=y
 CONFIG_ARM64_VA_BITS_48=y
@@ -208,6 +209,8 @@ CONFIG_BRCMFMAC=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SDIO=m
 CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_ADC=m
+CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_PM8941_PWRKEY=y
@@ -263,6 +266,7 @@ CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
+CONFIG_SPI_ROCKCHIP=y
 CONFIG_SPI_S3C64XX=y
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
@@ -292,6 +296,7 @@ CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_EXYNOS_THERMAL=y
+CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_S3C2410_WATCHDOG=y
 CONFIG_MESON_GXBB_WATCHDOG=m
@@ -300,12 +305,14 @@ CONFIG_RENESAS_WDT=y
 CONFIG_BCM2835_WDT=y
 CONFIG_MFD_CROS_EC=y
 CONFIG_MFD_CROS_EC_I2C=y
+CONFIG_MFD_CROS_EC_SPI=y
 CONFIG_MFD_EXYNOS_LPASS=m
 CONFIG_MFD_HI655X_PMIC=y
 CONFIG_MFD_MAX77620=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
+CONFIG_REGULATOR_FAN53555=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI655X=y
@@ -473,8 +480,10 @@ CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_EXYNOS_ADC=y
+CONFIG_ROCKCHIP_SARADC=m
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=m
+CONFIG_PWM_CROS_EC=m
 CONFIG_PWM_MESON=m
 CONFIG_PWM_ROCKCHIP=y
 CONFIG_PWM_SAMSUNG=y
@@ -484,6 +493,7 @@ CONFIG_PHY_HI6220_USB=y
 CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_PCIE=m
 CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_ARM_SCPI_PROTOCOL=y
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 15c142ce991c..b4d13d9267ff 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -286,6 +286,10 @@
 #define SCTLR_ELx_A     (1 << 1)
 #define SCTLR_ELx_M     1
 
+#define SCTLR_EL2_RES1  ((1 << 4)  | (1 << 5)  | (1 << 11) | (1 << 16) | \
+                         (1 << 16) | (1 << 18) | (1 << 22) | (1 << 23) | \
+                         (1 << 28) | (1 << 29))
+
 #define SCTLR_ELx_FLAGS (SCTLR_ELx_M | SCTLR_ELx_A | SCTLR_ELx_C | \
                          SCTLR_ELx_SA | SCTLR_ELx_I)
 
diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
index 839425c24b1c..3f9615582377 100644
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -106,10 +106,13 @@ __do_hyp_init:
         tlbi    alle2
         dsb     sy
 
-        mrs     x4, sctlr_el2
-        and     x4, x4, #SCTLR_ELx_EE   // preserve endianness of EL2
-        ldr     x5, =SCTLR_ELx_FLAGS
-        orr     x4, x4, x5
+        /*
+         * Preserve all the RES1 bits while setting the default flags,
+         * as well as the EE bit on BE. Drop the A flag since the compiler
+         * is allowed to generate unaligned accesses.
+         */
+        ldr     x4, =(SCTLR_EL2_RES1 | (SCTLR_ELx_FLAGS & ~SCTLR_ELx_A))
+CPU_BE( orr     x4, x4, #SCTLR_ELx_EE)
         msr     sctlr_el2, x4
         isb
 
diff --git a/arch/arm64/kvm/vgic-sys-reg-v3.c b/arch/arm64/kvm/vgic-sys-reg-v3.c
index 79f37e37d367..6260b69e5622 100644
--- a/arch/arm64/kvm/vgic-sys-reg-v3.c
+++ b/arch/arm64/kvm/vgic-sys-reg-v3.c
@@ -65,8 +65,8 @@ static bool access_gic_ctlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                  * Here set VMCR.CTLR in ICC_CTLR_EL1 layout.
                  * The vgic_set_vmcr() will convert to ICH_VMCR layout.
                  */
-                vmcr.ctlr = val & ICC_CTLR_EL1_CBPR_MASK;
-                vmcr.ctlr |= val & ICC_CTLR_EL1_EOImode_MASK;
+                vmcr.cbpr = (val & ICC_CTLR_EL1_CBPR_MASK) >> ICC_CTLR_EL1_CBPR_SHIFT;
+                vmcr.eoim = (val & ICC_CTLR_EL1_EOImode_MASK) >> ICC_CTLR_EL1_EOImode_SHIFT;
                 vgic_set_vmcr(vcpu, &vmcr);
         } else {
                 val = 0;
@@ -83,8 +83,8 @@ static bool access_gic_ctlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                  * The VMCR.CTLR value is in ICC_CTLR_EL1 layout.
                  * Extract it directly using ICC_CTLR_EL1 reg definitions.
                  */
-                val |= vmcr.ctlr & ICC_CTLR_EL1_CBPR_MASK;
-                val |= vmcr.ctlr & ICC_CTLR_EL1_EOImode_MASK;
+                val |= (vmcr.cbpr << ICC_CTLR_EL1_CBPR_SHIFT) & ICC_CTLR_EL1_CBPR_MASK;
+                val |= (vmcr.eoim << ICC_CTLR_EL1_EOImode_SHIFT) & ICC_CTLR_EL1_EOImode_MASK;
 
                 p->regval = val;
         }
@@ -135,7 +135,7 @@ static bool access_gic_bpr1(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                 p->regval = 0;
 
         vgic_get_vmcr(vcpu, &vmcr);
-        if (!((vmcr.ctlr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT)) {
+        if (!vmcr.cbpr) {
                 if (p->is_write) {
                         vmcr.abpr = (p->regval & ICC_BPR1_EL1_MASK) >>
                                      ICC_BPR1_EL1_SHIFT;
diff --git a/arch/hexagon/mm/uaccess.c b/arch/hexagon/mm/uaccess.c
index ec90afdb3ad0..c599eb126c9e 100644
--- a/arch/hexagon/mm/uaccess.c
+++ b/arch/hexagon/mm/uaccess.c
@@ -37,15 +37,14 @@ __kernel_size_t __clear_user_hexagon(void __user *dest, unsigned long count)
         long uncleared;
 
         while (count > PAGE_SIZE) {
-                uncleared = __copy_to_user_hexagon(dest, &empty_zero_page,
-                                                PAGE_SIZE);
+                uncleared = raw_copy_to_user(dest, &empty_zero_page, PAGE_SIZE);
                 if (uncleared)
                         return count - (PAGE_SIZE - uncleared);
                 count -= PAGE_SIZE;
                 dest += PAGE_SIZE;
         }
         if (count)
-                count = __copy_to_user_hexagon(dest, &empty_zero_page, count);
+                count = raw_copy_to_user(dest, &empty_zero_page, count);
 
         return count;
 }
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index f7c8f9972f61..bf4391d18923 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -380,22 +380,6 @@ source "arch/powerpc/platforms/Kconfig"
 
 menu "Kernel options"
 
-config PPC_DT_CPU_FTRS
-        bool "Device-tree based CPU feature discovery & setup"
-        depends on PPC_BOOK3S_64
-        default n
-        help
-          This enables code to use a new device tree binding for describing CPU
-          compatibility and features. Saying Y here will attempt to use the new
-          binding if the firmware provides it. Currently only the skiboot
-          firmware provides this binding.
-          If you're not sure say Y.
-
-config PPC_CPUFEATURES_ENABLE_UNKNOWN
-        bool "cpufeatures pass through unknown features to guest/userspace"
-        depends on PPC_DT_CPU_FTRS
-        default y
-
 config HIGHMEM
         bool "High memory support"
         depends on PPC32
@@ -1215,11 +1199,6 @@ source "arch/powerpc/Kconfig.debug"
 
 source "security/Kconfig"
 
-config KEYS_COMPAT
-        bool
-        depends on COMPAT && KEYS
-        default y
-
 source "crypto/Kconfig"
 
 config PPC_LIB_RHEAP
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index b4b5e6b671ca..0c4e470571ca 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -8,7 +8,7 @@
 #define H_PTE_INDEX_SIZE  9
 #define H_PMD_INDEX_SIZE  7
 #define H_PUD_INDEX_SIZE  9
-#define H_PGD_INDEX_SIZE  12
+#define H_PGD_INDEX_SIZE  9
 
 #ifndef __ASSEMBLY__
 #define H_PTE_TABLE_SIZE        (sizeof(pte_t) << H_PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index c2d509584a98..d02ad93bf708 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -214,7 +214,6 @@ enum {
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
 #define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #define CPU_FTR_PMAO_BUG                LONG_ASM_CONST(0x1000000000000000)
-#define CPU_FTR_SUBCORE                 LONG_ASM_CONST(0x2000000000000000)
 #define CPU_FTR_POWER9_DD1              LONG_ASM_CONST(0x4000000000000000)
 
 #ifndef __ASSEMBLY__
@@ -463,7 +462,7 @@ enum {
             CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
             CPU_FTR_ICSWX | CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
             CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \
-            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_SUBCORE)
+            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP)
 #define CPU_FTRS_POWER8E (CPU_FTRS_POWER8 | CPU_FTR_PMAO_BUG)
 #define CPU_FTRS_POWER8_DD1 (CPU_FTRS_POWER8 & ~CPU_FTR_DBELL)
 #define CPU_FTRS_POWER9 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index a2123f291ab0..bb99b651085a 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -110,13 +110,18 @@ void release_thread(struct task_struct *);
 #define TASK_SIZE_128TB (0x0000800000000000UL)
 #define TASK_SIZE_512TB (0x0002000000000000UL)
 
-#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * For now 512TB is only supported with book3s and 64K linux page size.
+ */
+#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_PPC_64K_PAGES)
 /*
  * Max value currently used:
  */
-#define TASK_SIZE_USER64        TASK_SIZE_512TB
+#define TASK_SIZE_USER64                TASK_SIZE_512TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_128TB
 #else
-#define TASK_SIZE_USER64        TASK_SIZE_64TB
+#define TASK_SIZE_USER64                TASK_SIZE_64TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_64TB
 #endif
 
 /*
@@ -132,7 +137,7 @@ void release_thread(struct task_struct *);
  * space during mmap's.
  */
 #define TASK_UNMAPPED_BASE_USER32 (PAGE_ALIGN(TASK_SIZE_USER32 / 4))
-#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(TASK_SIZE_128TB / 4))
+#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(DEFAULT_MAP_WINDOW_USER64 / 4))
 
 #define TASK_UNMAPPED_BASE ((is_32bit_task()) ? \
                 TASK_UNMAPPED_BASE_USER32 : TASK_UNMAPPED_BASE_USER64 )
@@ -143,21 +148,15 @@ void release_thread(struct task_struct *);
  * with 128TB and conditionally enable upto 512TB
  */
 #ifdef CONFIG_PPC_BOOK3S_64
-#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ? \
-                                 TASK_SIZE_USER32 : TASK_SIZE_128TB)
+#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ?                    \
+                                 TASK_SIZE_USER32 : DEFAULT_MAP_WINDOW_USER64)
 #else
 #define DEFAULT_MAP_WINDOW      TASK_SIZE
 #endif
 
 #ifdef __powerpc64__
 
-#ifdef CONFIG_PPC_BOOK3S_64
-/* Limit stack to 128TB */
-#define STACK_TOP_USER64 TASK_SIZE_128TB
-#else
-#define STACK_TOP_USER64 TASK_SIZE_USER64
-#endif
-
+#define STACK_TOP_USER64 DEFAULT_MAP_WINDOW_USER64
 #define STACK_TOP_USER32 TASK_SIZE_USER32
 
 #define STACK_TOP (is_32bit_task() ? \
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 8b3b46b7b0f2..329771559cbb 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topology(void);
 extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
 
+static inline int early_cpu_to_node(int cpu)
+{
+        int nid;
+
+        nid = numa_cpu_lookup_table[cpu];
+
+        /*
+         * Fall back to node 0 if nid is unset (it should be, except bugs).
+         * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
+         */
+        return (nid < 0) ? 0 : nid;
+}
 #else
 
+static inline int early_cpu_to_node(int cpu) { return 0; }
+
 static inline void dump_numa_cpu_topology(void) {}
 
 static inline int sysfs_add_device_to_node(struct device *dev, int nid)
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index fcc7588a96d6..4c7656dc4e04 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -8,6 +8,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/jump_label.h>
+#include <linux/libfdt.h>
 #include <linux/memblock.h>
 #include <linux/printk.h>
 #include <linux/sched.h>
@@ -642,7 +643,6 @@ static struct dt_cpu_feature_match __initdata
         {"processor-control-facility", feat_enable_dbell, CPU_FTR_DBELL},
         {"processor-control-facility-v3", feat_enable_dbell, CPU_FTR_DBELL},
         {"processor-utilization-of-resources-register", feat_enable_purr, 0},
-        {"subcore", feat_enable, CPU_FTR_SUBCORE},
         {"no-execute", feat_enable, 0},
         {"strong-access-ordering", feat_enable, CPU_FTR_SAO},
         {"cache-inhibited-large-page", feat_enable_large_ci, 0},
@@ -671,12 +671,24 @@ static struct dt_cpu_feature_match __initdata
         {"wait-v3", feat_enable, 0},
 };
 
-/* XXX: how to configure this? Default + boot time? */
-#ifdef CONFIG_PPC_CPUFEATURES_ENABLE_UNKNOWN
-#define CPU_FEATURE_ENABLE_UNKNOWN 1
-#else
-#define CPU_FEATURE_ENABLE_UNKNOWN 0
-#endif
+static bool __initdata using_dt_cpu_ftrs;
+static bool __initdata enable_unknown = true;
+
+static int __init dt_cpu_ftrs_parse(char *str)
+{
+        if (!str)
+                return 0;
+
+        if (!strcmp(str, "off"))
+                using_dt_cpu_ftrs = false;
+        else if (!strcmp(str, "known"))
+                enable_unknown = false;
+        else
+                return 1;
+
+        return 0;
+}
+early_param("dt_cpu_ftrs", dt_cpu_ftrs_parse);
 
 static void __init cpufeatures_setup_start(u32 isa)
 {
@@ -707,7 +719,7 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
                 }
         }
 
-        if (!known && CPU_FEATURE_ENABLE_UNKNOWN) {
+        if (!known && enable_unknown) {
                 if (!feat_try_enable_unknown(f)) {
                         pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
                                 f->name);
@@ -756,6 +768,26 @@ static void __init cpufeatures_setup_finished(void)
                 cur_cpu_spec->cpu_features, cur_cpu_spec->mmu_features);
 }
 
+static int __init disabled_on_cmdline(void)
+{
+        unsigned long root, chosen;
+        const char *p;
+
+        root = of_get_flat_dt_root();
+        chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
+        if (chosen == -FDT_ERR_NOTFOUND)
+                return false;
+
+        p = of_get_flat_dt_prop(chosen, "bootargs", NULL);
+        if (!p)
+                return false;
+
+        if (strstr(p, "dt_cpu_ftrs=off"))
+                return true;
+
+        return false;
+}
+
 static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
                                         int depth, void *data)
 {
@@ -766,8 +798,6 @@ static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
         return 0;
 }
 
-static bool __initdata using_dt_cpu_ftrs = false;
-
 bool __init dt_cpu_ftrs_in_use(void)
 {
         return using_dt_cpu_ftrs;
@@ -775,6 +805,8 @@ bool __init dt_cpu_ftrs_in_use(void)
 
 bool __init dt_cpu_ftrs_init(void *fdt)
 {
+        using_dt_cpu_ftrs = false;
+
         /* Setup and verify the FDT, if it fails we just bail */
         if (!early_init_dt_verify(fdt))
                 return false;
@@ -782,6 +814,9 @@ bool __init dt_cpu_ftrs_init(void *fdt)
         if (!of_scan_flat_dt(fdt_find_cpu_features, NULL))
                 return false;
 
+        if (disabled_on_cmdline())
+                return false;
+
         cpufeatures_setup_cpu();
 
         using_dt_cpu_ftrs = true;
@@ -1027,5 +1062,8 @@ static int __init dt_cpu_ftrs_scan_callback(unsigned long node, const char
 
 void __init dt_cpu_ftrs_scan(void)
 {
+        if (!using_dt_cpu_ftrs)
+                return;
+
         of_scan_flat_dt(dt_cpu_ftrs_scan_callback, NULL);
 }
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index baae104b16c7..2ad725ef4368 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1666,6 +1666,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
 #ifdef CONFIG_VSX
         current->thread.used_vsr = 0;
 #endif
+        current->thread.load_fp = 0;
         memset(&current->thread.fp_state, 0, sizeof(current->thread.fp_state));
         current->thread.fp_save_area = NULL;
 #ifdef CONFIG_ALTIVEC
@@ -1674,6 +1675,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         current->thread.vr_save_area = NULL;
         current->thread.vrsave = 0;
         current->thread.used_vr = 0;
+        current->thread.load_vec = 0;
 #endif /* CONFIG_ALTIVEC */
 #ifdef CONFIG_SPE
         memset(current->thread.evr, 0, sizeof(current->thread.evr));
@@ -1685,6 +1687,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         current->thread.tm_tfhar = 0;
         current->thread.tm_texasr = 0;
         current->thread.tm_tfiar = 0;
+        current->thread.load_tm = 0;
 #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
 }
 EXPORT_SYMBOL(start_thread);
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 71dcda91755d..857129acf960 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -928,7 +928,7 @@ void __init setup_arch(char **cmdline_p)
 
 #ifdef CONFIG_PPC_MM_SLICES
 #ifdef CONFIG_PPC64
-        init_mm.context.addr_limit = TASK_SIZE_128TB;
+        init_mm.context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 #else
 #error  "context.addr_limit not initialized."
 #endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index f35ff9dea4fb..a8c1f99e9607 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -661,7 +661,7 @@ void __init emergency_stack_init(void)
 
 static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
 {
-        return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
+        return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
                                     __pa(MAX_DMA_ADDRESS));
 }
 
@@ -672,7 +672,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size)
 
 static int pcpu_cpu_distance(unsigned int from, unsigned int to)
 {
-        if (cpu_to_node(from) == cpu_to_node(to))
+        if (early_cpu_to_node(from) == early_cpu_to_node(to))
                 return LOCAL_DISTANCE;
         else
                 return REMOTE_DISTANCE;
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index c6dca2ae78ef..a3edf813d455 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -99,7 +99,7 @@ static int hash__init_new_context(struct mm_struct *mm)
          * mm->context.addr_limit. Default to max task size so that we copy the
          * default values to paca which will help us to handle slb miss early.
          */
-        mm->context.addr_limit = TASK_SIZE_128TB;
+        mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 
         /*
          * The old code would re-promote on fork, we don't do that when using
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 018f8e90ac35..bb28e1a41257 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -402,7 +402,7 @@ static struct power_pmu power9_isa207_pmu = {
         .name                   = "POWER9",
         .n_counter              = MAX_PMU_COUNTERS,
         .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = ISA207_TEST_ADDER,
+        .test_adder             = P9_DD1_TEST_ADDER,
         .compute_mmcr           = isa207_compute_mmcr,
         .config_bhrb            = power9_config_bhrb,
         .bhrb_filter_map        = power9_bhrb_filter_map,
@@ -421,7 +421,7 @@ static struct power_pmu power9_pmu = {
         .name                   = "POWER9",
         .n_counter              = MAX_PMU_COUNTERS,
         .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = P9_DD1_TEST_ADDER,
+        .test_adder             = ISA207_TEST_ADDER,
         .compute_mmcr           = isa207_compute_mmcr,
         .config_bhrb            = power9_config_bhrb,
         .bhrb_filter_map        = power9_bhrb_filter_map,
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index 33244e3d9375..4fd64d3f5c44 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -59,6 +59,17 @@ config PPC_OF_BOOT_TRAMPOLINE
 
           In case of doubt, say Y
 
+config PPC_DT_CPU_FTRS
+        bool "Device-tree based CPU feature discovery & setup"
+        depends on PPC_BOOK3S_64
+        default y
+        help
+          This enables code to use a new device tree binding for describing CPU
+          compatibility and features. Saying Y here will attempt to use the new
+          binding if the firmware provides it. Currently only the skiboot
+          firmware provides this binding.
+          If you're not sure say Y.
+
 config UDBG_RTAS_CONSOLE
         bool "RTAS based debug console"
         depends on PPC_RTAS
diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
index e5a891ae80ee..84b7ac926ce6 100644
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -175,6 +175,8 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
         skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
         if (!dump_skip(cprm, skip))
                 goto Eio;
+
+        rc = 0;
 out:
         free_page((unsigned long)buf);
         return rc;
diff --git a/arch/powerpc/platforms/powernv/subcore.c b/arch/powerpc/platforms/powernv/subcore.c
index 0babef11136f..8c6119280c13 100644
--- a/arch/powerpc/platforms/powernv/subcore.c
+++ b/arch/powerpc/platforms/powernv/subcore.c
@@ -407,7 +407,13 @@ static DEVICE_ATTR(subcores_per_core, 0644,
 
 static int subcore_init(void)
 {
-        if (!cpu_has_feature(CPU_FTR_SUBCORE))
+        unsigned pvr_ver;
+
+        pvr_ver = PVR_VER(mfspr(SPRN_PVR));
+
+        if (pvr_ver != PVR_POWER8 &&
+            pvr_ver != PVR_POWER8E &&
+            pvr_ver != PVR_POWER8NVL)
                 return 0;
 
         /*
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index e104c71ea44a..1fb162ba9d1c 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -124,6 +124,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn)
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr);
                 lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index);
+                lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index);
                 lmbs[i].flags = be32_to_cpu(lmbs[i].flags);
         }
 
@@ -147,6 +148,7 @@ static void dlpar_update_drconf_property(struct device_node *dn,
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr);
                 lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index);
+                lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index);
                 lmbs[i].flags = cpu_to_be32(lmbs[i].flags);
         }
 
diff --git a/arch/powerpc/sysdev/simple_gpio.c b/arch/powerpc/sysdev/simple_gpio.c
index ef470b470b04..6afddae2fb47 100644
--- a/arch/powerpc/sysdev/simple_gpio.c
+++ b/arch/powerpc/sysdev/simple_gpio.c
@@ -75,7 +75,8 @@ static int u8_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 
 static void u8_gpio_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct u8_gpio_chip *u8_gc = gpiochip_get_data(&mm_gc->gc);
+        struct u8_gpio_chip *u8_gc =
+                container_of(mm_gc, struct u8_gpio_chip, mm_gc);
 
         u8_gc->data = in_8(mm_gc->regs);
 }
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e161fafb495b..6967addc6a89 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -363,9 +363,6 @@ config COMPAT
 config SYSVIPC_COMPAT
         def_bool y if COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
-
 config SMP
         def_bool y
         prompt "Symmetric multi-processing support"
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index a5039fa89314..282072206df7 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -30,6 +30,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -90,6 +94,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -359,6 +365,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -367,16 +374,19 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_RBD=m
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -442,6 +452,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -452,7 +464,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -471,6 +482,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -487,12 +499,18 @@ CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_XFS_DEBUG=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_BTRFS_DEBUG=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QUOTA_DEBUG=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
 CONFIG_AUTOFS4_FS=m
@@ -558,6 +576,7 @@ CONFIG_HEADERS_CHECK=y
 CONFIG_DEBUG_SECTION_MISMATCH=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_OBJECTS=y
 CONFIG_DEBUG_OBJECTS_SELFTEST=y
 CONFIG_DEBUG_OBJECTS_FREE=y
@@ -580,7 +599,6 @@ CONFIG_DETECT_HUNG_TASK=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_DEBUG_TIMEKEEPING=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
 CONFIG_PROVE_LOCKING=y
@@ -595,6 +613,7 @@ CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=300
 CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
+CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAILSLAB=y
 CONFIG_FAIL_PAGE_ALLOC=y
@@ -616,13 +635,12 @@ CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
+CONFIG_TEST_SORT=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_RBTREE_TEST=y
 CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_TEST_STRING_HELPERS=y
-CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
 CONFIG_TEST_BPF=m
 CONFIG_BUG_ON_DATA_CORRUPTION=y
@@ -630,6 +648,7 @@ CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -640,7 +659,9 @@ CONFIG_CRYPTO_RSA=m
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
@@ -648,6 +669,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -657,8 +679,10 @@ CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -674,6 +698,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -685,6 +710,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
@@ -692,6 +718,7 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
+CONFIG_RANDOM32_SELFTEST=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 83970b5afb2b..3c6b78189fbc 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -46,7 +47,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -88,6 +92,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -356,6 +362,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -364,16 +371,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -439,6 +448,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -449,7 +460,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -468,6 +478,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -483,11 +494,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -553,7 +568,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -576,6 +590,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -599,6 +614,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -611,6 +627,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -626,16 +643,19 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
+CONFIG_PKEY=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index fbc6542aaf59..653d72bcc007 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -86,6 +90,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -354,6 +360,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -362,16 +369,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -437,6 +446,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -447,7 +458,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -466,6 +476,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -481,11 +492,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -551,7 +566,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -574,6 +588,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -597,6 +612,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -609,6 +625,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -624,6 +641,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -635,6 +653,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index e23d97c13735..afa46a7406ea 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -12,8 +12,10 @@ CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=2
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_HZ_100=y
+# CONFIG_ARCH_RANDOM is not set
 # CONFIG_COMPACTION is not set
 # CONFIG_MIGRATION is not set
+# CONFIG_BOUNCE is not set
 # CONFIG_CHECK_STACK is not set
 # CONFIG_CHSC_SCH is not set
 # CONFIG_SCM_BUS is not set
@@ -36,11 +38,11 @@ CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_ZFCP=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_HVC_IUCV is not set
+# CONFIG_HW_RANDOM_S390 is not set
 CONFIG_RAW_DRIVER=y
 # CONFIG_SCLP_ASYNC is not set
 # CONFIG_HMC_DRV is not set
@@ -54,9 +56,9 @@ CONFIG_RAW_DRIVER=y
 # CONFIG_INOTIFY_USER is not set
 CONFIG_CONFIGFS_FS=y
 # CONFIG_MISC_FILESYSTEMS is not set
+# CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_PANIC_ON_OOPS=y
 # CONFIG_SCHED_DEBUG is not set
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 97189dbaf34b..20244a38c886 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -28,6 +28,7 @@ CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -108,7 +109,6 @@ CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
-CONFIG_MD_RAID0=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=m
@@ -131,6 +131,7 @@ CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 CONFIG_DEVKMEM=y
@@ -162,7 +163,6 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_LOCKING=y
 CONFIG_LOCK_STAT=y
@@ -172,14 +172,12 @@ CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_SG=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
@@ -190,7 +188,6 @@ CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
-CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_XTS=m
@@ -230,6 +227,7 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_ZCRYPT=m
 CONFIG_PKEY=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 426614a882a9..65d07ac34647 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -541,7 +541,6 @@ struct kvm_s390_float_interrupt {
         struct mutex ais_lock;
         u8 simm;
         u8 nimm;
-        int ais_enabled;
 };
 
 struct kvm_hw_wp_info_arch {
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index e408d9cc5b96..6315037335ba 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -231,12 +231,17 @@ ENTRY(sie64a)
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 .Lsie_done:
 # some program checks are suppressing. C code (e.g. do_protection_exception)
-# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions between sie64a and .Lsie_done should not cause program
-# interrupts. So lets use a nop (47 00 00 00) as a landing pad.
+# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There
+# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable.
+# Other instructions between sie64a and .Lsie_done should not cause program
+# interrupts. So lets use 3 nops as a landing pad for all possible rewinds.
 # See also .Lcleanup_sie
-.Lrewind_pad:
-        nop     0
+.Lrewind_pad6:
+        nopr    7
+.Lrewind_pad4:
+        nopr    7
+.Lrewind_pad2:
+        nopr    7
         .globl sie_exit
 sie_exit:
         lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
@@ -249,7 +254,9 @@ sie_exit:
         stg     %r14,__SF_EMPTY+16(%r15)        # set exit reason code
         j       sie_exit
 
-        EX_TABLE(.Lrewind_pad,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad6,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad4,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad2,.Lsie_fault)
         EX_TABLE(sie_exit,.Lsie_fault)
 EXPORT_SYMBOL(sie64a)
 EXPORT_SYMBOL(sie_exit)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index caf15c8a8948..2d120fef7d90 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -2160,7 +2160,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
         struct kvm_s390_ais_req req;
         int ret = 0;
 
-        if (!fi->ais_enabled)
+        if (!test_kvm_facility(kvm, 72))
                 return -ENOTSUPP;
 
         if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
@@ -2204,7 +2204,7 @@ static int kvm_s390_inject_airq(struct kvm *kvm,
         };
         int ret = 0;
 
-        if (!fi->ais_enabled || !adapter->suppressible)
+        if (!test_kvm_facility(kvm, 72) || !adapter->suppressible)
                 return kvm_s390_inject_vm(kvm, &s390int);
 
         mutex_lock(&fi->ais_lock);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 689ac48361c6..f28e2e776931 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -558,7 +558,6 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                 } else {
                         set_kvm_facility(kvm->arch.model.fac_mask, 72);
                         set_kvm_facility(kvm->arch.model.fac_list, 72);
-                        kvm->arch.float_int.ais_enabled = 1;
                         r = 0;
                 }
                 mutex_unlock(&kvm->lock);
@@ -1533,7 +1532,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         mutex_init(&kvm->arch.float_int.ais_lock);
         kvm->arch.float_int.simm = 0;
         kvm->arch.float_int.nimm = 0;
-        kvm->arch.float_int.ais_enabled = 0;
         spin_lock_init(&kvm->arch.float_int.lock);
         for (i = 0; i < FIRQ_LIST_COUNT; i++)
                 INIT_LIST_HEAD(&kvm->arch.float_int.lists[i]);
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 58243b0d21c0..5639c9fe5b55 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -192,9 +192,9 @@ config NR_CPUS
         int "Maximum number of CPUs"
         depends on SMP
         range 2 32 if SPARC32
-        range 2 1024 if SPARC64
+        range 2 4096 if SPARC64
         default 32 if SPARC32
-        default 64 if SPARC64
+        default 4096 if SPARC64
 
 source kernel/Kconfig.hz
 
@@ -295,9 +295,13 @@ config NUMA
         depends on SPARC64 && SMP
 
 config NODES_SHIFT
-        int
-        default "4"
+        int "Maximum NUMA Nodes (as a power of 2)"
+        range 4 5 if SPARC64
+        default "5"
         depends on NEED_MULTIPLE_NODES
+        help
+          Specify the maximum number of NUMA Nodes available on the target
+          system.  Increases memory reserved to accommodate various tables.
 
 # Some NUMA nodes have memory ranges that span
 # other nodes.  Even though a pfn is valid and
@@ -573,9 +577,6 @@ config SYSVIPC_COMPAT
         depends on COMPAT && SYSVIPC
         default y
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
-
 endmenu
 
 source "net/Kconfig"
diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h
index f7de0dbc38af..83b36a5371ff 100644
--- a/arch/sparc/include/asm/mmu_64.h
+++ b/arch/sparc/include/asm/mmu_64.h
@@ -52,7 +52,7 @@
 #define CTX_NR_MASK             TAG_CONTEXT_BITS
 #define CTX_HW_MASK             (CTX_NR_MASK | CTX_PGSZ_MASK)
 
-#define CTX_FIRST_VERSION       ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL))
+#define CTX_FIRST_VERSION       BIT(CTX_VERSION_SHIFT)
 #define CTX_VALID(__ctx)        \
          (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK))
 #define CTX_HWBITS(__ctx)       ((__ctx.sparc64_ctx_val) & CTX_HW_MASK)
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index 22fede6eba11..2cddcda4f85f 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -19,13 +19,8 @@ extern spinlock_t ctx_alloc_lock;
 extern unsigned long tlb_context_cache;
 extern unsigned long mmu_context_bmap[];
 
+DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm);
 void get_new_mmu_context(struct mm_struct *mm);
-#ifdef CONFIG_SMP
-void smp_new_mmu_context_version(void);
-#else
-#define smp_new_mmu_context_version() do { } while (0)
-#endif
-
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
 void destroy_context(struct mm_struct *mm);
 
@@ -76,8 +71,9 @@ void __flush_tlb_mm(unsigned long, unsigned long);
 static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk)
 {
         unsigned long ctx_valid, flags;
-        int cpu;
+        int cpu = smp_processor_id();
 
+        per_cpu(per_cpu_secondary_mm, cpu) = mm;
         if (unlikely(mm == &init_mm))
                 return;
 
@@ -123,7 +119,6 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
          * for the first time, we must flush that context out of the
          * local TLB.
          */
-        cpu = smp_processor_id();
         if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) {
                 cpumask_set_cpu(cpu, mm_cpumask(mm));
                 __flush_tlb_mm(CTX_HWBITS(mm->context),
@@ -133,26 +128,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
-
-/* Activate a new MM instance for the current task. */
-static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm)
-{
-        unsigned long flags;
-        int cpu;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-        if (!CTX_VALID(mm->context))
-                get_new_mmu_context(mm);
-        cpu = smp_processor_id();
-        if (!cpumask_test_cpu(cpu, mm_cpumask(mm)))
-                cpumask_set_cpu(cpu, mm_cpumask(mm));
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT);
-        tsb_context_switch(mm);
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-}
-
+#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL)
 #endif /* !(__ASSEMBLY__) */
 
 #endif /* !(__SPARC64_MMU_CONTEXT_H) */
diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h
index 266937030546..522b43db2ed3 100644
--- a/arch/sparc/include/asm/pil.h
+++ b/arch/sparc/include/asm/pil.h
@@ -20,7 +20,6 @@
 #define PIL_SMP_CALL_FUNC       1
 #define PIL_SMP_RECEIVE_SIGNAL  2
 #define PIL_SMP_CAPTURE         3
-#define PIL_SMP_CTX_NEW_VERSION 4
 #define PIL_DEVICE_IRQ          5
 #define PIL_SMP_CALL_FUNC_SNGL  6
 #define PIL_DEFERRED_PCR_WORK   7
diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
index 8174f6cdbbbb..9dca7a892978 100644
--- a/arch/sparc/include/asm/vio.h
+++ b/arch/sparc/include/asm/vio.h
@@ -327,6 +327,7 @@ struct vio_dev {
         int                     compat_len;
 
         u64                     dev_no;
+        u64                     id;
 
         unsigned long           channel_id;
 
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index b542cc7c8d94..f87265afb175 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -909,7 +909,7 @@ static int register_services(struct ds_info *dp)
                 pbuf.req.handle = cp->handle;
                 pbuf.req.major = 1;
                 pbuf.req.minor = 0;
-                strcpy(pbuf.req.svc_id, cp->service_id);
+                strcpy(pbuf.id_buf, cp->service_id);
 
                 err = __ds_send(lp, &pbuf, msg_len);
                 if (err > 0)
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index 4d0248aa0928..99dd133a029f 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb)
 {
 #ifdef CONFIG_SMP
         unsigned long page;
+        void *mondo, *p;
 
-        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64));
+        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE);
+
+        /* Make sure mondo block is 64byte aligned */
+        p = kzalloc(127, GFP_KERNEL);
+        if (!p) {
+                prom_printf("SUN4V: Error, cannot allocate mondo block.\n");
+                prom_halt();
+        }
+        mondo = (void *)(((unsigned long)p + 63) & ~0x3f);
+        tb->cpu_mondo_block_pa = __pa(mondo);
 
         page = get_zeroed_page(GFP_KERNEL);
         if (!page) {
-                prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n");
+                prom_printf("SUN4V: Error, cannot allocate cpu list page.\n");
                 prom_halt();
         }
 
-        tb->cpu_mondo_block_pa = __pa(page);
-        tb->cpu_list_pa = __pa(page + 64);
+        tb->cpu_list_pa = __pa(page);
 #endif
 }
 
diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h
index c9804551262c..6ae1e77be0bf 100644
--- a/arch/sparc/kernel/kernel.h
+++ b/arch/sparc/kernel/kernel.h
@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 /* smp_64.c */
 void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs);
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs);
 void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs);
 
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index b3bc0ac757cc..fdf31040a7dc 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -964,37 +964,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
         preempt_enable();
 }
 
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
-{
-        struct mm_struct *mm;
-        unsigned long flags;
-
-        clear_softint(1 << irq);
-
-        /* See if we need to allocate a new TLB context because
-         * the version of the one we are using is now out of date.
-         */
-        mm = current->active_mm;
-        if (unlikely(!mm || (mm == &init_mm)))
-                return;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-
-        if (unlikely(!CTX_VALID(mm->context)))
-                get_new_mmu_context(mm);
-
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context),
-                       SECONDARY_CONTEXT);
-}
-
-void smp_new_mmu_context_version(void)
-{
-        smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0);
-}
-
 #ifdef CONFIG_KGDB
 void kgdb_roundup_cpus(unsigned long flags)
 {
diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index 10689cfd0ad4..07c0df924960 100644
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -455,13 +455,16 @@ __tsb_context_switch:
         .type   copy_tsb,#function
 copy_tsb:               /* %o0=old_tsb_base, %o1=old_tsb_size
                          * %o2=new_tsb_base, %o3=new_tsb_size
+                         * %o4=page_size_shift
                          */
         sethi           %uhi(TSB_PASS_BITS), %g7
         srlx            %o3, 4, %o3
-        add             %o0, %o1, %g1   /* end of old tsb */
+        add             %o0, %o1, %o1   /* end of old tsb */
         sllx            %g7, 32, %g7
         sub             %o3, 1, %o3     /* %o3 == new tsb hash mask */
 
+        mov             %o4, %g1        /* page_size_shift */
+
 661:    prefetcha       [%o0] ASI_N, #one_read
         .section        .tsb_phys_patch, "ax"
         .word           661b
@@ -486,9 +489,9 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         /* This can definitely be computed faster... */
         srlx            %o0, 4, %o5     /* Build index */
         and             %o5, 511, %o5   /* Mask index */
-        sllx            %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */
+        sllx            %o5, %g1, %o5   /* Put into vaddr position */
         or              %o4, %o5, %o4   /* Full VADDR. */
-        srlx            %o4, PAGE_SHIFT, %o4 /* Shift down to create index */
+        srlx            %o4, %g1, %o4   /* Shift down to create index */
         and             %o4, %o3, %o4   /* Mask with new_tsb_nents-1 */
         sllx            %o4, 4, %o4     /* Shift back up into tsb ent offset */
         TSB_STORE(%o2 + %o4, %g2)       /* Store TAG */
@@ -496,7 +499,7 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         TSB_STORE(%o2 + %o4, %g3)       /* Store TTE */
 
 80:     add             %o0, 16, %o0
-        cmp             %o0, %g1
+        cmp             %o0, %o1
         bne,pt          %xcc, 90b
          nop
 
diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S
index 7bd8f6556352..efe93ab4a9c0 100644
--- a/arch/sparc/kernel/ttable_64.S
+++ b/arch/sparc/kernel/ttable_64.S
@@ -50,7 +50,7 @@ tl0_resv03e:	BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40)
 tl0_irq1:       TRAP_IRQ(smp_call_function_client, 1)
 tl0_irq2:       TRAP_IRQ(smp_receive_signal_client, 2)
 tl0_irq3:       TRAP_IRQ(smp_penguin_jailcell, 3)
-tl0_irq4:       TRAP_IRQ(smp_new_mmu_context_version_client, 4)
+tl0_irq4:       BTRAP(0x44)
 #else
 tl0_irq1:       BTRAP(0x41)
 tl0_irq2:       BTRAP(0x42)
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index f6bb857254fc..075d38980dee 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -302,13 +302,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
         if (!id) {
                 dev_set_name(&vdev->dev, "%s", bus_id_name);
                 vdev->dev_no = ~(u64)0;
+                vdev->id = ~(u64)0;
         } else if (!cfg_handle) {
                 dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id);
                 vdev->dev_no = *id;
+                vdev->id = ~(u64)0;
         } else {
                 dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name,
                              *cfg_handle, *id);
                 vdev->dev_no = *cfg_handle;
+                vdev->id = *id;
         }
 
         vdev->dev.parent = parent;
@@ -351,27 +354,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node)
         (void) vio_create_one(hp, node, &root_vdev->dev);
 }
 
+struct vio_md_node_query {
+        const char *type;
+        u64 dev_no;
+        u64 id;
+};
+
 static int vio_md_node_match(struct device *dev, void *arg)
 {
+        struct vio_md_node_query *query = (struct vio_md_node_query *) arg;
         struct vio_dev *vdev = to_vio_dev(dev);
 
-        if (vdev->mp == (u64) arg)
-                return 1;
+        if (vdev->dev_no != query->dev_no)
+                return 0;
+        if (vdev->id != query->id)
+                return 0;
+        if (strcmp(vdev->type, query->type))
+                return 0;
 
-        return 0;
+        return 1;
 }
 
 static void vio_remove(struct mdesc_handle *hp, u64 node)
 {
+        const char *type;
+        const u64 *id, *cfg_handle;
+        u64 a;
+        struct vio_md_node_query query;
         struct device *dev;
 
-        dev = device_find_child(&root_vdev->dev, (void *) node,
+        type = mdesc_get_property(hp, node, "device-type", NULL);
+        if (!type) {
+                type = mdesc_get_property(hp, node, "name", NULL);
+                if (!type)
+                        type = mdesc_node_name(hp, node);
+        }
+
+        query.type = type;
+
+        id = mdesc_get_property(hp, node, "id", NULL);
+        cfg_handle = NULL;
+        mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) {
+                u64 target;
+
+                target = mdesc_arc_target(hp, a);
+                cfg_handle = mdesc_get_property(hp, target,
+                                                "cfg-handle", NULL);
+                if (cfg_handle)
+                        break;
+        }
+
+        if (!id) {
+                query.dev_no = ~(u64)0;
+                query.id = ~(u64)0;
+        } else if (!cfg_handle) {
+                query.dev_no = *id;
+                query.id = ~(u64)0;
+        } else {
+                query.dev_no = *cfg_handle;
+                query.id = *id;
+        }
+
+        dev = device_find_child(&root_vdev->dev, &query,
                                 vio_md_node_match);
         if (dev) {
                 printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev));
 
                 device_unregister(dev);
                 put_device(dev);
+        } else {
+                if (!id)
+                        printk(KERN_ERR "VIO: Removed unknown %s node.\n",
+                               type);
+                else if (!cfg_handle)
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n",
+                               type, *id);
+                else
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n",
+                               type, *cfg_handle, *id);
         }
 }
 
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index 69912d2f8b54..07c03e72d812 100644
--- a/arch/sparc/lib/Makefile
+++ b/arch/sparc/lib/Makefile
@@ -15,6 +15,7 @@ lib-$(CONFIG_SPARC32) += copy_user.o locks.o
 lib-$(CONFIG_SPARC64) += atomic_64.o
 lib-$(CONFIG_SPARC32) += lshrdi3.o ashldi3.o
 lib-$(CONFIG_SPARC32) += muldi3.o bitext.o cmpdi2.o
+lib-$(CONFIG_SPARC64) += multi3.o
 
 lib-$(CONFIG_SPARC64) += copy_page.o clear_page.o bzero.o
 lib-$(CONFIG_SPARC64) += csum_copy.o csum_copy_from_user.o csum_copy_to_user.o
diff --git a/arch/sparc/lib/multi3.S b/arch/sparc/lib/multi3.S
new file mode 100644
index 000000000000..d6b6c97fe3c7
--- /dev/null
+++ b/arch/sparc/lib/multi3.S
@@ -0,0 +1,35 @@
+#include <linux/linkage.h>
+#include <asm/export.h>
+
+        .text
+        .align  4
+ENTRY(__multi3) /* %o0 = u, %o1 = v */
+        mov     %o1, %g1
+        srl     %o3, 0, %g4
+        mulx    %g4, %g1, %o1
+        srlx    %g1, 0x20, %g3
+        mulx    %g3, %g4, %g5
+        sllx    %g5, 0x20, %o5
+        srl     %g1, 0, %g4
+        sub     %o1, %o5, %o5
+        srlx    %o5, 0x20, %o5
+        addcc   %g5, %o5, %g5
+        srlx    %o3, 0x20, %o5
+        mulx    %g4, %o5, %g4
+        mulx    %g3, %o5, %o5
+        sethi   %hi(0x80000000), %g3
+        addcc   %g5, %g4, %g5
+        srlx    %g5, 0x20, %g5
+        add     %g3, %g3, %g3
+        movcc   %xcc, %g0, %g3
+        addcc   %o5, %g5, %o5
+        sllx    %g4, 0x20, %g4
+        add     %o1, %g4, %o1
+        add     %o5, %g3, %g2
+        mulx    %g1, %o2, %g1
+        add     %g1, %g2, %g1
+        mulx    %o0, %o3, %o0
+        retl
+         add    %g1, %o0, %o0
+ENDPROC(__multi3)
+EXPORT_SYMBOL(__multi3)
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 0cda653ae007..3c40ebd50f92 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -358,7 +358,8 @@ static int __init setup_hugepagesz(char *string)
         }
 
         if ((hv_pgsz_mask & cpu_pgsz_mask) == 0U) {
-                pr_warn("hugepagesz=%llu not supported by MMU.\n",
+                hugetlb_bad_size();
+                pr_err("hugepagesz=%llu not supported by MMU.\n",
                         hugepage_size);
                 goto out;
         }
@@ -706,10 +707,58 @@ EXPORT_SYMBOL(__flush_dcache_range);
 
 /* get_new_mmu_context() uses "cache + 1".  */
 DEFINE_SPINLOCK(ctx_alloc_lock);
-unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1;
+unsigned long tlb_context_cache = CTX_FIRST_VERSION;
 #define MAX_CTX_NR      (1UL << CTX_NR_BITS)
 #define CTX_BMAP_SLOTS  BITS_TO_LONGS(MAX_CTX_NR)
 DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR);
+DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0};
+
+static void mmu_context_wrap(void)
+{
+        unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK;
+        unsigned long new_ver, new_ctx, old_ctx;
+        struct mm_struct *mm;
+        int cpu;
+
+        bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS);
+
+        /* Reserve kernel context */
+        set_bit(0, mmu_context_bmap);
+
+        new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION;
+        if (unlikely(new_ver == 0))
+                new_ver = CTX_FIRST_VERSION;
+        tlb_context_cache = new_ver;
+
+        /*
+         * Make sure that any new mm that are added into per_cpu_secondary_mm,
+         * are going to go through get_new_mmu_context() path.
+         */
+        mb();
+
+        /*
+         * Updated versions to current on those CPUs that had valid secondary
+         * contexts
+         */
+        for_each_online_cpu(cpu) {
+                /*
+                 * If a new mm is stored after we took this mm from the array,
+                 * it will go into get_new_mmu_context() path, because we
+                 * already bumped the version in tlb_context_cache.
+                 */
+                mm = per_cpu(per_cpu_secondary_mm, cpu);
+
+                if (unlikely(!mm || mm == &init_mm))
+                        continue;
+
+                old_ctx = mm->context.sparc64_ctx_val;
+                if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) {
+                        new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver;
+                        set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap);
+                        mm->context.sparc64_ctx_val = new_ctx;
+                }
+        }
+}
 
 /* Caller does TLB context flushing on local CPU if necessary.
  * The caller also ensures that CTX_VALID(mm->context) is false.
@@ -725,48 +774,30 @@ void get_new_mmu_context(struct mm_struct *mm)
 {
         unsigned long ctx, new_ctx;
         unsigned long orig_pgsz_bits;
-        int new_version;
 
         spin_lock(&ctx_alloc_lock);
+retry:
+        /* wrap might have happened, test again if our context became valid */
+        if (unlikely(CTX_VALID(mm->context)))
+                goto out;
         orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK);
         ctx = (tlb_context_cache + 1) & CTX_NR_MASK;
         new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx);
-        new_version = 0;
         if (new_ctx >= (1 << CTX_NR_BITS)) {
                 new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1);
                 if (new_ctx >= ctx) {
-                        int i;
-                        new_ctx = (tlb_context_cache & CTX_VERSION_MASK) +
-                                CTX_FIRST_VERSION;
-                        if (new_ctx == 1)
-                                new_ctx = CTX_FIRST_VERSION;
-
-                        /* Don't call memset, for 16 entries that's just
-                         * plain silly...
-                         */
-                        mmu_context_bmap[0] = 3;
-                        mmu_context_bmap[1] = 0;
-                        mmu_context_bmap[2] = 0;
-                        mmu_context_bmap[3] = 0;
-                        for (i = 4; i < CTX_BMAP_SLOTS; i += 4) {
-                                mmu_context_bmap[i + 0] = 0;
-                                mmu_context_bmap[i + 1] = 0;
-                                mmu_context_bmap[i + 2] = 0;
-                                mmu_context_bmap[i + 3] = 0;
-                        }
-                        new_version = 1;
-                        goto out;
+                        mmu_context_wrap();
+                        goto retry;
                 }
         }
+        if (mm->context.sparc64_ctx_val)
+                cpumask_clear(mm_cpumask(mm));
         mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63));
         new_ctx |= (tlb_context_cache & CTX_VERSION_MASK);
-out:
         tlb_context_cache = new_ctx;
         mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits;
+out:
         spin_unlock(&ctx_alloc_lock);
-
-        if (unlikely(new_version))
-                smp_new_mmu_context_version();
 }
 
 static int numa_enabled = 1;
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index bedf08b22a47..0d4b998c7d7b 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -496,7 +496,8 @@ retry_tsb_alloc:
                 extern void copy_tsb(unsigned long old_tsb_base,
                                      unsigned long old_tsb_size,
                                      unsigned long new_tsb_base,
-                                     unsigned long new_tsb_size);
+                                     unsigned long new_tsb_size,
+                                     unsigned long page_size_shift);
                 unsigned long old_tsb_base = (unsigned long) old_tsb;
                 unsigned long new_tsb_base = (unsigned long) new_tsb;
 
@@ -504,7 +505,9 @@ retry_tsb_alloc:
                         old_tsb_base = __pa(old_tsb_base);
                         new_tsb_base = __pa(new_tsb_base);
                 }
-                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size);
+                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size,
+                        tsb_index == MM_TSB_BASE ?
+                        PAGE_SHIFT : REAL_HPAGE_SHIFT);
         }
 
         mm->context.tsb_block[tsb_index].tsb = new_tsb;
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index 5d2fd6cd3189..fcf4d27a38fb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -971,11 +971,6 @@ xcall_capture:
         wr              %g0, (1 << PIL_SMP_CAPTURE), %set_softint
         retry
 
-        .globl          xcall_new_mmu_context_version
-xcall_new_mmu_context_version:
-        wr              %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint
-        retry
-
 #ifdef CONFIG_KGDB
         .globl          xcall_kgdb_capture
 xcall_kgdb_capture:
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 4ccfacc7232a..0efb4c9497bc 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2776,10 +2776,6 @@ config COMPAT_FOR_U64_ALIGNMENT
 config SYSVIPC_COMPAT
         def_bool y
         depends on SYSVIPC
-
-config KEYS_COMPAT
-        def_bool y
-        depends on KEYS
 endif
 
 endmenu
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index a70fd61095f8..6f077445647a 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -255,6 +255,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                 break;
 
         case 4: /* MediaGX/GXm or Geode GXM/GXLV/GX1 */
+        case 11: /* GX1 with inverted Device ID */
 #ifdef CONFIG_PCI
         {
                 u32 vendor, device;
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index afdfd237b59f..f522415bf9e5 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -619,6 +619,9 @@ int __init save_microcode_in_initrd_intel(void)
 
         show_saved_mc();
 
+        /* initrd is going away, clear patch ptr. */
+        intel_ucode_patch = NULL;
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index da5c09789984..43e10d6fdbed 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -161,8 +161,8 @@ void kvm_async_pf_task_wait(u32 token)
                          */
                         rcu_irq_exit();
                         native_safe_halt();
-                        rcu_irq_enter();
                         local_irq_disable();
+                        rcu_irq_enter();
                 }
         }
         if (!n.halted)
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index a181ae76c71c..59ca2eea522c 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -780,18 +780,20 @@ out:
 static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i)
 {
         struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i];
-        int j, nent = vcpu->arch.cpuid_nent;
+        struct kvm_cpuid_entry2 *ej;
+        int j = i;
+        int nent = vcpu->arch.cpuid_nent;
 
         e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT;
         /* when no next entry is found, the current entry[i] is reselected */
-        for (j = i + 1; ; j = (j + 1) % nent) {
-                struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
-                if (ej->function == e->function) {
-                        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
-                        return j;
-                }
-        }
-        return 0; /* silence gcc, even though control never reaches here */
+        do {
+                j = (j + 1) % nent;
+                ej = &vcpu->arch.cpuid_entries[j];
+        } while (ej->function != e->function);
+
+        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
+
+        return j;
 }
 
 /* find an entry with matching function, matching index (if needed), and that
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 5d3376f67794..cb8225969255 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3698,12 +3698,15 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
         return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
 }
 
-static bool can_do_async_pf(struct kvm_vcpu *vcpu)
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
 {
         if (unlikely(!lapic_in_kernel(vcpu) ||
                      kvm_event_needs_reinjection(vcpu)))
                 return false;
 
+        if (is_guest_mode(vcpu))
+                return false;
+
         return kvm_x86_ops->interrupt_allowed(vcpu);
 }
 
@@ -3719,7 +3722,7 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
         if (!async)
                 return false; /* *pfn has correct page already */
 
-        if (!prefault && can_do_async_pf(vcpu)) {
+        if (!prefault && kvm_can_do_async_pf(vcpu)) {
                 trace_kvm_try_async_get_page(gva, gfn);
                 if (kvm_find_async_pf_gfn(vcpu, gfn)) {
                         trace_kvm_async_pf_doublefault(gva, gfn);
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 27975807cc64..330bf3a811fb 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -76,6 +76,7 @@ int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct);
 void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu);
 void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
                              bool accessed_dirty);
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
 
 static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
 {
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 9b4b5d6dcd34..ca5d2b93385c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2425,7 +2425,7 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned nr)
         if (!(vmcs12->exception_bitmap & (1u << nr)))
                 return 0;
 
-        nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason,
+        nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
                           vmcs_read32(VM_EXIT_INTR_INFO),
                           vmcs_readl(EXIT_QUALIFICATION));
         return 1;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index a2cd0997343c..87d3cb901935 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8607,8 +8607,7 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
         if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED))
                 return true;
         else
-                return !kvm_event_needs_reinjection(vcpu) &&
-                        kvm_x86_ops->interrupt_allowed(vcpu);
+                return kvm_can_do_async_pf(vcpu);
 }
 
 void kvm_arch_start_assignment(struct kvm *kvm)
diff --git a/arch/xtensa/include/asm/irq.h b/arch/xtensa/include/asm/irq.h
index f71f88ea7646..19707db966f1 100644
--- a/arch/xtensa/include/asm/irq.h
+++ b/arch/xtensa/include/asm/irq.h
@@ -29,7 +29,8 @@ static inline void variant_irq_disable(unsigned int irq) { }
 # define PLATFORM_NR_IRQS 0
 #endif
 #define XTENSA_NR_IRQS XCHAL_NUM_INTERRUPTS
-#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS)
+#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS + 1)
+#define XTENSA_PIC_LINUX_IRQ(hwirq) ((hwirq) + 1)
 
 #if VARIANT_NR_IRQS == 0
 static inline void variant_init_irq(void) { }
diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
index a265edd6ac37..99341028cc77 100644
--- a/arch/xtensa/kernel/irq.c
+++ b/arch/xtensa/kernel/irq.c
@@ -34,11 +34,6 @@ asmlinkage void do_IRQ(int hwirq, struct pt_regs *regs)
 {
         int irq = irq_find_mapping(NULL, hwirq);
 
-        if (hwirq >= NR_IRQS) {
-                printk(KERN_EMERG "%s: cannot handle IRQ %d\n",
-                                __func__, hwirq);
-        }
-
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
         /* Debugging check for stack overflow: is there less than 1KB free? */
         {
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 394ef08300b6..33bfa5270d95 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -593,8 +593,7 @@ c_show(struct seq_file *f, void *slot)
                       (ccount_freq/10000) % 100,
                       loops_per_jiffy/(500000/HZ),
                       (loops_per_jiffy/(5000/HZ)) % 100);
-
-        seq_printf(f,"flags\t\t: "
+        seq_puts(f, "flags\t\t: "
 #if XCHAL_HAVE_NMI
                      "nmi "
 #endif
diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
index 30d9fc21e076..162c77e53ca8 100644
--- a/arch/xtensa/kernel/vmlinux.lds.S
+++ b/arch/xtensa/kernel/vmlinux.lds.S
@@ -118,7 +118,7 @@ SECTIONS
   SECTION_VECTOR (.KernelExceptionVector.text, KERNEL_VECTOR_VADDR)
   SECTION_VECTOR (.UserExceptionVector.literal, USER_VECTOR_VADDR - 4)
   SECTION_VECTOR (.UserExceptionVector.text, USER_VECTOR_VADDR)
-  SECTION_VECTOR (.DoubleExceptionVector.literal, DOUBLEEXC_VECTOR_VADDR - 48)
+  SECTION_VECTOR (.DoubleExceptionVector.literal, DOUBLEEXC_VECTOR_VADDR - 20)
   SECTION_VECTOR (.DoubleExceptionVector.text, DOUBLEEXC_VECTOR_VADDR)
 #endif
 
@@ -306,13 +306,13 @@ SECTIONS
                   .UserExceptionVector.literal)
   SECTION_VECTOR (_DoubleExceptionVector_literal,
                   .DoubleExceptionVector.literal,
-                  DOUBLEEXC_VECTOR_VADDR - 48,
+                  DOUBLEEXC_VECTOR_VADDR - 20,
                   SIZEOF(.UserExceptionVector.text),
                   .UserExceptionVector.text)
   SECTION_VECTOR (_DoubleExceptionVector_text,
                   .DoubleExceptionVector.text,
                   DOUBLEEXC_VECTOR_VADDR,
-                  48,
+                  20,
                   .DoubleExceptionVector.literal)
 
   . = (LOADADDR( .DoubleExceptionVector.text ) + SIZEOF( .DoubleExceptionVector.text ) + 3) & ~ 3;
diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c
index 02e94bb3ad3e..c45b90bb9339 100644
--- a/arch/xtensa/platforms/iss/simdisk.c
+++ b/arch/xtensa/platforms/iss/simdisk.c
@@ -317,8 +317,7 @@ static int __init simdisk_init(void)
         if (simdisk_count > MAX_SIMDISK_COUNT)
                 simdisk_count = MAX_SIMDISK_COUNT;
 
-        sddev = kmalloc(simdisk_count * sizeof(struct simdisk),
-                        GFP_KERNEL);
+        sddev = kmalloc_array(simdisk_count, sizeof(*sddev), GFP_KERNEL);
         if (sddev == NULL)
                 goto out_unregister;
 
diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
index dbeea2b440a1..1fda7e20dfcb 100644
--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
@@ -24,16 +24,18 @@
 
 /* Interrupt configuration. */
 
-#define PLATFORM_NR_IRQS        10
+#define PLATFORM_NR_IRQS        0
 
 /* Default assignment of LX60 devices to external interrupts. */
 
 #ifdef CONFIG_XTENSA_MX
 #define DUART16552_INTNUM       XCHAL_EXTINT3_NUM
 #define OETH_IRQ                XCHAL_EXTINT4_NUM
+#define C67X00_IRQ              XCHAL_EXTINT8_NUM
 #else
 #define DUART16552_INTNUM       XCHAL_EXTINT0_NUM
 #define OETH_IRQ                XCHAL_EXTINT1_NUM
+#define C67X00_IRQ              XCHAL_EXTINT5_NUM
 #endif
 
 /*
@@ -63,5 +65,5 @@
 
 #define C67X00_PADDR            (XCHAL_KIO_PADDR + 0x0D0D0000)
 #define C67X00_SIZE             0x10
-#define C67X00_IRQ              5
+
 #endif /* __XTENSA_XTAVNET_HARDWARE_H */
diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 779be723eb2b..42285f35d313 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -175,8 +175,8 @@ static struct resource ethoc_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [2] = { /* IRQ number */
-                .start = OETH_IRQ,
-                .end   = OETH_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -213,8 +213,8 @@ static struct resource c67x00_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [1] = { /* IRQ number */
-                .start = C67X00_IRQ,
-                .end   = C67X00_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -247,7 +247,7 @@ static struct resource serial_resource = {
 static struct plat_serial8250_port serial_platform_data[] = {
         [0] = {
                 .mapbase        = DUART16552_PADDR,
-                .irq            = DUART16552_INTNUM,
+                .irq            = XTENSA_PIC_LINUX_IRQ(DUART16552_INTNUM),
                 .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST |
                                   UPF_IOREMAP,
                 .iotype         = XCHAL_HAVE_BE ? UPIO_MEM32BE : UPIO_MEM32,
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index c8a32fb345cf..78b2e0db4fb2 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -52,7 +52,7 @@ BFQG_FLAG_FNS(idling)
 BFQG_FLAG_FNS(empty)
 #undef BFQG_FLAG_FNS
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
 {
         unsigned long long now;
@@ -67,7 +67,7 @@ static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
         bfqg_stats_clear_waiting(stats);
 }
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
                                                  struct bfq_group *curr_bfqg)
 {
@@ -81,7 +81,7 @@ static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
         bfqg_stats_mark_waiting(stats);
 }
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_end_empty_time(struct bfqg_stats *stats)
 {
         unsigned long long now;
@@ -203,12 +203,30 @@ struct bfq_group *bfqq_group(struct bfq_queue *bfqq)
 
 static void bfqg_get(struct bfq_group *bfqg)
 {
-        return blkg_get(bfqg_to_blkg(bfqg));
+        bfqg->ref++;
 }
 
 void bfqg_put(struct bfq_group *bfqg)
 {
-        return blkg_put(bfqg_to_blkg(bfqg));
+        bfqg->ref--;
+
+        if (bfqg->ref == 0)
+                kfree(bfqg);
+}
+
+static void bfqg_and_blkg_get(struct bfq_group *bfqg)
+{
+        /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */
+        bfqg_get(bfqg);
+
+        blkg_get(bfqg_to_blkg(bfqg));
+}
+
+void bfqg_and_blkg_put(struct bfq_group *bfqg)
+{
+        bfqg_put(bfqg);
+
+        blkg_put(bfqg_to_blkg(bfqg));
 }
 
 void bfqg_stats_update_io_add(struct bfq_group *bfqg, struct bfq_queue *bfqq,
@@ -312,7 +330,11 @@ void bfq_init_entity(struct bfq_entity *entity, struct bfq_group *bfqg)
         if (bfqq) {
                 bfqq->ioprio = bfqq->new_ioprio;
                 bfqq->ioprio_class = bfqq->new_ioprio_class;
-                bfqg_get(bfqg);
+                /*
+                 * Make sure that bfqg and its associated blkg do not
+                 * disappear before entity.
+                 */
+                bfqg_and_blkg_get(bfqg);
         }
         entity->parent = bfqg->my_entity; /* NULL for root group */
         entity->sched_data = &bfqg->sched_data;
@@ -399,6 +421,8 @@ struct blkg_policy_data *bfq_pd_alloc(gfp_t gfp, int node)
                 return NULL;
         }
 
+        /* see comments in bfq_bic_update_cgroup for why refcounting */
+        bfqg_get(bfqg);
         return &bfqg->pd;
 }
 
@@ -426,7 +450,7 @@ void bfq_pd_free(struct blkg_policy_data *pd)
         struct bfq_group *bfqg = pd_to_bfqg(pd);
 
         bfqg_stats_exit(&bfqg->stats);
-        return kfree(bfqg);
+        bfqg_put(bfqg);
 }
 
 void bfq_pd_reset_stats(struct blkg_policy_data *pd)
@@ -496,9 +520,10 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
  * Move @bfqq to @bfqg, deactivating it from its old group and reactivating
  * it on the new one.  Avoid putting the entity on the old group idle tree.
  *
- * Must be called under the queue lock; the cgroup owning @bfqg must
- * not disappear (by now this just means that we are called under
- * rcu_read_lock()).
+ * Must be called under the scheduler lock, to make sure that the blkg
+ * owning @bfqg does not disappear (see comments in
+ * bfq_bic_update_cgroup on guaranteeing the consistency of blkg
+ * objects).
  */
 void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                    struct bfq_group *bfqg)
@@ -519,16 +544,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                 bfq_deactivate_bfqq(bfqd, bfqq, false, false);
         else if (entity->on_st)
                 bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
-        bfqg_put(bfqq_group(bfqq));
+        bfqg_and_blkg_put(bfqq_group(bfqq));
 
-        /*
-         * Here we use a reference to bfqg.  We don't need a refcounter
-         * as the cgroup reference will not be dropped, so that its
-         * destroy() callback will not be invoked.
-         */
         entity->parent = bfqg->my_entity;
         entity->sched_data = &bfqg->sched_data;
-        bfqg_get(bfqg);
+        /* pin down bfqg and its associated blkg  */
+        bfqg_and_blkg_get(bfqg);
 
         if (bfq_bfqq_busy(bfqq)) {
                 bfq_pos_tree_add_move(bfqd, bfqq);
@@ -545,8 +566,9 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
  * @bic: the bic to move.
  * @blkcg: the blk-cgroup to move to.
  *
- * Move bic to blkcg, assuming that bfqd->queue is locked; the caller
- * has to make sure that the reference to cgroup is valid across the call.
+ * Move bic to blkcg, assuming that bfqd->lock is held; which makes
+ * sure that the reference to cgroup is valid across the call (see
+ * comments in bfq_bic_update_cgroup on this issue)
  *
  * NOTE: an alternative approach might have been to store the current
  * cgroup in bfqq and getting a reference to it, reducing the lookup
@@ -604,6 +626,57 @@ void bfq_bic_update_cgroup(struct bfq_io_cq *bic, struct bio *bio)
                 goto out;
 
         bfqg = __bfq_bic_change_cgroup(bfqd, bic, bio_blkcg(bio));
+        /*
+         * Update blkg_path for bfq_log_* functions. We cache this
+         * path, and update it here, for the following
+         * reasons. Operations on blkg objects in blk-cgroup are
+         * protected with the request_queue lock, and not with the
+         * lock that protects the instances of this scheduler
+         * (bfqd->lock). This exposes BFQ to the following sort of
+         * race.
+         *
+         * The blkg_lookup performed in bfq_get_queue, protected
+         * through rcu, may happen to return the address of a copy of
+         * the original blkg. If this is the case, then the
+         * bfqg_and_blkg_get performed in bfq_get_queue, to pin down
+         * the blkg, is useless: it does not prevent blk-cgroup code
+         * from destroying both the original blkg and all objects
+         * directly or indirectly referred by the copy of the
+         * blkg.
+         *
+         * On the bright side, destroy operations on a blkg invoke, as
+         * a first step, hooks of the scheduler associated with the
+         * blkg. And these hooks are executed with bfqd->lock held for
+         * BFQ. As a consequence, for any blkg associated with the
+         * request queue this instance of the scheduler is attached
+         * to, we are guaranteed that such a blkg is not destroyed, and
+         * that all the pointers it contains are consistent, while we
+         * are holding bfqd->lock. A blkg_lookup performed with
+         * bfqd->lock held then returns a fully consistent blkg, which
+         * remains consistent until this lock is held.
+         *
+         * Thanks to the last fact, and to the fact that: (1) bfqg has
+         * been obtained through a blkg_lookup in the above
+         * assignment, and (2) bfqd->lock is being held, here we can
+         * safely use the policy data for the involved blkg (i.e., the
+         * field bfqg->pd) to get to the blkg associated with bfqg,
+         * and then we can safely use any field of blkg. After we
+         * release bfqd->lock, even just getting blkg through this
+         * bfqg may cause dangling references to be traversed, as
+         * bfqg->pd may not exist any more.
+         *
+         * In view of the above facts, here we cache, in the bfqg, any
+         * blkg data we may need for this bic, and for its associated
+         * bfq_queue. As of now, we need to cache only the path of the
+         * blkg, which is used in the bfq_log_* functions.
+         *
+         * Finally, note that bfqg itself needs to be protected from
+         * destruction on the blkg_free of the original blkg (which
+         * invokes bfq_pd_free). We use an additional private
+         * refcounter for bfqg, to let it disappear only after no
+         * bfq_queue refers to it any longer.
+         */
+        blkg_path(bfqg_to_blkg(bfqg), bfqg->blkg_path, sizeof(bfqg->blkg_path));
         bic->blkcg_serial_nr = serial_nr;
 out:
         rcu_read_unlock();
@@ -640,8 +713,6 @@ static void bfq_reparent_leaf_entity(struct bfq_data *bfqd,
  * @bfqd: the device data structure with the root group.
  * @bfqg: the group to move from.
  * @st: the service tree with the entities.
- *
- * Needs queue_lock to be taken and reference to be valid over the call.
  */
 static void bfq_reparent_active_entities(struct bfq_data *bfqd,
                                          struct bfq_group *bfqg,
@@ -692,8 +763,7 @@ void bfq_pd_offline(struct blkg_policy_data *pd)
                 /*
                  * The idle tree may still contain bfq_queues belonging
                  * to exited task because they never migrated to a different
-                 * cgroup from the one being destroyed now.  No one else
-                 * can access them so it's safe to act without any lock.
+                 * cgroup from the one being destroyed now.
                  */
                 bfq_flush_idle_tree(st);
 
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 08ce45096350..ed93da2462ab 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -3665,7 +3665,7 @@ void bfq_put_queue(struct bfq_queue *bfqq)
 
         kmem_cache_free(bfq_pool, bfqq);
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-        bfqg_put(bfqg);
+        bfqg_and_blkg_put(bfqg);
 #endif
 }
 
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index ae783c06dfd9..5c3bf9861492 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -759,6 +759,12 @@ struct bfq_group {
         /* must be the first member */
         struct blkg_policy_data pd;
 
+        /* cached path for this blkg (see comments in bfq_bic_update_cgroup) */
+        char blkg_path[128];
+
+        /* reference counter (see comments in bfq_bic_update_cgroup) */
+        int ref;
+
         struct bfq_entity entity;
         struct bfq_sched_data sched_data;
 
@@ -838,7 +844,7 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
 struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node);
-void bfqg_put(struct bfq_group *bfqg);
+void bfqg_and_blkg_put(struct bfq_group *bfqg);
 
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
 extern struct cftype bfq_blkcg_legacy_files[];
@@ -910,20 +916,13 @@ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 
 #define bfq_log_bfqq(bfqd, bfqq, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqq_group(bfqq)), __pbuf, sizeof(__pbuf)); \
-        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid, \
+        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid,\
                         bfq_bfqq_sync((bfqq)) ? 'S' : 'A',              \
-                          __pbuf, ##args);                              \
+                        bfqq_group(bfqq)->blkg_path, ##args);           \
 } while (0)
 
-#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqg), __pbuf, sizeof(__pbuf));          \
-        blk_add_trace_msg((bfqd)->queue, "%s " fmt, __pbuf, ##args);    \
-} while (0)
+#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  \
+        blk_add_trace_msg((bfqd)->queue, "%s " fmt, (bfqg)->blkg_path, ##args)
 
 #else /* CONFIG_BFQ_GROUP_IOSCHED */
 
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 5384713d48bc..b5009a896a7f 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *bio)
         if (bio_op(bio) != REQ_OP_READ && bio_op(bio) != REQ_OP_WRITE)
                 return false;
 
+        if (!bio_sectors(bio))
+                return false;
+
         /* Already protected? */
         if (bio_integrity(bio))
                 return false;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 1bcccedcc74f..bb66c96850b1 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1461,22 +1461,28 @@ static blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx, struct request *rq)
         return blk_tag_to_qc_t(rq->internal_tag, hctx->queue_num, true);
 }
 
-static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
-                                      bool may_sleep)
+static void __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+                                        struct request *rq,
+                                        blk_qc_t *cookie, bool may_sleep)
 {
         struct request_queue *q = rq->q;
         struct blk_mq_queue_data bd = {
                 .rq = rq,
                 .last = true,
         };
-        struct blk_mq_hw_ctx *hctx;
         blk_qc_t new_cookie;
         int ret;
+        bool run_queue = true;
+
+        if (blk_mq_hctx_stopped(hctx)) {
+                run_queue = false;
+                goto insert;
+        }
 
         if (q->elevator)
                 goto insert;
 
-        if (!blk_mq_get_driver_tag(rq, &hctx, false))
+        if (!blk_mq_get_driver_tag(rq, NULL, false))
                 goto insert;
 
         new_cookie = request_to_qc_t(hctx, rq);
@@ -1500,7 +1506,7 @@ static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
 
         __blk_mq_requeue_request(rq);
 insert:
-        blk_mq_sched_insert_request(rq, false, true, false, may_sleep);
+        blk_mq_sched_insert_request(rq, false, run_queue, false, may_sleep);
 }
 
 static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
@@ -1508,7 +1514,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
 {
         if (!(hctx->flags & BLK_MQ_F_BLOCKING)) {
                 rcu_read_lock();
-                __blk_mq_try_issue_directly(rq, cookie, false);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, false);
                 rcu_read_unlock();
         } else {
                 unsigned int srcu_idx;
@@ -1516,7 +1522,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                 might_sleep();
 
                 srcu_idx = srcu_read_lock(&hctx->queue_rq_srcu);
-                __blk_mq_try_issue_directly(rq, cookie, true);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, true);
                 srcu_read_unlock(&hctx->queue_rq_srcu, srcu_idx);
         }
 }
@@ -1619,9 +1625,12 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
                 blk_mq_put_ctx(data.ctx);
 
-                if (same_queue_rq)
+                if (same_queue_rq) {
+                        data.hctx = blk_mq_map_queue(q,
+                                        same_queue_rq->mq_ctx->cpu);
                         blk_mq_try_issue_directly(data.hctx, same_queue_rq,
                                         &cookie);
+                }
         } else if (q->nr_hw_queues > 1 && is_sync) {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index fc13dd0c6e39..a7285bf2831c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -27,6 +27,13 @@ static int throtl_quantum = 32;
 #define MIN_THROTL_IOPS (10)
 #define DFL_LATENCY_TARGET (-1L)
 #define DFL_IDLE_THRESHOLD (0)
+#define DFL_HD_BASELINE_LATENCY (4000L) /* 4ms */
+#define LATENCY_FILTERED_SSD (0)
+/*
+ * For HD, very small latency comes from sequential IO. Such IO is helpless to
+ * help determine if its IO is impacted by others, hence we ignore the IO
+ */
+#define LATENCY_FILTERED_HD (1000L) /* 1ms */
 
 #define SKIP_LATENCY (((u64)1) << BLK_STAT_RES_SHIFT)
 
@@ -212,6 +219,7 @@ struct throtl_data
         struct avg_latency_bucket avg_buckets[LATENCY_BUCKET_SIZE];
         struct latency_bucket __percpu *latency_buckets;
         unsigned long last_calculate_time;
+        unsigned long filtered_latency;
 
         bool track_bio_latency;
 };
@@ -698,7 +706,7 @@ static void throtl_dequeue_tg(struct throtl_grp *tg)
 static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
                                           unsigned long expires)
 {
-        unsigned long max_expire = jiffies + 8 * sq_to_tg(sq)->td->throtl_slice;
+        unsigned long max_expire = jiffies + 8 * sq_to_td(sq)->throtl_slice;
 
         /*
          * Since we are adjusting the throttle limit dynamically, the sleep
@@ -2281,7 +2289,7 @@ void blk_throtl_bio_endio(struct bio *bio)
                 throtl_track_latency(tg->td, blk_stat_size(&bio->bi_issue_stat),
                         bio_op(bio), lat);
 
-        if (tg->latency_target) {
+        if (tg->latency_target && lat >= tg->td->filtered_latency) {
                 int bucket;
                 unsigned int threshold;
 
@@ -2417,14 +2425,20 @@ void blk_throtl_exit(struct request_queue *q)
 void blk_throtl_register_queue(struct request_queue *q)
 {
         struct throtl_data *td;
+        int i;
 
         td = q->td;
         BUG_ON(!td);
 
-        if (blk_queue_nonrot(q))
+        if (blk_queue_nonrot(q)) {
                 td->throtl_slice = DFL_THROTL_SLICE_SSD;
-        else
+                td->filtered_latency = LATENCY_FILTERED_SSD;
+        } else {
                 td->throtl_slice = DFL_THROTL_SLICE_HD;
+                td->filtered_latency = LATENCY_FILTERED_HD;
+                for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                        td->avg_buckets[i].latency = DFL_HD_BASELINE_LATENCY;
+        }
 #ifndef CONFIG_BLK_DEV_THROTTLING_LOW
         /* if no low limit, use previous default */
         td->throtl_slice = DFL_THROTL_SLICE_HD;
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index d3a989e718f5..3cd6e12cfc46 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -141,7 +141,7 @@ int public_key_verify_signature(const struct public_key *pkey,
          * signature and returns that to us.
          */
         ret = crypto_akcipher_verify(req);
-        if (ret == -EINPROGRESS) {
+        if ((ret == -EINPROGRESS) || (ret == -EBUSY)) {
                 wait_for_completion(&compl.completion);
                 ret = compl.err;
         }
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 672a94c2c3ff..d178650fd524 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -381,7 +381,7 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
         }
 
 error:
-        kfree(desc);
+        kzfree(desc);
 error_no_desc:
         crypto_free_shash(tfm);
         kleave(" = %d", ret);
@@ -450,6 +450,6 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
         ret = pefile_digest_pe(pebuf, pelen, &ctx);
 
 error:
-        kfree(ctx.digest);
+        kzfree(ctx.digest);
         return ret;
 }
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index c80765b211cf..dd03fead1ca3 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -102,6 +102,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
                 }
         }
 
+        ret = -ENOMEM;
         cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
         if (!cert->pub->key)
                 goto error_decode;
diff --git a/crypto/drbg.c b/crypto/drbg.c
index fa749f470135..cdb27ac4b226 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1767,9 +1767,8 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                         break;
                 case -EINPROGRESS:
                 case -EBUSY:
-                        ret = wait_for_completion_interruptible(
-                                &drbg->ctr_completion);
-                        if (!ret && !drbg->ctr_async_err) {
+                        wait_for_completion(&drbg->ctr_completion);
+                        if (!drbg->ctr_async_err) {
                                 reinit_completion(&drbg->ctr_completion);
                                 break;
                         }
diff --git a/crypto/gcm.c b/crypto/gcm.c
index b7ad808be3d4..3841b5eafa7e 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -152,10 +152,8 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
 
         err = crypto_skcipher_encrypt(&data->req);
         if (err == -EINPROGRESS || err == -EBUSY) {
-                err = wait_for_completion_interruptible(
-                        &data->result.completion);
-                if (!err)
-                        err = data->result.err;
+                wait_for_completion(&data->result.completion);
+                err = data->result.err;
         }
 
         if (err)
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index c5fecf97ee2f..797b28dc7b34 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -666,14 +666,6 @@ static const struct iommu_ops *iort_iommu_xlate(struct device *dev,
         int ret = -ENODEV;
         struct fwnode_handle *iort_fwnode;
 
-        /*
-         * If we already translated the fwspec there
-         * is nothing left to do, return the iommu_ops.
-         */
-        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
-        if (ops)
-                return ops;
-
         if (node) {
                 iort_fwnode = iort_get_fwnode(node);
                 if (!iort_fwnode)
@@ -735,6 +727,14 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         u32 streamid = 0;
         int err;
 
+        /*
+         * If we already translated the fwspec there
+         * is nothing left to do, return the iommu_ops.
+         */
+        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
+        if (ops)
+                return ops;
+
         if (dev_is_pci(dev)) {
                 struct pci_bus *bus = to_pci_dev(dev)->bus;
                 u32 rid;
@@ -782,6 +782,12 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         if (err)
                 ops = ERR_PTR(err);
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index a9a9ab3399d4..d42eeef9d928 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -782,7 +782,7 @@ static int acpi_battery_update(struct acpi_battery *battery, bool resume)
         if ((battery->state & ACPI_BATTERY_STATE_CRITICAL) ||
             (test_bit(ACPI_BATTERY_ALARM_PRESENT, &battery->flags) &&
             (battery->capacity_now <= battery->alarm)))
-                pm_wakeup_hard_event(&battery->device->dev);
+                pm_wakeup_event(&battery->device->dev, 0);
 
         return result;
 }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 9ad8cdb58743..e19f530f1083 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -217,7 +217,7 @@ static int acpi_lid_notify_state(struct acpi_device *device, int state)
         }
 
         if (state)
-                pm_wakeup_hard_event(&device->dev);
+                pm_wakeup_event(&device->dev, 0);
 
         ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, device);
         if (ret == NOTIFY_DONE)
@@ -402,7 +402,7 @@ static void acpi_button_notify(struct acpi_device *device, u32 event)
                 } else {
                         int keycode;
 
-                        pm_wakeup_hard_event(&device->dev);
+                        pm_wakeup_event(&device->dev, 0);
                         if (button->suspended)
                                 break;
 
@@ -534,7 +534,6 @@ static int acpi_button_add(struct acpi_device *device)
                 lid_device = device;
         }
 
-        device_init_wakeup(&device->dev, true);
         printk(KERN_INFO PREFIX "%s [%s]\n", name, acpi_device_bid(device));
         return 0;
 
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 798d5003a039..993fd31394c8 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -24,7 +24,6 @@
 #include <linux/pm_qos.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
-#include <linux/suspend.h>
 
 #include "internal.h"
 
@@ -400,7 +399,7 @@ static void acpi_pm_notify_handler(acpi_handle handle, u32 val, void *not_used)
         mutex_lock(&acpi_pm_notifier_lock);
 
         if (adev->wakeup.flags.notifier_present) {
-                pm_wakeup_ws_event(adev->wakeup.ws, 0, true);
+                __pm_wakeup_event(adev->wakeup.ws, 0);
                 if (adev->wakeup.context.work.func)
                         queue_pm_work(&adev->wakeup.context.work);
         }
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index e39ec7b7cb67..3a10d7573477 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1371,8 +1371,8 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr)
         iort_set_dma_mask(dev);
 
         iommu = iort_iommu_configure(dev);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
         /*
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index a6574d626340..097d630ab886 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -663,40 +663,14 @@ static int acpi_freeze_prepare(void)
         acpi_os_wait_events_complete();
         if (acpi_sci_irq_valid())
                 enable_irq_wake(acpi_sci_irq);
-
         return 0;
 }
 
-static void acpi_freeze_wake(void)
-{
-        /*
-         * If IRQD_WAKEUP_ARMED is not set for the SCI at this point, it means
-         * that the SCI has triggered while suspended, so cancel the wakeup in
-         * case it has not been a wakeup event (the GPEs will be checked later).
-         */
-        if (acpi_sci_irq_valid() &&
-            !irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
-                pm_system_cancel_wakeup();
-}
-
-static void acpi_freeze_sync(void)
-{
-        /*
-         * Process all pending events in case there are any wakeup ones.
-         *
-         * The EC driver uses the system workqueue, so that one needs to be
-         * flushed too.
-         */
-        acpi_os_wait_events_complete();
-        flush_scheduled_work();
-}
-
 static void acpi_freeze_restore(void)
 {
         acpi_disable_wakeup_devices(ACPI_STATE_S0);
         if (acpi_sci_irq_valid())
                 disable_irq_wake(acpi_sci_irq);
-
         acpi_enable_all_runtime_gpes();
 }
 
@@ -708,8 +682,6 @@ static void acpi_freeze_end(void)
 static const struct platform_freeze_ops acpi_freeze_ops = {
         .begin = acpi_freeze_begin,
         .prepare = acpi_freeze_prepare,
-        .wake = acpi_freeze_wake,
-        .sync = acpi_freeze_sync,
         .restore = acpi_freeze_restore,
         .end = acpi_freeze_end,
 };
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e987a6f55d36..9faee1c893e5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1091,6 +1091,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
         if (async_error)
                 goto Complete;
 
+        if (pm_wakeup_pending()) {
+                async_error = -EBUSY;
+                goto Complete;
+        }
+
         if (dev->power.syscore || dev->power.direct_complete)
                 goto Complete;
 
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 9c36b27996fc..c313b600d356 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -28,8 +28,8 @@ bool events_check_enabled __read_mostly;
 /* First wakeup IRQ seen by the kernel in the last cycle. */
 unsigned int pm_wakeup_irq __read_mostly;
 
-/* If greater than 0 and the system is suspending, terminate the suspend. */
-static atomic_t pm_abort_suspend __read_mostly;
+/* If set and the system is suspending, terminate the suspend. */
+static bool pm_abort_suspend __read_mostly;
 
 /*
  * Combined counters of registered wakeup events and wakeup events in progress.
@@ -855,26 +855,20 @@ bool pm_wakeup_pending(void)
                 pm_print_active_wakeup_sources();
         }
 
-        return ret || atomic_read(&pm_abort_suspend) > 0;
+        return ret || pm_abort_suspend;
 }
 
 void pm_system_wakeup(void)
 {
-        atomic_inc(&pm_abort_suspend);
+        pm_abort_suspend = true;
         freeze_wake();
 }
 EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
-void pm_system_cancel_wakeup(void)
-{
-        atomic_dec(&pm_abort_suspend);
-}
-
-void pm_wakeup_clear(bool reset)
+void pm_wakeup_clear(void)
 {
+        pm_abort_suspend = false;
         pm_wakeup_irq = 0;
-        if (reset)
-                atomic_set(&pm_abort_suspend, 0);
 }
 
 void pm_system_irq_wakeup(unsigned int irq_number)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 28d932906f24..ebbd0c3fe0ed 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -608,6 +608,9 @@ static int loop_switch(struct loop_device *lo, struct file *file)
  */
 static int loop_flush(struct loop_device *lo)
 {
+        /* loop not yet configured, no running thread, nothing to flush */
+        if (lo->lo_state != Lo_bound)
+                return 0;
         return loop_switch(lo, NULL);
 }
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6e0cbe092220..593a8818aca9 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -343,7 +343,7 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma)
         phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
 
         /* It's illegal to wrap around the end of the physical address space. */
-        if (offset + (phys_addr_t)size < offset)
+        if (offset + (phys_addr_t)size - 1 < offset)
                 return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
diff --git a/drivers/char/random.c b/drivers/char/random.c
index a561f0c2f428..e870f329db88 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1,6 +1,9 @@
 /*
  * random.c -- A strong random number generator
  *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
+ * Rights Reserved.
+ *
  * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
  *
  * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999.  All
@@ -762,6 +765,8 @@ static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
 static struct crng_state **crng_node_pool __read_mostly;
 #endif
 
+static void invalidate_batched_entropy(void);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -799,6 +804,7 @@ static int crng_fast_load(const char *cp, size_t len)
                 cp++; crng_init_cnt++; len--;
         }
         if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
+                invalidate_batched_entropy();
                 crng_init = 1;
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: fast init done\n");
@@ -836,6 +842,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         memzero_explicit(&buf, sizeof(buf));
         crng->init_time = jiffies;
         if (crng == &primary_crng && crng_init < 2) {
+                invalidate_batched_entropy();
                 crng_init = 2;
                 process_random_ready_list();
                 wake_up_interruptible(&crng_init_wait);
@@ -1097,15 +1104,15 @@ static void add_interrupt_bench(cycles_t start)
 static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
 {
         __u32 *ptr = (__u32 *) regs;
-        unsigned long flags;
+        unsigned int idx;
 
         if (regs == NULL)
                 return 0;
-        local_irq_save(flags);
-        if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
-                f->reg_idx = 0;
-        ptr += f->reg_idx++;
-        local_irq_restore(flags);
+        idx = READ_ONCE(f->reg_idx);
+        if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
+                idx = 0;
+        ptr += idx++;
+        WRITE_ONCE(f->reg_idx, idx);
         return *ptr;
 }
 
@@ -2023,6 +2030,7 @@ struct batched_entropy {
         };
         unsigned int position;
 };
+static rwlock_t batched_entropy_reset_lock = __RW_LOCK_UNLOCKED(batched_entropy_reset_lock);
 
 /*
  * Get a random word for internal kernel use only. The quality of the random
@@ -2033,6 +2041,8 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
 u64 get_random_u64(void)
 {
         u64 ret;
+        bool use_lock = crng_init < 2;
+        unsigned long flags;
         struct batched_entropy *batch;
 
 #if BITS_PER_LONG == 64
@@ -2045,11 +2055,15 @@ u64 get_random_u64(void)
 #endif
 
         batch = &get_cpu_var(batched_entropy_u64);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
                 extract_crng((u8 *)batch->entropy_u64);
                 batch->position = 0;
         }
         ret = batch->entropy_u64[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u64);
         return ret;
 }
@@ -2059,22 +2073,45 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
 u32 get_random_u32(void)
 {
         u32 ret;
+        bool use_lock = crng_init < 2;
+        unsigned long flags;
         struct batched_entropy *batch;
 
         if (arch_get_random_int(&ret))
                 return ret;
 
         batch = &get_cpu_var(batched_entropy_u32);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
                 extract_crng((u8 *)batch->entropy_u32);
                 batch->position = 0;
         }
         ret = batch->entropy_u32[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u32);
         return ret;
 }
 EXPORT_SYMBOL(get_random_u32);
 
+/* It's important to invalidate all potential batched entropy that might
+ * be stored before the crng is initialized, which we can do lazily by
+ * simply resetting the counter to zero so that it's re-extracted on the
+ * next usage. */
+static void invalidate_batched_entropy(void)
+{
+        int cpu;
+        unsigned long flags;
+
+        write_lock_irqsave(&batched_entropy_reset_lock, flags);
+        for_each_possible_cpu (cpu) {
+                per_cpu_ptr(&batched_entropy_u32, cpu)->position = 0;
+                per_cpu_ptr(&batched_entropy_u64, cpu)->position = 0;
+        }
+        write_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+}
+
 /**
  * randomize_page - Generate a random, page aligned address
  * @start:      The smallest acceptable address the caller will take.
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b7de5bd76a31..eb1158532de3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -571,9 +571,10 @@ static inline void update_turbo_state(void)
 static int min_perf_pct_min(void)
 {
         struct cpudata *cpu = all_cpu_data[0];
+        int turbo_pstate = cpu->pstate.turbo_pstate;
 
-        return DIV_ROUND_UP(cpu->pstate.min_pstate * 100,
-                            cpu->pstate.turbo_pstate);
+        return turbo_pstate ?
+                DIV_ROUND_UP(cpu->pstate.min_pstate * 100, turbo_pstate) : 0;
 }
 
 static s16 intel_pstate_get_epb(struct cpudata *cpu_data)
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 6ed32aac8bbe..922d0823f8ec 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -210,9 +210,12 @@ EXPORT_SYMBOL_GPL(kill_dax);
 static struct inode *dax_alloc_inode(struct super_block *sb)
 {
         struct dax_device *dax_dev;
+        struct inode *inode;
 
         dax_dev = kmem_cache_alloc(dax_cache, GFP_KERNEL);
-        return &dax_dev->inode;
+        inode = &dax_dev->inode;
+        inode->i_rdev = 0;
+        return inode;
 }
 
 static struct dax_device *to_dax_dev(struct inode *inode)
@@ -227,7 +230,8 @@ static void dax_i_callback(struct rcu_head *head)
 
         kfree(dax_dev->host);
         dax_dev->host = NULL;
-        ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
+        if (inode->i_rdev)
+                ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
         kmem_cache_free(dax_cache, dax_dev);
 }
 
@@ -423,6 +427,7 @@ static void init_once(void *_dax_dev)
         struct dax_device *dax_dev = _dax_dev;
         struct inode *inode = &dax_dev->inode;
 
+        memset(dax_dev, 0, sizeof(*dax_dev));
         inode_init_once(inode);
 }
 
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index 8bf27323f7a3..b58233e4ed71 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -27,6 +27,26 @@ struct bmp_header {
         u32 size;
 } __packed;
 
+static bool efi_bgrt_addr_valid(u64 addr)
+{
+        efi_memory_desc_t *md;
+
+        for_each_efi_memory_desc(md) {
+                u64 size;
+                u64 end;
+
+                if (md->type != EFI_BOOT_SERVICES_DATA)
+                        continue;
+
+                size = md->num_pages << EFI_PAGE_SHIFT;
+                end = md->phys_addr + size;
+                if (addr >= md->phys_addr && addr < end)
+                        return true;
+        }
+
+        return false;
+}
+
 void __init efi_bgrt_init(struct acpi_table_header *table)
 {
         void *image;
@@ -36,7 +56,7 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
         if (acpi_disabled)
                 return;
 
-        if (!efi_enabled(EFI_BOOT))
+        if (!efi_enabled(EFI_MEMMAP))
                 return;
 
         if (table->length < sizeof(bgrt_tab)) {
@@ -65,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                 goto out;
         }
 
+        if (!efi_bgrt_addr_valid(bgrt->image_address)) {
+                pr_notice("Ignoring BGRT: invalid image address\n");
+                goto out;
+        }
         image = early_memremap(bgrt->image_address, sizeof(bmp_header));
         if (!image) {
                 pr_notice("Ignoring BGRT: failed to map image header memory\n");
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 1e7860f02f4f..31058d400bda 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -136,12 +136,12 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         info->value = value;
 
         INIT_LIST_HEAD(&info->list);
-        list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
         if (ret)
                 goto free_info_key;
 
+        list_add_tail(&info->list, &sec->attribs);
         return 0;
 
 free_info_key:
@@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec)
         struct vpd_attrib_info *temp;
 
         list_for_each_entry_safe(info, temp, &sec->attribs, list) {
-                kfree(info->key);
                 sysfs_remove_bin_file(sec->kobj, &info->bin_attr);
+                kfree(info->key);
                 kfree(info);
         }
 }
@@ -244,7 +244,7 @@ static int vpd_section_destroy(struct vpd_section *sec)
 {
         if (sec->enabled) {
                 vpd_section_attrib_destroy(sec);
-                kobject_del(sec->kobj);
+                kobject_put(sec->kobj);
                 sysfs_remove_bin_file(vpd_kobj, &sec->bin_attr);
                 kfree(sec->raw_name);
                 iounmap(sec->baseaddr);
@@ -331,7 +331,7 @@ static void __exit vpd_platform_exit(void)
 {
         vpd_section_destroy(&ro_vpd);
         vpd_section_destroy(&rw_vpd);
-        kobject_del(vpd_kobj);
+        kobject_put(vpd_kobj);
 }
 
 module_init(vpd_platform_init);
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index ccea609676ee..4ca436e66bdb 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -646,6 +646,9 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset,
         int rc;
         int i;
 
+        if (!gpio->clk)
+                return -EINVAL;
+
         rc = usecs_to_cycles(gpio, usecs, &requested_cycles);
         if (rc < 0) {
                 dev_warn(chip->parent, "Failed to convert %luus to cycles at %luHz: %d\n",
diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
index 2197368cc899..e60156ec0c18 100644
--- a/drivers/gpio/gpio-crystalcove.c
+++ b/drivers/gpio/gpio-crystalcove.c
@@ -90,8 +90,18 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)
 {
         int reg;
 
-        if (gpio == 94)
-                return GPIOPANELCTL;
+        if (gpio >= CRYSTALCOVE_GPIO_NUM) {
+                /*
+                 * Virtual GPIO called from ACPI, for now we only support
+                 * the panel ctl.
+                 */
+                switch (gpio) {
+                case 0x5e:
+                        return GPIOPANELCTL;
+                default:
+                        return -EOPNOTSUPP;
+                }
+        }
 
         if (reg_type == CTRL_IN) {
                 if (gpio < 8)
@@ -130,36 +140,36 @@ static void crystalcove_update_irq_ctrl(struct crystalcove_gpio *cg, int gpio)
 static int crystalcove_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_INPUT_SET);
+        return regmap_write(cg->regmap, reg, CTLO_INPUT_SET);
 }
 
 static int crystalcove_gpio_dir_out(struct gpio_chip *chip, unsigned gpio,
                                     int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_OUTPUT_SET | value);
+        return regmap_write(cg->regmap, reg, CTLO_OUTPUT_SET | value);
 }
 
 static int crystalcove_gpio_get(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
-        int ret;
         unsigned int val;
+        int ret, reg = to_reg(gpio, CTRL_IN);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        ret = regmap_read(cg->regmap, to_reg(gpio, CTRL_IN), &val);
+        ret = regmap_read(cg->regmap, reg, &val);
         if (ret)
                 return ret;
 
@@ -170,14 +180,15 @@ static void crystalcove_gpio_set(struct gpio_chip *chip,
                                  unsigned gpio, int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return;
 
         if (value)
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 1);
+                regmap_update_bits(cg->regmap, reg, 1, 1);
         else
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 0);
+                regmap_update_bits(cg->regmap, reg, 1, 0);
 }
 
 static int crystalcove_irq_type(struct irq_data *data, unsigned type)
@@ -185,6 +196,9 @@ static int crystalcove_irq_type(struct irq_data *data, unsigned type)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
+        if (data->hwirq >= CRYSTALCOVE_GPIO_NUM)
+                return 0;
+
         switch (type) {
         case IRQ_TYPE_NONE:
                 cg->intcnt_value = CTLI_INTCNT_DIS;
@@ -235,8 +249,10 @@ static void crystalcove_irq_unmask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = false;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = false;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static void crystalcove_irq_mask(struct irq_data *data)
@@ -244,8 +260,10 @@ static void crystalcove_irq_mask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = true;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = true;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static struct irq_chip crystalcove_irqchip = {
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 19a92efabbef..5104b6398139 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -747,7 +747,7 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
                 set = U32_MAX;
         else
                 return -EINVAL;
-        writel_relaxed(0, mvebu_gpioreg_blink_counter_select(mvchip));
+        writel_relaxed(set, mvebu_gpioreg_blink_counter_select(mvchip));
 
         mvpwm = devm_kzalloc(dev, sizeof(struct mvebu_pwm), GFP_KERNEL);
         if (!mvpwm)
@@ -768,6 +768,13 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
         mvpwm->chip.dev = dev;
         mvpwm->chip.ops = &mvebu_pwm_ops;
         mvpwm->chip.npwm = mvchip->chip.ngpio;
+        /*
+         * There may already be some PWM allocated, so we can't force
+         * mvpwm->chip.base to a fixed point like mvchip->chip.base.
+         * So, we let pwmchip_add() do the numbering and take the next free
+         * region.
+         */
+        mvpwm->chip.base = -1;
 
         spin_lock_init(&mvpwm->lock);
 
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 8be9719284b0..aa885a614e27 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -508,6 +508,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
                 bool has_connectors =
                         !!new_crtc_state->connector_mask;
 
+                WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
+
                 if (!drm_mode_equal(&old_crtc_state->mode, &new_crtc_state->mode)) {
                         DRM_DEBUG_ATOMIC("[CRTC:%d:%s] mode changed\n",
                                          crtc->base.id, crtc->name);
@@ -551,6 +553,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
         for_each_oldnew_connector_in_state(state, connector, old_connector_state, new_connector_state, i) {
                 const struct drm_connector_helper_funcs *funcs = connector->helper_private;
 
+                WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
+
                 /*
                  * This only sets crtc->connectors_changed for routing changes,
                  * drivers must set crtc->connectors_changed themselves when
@@ -650,6 +654,8 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
         for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
+                WARN_ON(!drm_modeset_is_locked(&plane->mutex));
+
                 funcs = plane->helper_private;
 
                 drm_atomic_helper_plane_changed(state, old_plane_state, new_plane_state, plane);
@@ -2663,7 +2669,12 @@ int drm_atomic_helper_resume(struct drm_device *dev,
 
         drm_modeset_acquire_init(&ctx, 0);
         while (1) {
+                err = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (err)
+                        goto out;
+
                 err = drm_atomic_helper_commit_duplicated_state(state, &ctx);
+out:
                 if (err != -EDEADLK)
                         break;
 
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index b5c6bb46a425..37b8ad3e30d8 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -358,7 +358,12 @@ EXPORT_SYMBOL(drm_put_dev);
 void drm_unplug_dev(struct drm_device *dev)
 {
         /* for a USB device */
-        drm_dev_unregister(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_modeset_unregister_all(dev);
+
+        drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 
         mutex_lock(&drm_global_mutex);
 
diff --git a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
index 5abc69c9630f..f77dcfaade6c 100644
--- a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
+++ b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
@@ -760,7 +760,7 @@ static int dsi_parse_dt(struct platform_device *pdev, struct dw_dsi *dsi)
          * Get the endpoint node. In our case, dsi has one output port1
          * to which the external HDMI bridge is connected.
          */
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, NULL, &dsi->bridge);
+        ret = drm_of_find_panel_or_bridge(np, 1, 0, NULL, &dsi->bridge);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index c994fe6e65b2..48428672fc6e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1235,6 +1235,15 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_fini;
 
         pci_set_drvdata(pdev, &dev_priv->drm);
+        /*
+         * Disable the system suspend direct complete optimization, which can
+         * leave the device suspended skipping the driver's suspend handlers
+         * if the device was already runtime suspended. This is needed due to
+         * the difference in our runtime and system suspend sequence and
+         * becaue the HDA driver may require us to enable the audio power
+         * domain during system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 
         ret = i915_driver_init_early(dev_priv, ent);
         if (ret < 0)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 963f6d4481f7..2c453a4e97d5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2991,6 +2991,16 @@ static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv)
         return false;
 }
 
+static inline bool
+intel_ggtt_update_needs_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        if (IS_BROXTON(dev_priv) && intel_iommu_gfx_mapped)
+                return true;
+#endif
+        return false;
+}
+
 int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                                 int enable_ppgtt);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b6ac3df18b58..462031cbd77f 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3298,6 +3298,10 @@ int i915_gem_wait_for_idle(struct drm_i915_private *i915, unsigned int flags)
 {
         int ret;
 
+        /* If the device is asleep, we have no requests outstanding */
+        if (!READ_ONCE(i915->gt.awake))
+                return 0;
+
         if (flags & I915_WAIT_LOCKED) {
                 struct i915_gem_timeline *tl;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 50b8f1139ff9..f1989b8792dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2191,6 +2191,101 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm,
                 gen8_set_pte(&gtt_base[i], scratch_pte);
 }
 
+static void bxt_vtd_ggtt_wa(struct i915_address_space *vm)
+{
+        struct drm_i915_private *dev_priv = vm->i915;
+
+        /*
+         * Make sure the internal GAM fifo has been cleared of all GTT
+         * writes before exiting stop_machine(). This guarantees that
+         * any aperture accesses waiting to start in another process
+         * cannot back up behind the GTT writes causing a hang.
+         * The register can be any arbitrary GAM register.
+         */
+        POSTING_READ(GFX_FLSH_CNTL_GEN6);
+}
+
+struct insert_page {
+        struct i915_address_space *vm;
+        dma_addr_t addr;
+        u64 offset;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_page__cb(void *_arg)
+{
+        struct insert_page *arg = _arg;
+
+        gen8_ggtt_insert_page(arg->vm, arg->addr, arg->offset, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_page__BKL(struct i915_address_space *vm,
+                                          dma_addr_t addr,
+                                          u64 offset,
+                                          enum i915_cache_level level,
+                                          u32 unused)
+{
+        struct insert_page arg = { vm, addr, offset, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_page__cb, &arg, NULL);
+}
+
+struct insert_entries {
+        struct i915_address_space *vm;
+        struct sg_table *st;
+        u64 start;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_entries__cb(void *_arg)
+{
+        struct insert_entries *arg = _arg;
+
+        gen8_ggtt_insert_entries(arg->vm, arg->st, arg->start, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_entries__BKL(struct i915_address_space *vm,
+                                             struct sg_table *st,
+                                             u64 start,
+                                             enum i915_cache_level level,
+                                             u32 unused)
+{
+        struct insert_entries arg = { vm, st, start, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_entries__cb, &arg, NULL);
+}
+
+struct clear_range {
+        struct i915_address_space *vm;
+        u64 start;
+        u64 length;
+};
+
+static int bxt_vtd_ggtt_clear_range__cb(void *_arg)
+{
+        struct clear_range *arg = _arg;
+
+        gen8_ggtt_clear_range(arg->vm, arg->start, arg->length);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_clear_range__BKL(struct i915_address_space *vm,
+                                          u64 start,
+                                          u64 length)
+{
+        struct clear_range arg = { vm, start, length };
+
+        stop_machine(bxt_vtd_ggtt_clear_range__cb, &arg, NULL);
+}
+
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                   u64 start, u64 length)
 {
@@ -2785,6 +2880,14 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
 
         ggtt->base.insert_entries = gen8_ggtt_insert_entries;
 
+        /* Serialize GTT updates with aperture access on BXT if VT-d is on. */
+        if (intel_ggtt_update_needs_vtd_wa(dev_priv)) {
+                ggtt->base.insert_entries = bxt_vtd_ggtt_insert_entries__BKL;
+                ggtt->base.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
+                if (ggtt->base.clear_range != nop_clear_range)
+                        ggtt->base.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+        }
+
         ggtt->invalidate = gen6_ggtt_invalidate;
 
         return ggtt_probe_common(ggtt, size);
@@ -2997,7 +3100,8 @@ void i915_ggtt_enable_guc(struct drm_i915_private *i915)
 
 void i915_ggtt_disable_guc(struct drm_i915_private *i915)
 {
-        i915->ggtt.invalidate = gen6_ggtt_invalidate;
+        if (i915->ggtt.invalidate == guc_ggtt_invalidate)
+                i915->ggtt.invalidate = gen6_ggtt_invalidate;
 }
 
 void i915_gem_restore_gtt_mappings(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index a0d6d4317a49..fb5231f98c0d 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -278,7 +278,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
                         obj->mm.quirked = false;
                 }
                 if (!i915_gem_object_is_tiled(obj)) {
-                        GEM_BUG_ON(!obj->mm.quirked);
+                        GEM_BUG_ON(obj->mm.quirked);
                         __i915_gem_object_pin_pages(obj);
                         obj->mm.quirked = true;
                 }
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index f87b0c4e564d..1a78363c7f4a 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -208,7 +208,7 @@ static const struct intel_device_info intel_ironlake_d_info = {
 static const struct intel_device_info intel_ironlake_m_info = {
         GEN5_FEATURES,
         .platform = INTEL_IRONLAKE,
-        .is_mobile = 1,
+        .is_mobile = 1, .has_fbc = 1,
 };
 
 #define GEN6_FEATURES \
@@ -390,7 +390,6 @@ static const struct intel_device_info intel_skylake_gt3_info = {
         .has_hw_contexts = 1, \
         .has_logical_ring_contexts = 1, \
         .has_guc = 1, \
-        .has_decoupled_mmio = 1, \
         .has_aliasing_ppgtt = 1, \
         .has_full_ppgtt = 1, \
         .has_full_48bit_ppgtt = 1, \
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3cabe52a4e3b..569717a12723 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -12203,6 +12203,15 @@ static void update_scanline_offset(struct intel_crtc *crtc)
          * type. For DP ports it behaves like most other platforms, but on HDMI
          * there's an extra 1 line difference. So we need to add two instead of
          * one to the value.
+         *
+         * On VLV/CHV DSI the scanline counter would appear to increment
+         * approx. 1/3 of a scanline before start of vblank. Unfortunately
+         * that means we can't tell whether we're in vblank or not while
+         * we're on that particular line. We must still set scanline_offset
+         * to 1 so that the vblank timestamps come out correct when we query
+         * the scanline counter from within the vblank interrupt handler.
+         * However if queried just before the start of vblank we'll get an
+         * answer that's slightly in the future.
          */
         if (IS_GEN2(dev_priv)) {
                 const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 854e8e0c836b..f94eacff196c 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1075,6 +1075,22 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
         return 0;
 }
 
+static bool ring_is_idle(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *dev_priv = engine->i915;
+        bool idle = true;
+
+        intel_runtime_pm_get(dev_priv);
+
+        /* No bit for gen2, so assume the CS parser is idle */
+        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+                idle = false;
+
+        intel_runtime_pm_put(dev_priv);
+
+        return idle;
+}
+
 /**
  * intel_engine_is_idle() - Report if the engine has finished process all work
  * @engine: the intel_engine_cs
@@ -1084,8 +1100,6 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
  */
 bool intel_engine_is_idle(struct intel_engine_cs *engine)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
-
         /* Any inflight/incomplete requests? */
         if (!i915_seqno_passed(intel_engine_get_seqno(engine),
                                intel_engine_last_submit(engine)))
@@ -1100,7 +1114,7 @@ bool intel_engine_is_idle(struct intel_engine_cs *engine)
                 return false;
 
         /* Ring stopped? */
-        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+        if (!ring_is_idle(engine))
                 return false;
 
         return true;
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index ded2add18b26..d93c58410bff 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -82,20 +82,10 @@ static unsigned int get_crtc_fence_y_offset(struct intel_crtc *crtc)
 static void intel_fbc_get_plane_source_size(struct intel_fbc_state_cache *cache,
                                             int *width, int *height)
 {
-        int w, h;
-
-        if (drm_rotation_90_or_270(cache->plane.rotation)) {
-                w = cache->plane.src_h;
-                h = cache->plane.src_w;
-        } else {
-                w = cache->plane.src_w;
-                h = cache->plane.src_h;
-        }
-
         if (width)
-                *width = w;
+                *width = cache->plane.src_w;
         if (height)
-                *height = h;
+                *height = cache->plane.src_h;
 }
 
 static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
@@ -746,6 +736,11 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                 cache->crtc.hsw_bdw_pixel_rate = crtc_state->pixel_rate;
 
         cache->plane.rotation = plane_state->base.rotation;
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         cache->plane.src_w = drm_rect_width(&plane_state->base.src) >> 16;
         cache->plane.src_h = drm_rect_height(&plane_state->base.src) >> 16;
         cache->plane.visible = plane_state->base.visible;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 570bd603f401..2ca481b5aa69 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4335,11 +4335,19 @@ skl_compute_wm(struct drm_atomic_state *state)
         struct drm_crtc_state *cstate;
         struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
         struct skl_wm_values *results = &intel_state->wm_results;
+        struct drm_device *dev = state->dev;
         struct skl_pipe_wm *pipe_wm;
         bool changed = false;
         int ret, i;
 
         /*
+         * When we distrust bios wm we always need to recompute to set the
+         * expected DDB allocations for each CRTC.
+         */
+        if (to_i915(dev)->wm.distrust_bios_wm)
+                changed = true;
+
+        /*
          * If this transaction isn't actually touching any CRTC's, don't
          * bother with watermark calculation.  Note that if we pass this
          * test, we're guaranteed to hold at least one CRTC state mutex,
@@ -4349,6 +4357,7 @@ skl_compute_wm(struct drm_atomic_state *state)
          */
         for_each_new_crtc_in_state(state, crtc, cstate, i)
                 changed = true;
+
         if (!changed)
                 return 0;
 
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index c3780d0d2baf..559f1ab42bfc 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -435,8 +435,9 @@ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
         }
 
         /* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
-        if (intel_crtc->config->pipe_src_w > 3200 ||
-                                intel_crtc->config->pipe_src_h > 2000) {
+        if (dev_priv->psr.psr2_support &&
+            (intel_crtc->config->pipe_src_w > 3200 ||
+             intel_crtc->config->pipe_src_h > 2000)) {
                 dev_priv->psr.psr2_support = false;
                 return false;
         }
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8c87c717c7cd..e6517edcd16b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -83,10 +83,13 @@ int intel_usecs_to_scanlines(const struct drm_display_mode *adjusted_mode,
  */
 void intel_pipe_update_start(struct intel_crtc *crtc)
 {
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
         const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
         long timeout = msecs_to_jiffies_timeout(1);
         int scanline, min, max, vblank_start;
         wait_queue_head_t *wq = drm_crtc_vblank_waitqueue(&crtc->base);
+        bool need_vlv_dsi_wa = (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+                intel_crtc_has_type(crtc->config, INTEL_OUTPUT_DSI);
         DEFINE_WAIT(wait);
 
         vblank_start = adjusted_mode->crtc_vblank_start;
@@ -139,6 +142,24 @@ void intel_pipe_update_start(struct intel_crtc *crtc)
 
         drm_crtc_vblank_put(&crtc->base);
 
+        /*
+         * On VLV/CHV DSI the scanline counter would appear to
+         * increment approx. 1/3 of a scanline before start of vblank.
+         * The registers still get latched at start of vblank however.
+         * This means we must not write any registers on the first
+         * line of vblank (since not the whole line is actually in
+         * vblank). And unfortunately we can't use the interrupt to
+         * wait here since it will fire too soon. We could use the
+         * frame start interrupt instead since it will fire after the
+         * critical scanline, but that would require more changes
+         * in the interrupt code. So for now we'll just do the nasty
+         * thing and poll for the bad scanline to pass us by.
+         *
+         * FIXME figure out if BXT+ DSI suffers from this as well
+         */
+        while (need_vlv_dsi_wa && scanline == vblank_start)
+                scanline = intel_get_crtc_scanline(crtc);
+
         crtc->debug.scanline_start = scanline;
         crtc->debug.start_vbl_time = ktime_get();
         crtc->debug.start_vbl_count = intel_crtc_get_vblank_counter(crtc);
diff --git a/drivers/gpu/drm/i915/intel_uc.h b/drivers/gpu/drm/i915/intel_uc.h
index 4b7f73aeddac..f84115261ae7 100644
--- a/drivers/gpu/drm/i915/intel_uc.h
+++ b/drivers/gpu/drm/i915/intel_uc.h
@@ -59,8 +59,6 @@ struct drm_i915_gem_request;
  *                available in the work queue (note, the queue is shared,
  *                not per-engine). It is OK for this to be nonzero, but
  *                it should not be huge!
- *   q_fail: failed to enqueue a work item. This should never happen,
- *           because we check for space beforehand.
  *   b_fail: failed to ring the doorbell. This should never happen, unless
  *           somehow the hardware misbehaves, or maybe if the GuC firmware
  *           crashes? We probably need to reset the GPU to recover.
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 8fb801fab039..8b05ecb8fdef 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -673,7 +673,7 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 ret = drm_of_find_panel_or_bridge(child,
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
-                if (ret)
+                if (ret && ret != -ENODEV)
                         return ret;
 
                 /* panel ddc only if there is no bridge */
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 808b995a990f..b5cc6e12334c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -19,6 +19,7 @@
 #include <drm/drm_of.h>
 #include <linux/clk.h>
 #include <linux/component.h>
+#include <linux/iopoll.h>
 #include <linux/irq.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -900,16 +901,12 @@ static int mtk_dsi_host_detach(struct mipi_dsi_host *host,
 
 static void mtk_dsi_wait_for_idle(struct mtk_dsi *dsi)
 {
-        u32 timeout_ms = 500000; /* total 1s ~ 2s timeout */
-
-        while (timeout_ms--) {
-                if (!(readl(dsi->regs + DSI_INTSTA) & DSI_BUSY))
-                        break;
-
-                usleep_range(2, 4);
-        }
+        int ret;
+        u32 val;
 
-        if (timeout_ms == 0) {
+        ret = readl_poll_timeout(dsi->regs + DSI_INTSTA, val, !(val & DSI_BUSY),
+                                 4, 2000000);
+        if (ret) {
                 DRM_WARN("polling dsi wait not busy timeout!\n");
 
                 mtk_dsi_enable(dsi);
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 41a1c03b0347..0a4ffd724146 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi,
         }
 
         err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
-        if (err) {
+        if (err < 0) {
                 dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
                         err);
                 return err;
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 75382f5f0fce..10b227d83e9a 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -152,7 +152,7 @@ static struct regmap_config meson_regmap_config = {
         .max_register   = 0x1000,
 };
 
-static int meson_drv_bind(struct device *dev)
+static int meson_drv_bind_master(struct device *dev, bool has_components)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct meson_drm *priv;
@@ -233,10 +233,12 @@ static int meson_drv_bind(struct device *dev)
         if (ret)
                 goto free_drm;
 
-        ret = component_bind_all(drm->dev, drm);
-        if (ret) {
-                dev_err(drm->dev, "Couldn't bind all components\n");
-                goto free_drm;
+        if (has_components) {
+                ret = component_bind_all(drm->dev, drm);
+                if (ret) {
+                        dev_err(drm->dev, "Couldn't bind all components\n");
+                        goto free_drm;
+                }
         }
 
         ret = meson_plane_create(priv);
@@ -276,6 +278,11 @@ free_drm:
         return ret;
 }
 
+static int meson_drv_bind(struct device *dev)
+{
+        return meson_drv_bind_master(dev, true);
+}
+
 static void meson_drv_unbind(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
@@ -357,6 +364,9 @@ static int meson_drv_probe(struct platform_device *pdev)
                 count += meson_probe_remote(pdev, &match, np, remote);
         }
 
+        if (count && !match)
+                return meson_drv_bind_master(&pdev->dev, false);
+
         /* If some endpoints were found, initialize the nodes */
         if (count) {
                 dev_info(&pdev->dev, "Queued %d outputs on vpu\n", count);
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
index 6a567fe347b3..820a4805916f 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
@@ -4,6 +4,7 @@
 
 struct nvkm_alarm {
         struct list_head head;
+        struct list_head exec;
         u64 timestamp;
         void (*func)(struct nvkm_alarm *);
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 36268e1802b5..15a13d09d431 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -80,7 +80,7 @@ int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
-int nouveau_runtime_pm = -1;
+static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
 
 static struct drm_driver driver_stub;
@@ -495,7 +495,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         nouveau_fbcon_init(dev);
         nouveau_led_init(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
@@ -527,7 +527,7 @@ nouveau_drm_unload(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_get_sync(dev->dev);
                 pm_runtime_forbid(dev->dev);
         }
@@ -726,6 +726,14 @@ nouveau_pmops_thaw(struct device *dev)
         return nouveau_do_resume(drm_dev, false);
 }
 
+bool
+nouveau_pmops_runtime()
+{
+        if (nouveau_runtime_pm == -1)
+                return nouveau_is_optimus() || nouveau_is_v1_dsm();
+        return nouveau_runtime_pm == 1;
+}
+
 static int
 nouveau_pmops_runtime_suspend(struct device *dev)
 {
@@ -733,14 +741,7 @@ nouveau_pmops_runtime_suspend(struct device *dev)
         struct drm_device *drm_dev = pci_get_drvdata(pdev);
         int ret;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
@@ -765,8 +766,10 @@ nouveau_pmops_runtime_resume(struct device *dev)
         struct nvif_device *device = &nouveau_drm(drm_dev)->client.device;
         int ret;
 
-        if (nouveau_runtime_pm == 0)
-                return -EINVAL;
+        if (!nouveau_pmops_runtime()) {
+                pm_runtime_forbid(dev);
+                return -EBUSY;
+        }
 
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
@@ -796,14 +799,7 @@ nouveau_pmops_runtime_idle(struct device *dev)
         struct nouveau_drm *drm = nouveau_drm(drm_dev);
         struct drm_crtc *crtc;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index eadec2f49ad3..a11b6aaed325 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -108,8 +108,6 @@ nouveau_cli(struct drm_file *fpriv)
 #include <nvif/object.h>
 #include <nvif/device.h>
 
-extern int nouveau_runtime_pm;
-
 struct nouveau_drm {
         struct nouveau_cli client;
         struct drm_device *dev;
@@ -195,6 +193,7 @@ nouveau_drm(struct drm_device *dev)
 
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
+bool nouveau_pmops_runtime(void);
 
 #include <nvkm/core/tegra.h>
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index a4aacbc0cec8..02fe0efb9e16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -87,7 +87,7 @@ void
 nouveau_vga_init(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         /* only relevant for PCI devices */
         if (!dev->pdev)
@@ -99,10 +99,6 @@ nouveau_vga_init(struct nouveau_drm *drm)
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
         vga_switcheroo_register_client(dev->pdev, &nouveau_switcheroo_ops, runtime);
 
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
@@ -113,18 +109,13 @@ void
 nouveau_vga_fini(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         vga_client_register(dev->pdev, NULL, NULL, NULL);
 
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
-
         vga_switcheroo_unregister_client(dev->pdev);
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
                 vga_switcheroo_fini_domain_pm_ops(drm->dev->dev);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index a7663249b3ba..06e564a9ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -2107,7 +2107,8 @@ nv50_head_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state)
                                         asyc->set.dither = true;
                         }
                 } else {
-                        asyc->set.mask = ~0;
+                        if (asyc)
+                                asyc->set.mask = ~0;
                         asyh->set.mask = ~0;
                 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
index f2a86eae0a0d..2437f7d41ca2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
                 /* Move to completed list.  We'll drop the lock before
                  * executing the callback so it can reschedule itself.
                  */
-                list_move_tail(&alarm->head, &exec);
+                list_del_init(&alarm->head);
+                list_add(&alarm->exec, &exec);
         }
 
         /* Shut down interrupt if no more pending alarms. */
@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
         spin_unlock_irqrestore(&tmr->lock, flags);
 
         /* Execute completed callbacks. */
-        list_for_each_entry_safe(alarm, atemp, &exec, head) {
-                list_del_init(&alarm->head);
+        list_for_each_entry_safe(alarm, atemp, &exec, exec) {
+                list_del(&alarm->exec);
                 alarm->func(alarm);
         }
 }
diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index d8fa7a9c9240..ce5f2d1f9994 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -245,8 +245,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
                                       struct drm_connector_state *conn_state)
 {
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc_state);
-        struct rockchip_dp_device *dp = to_dp(encoder);
-        int ret;
 
         /*
          * The hardware IC designed that VOP must output the RGB10 video
@@ -258,16 +256,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
 
         s->output_mode = ROCKCHIP_OUT_MODE_AAAA;
         s->output_type = DRM_MODE_CONNECTOR_eDP;
-        if (dp->data->chip_type == RK3399_EDP) {
-                /*
-                 * For RK3399, VOP Lit must code the out mode to RGB888,
-                 * VOP Big must code the out mode to RGB10.
-                 */
-                ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node,
-                                                        encoder);
-                if (ret > 0)
-                        s->output_mode = ROCKCHIP_OUT_MODE_P888;
-        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index a2169dd3d26b..14fa1f8351e8 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -615,7 +615,6 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 {
         struct cdn_dp_device *dp = encoder_to_dp(encoder);
         int ret, val;
-        struct rockchip_crtc_state *state;
 
         ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node, encoder);
         if (ret < 0) {
@@ -625,14 +624,10 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEV_DEBUG_KMS(dp->dev, "vop %s output to cdn-dp\n",
                           (ret) ? "LIT" : "BIG");
-        state = to_rockchip_crtc_state(encoder->crtc->state);
-        if (ret) {
+        if (ret)
                 val = DP_SEL_VOP_LIT | (DP_SEL_VOP_LIT << 16);
-                state->output_mode = ROCKCHIP_OUT_MODE_P888;
-        } else {
+        else
                 val = DP_SEL_VOP_LIT << 16;
-                state->output_mode = ROCKCHIP_OUT_MODE_AAAA;
-        }
 
         ret = cdn_dp_grf_write(dp, GRF_SOC_CON9, val);
         if (ret)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 3f7a82d1e095..45589d6ce65e 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -875,6 +875,7 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
 static void vop_crtc_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
+        const struct vop_data *vop_data = vop->data;
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc->state);
         struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
         u16 hsync_len = adjusted_mode->hsync_end - adjusted_mode->hsync_start;
@@ -967,6 +968,13 @@ static void vop_crtc_enable(struct drm_crtc *crtc)
                 DRM_DEV_ERROR(vop->dev, "unsupported connector_type [%d]\n",
                               s->output_type);
         }
+
+        /*
+         * if vop is not support RGB10 output, need force RGB10 to RGB888.
+         */
+        if (s->output_mode == ROCKCHIP_OUT_MODE_AAAA &&
+            !(vop_data->feature & VOP_FEATURE_OUTPUT_RGB10))
+                s->output_mode = ROCKCHIP_OUT_MODE_P888;
         VOP_CTRL_SET(vop, out_mode, s->output_mode);
 
         VOP_CTRL_SET(vop, htotal_pw, (htotal << 16) | hsync_len);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 5a4faa85dbd2..9979fd0c2282 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -142,6 +142,9 @@ struct vop_data {
         const struct vop_intr *intr;
         const struct vop_win_data *win;
         unsigned int win_size;
+
+#define VOP_FEATURE_OUTPUT_RGB10        BIT(0)
+        u64 feature;
 };
 
 /* interrupt define */
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index 0da44442aab0..bafd698a28b1 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -275,6 +275,7 @@ static const struct vop_intr rk3288_vop_intr = {
 static const struct vop_data rk3288_vop = {
         .init_table = rk3288_init_reg_table,
         .table_size = ARRAY_SIZE(rk3288_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3288_vop_intr,
         .ctrl = &rk3288_ctrl_data,
         .win = rk3288_vop_win_data,
@@ -343,6 +344,7 @@ static const struct vop_reg_data rk3399_init_reg_table[] = {
 static const struct vop_data rk3399_vop_big = {
         .init_table = rk3399_init_reg_table,
         .table_size = ARRAY_SIZE(rk3399_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3399_vop_intr,
         .ctrl = &rk3399_ctrl_data,
         /*
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 130d51c5ec6a..4b948fba9eec 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -41,9 +41,9 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
 
-#define VMWGFX_DRIVER_DATE "20170221"
+#define VMWGFX_DRIVER_DATE "20170607"
 #define VMWGFX_DRIVER_MAJOR 2
-#define VMWGFX_DRIVER_MINOR 12
+#define VMWGFX_DRIVER_MINOR 13
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index b6a0806b06bf..a1c68e6a689e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
                                 return fifo_state->static_buffer;
                         else {
                                 fifo_state->dynamic_buffer = vmalloc(bytes);
+                                if (!fifo_state->dynamic_buffer)
+                                        goto out_err;
                                 return fifo_state->dynamic_buffer;
                         }
                 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ef9f3a2a4030..1d2db5d912b0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -274,108 +274,6 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 }
 
 
-
-/**
- * vmw_du_cursor_plane_update() - Update cursor image and location
- *
- * @plane: plane object to update
- * @crtc: owning CRTC of @plane
- * @fb: framebuffer to flip onto plane
- * @crtc_x: x offset of plane on crtc
- * @crtc_y: y offset of plane on crtc
- * @crtc_w: width of plane rectangle on crtc
- * @crtc_h: height of plane rectangle on crtc
- * @src_x: Not used
- * @src_y: Not used
- * @src_w: Not used
- * @src_h: Not used
- *
- *
- * RETURNS:
- * Zero on success, error code on failure
- */
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h)
-{
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-        struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
-        struct vmw_surface *surface = NULL;
-        struct vmw_dma_buffer *dmabuf = NULL;
-        s32 hotspot_x, hotspot_y;
-        int ret;
-
-        hotspot_x = du->hotspot_x + fb->hot_x;
-        hotspot_y = du->hotspot_y + fb->hot_y;
-
-        /* A lot of the code assumes this */
-        if (crtc_w != 64 || crtc_h != 64) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (vmw_framebuffer_to_vfb(fb)->dmabuf)
-                dmabuf = vmw_framebuffer_to_vfbd(fb)->buffer;
-        else
-                surface = vmw_framebuffer_to_vfbs(fb)->surface;
-
-        if (surface && !surface->snooper.image) {
-                DRM_ERROR("surface not suitable for cursor\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* setup new image */
-        ret = 0;
-        if (surface) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_surface = surface;
-
-                du->cursor_age = du->cursor_surface->snooper.age;
-
-                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                              64, 64, hotspot_x, hotspot_y);
-        } else if (dmabuf) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_dmabuf = dmabuf;
-
-                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, crtc_w, crtc_h,
-                                               hotspot_x, hotspot_y);
-        } else {
-                vmw_cursor_update_position(dev_priv, false, 0, 0);
-                goto out;
-        }
-
-        if (!ret) {
-                du->cursor_x = crtc_x + du->set_gui_x;
-                du->cursor_y = crtc_y + du->set_gui_y;
-
-                vmw_cursor_update_position(dev_priv, true,
-                                           du->cursor_x + hotspot_x,
-                                           du->cursor_y + hotspot_y);
-        }
-
-out:
-        return ret;
-}
-
-
-int vmw_du_cursor_plane_disable(struct drm_plane *plane)
-{
-        if (plane->fb) {
-                drm_framebuffer_unreference(plane->fb);
-                plane->fb = NULL;
-        }
-
-        return -EINVAL;
-}
-
-
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane)
 {
         vmw_cursor_update_position(plane->dev->dev_private, false, 0, 0);
@@ -473,18 +371,6 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
 
 
 void
-vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                   struct drm_plane_state *old_state)
-{
-        struct drm_crtc *crtc = plane->state->crtc ?: old_state->crtc;
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-
-        drm_atomic_set_fb_for_plane(plane->state, NULL);
-        vmw_cursor_update_position(dev_priv, false, 0, 0);
-}
-
-
-void
 vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                   struct drm_plane_state *old_state)
 {
@@ -1498,6 +1384,7 @@ vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
          */
         if (vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)  &&
             dmabuf && only_2d &&
+            mode_cmd->width > 64 &&  /* Don't create a proxy for cursor */
             dev_priv->active_display_unit == vmw_du_screen_target) {
                 ret = vmw_create_dmabuf_proxy(dev_priv->dev, mode_cmd,
                                               dmabuf, &surface);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 13f2f1d2818a..5f8d678ae675 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -256,10 +256,6 @@ int vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                            u16 *r, u16 *g, u16 *b,
                            uint32_t size,
                            struct drm_modeset_acquire_ctx *ctx);
-int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
-                            uint32_t handle, uint32_t width, uint32_t height,
-                            int32_t hot_x, int32_t hot_y);
-int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_set_property(struct drm_connector *connector,
                                   struct drm_property *property,
                                   uint64_t val);
@@ -339,15 +335,6 @@ void vmw_kms_create_implicit_placement_property(struct vmw_private *dev_priv,
 /* Universal Plane Helpers */
 void vmw_du_primary_plane_destroy(struct drm_plane *plane);
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane);
-int vmw_du_cursor_plane_disable(struct drm_plane *plane);
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h);
 
 /* Atomic Helpers */
 int vmw_du_primary_plane_atomic_check(struct drm_plane *plane,
@@ -356,8 +343,6 @@ int vmw_du_cursor_plane_atomic_check(struct drm_plane *plane,
                                      struct drm_plane_state *state);
 void vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                        struct drm_plane_state *old_state);
-void vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                        struct drm_plane_state *old_state);
 int vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
                                    struct drm_plane_state *new_state);
 void vmw_du_plane_cleanup_fb(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index bad31bdf09b6..50be1f034f9e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -56,6 +56,8 @@ enum stdu_content_type {
  * @right: Right side of bounding box.
  * @top: Top side of bounding box.
  * @bottom: Bottom side of bounding box.
+ * @fb_left: Left side of the framebuffer/content bounding box
+ * @fb_top: Top of the framebuffer/content bounding box
  * @buf: DMA buffer when DMA-ing between buffer and screen targets.
  * @sid: Surface ID when copying between surface and screen targets.
  */
@@ -63,6 +65,7 @@ struct vmw_stdu_dirty {
         struct vmw_kms_dirty base;
         SVGA3dTransferType  transfer;
         s32 left, right, top, bottom;
+        s32 fb_left, fb_top;
         u32 pitch;
         union {
                 struct vmw_dma_buffer *buf;
@@ -647,7 +650,7 @@ static void vmw_stdu_dmabuf_fifo_commit(struct vmw_kms_dirty *dirty)
  *
  * @dirty: The closure structure.
  *
- * This function calculates the bounding box for all the incoming clips
+ * This function calculates the bounding box for all the incoming clips.
  */
 static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 {
@@ -656,11 +659,19 @@ static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 
         dirty->num_hits = 1;
 
-        /* Calculate bounding box */
+        /* Calculate destination bounding box */
         ddirty->left = min_t(s32, ddirty->left, dirty->unit_x1);
         ddirty->top = min_t(s32, ddirty->top, dirty->unit_y1);
         ddirty->right = max_t(s32, ddirty->right, dirty->unit_x2);
         ddirty->bottom = max_t(s32, ddirty->bottom, dirty->unit_y2);
+
+        /*
+         * Calculate content bounding box.  We only need the top-left
+         * coordinate because width and height will be the same as the
+         * destination bounding box above
+         */
+        ddirty->fb_left = min_t(s32, ddirty->fb_left, dirty->fb_x);
+        ddirty->fb_top  = min_t(s32, ddirty->fb_top, dirty->fb_y);
 }
 
 
@@ -697,11 +708,11 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
         src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
         src = ttm_kmap_obj_virtual(&stdu->host_map, &not_used);
-        src += dirty->unit_y1 * src_pitch + dirty->unit_x1 * stdu->cpp;
+        src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
 
         dst_pitch = ddirty->pitch;
         dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used);
-        dst += dirty->fb_y * dst_pitch + dirty->fb_x * stdu->cpp;
+        dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
 
 
         /* Figure out the real direction */
@@ -760,7 +771,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         }
 
 out_cleanup:
-        ddirty->left = ddirty->top = S32_MAX;
+        ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
         ddirty->right = ddirty->bottom = S32_MIN;
 }
 
@@ -812,6 +823,7 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
                 SVGA3D_READ_HOST_VRAM;
         ddirty.left = ddirty.top = S32_MAX;
         ddirty.right = ddirty.bottom = S32_MIN;
+        ddirty.fb_left = ddirty.fb_top = S32_MAX;
         ddirty.pitch = vfb->base.pitches[0];
         ddirty.buf = buf;
         ddirty.base.fifo_commit = vmw_stdu_dmabuf_fifo_commit;
@@ -1355,6 +1367,11 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
                 DRM_ERROR("Failed to bind surface to STDU.\n");
         else
                 crtc->primary->fb = plane->state->fb;
+
+        ret = vmw_stdu_update_st(dev_priv, stdu);
+
+        if (ret)
+                DRM_ERROR("Failed to update STDU.\n");
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 7681341fe32b..6b70bd259953 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1274,11 +1274,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
         int ret;
         uint32_t size;
-        uint32_t backup_handle;
+        uint32_t backup_handle = 0;
 
         if (req->multisample_count != 0)
                 return -EINVAL;
 
+        if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+                return -EINVAL;
+
         if (unlikely(vmw_user_surface_size == 0))
                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
                         128;
@@ -1314,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
                 ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
                                              &res->backup,
                                              &user_srf->backup_base);
-                if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
-                    res->backup_size) {
-                        DRM_ERROR("Surface backup buffer is too small.\n");
-                        vmw_dmabuf_unreference(&res->backup);
-                        ret = -EINVAL;
-                        goto out_unlock;
+                if (ret == 0) {
+                        if (res->backup->base.num_pages * PAGE_SIZE <
+                            res->backup_size) {
+                                DRM_ERROR("Surface backup buffer is too small.\n");
+                                vmw_dmabuf_unreference(&res->backup);
+                                ret = -EINVAL;
+                                goto out_unlock;
+                        } else {
+                                backup_handle = req->buffer_handle;
+                        }
                 }
         } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
                 ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1491,7 +1498,7 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
                                  dev_priv->stdu_max_height);
 
                 if (size.width > max_width || size.height > max_height) {
-                        DRM_ERROR("%ux%u\n, exeeds max surface size %ux%u",
+                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                   size.width, size.height,
                                   max_width, max_height);
                         return -EINVAL;
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 16d556816b5f..2fb5f432a54c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -725,15 +725,16 @@ void ipu_set_ic_src_mux(struct ipu_soc *ipu, int csi_id, bool vdi)
         spin_lock_irqsave(&ipu->lock, flags);
 
         val = ipu_cm_read(ipu, IPU_CONF);
-        if (vdi) {
+        if (vdi)
                 val |= IPU_CONF_IC_INPUT;
-        } else {
+        else
                 val &= ~IPU_CONF_IC_INPUT;
-                if (csi_id == 1)
-                        val |= IPU_CONF_CSI_SEL;
-                else
-                        val &= ~IPU_CONF_CSI_SEL;
-        }
+
+        if (csi_id == 1)
+                val |= IPU_CONF_CSI_SEL;
+        else
+                val &= ~IPU_CONF_CSI_SEL;
+
         ipu_cm_write(ipu, val, IPU_CONF);
 
         spin_unlock_irqrestore(&ipu->lock, flags);
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c55563379e2e..c35f74c83065 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -131,8 +131,6 @@ int ipu_pre_get(struct ipu_pre *pre)
         if (pre->in_use)
                 return -EBUSY;
 
-        clk_prepare_enable(pre->clk_axi);
-
         /* first get the engine out of reset and remove clock gating */
         writel(0, pre->regs + IPU_PRE_CTRL);
 
@@ -149,12 +147,7 @@ int ipu_pre_get(struct ipu_pre *pre)
 
 void ipu_pre_put(struct ipu_pre *pre)
 {
-        u32 val;
-
-        val = IPU_PRE_CTRL_SFTRST | IPU_PRE_CTRL_CLKGATE;
-        writel(val, pre->regs + IPU_PRE_CTRL);
-
-        clk_disable_unprepare(pre->clk_axi);
+        writel(IPU_PRE_CTRL_SFTRST, pre->regs + IPU_PRE_CTRL);
 
         pre->in_use = false;
 }
@@ -249,6 +242,8 @@ static int ipu_pre_probe(struct platform_device *pdev)
         if (!pre->buffer_virt)
                 return -ENOMEM;
 
+        clk_prepare_enable(pre->clk_axi);
+
         pre->dev = dev;
         platform_set_drvdata(pdev, pre);
         mutex_lock(&ipu_pre_list_mutex);
@@ -268,6 +263,8 @@ static int ipu_pre_remove(struct platform_device *pdev)
         available_pres--;
         mutex_unlock(&ipu_pre_list_mutex);
 
+        clk_disable_unprepare(pre->clk_axi);
+
         if (pre->buffer_virt)
                 gen_pool_free(pre->iram, (unsigned long)pre->buffer_virt,
                               IPU_PRE_MAX_WIDTH * IPU_PRE_NUM_SCANLINES * 4);
diff --git a/drivers/iio/adc/bcm_iproc_adc.c b/drivers/iio/adc/bcm_iproc_adc.c
index 21d38c8af21e..7f4f9c4150e3 100644
--- a/drivers/iio/adc/bcm_iproc_adc.c
+++ b/drivers/iio/adc/bcm_iproc_adc.c
@@ -143,7 +143,7 @@ static void iproc_adc_reg_dump(struct iio_dev *indio_dev)
         iproc_adc_dbg_reg(dev, adc_priv, IPROC_SOFT_BYPASS_DATA);
 }
 
-static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
 {
         u32 channel_intr_status;
         u32 intr_status;
@@ -167,7 +167,7 @@ static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
         return IRQ_NONE;
 }
 
-static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
 {
         irqreturn_t retval = IRQ_NONE;
         struct iproc_adc_priv *adc_priv;
@@ -181,7 +181,7 @@ static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
         adc_priv = iio_priv(indio_dev);
 
         regmap_read(adc_priv->regmap, IPROC_INTERRUPT_STATUS, &intr_status);
-        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_thread(),INTRPT_STS:%x\n",
+        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_handler(),INTRPT_STS:%x\n",
                         intr_status);
 
         intr_channels = (intr_status & IPROC_ADC_INTR_MASK) >> IPROC_ADC_INTR;
@@ -566,8 +566,8 @@ static int iproc_adc_probe(struct platform_device *pdev)
         }
 
         ret = devm_request_threaded_irq(&pdev->dev, adc_priv->irqno,
-                                iproc_adc_interrupt_thread,
                                 iproc_adc_interrupt_handler,
+                                iproc_adc_interrupt_thread,
                                 IRQF_SHARED, "iproc-adc", indio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq error %d\n", ret);
diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index ec82106480e1..b0526e4b9530 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -438,10 +438,10 @@ static ssize_t max9611_shunt_resistor_show(struct device *dev,
         struct max9611_dev *max9611 = iio_priv(dev_to_iio_dev(dev));
         unsigned int i, r;
 
-        i = max9611->shunt_resistor_uohm / 1000;
-        r = max9611->shunt_resistor_uohm % 1000;
+        i = max9611->shunt_resistor_uohm / 1000000;
+        r = max9611->shunt_resistor_uohm % 1000000;
 
-        return sprintf(buf, "%u.%03u\n", i, r);
+        return sprintf(buf, "%u.%06u\n", i, r);
 }
 
 static IIO_DEVICE_ATTR(in_power_shunt_resistor, 0444,
@@ -536,8 +536,8 @@ static int max9611_probe(struct i2c_client *client,
         int ret;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*max9611));
-        if (IS_ERR(indio_dev))
-                return PTR_ERR(indio_dev);
+        if (!indio_dev)
+                return -ENOMEM;
 
         i2c_set_clientdata(client, indio_dev);
 
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index b23527309088..81d4c39e414a 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -105,6 +105,8 @@ struct sun4i_gpadc_iio {
         bool                            no_irq;
         /* prevents concurrent reads of temperature and ADC */
         struct mutex                    mutex;
+        struct thermal_zone_device      *tzd;
+        struct device                   *sensor_device;
 };
 
 #define SUN4I_GPADC_ADC_CHANNEL(_channel, _name) {              \
@@ -502,7 +504,6 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
 {
         struct sun4i_gpadc_iio *info = iio_priv(indio_dev);
         const struct of_device_id *of_dev;
-        struct thermal_zone_device *tzd;
         struct resource *mem;
         void __iomem *base;
         int ret;
@@ -532,13 +533,14 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
         if (!IS_ENABLED(CONFIG_THERMAL_OF))
                 return 0;
 
-        tzd = devm_thermal_zone_of_sensor_register(&pdev->dev, 0, info,
-                                                   &sun4i_ts_tz_ops);
-        if (IS_ERR(tzd))
+        info->sensor_device = &pdev->dev;
+        info->tzd = thermal_zone_of_sensor_register(info->sensor_device, 0,
+                                                    info, &sun4i_ts_tz_ops);
+        if (IS_ERR(info->tzd))
                 dev_err(&pdev->dev, "could not register thermal sensor: %ld\n",
-                        PTR_ERR(tzd));
+                        PTR_ERR(info->tzd));
 
-        return PTR_ERR_OR_ZERO(tzd);
+        return PTR_ERR_OR_ZERO(info->tzd);
 }
 
 static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
@@ -584,15 +586,15 @@ static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
                  * of_node, and the device from this driver as third argument to
                  * return the temperature.
                  */
-                struct thermal_zone_device *tzd;
-                tzd = devm_thermal_zone_of_sensor_register(pdev->dev.parent, 0,
-                                                           info,
-                                                           &sun4i_ts_tz_ops);
-                if (IS_ERR(tzd)) {
+                info->sensor_device = pdev->dev.parent;
+                info->tzd = thermal_zone_of_sensor_register(info->sensor_device,
+                                                            0, info,
+                                                            &sun4i_ts_tz_ops);
+                if (IS_ERR(info->tzd)) {
                         dev_err(&pdev->dev,
                                 "could not register thermal sensor: %ld\n",
-                                PTR_ERR(tzd));
-                        return PTR_ERR(tzd);
+                                PTR_ERR(info->tzd));
+                        return PTR_ERR(info->tzd);
                 }
         } else {
                 indio_dev->num_channels =
@@ -688,7 +690,13 @@ static int sun4i_gpadc_remove(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        if (!info->no_irq && IS_ENABLED(CONFIG_THERMAL_OF))
+
+        if (!IS_ENABLED(CONFIG_THERMAL_OF))
+                return 0;
+
+        thermal_zone_of_sensor_unregister(info->sensor_device, info->tzd);
+
+        if (!info->no_irq)
                 iio_map_array_unregister(indio_dev);
 
         return 0;
@@ -700,6 +708,7 @@ static const struct platform_device_id sun4i_gpadc_id[] = {
         { "sun6i-a31-gpadc-iio", (kernel_ulong_t)&sun6i_gpadc_data },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(platform, sun4i_gpadc_id);
 
 static struct platform_driver sun4i_gpadc_driver = {
         .driver = {
@@ -711,6 +720,7 @@ static struct platform_driver sun4i_gpadc_driver = {
         .probe = sun4i_gpadc_probe,
         .remove = sun4i_gpadc_remove,
 };
+MODULE_DEVICE_TABLE(of, sun4i_gpadc_of_id);
 
 module_platform_driver(sun4i_gpadc_driver);
 
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 4282ceca3d8f..6cbed7eb118a 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev));
+        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
         if (indio_dev == NULL) {
                 dev_err(&pdev->dev, "failed to allocate iio device\n");
                 return -ENOMEM;
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 978e1592c2a3..4061fed93f1f 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -451,7 +451,8 @@ static ssize_t iio_trigger_write_current(struct device *dev,
         return len;
 
 out_trigger_put:
-        iio_trigger_put(trig);
+        if (trig)
+                iio_trigger_put(trig);
         return ret;
 }
 
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index b30e0c1c6cc4..67838edd8b37 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -74,9 +74,9 @@ static const int int_time_mapping[] = {100000, 50000, 200000, 400000};
 static const struct reg_field reg_field_it =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 3, 4);
 static const struct reg_field reg_field_als_intr =
-                                REG_FIELD(LTR501_INTR, 0, 0);
-static const struct reg_field reg_field_ps_intr =
                                 REG_FIELD(LTR501_INTR, 1, 1);
+static const struct reg_field reg_field_ps_intr =
+                                REG_FIELD(LTR501_INTR, 0, 0);
 static const struct reg_field reg_field_als_rate =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 0, 2);
 static const struct reg_field reg_field_ps_rate =
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index ddf9bee89f77..aa4df0dcc8c9 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -40,9 +40,9 @@
 #define AS3935_AFE_PWR_BIT      BIT(0)
 
 #define AS3935_INT              0x03
-#define AS3935_INT_MASK         0x07
+#define AS3935_INT_MASK         0x0f
 #define AS3935_EVENT_INT        BIT(3)
-#define AS3935_NOISE_INT        BIT(1)
+#define AS3935_NOISE_INT        BIT(0)
 
 #define AS3935_DATA             0x07
 #define AS3935_DATA_MASK        0x3F
@@ -215,7 +215,7 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 
         st->buffer[0] = val & AS3935_DATA_MASK;
         iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
-                                           pf->timestamp);
+                                           iio_get_time_ns(indio_dev));
 err_read:
         iio_trigger_notify_done(indio_dev->trig);
 
@@ -244,7 +244,7 @@ static void as3935_event_work(struct work_struct *work)
 
         switch (val) {
         case AS3935_EVENT_INT:
-                iio_trigger_poll(st->trig);
+                iio_trigger_poll_chained(st->trig);
                 break;
         case AS3935_NOISE_INT:
                 dev_warn(&st->spi->dev, "noise level is too high\n");
@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private)
 
 static void calibrate_as3935(struct as3935_state *st)
 {
-        mutex_lock(&st->lock);
-
         /* mask disturber interrupt bit */
         as3935_write(st, AS3935_INT, BIT(5));
 
@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as3935_state *st)
 
         mdelay(2);
         as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
-
-        mutex_unlock(&st->lock);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -318,6 +314,8 @@ static int as3935_resume(struct device *dev)
         val &= ~AS3935_AFE_PWR_BIT;
         ret = as3935_write(st, AS3935_AFE_GAIN, val);
 
+        calibrate_as3935(st);
+
 err_resume:
         mutex_unlock(&st->lock);
 
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index e73d968023f7..f1fa1f172107 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,8 +1118,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E546   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
+ * Fujitsu LIFEBOOK E557   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
@@ -1525,6 +1527,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E546  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -1546,6 +1555,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/input/rmi4/rmi_f03.c b/drivers/input/rmi4/rmi_f03.c
index 77dad045a468..ad71a5e768dc 100644
--- a/drivers/input/rmi4/rmi_f03.c
+++ b/drivers/input/rmi4/rmi_f03.c
@@ -146,7 +146,7 @@ static int rmi_f03_register_pt(struct f03_data *f03)
         if (!serio)
                 return -ENOMEM;
 
-        serio->id.type = SERIO_8042;
+        serio->id.type = SERIO_PS_PSTHRU;
         serio->write = rmi_f03_pt_write;
         serio->port_data = f03;
 
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index 9f44ee8ea1bc..19779b88a479 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -118,6 +118,7 @@ static const struct iommu_ops
 
         ops = iommu_ops_from_fwnode(fwnode);
         if ((ops && !ops->of_xlate) ||
+            !of_device_is_available(iommu_spec->np) ||
             (!ops && !of_iommu_driver_present(iommu_spec->np)))
                 return NULL;
 
@@ -236,6 +237,12 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
                         ops = ERR_PTR(err);
         }
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index bb3ac5fe5846..72a391e01011 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -142,7 +142,7 @@ static struct irq_chip xtensa_mx_irq_chip = {
 int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_mx_irq_domain_ops,
                                 &xtensa_mx_irq_chip);
         irq_set_default_host(root_domain);
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index 472ae1770964..f728755fa292 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -89,7 +89,7 @@ static struct irq_chip xtensa_irq_chip = {
 int __init xtensa_pic_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_irq_domain_ops, &xtensa_irq_chip);
         irq_set_default_host(root_domain);
         return 0;
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index d07dd5196ffc..8aa158a09180 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
                        id);
                 return NULL;
         } else {
-                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
                 if (!rs)
                         return NULL;
                 rs->state = CCPResetIdle;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 8b7faea2ddf8..422dced7c90a 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -75,7 +75,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
                 if (sk->sk_state != MISDN_BOUND)
                         continue;
                 if (!cskb)
-                        cskb = skb_copy(skb, GFP_KERNEL);
+                        cskb = skb_copy(skb, GFP_ATOMIC);
                 if (!cskb) {
                         printk(KERN_WARNING "%s no skb\n", __func__);
                         break;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 212a6777ff31..87edc342ccb3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5174,6 +5174,18 @@ static void mddev_delayed_delete(struct work_struct *ws)
 
 static void no_op(struct percpu_ref *r) {}
 
+int mddev_init_writes_pending(struct mddev *mddev)
+{
+        if (mddev->writes_pending.percpu_count_ptr)
+                return 0;
+        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
+                return -ENOMEM;
+        /* We want to start with the refcount at zero */
+        percpu_ref_put(&mddev->writes_pending);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_init_writes_pending);
+
 static int md_alloc(dev_t dev, char *name)
 {
         /*
@@ -5239,10 +5251,6 @@ static int md_alloc(dev_t dev, char *name)
         blk_queue_make_request(mddev->queue, md_make_request);
         blk_set_stacking_limits(&mddev->queue->limits);
 
-        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
-                goto abort;
-        /* We want to start with the refcount at zero */
-        percpu_ref_put(&mddev->writes_pending);
         disk = alloc_disk(1 << shift);
         if (!disk) {
                 blk_cleanup_queue(mddev->queue);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 11f15146ce51..0fa1de42c42b 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -648,6 +648,7 @@ extern void md_unregister_thread(struct md_thread **threadp);
 extern void md_wakeup_thread(struct md_thread *thread);
 extern void md_check_recovery(struct mddev *mddev);
 extern void md_reap_sync_thread(struct mddev *mddev);
+extern int mddev_init_writes_pending(struct mddev *mddev);
 extern void md_write_start(struct mddev *mddev, struct bio *bi);
 extern void md_write_inc(struct mddev *mddev, struct bio *bi);
 extern void md_write_end(struct mddev *mddev);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index af5056d56878..e1a7e3d4c5e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3063,6 +3063,8 @@ static int raid1_run(struct mddev *mddev)
                         mdname(mddev));
                 return -EIO;
         }
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
         /*
          * copy the already verified devices into our private RAID1
          * bookkeeping area. [whatever we allocate in run(),
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4343d7ff9916..797ed60abd5e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3611,6 +3611,9 @@ static int raid10_run(struct mddev *mddev)
         int first = 1;
         bool discard_supported = false;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->private == NULL) {
                 conf = setup_conf(mddev);
                 if (IS_ERR(conf))
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 722064689e82..ec0f951ae19f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7118,6 +7118,9 @@ static int raid5_run(struct mddev *mddev)
         long long min_offset_diff = 0;
         int first = 1;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->recovery_cp != MaxSector)
                 pr_notice("md/raid:%s: not clean -- starting background reconstruction\n",
                           mdname(mddev));
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index b72edd27f880..55d9c2b82b7e 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -2,6 +2,12 @@
 # Multimedia device configuration
 #
 
+config CEC_CORE
+        tristate
+
+config CEC_NOTIFIER
+        bool
+
 menuconfig MEDIA_SUPPORT
         tristate "Multimedia support"
         depends on HAS_IOMEM
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 523fea3648ad..044503aa8801 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -4,8 +4,6 @@
 
 media-objs      := media-device.o media-devnode.o media-entity.o
 
-obj-$(CONFIG_CEC_CORE) += cec/
-
 #
 # I2C drivers should come before other drivers, otherwise they'll fail
 # when compiled as builtin drivers
@@ -26,6 +24,8 @@ obj-$(CONFIG_DVB_CORE)  += dvb-core/
 # There are both core and drivers at RC subtree - merge before drivers
 obj-y += rc/
 
+obj-$(CONFIG_CEC_CORE) += cec/
+
 #
 # Finally, merge the drivers that require the core
 #
diff --git a/drivers/media/cec/Kconfig b/drivers/media/cec/Kconfig
index f944d93e3167..4e25a950ae6f 100644
--- a/drivers/media/cec/Kconfig
+++ b/drivers/media/cec/Kconfig
@@ -1,19 +1,5 @@
-config CEC_CORE
-        tristate
-        depends on MEDIA_CEC_SUPPORT
-        default y
-
-config MEDIA_CEC_NOTIFIER
-        bool
-
 config MEDIA_CEC_RC
         bool "HDMI CEC RC integration"
         depends on CEC_CORE && RC_CORE
         ---help---
           Pass on CEC remote control messages to the RC framework.
-
-config MEDIA_CEC_DEBUG
-        bool "HDMI CEC debugfs interface"
-        depends on CEC_CORE && DEBUG_FS
-        ---help---
-          Turns on the DebugFS interface for CEC devices.
diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
index 402a6c62a3e8..eaf408e64669 100644
--- a/drivers/media/cec/Makefile
+++ b/drivers/media/cec/Makefile
@@ -1,6 +1,6 @@
 cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
 
-ifeq ($(CONFIG_MEDIA_CEC_NOTIFIER),y)
+ifeq ($(CONFIG_CEC_NOTIFIER),y)
   cec-objs += cec-notifier.o
 endif
 
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index f5fe01c9da8a..9dfc79800c71 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1864,7 +1864,7 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
 }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
 /*
  * Log the current state of the CEC adapter.
  * Very useful for debugging.
diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index f9ebff90f8eb..2f87748ba4fc 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -187,7 +187,7 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
         put_device(&devnode->dev);
 }
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 static void cec_cec_notify(struct cec_adapter *adap, u16 pa)
 {
         cec_s_phys_addr(adap, pa, false);
@@ -323,7 +323,7 @@ int cec_register_adapter(struct cec_adapter *adap,
         }
 
         dev_set_drvdata(&adap->devnode.dev, adap);
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         if (!top_cec_dir)
                 return 0;
 
@@ -355,7 +355,7 @@ void cec_unregister_adapter(struct cec_adapter *adap)
         adap->rc = NULL;
 #endif
         debugfs_remove_recursive(adap->cec_dir);
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         if (adap->notifier)
                 cec_notifier_unregister(adap->notifier);
 #endif
@@ -395,7 +395,7 @@ static int __init cec_devnode_init(void)
                 return ret;
         }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         top_cec_dir = debugfs_create_dir("cec", NULL);
         if (IS_ERR_OR_NULL(top_cec_dir)) {
                 pr_warn("cec: Failed to create debugfs cec dir\n");
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index fd181c99ce11..aaa9471c7d11 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -220,7 +220,8 @@ config VIDEO_ADV7604
 
 config VIDEO_ADV7604_CEC
         bool "Enable Analog Devices ADV7604 CEC support"
-        depends on VIDEO_ADV7604 && CEC_CORE
+        depends on VIDEO_ADV7604
+        select CEC_CORE
         ---help---
           When selected the adv7604 will support the optional
           HDMI CEC feature.
@@ -240,7 +241,8 @@ config VIDEO_ADV7842
 
 config VIDEO_ADV7842_CEC
         bool "Enable Analog Devices ADV7842 CEC support"
-        depends on VIDEO_ADV7842 && CEC_CORE
+        depends on VIDEO_ADV7842
+        select CEC_CORE
         ---help---
           When selected the adv7842 will support the optional
           HDMI CEC feature.
@@ -478,7 +480,8 @@ config VIDEO_ADV7511
 
 config VIDEO_ADV7511_CEC
         bool "Enable Analog Devices ADV7511 CEC support"
-        depends on VIDEO_ADV7511 && CEC_CORE
+        depends on VIDEO_ADV7511
+        select CEC_CORE
         ---help---
           When selected the adv7511 will support the optional
           HDMI CEC feature.
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index ac026ee1ca07..041cb80a26b1 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -501,8 +501,9 @@ if CEC_PLATFORM_DRIVERS
 
 config VIDEO_SAMSUNG_S5P_CEC
        tristate "Samsung S5P CEC driver"
-       depends on CEC_CORE && (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for Samsung S5P HDMI CEC interface. It uses the
          generic CEC framework interface.
@@ -511,8 +512,9 @@ config VIDEO_SAMSUNG_S5P_CEC
 
 config VIDEO_STI_HDMI_CEC
        tristate "STMicroelectronics STiH4xx HDMI CEC driver"
-       depends on CEC_CORE && (ARCH_STI || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on ARCH_STI || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for STIH4xx HDMI CEC interface. It uses the
          generic CEC framework interface.
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index b36ac19dc6e4..154de92dd809 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -26,7 +26,8 @@ config VIDEO_VIVID
 
 config VIDEO_VIVID_CEC
         bool "Enable CEC emulation support"
-        depends on VIDEO_VIVID && CEC_CORE
+        depends on VIDEO_VIVID
+        select CEC_CORE
         ---help---
           When selected the vivid module will emulate the optional
           HDMI CEC feature.
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 90f66dc7c0d7..a2fc1a1d58b0 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle);
  */
 void ir_raw_event_handle(struct rc_dev *dev)
 {
-        if (!dev->raw)
+        if (!dev->raw || !dev->raw->thread)
                 return;
 
         wake_up_process(dev->raw->thread);
@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev)
 {
         int rc;
         struct ir_raw_handler *handler;
+        struct task_struct *thread;
 
         if (!dev)
                 return -EINVAL;
@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev)
          * because the event is coming from userspace
          */
         if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw,
-                                               "rc%u", dev->minor);
+                thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u",
+                                     dev->minor);
 
-                if (IS_ERR(dev->raw->thread)) {
-                        rc = PTR_ERR(dev->raw->thread);
+                if (IS_ERR(thread)) {
+                        rc = PTR_ERR(thread);
                         goto out;
                 }
+
+                dev->raw->thread = thread;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/usb/pulse8-cec/Kconfig b/drivers/media/usb/pulse8-cec/Kconfig
index 8937f3986a01..18ead44824ba 100644
--- a/drivers/media/usb/pulse8-cec/Kconfig
+++ b/drivers/media/usb/pulse8-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_PULSE8_CEC
         tristate "Pulse Eight HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/Kconfig b/drivers/media/usb/rainshadow-cec/Kconfig
index 3eb86607efb8..030ef01b1ff0 100644
--- a/drivers/media/usb/rainshadow-cec/Kconfig
+++ b/drivers/media/usb/rainshadow-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_RAINSHADOW_CEC
         tristate "RainShadow Tech HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
index 541ca543f71f..71bd68548c9c 100644
--- a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
@@ -119,7 +119,7 @@ static void rain_irq_work_handler(struct work_struct *work)
 
         while (true) {
                 unsigned long flags;
-                bool exit_loop;
+                bool exit_loop = false;
                 char data;
 
                 spin_lock_irqsave(&rain->buf_lock, flags);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 35910f945bfa..99e644cda4d1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -581,7 +581,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
         return of_platform_populate(np, NULL, NULL, dev);
 }
 
-static int atmel_ebi_resume(struct device *dev)
+static __maybe_unused int atmel_ebi_resume(struct device *dev)
 {
         struct atmel_ebi *ebi = dev_get_drvdata(dev);
         struct atmel_ebi_dev *ebid;
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 17b433f1ce23..0761271d68c5 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -159,11 +159,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
 
         /* Do this outside the status_mutex to avoid a circular dependency with
          * the locking in cxl_mmap_fault() */
-        if (copy_from_user(&work, uwork,
-                           sizeof(struct cxl_ioctl_start_work))) {
-                rc = -EFAULT;
-                goto out;
-        }
+        if (copy_from_user(&work, uwork, sizeof(work)))
+                return -EFAULT;
 
         mutex_lock(&ctx->status_mutex);
         if (ctx->status != OPENED) {
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 871a2f09c718..8d6ea9712dbd 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -1302,13 +1302,16 @@ int cxl_native_register_psl_err_irq(struct cxl *adapter)
 
 void cxl_native_release_psl_err_irq(struct cxl *adapter)
 {
-        if (adapter->native->err_virq != irq_find_mapping(NULL, adapter->native->err_hwirq))
+        if (adapter->native->err_virq == 0 ||
+            adapter->native->err_virq !=
+            irq_find_mapping(NULL, adapter->native->err_hwirq))
                 return;
 
         cxl_p1_write(adapter, CXL_PSL_ErrIVTE, 0x0000000000000000);
         cxl_unmap_irq(adapter->native->err_virq, adapter);
         cxl_ops->release_one_irq(adapter, adapter->native->err_hwirq);
         kfree(adapter->irq_name);
+        adapter->native->err_virq = 0;
 }
 
 int cxl_native_register_serr_irq(struct cxl_afu *afu)
@@ -1346,13 +1349,15 @@ int cxl_native_register_serr_irq(struct cxl_afu *afu)
 
 void cxl_native_release_serr_irq(struct cxl_afu *afu)
 {
-        if (afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
+        if (afu->serr_virq == 0 ||
+            afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
                 return;
 
         cxl_p1n_write(afu, CXL_PSL_SERR_An, 0x0000000000000000);
         cxl_unmap_irq(afu->serr_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->serr_hwirq);
         kfree(afu->err_irq_name);
+        afu->serr_virq = 0;
 }
 
 int cxl_native_register_psl_irq(struct cxl_afu *afu)
@@ -1375,12 +1380,15 @@ int cxl_native_register_psl_irq(struct cxl_afu *afu)
 
 void cxl_native_release_psl_irq(struct cxl_afu *afu)
 {
-        if (afu->native->psl_virq != irq_find_mapping(NULL, afu->native->psl_hwirq))
+        if (afu->native->psl_virq == 0 ||
+            afu->native->psl_virq !=
+            irq_find_mapping(NULL, afu->native->psl_hwirq))
                 return;
 
         cxl_unmap_irq(afu->native->psl_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->native->psl_hwirq);
         kfree(afu->psl_irq_name);
+        afu->native->psl_virq = 0;
 }
 
 static void recover_psl_err(struct cxl_afu *afu, u64 errstat)
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index d1928fdd0f43..07aad8576334 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -763,8 +763,10 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a,
 {
         struct mei_cl_device *cldev = to_mei_cl_device(dev);
         const uuid_le *uuid = mei_me_cl_uuid(cldev->me_cl);
+        u8 version = mei_me_cl_ver(cldev->me_cl);
 
-        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:", cldev->name, uuid);
+        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:%02X:",
+                         cldev->name, uuid, version);
 }
 static DEVICE_ATTR_RO(modalias);
 
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 96046bb12ca1..14c0be98e0a4 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -114,13 +114,13 @@ static inline int mv88e6xxx_g2_set_eeprom16(struct mv88e6xxx_chip *chip,
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip, int src_dev,
-                           int src_port, u16 data)
+static inline int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip,
+                                         int src_dev, int src_port, u16 data)
 {
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
+static inline int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
 {
         return -EOPNOTSUPP;
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index b3bc87fe3764..0a98c369df20 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -324,7 +324,7 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
                               struct xgbe_ring *ring,
                               struct xgbe_ring_data *rdata)
 {
-        int order, ret;
+        int ret;
 
         if (!ring->rx_hdr_pa.pages) {
                 ret = xgbe_alloc_pages(pdata, &ring->rx_hdr_pa, GFP_ATOMIC, 0);
@@ -333,9 +333,8 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
         }
 
         if (!ring->rx_buf_pa.pages) {
-                order = max_t(int, PAGE_ALLOC_COSTLY_ORDER - 1, 0);
                 ret = xgbe_alloc_pages(pdata, &ring->rx_buf_pa, GFP_ATOMIC,
-                                       order);
+                                       PAGE_ALLOC_COSTLY_ORDER);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 099b374c1b17..5274501428e4 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2026,9 +2026,12 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         priv->num_rx_desc_words = params->num_rx_desc_words;
 
         priv->irq0 = platform_get_irq(pdev, 0);
-        if (!priv->is_lite)
+        if (!priv->is_lite) {
                 priv->irq1 = platform_get_irq(pdev, 1);
-        priv->wol_irq = platform_get_irq(pdev, 2);
+                priv->wol_irq = platform_get_irq(pdev, 2);
+        } else {
+                priv->wol_irq = platform_get_irq(pdev, 1);
+        }
         if (priv->irq0 <= 0 || (priv->irq1 <= 0 && !priv->is_lite)) {
                 dev_err(&pdev->dev, "invalid interrupts\n");
                 ret = -EINVAL;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index eccb3d1b6abb..5f49334dcad5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1926,7 +1926,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 38a5c6764bb5..77ed2f628f9c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2196,10 +2196,14 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto irq_err;
         }
+
+        mutex_lock(&uld_mutex);
         enable_rx(adap);
         t4_sge_start(adap);
         t4_intr_enable(adap);
         adap->flags |= FULL_INIT_DONE;
+        mutex_unlock(&uld_mutex);
+
         notify_ulds(adap, CXGB4_STATE_UP);
 #if IS_ENABLED(CONFIG_IPV6)
         update_clip(adap);
@@ -2771,6 +2775,9 @@ void t4_fatal_err(struct adapter *adap)
 {
         int port;
 
+        if (pci_channel_offline(adap->pdev))
+                return;
+
         /* Disable the SGE since ULDs are going to free resources that
          * could be exposed to the adapter.  RDMA MWs for example...
          */
@@ -3882,9 +3889,10 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
         spin_lock(&adap->stats_lock);
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                netif_device_detach(dev);
-                netif_carrier_off(dev);
+                if (dev) {
+                        netif_device_detach(dev);
+                        netif_carrier_off(dev);
+                }
         }
         spin_unlock(&adap->stats_lock);
         disable_interrupts(adap);
@@ -3963,12 +3971,13 @@ static void eeh_resume(struct pci_dev *pdev)
         rtnl_lock();
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                if (netif_running(dev)) {
-                        link_start(dev);
-                        cxgb_set_rxmode(dev);
+                if (dev) {
+                        if (netif_running(dev)) {
+                                link_start(dev);
+                                cxgb_set_rxmode(dev);
+                        }
+                        netif_device_attach(dev);
                 }
-                netif_device_attach(dev);
         }
         rtnl_unlock();
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index aded42b96f6d..3a34aa629f7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -4557,8 +4557,13 @@ void t4_intr_enable(struct adapter *adapter)
  */
 void t4_intr_disable(struct adapter *adapter)
 {
-        u32 whoami = t4_read_reg(adapter, PL_WHOAMI_A);
-        u32 pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
+        u32 whoami, pf;
+
+        if (pci_channel_offline(adapter->pdev))
+                return;
+
+        whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+        pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
                         SOURCEPF_G(whoami) : T6_SOURCEPF_G(whoami);
 
         t4_write_reg(adapter, MYPF_REG(PL_PF_INT_ENABLE_A), 0);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index 3549d3876278..f2d623a7aee0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x2B
+#define T4FW_VERSION_MICRO 0x2D
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x2B
+#define T5FW_VERSION_MICRO 0x2D
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x2B
+#define T6FW_VERSION_MICRO 0x2D
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index e863ba74d005..8bb0db990c8f 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -739,6 +739,8 @@ static int ethoc_open(struct net_device *dev)
         if (ret)
                 return ret;
 
+        napi_enable(&priv->napi);
+
         ethoc_init_ring(priv, dev->mem_start);
         ethoc_reset(priv);
 
@@ -754,7 +756,6 @@ static int ethoc_open(struct net_device *dev)
         priv->old_duplex = -1;
 
         phy_start(dev->phydev);
-        napi_enable(&priv->napi);
 
         if (netif_msg_ifup(priv)) {
                 dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 446c7b374ff5..a10de1e9c157 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -381,7 +381,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
 {
         const struct of_device_id *id =
                 of_match_device(fsl_pq_mdio_match, &pdev->dev);
-        const struct fsl_pq_mdio_data *data = id->data;
+        const struct fsl_pq_mdio_data *data;
         struct device_node *np = pdev->dev.of_node;
         struct resource res;
         struct device_node *tbi;
@@ -389,6 +389,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
         struct mii_bus *new_bus;
         int err;
 
+        if (!id) {
+                dev_err(&pdev->dev, "Failed to match device\n");
+                return -ENODEV;
+        }
+
+        data = id->data;
+
         dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
 
         new_bus = mdiobus_alloc_size(sizeof(*priv));
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 4f2d329dba99..a93757c255f7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -81,7 +81,7 @@
 static const char ibmvnic_driver_name[] = "ibmvnic";
 static const char ibmvnic_driver_string[] = "IBM System i/p Virtual NIC Driver";
 
-MODULE_AUTHOR("Santiago Leon <santi_leon@yahoo.com>");
+MODULE_AUTHOR("Santiago Leon");
 MODULE_DESCRIPTION("IBM System i/p Virtual NIC Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d5c9c9e06ff5..150caf6ca2b4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -295,7 +295,7 @@ struct i40e_vsi *i40e_find_vsi_from_id(struct i40e_pf *pf, u16 id)
  **/
 void i40e_service_event_schedule(struct i40e_pf *pf)
 {
-        if (!test_bit(__I40E_VSI_DOWN, pf->state) &&
+        if (!test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
                 queue_work(i40e_wq, &pf->service_task);
 }
@@ -3611,7 +3611,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
                  * this is not a performance path and napi_schedule()
                  * can deal with rescheduling.
                  */
-                if (!test_bit(__I40E_VSI_DOWN, pf->state))
+                if (!test_bit(__I40E_DOWN, pf->state))
                         napi_schedule_irqoff(&q_vector->napi);
         }
 
@@ -3687,7 +3687,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
 enable_intr:
         /* re-enable interrupt causes */
         wr32(hw, I40E_PFINT_ICR0_ENA, ena_mask);
-        if (!test_bit(__I40E_VSI_DOWN, pf->state)) {
+        if (!test_bit(__I40E_DOWN, pf->state)) {
                 i40e_service_event_schedule(pf);
                 i40e_irq_dynamic_enable_icr0(pf, false);
         }
@@ -6203,7 +6203,7 @@ static void i40e_fdir_reinit_subtask(struct i40e_pf *pf)
 {
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 return;
 
         if (test_bit(__I40E_FD_FLUSH_REQUESTED, pf->state))
@@ -6344,7 +6344,7 @@ static void i40e_watchdog_subtask(struct i40e_pf *pf)
         int i;
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state) ||
+        if (test_bit(__I40E_DOWN, pf->state) ||
             test_bit(__I40E_CONFIG_BUSY, pf->state))
                 return;
 
@@ -6399,9 +6399,9 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
                 reset_flags |= BIT(__I40E_GLOBAL_RESET_REQUESTED);
                 clear_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
         }
-        if (test_bit(__I40E_VSI_DOWN_REQUESTED, pf->state)) {
-                reset_flags |= BIT(__I40E_VSI_DOWN_REQUESTED);
-                clear_bit(__I40E_VSI_DOWN_REQUESTED, pf->state);
+        if (test_bit(__I40E_DOWN_REQUESTED, pf->state)) {
+                reset_flags |= BIT(__I40E_DOWN_REQUESTED);
+                clear_bit(__I40E_DOWN_REQUESTED, pf->state);
         }
 
         /* If there's a recovery already waiting, it takes
@@ -6415,7 +6415,7 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
 
         /* If we're already down or resetting, just bail */
         if (reset_flags &&
-            !test_bit(__I40E_VSI_DOWN, pf->state) &&
+            !test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_CONFIG_BUSY, pf->state)) {
                 rtnl_lock();
                 i40e_do_reset(pf, reset_flags, true);
@@ -7002,7 +7002,7 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
         u32 val;
         int v;
 
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 goto clear_recovery;
         dev_dbg(&pf->pdev->dev, "Rebuilding internal switch\n");
 
@@ -9767,7 +9767,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
                 return -ENODEV;
         }
         if (vsi == pf->vsi[pf->lan_vsi] &&
-            !test_bit(__I40E_VSI_DOWN, pf->state)) {
+            !test_bit(__I40E_DOWN, pf->state)) {
                 dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
                 return -ENODEV;
         }
@@ -11003,7 +11003,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         pf->next_vsi = 0;
         pf->pdev = pdev;
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         hw = &pf->hw;
         hw->back = pf;
@@ -11293,7 +11293,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * before setting up the misc vector or we get a race and the vector
          * ends up disabled forever.
          */
-        clear_bit(__I40E_VSI_DOWN, pf->state);
+        clear_bit(__I40E_DOWN, pf->state);
 
         /* In case of MSIX we are going to setup the misc vector right here
          * to handle admin queue events etc. In case of legacy and MSI
@@ -11448,7 +11448,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         /* Unwind what we've done if something failed in the setup */
 err_vsis:
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         i40e_clear_interrupt_scheme(pf);
         kfree(pf->vsi);
 err_switch_setup:
@@ -11500,7 +11500,7 @@ static void i40e_remove(struct pci_dev *pdev)
 
         /* no more scheduling of any task */
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         if (pf->service_timer.data)
                 del_timer_sync(&pf->service_timer);
         if (pf->service_task.func)
@@ -11740,7 +11740,7 @@ static void i40e_shutdown(struct pci_dev *pdev)
         struct i40e_hw *hw = &pf->hw;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         rtnl_lock();
         i40e_prep_for_reset(pf, true);
         rtnl_unlock();
@@ -11789,7 +11789,7 @@ static int i40e_suspend(struct pci_dev *pdev, pm_message_t state)
         int retval = 0;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         if (pf->wol_en && (pf->flags & I40E_FLAG_WOL_MC_MAGIC_PKT_WAKE))
                 i40e_enable_mc_magic_wake(pf);
@@ -11841,7 +11841,7 @@ static int i40e_resume(struct pci_dev *pdev)
 
         /* handling the reset will rebuild the device state */
         if (test_and_clear_bit(__I40E_SUSPENDED, pf->state)) {
-                clear_bit(__I40E_VSI_DOWN, pf->state);
+                clear_bit(__I40E_DOWN, pf->state);
                 rtnl_lock();
                 i40e_reset_and_rebuild(pf, false, true);
                 rtnl_unlock();
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 29321a6167a6..cd894f4023b1 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1854,7 +1854,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index dfe241a12ad0..12b02e530503 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1190,7 +1190,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index ae5fdc2df654..ffbcb27c05e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1562,11 +1562,6 @@ static int mlx4_en_flow_replace(struct net_device *dev,
                 qpn = priv->drop_qp.qpn;
         else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
                 qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
-                if (qpn < priv->rss_map.base_qpn ||
-                    qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
-                        en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
-                        return -EINVAL;
-                }
         } else {
                 if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
                         en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 1a670b681555..0710b3677464 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -35,6 +35,7 @@
 #include <linux/etherdevice.h>
 
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 #include <linux/export.h>
 
 #include "mlx4.h"
@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
 
+        if (!mlx4_qp_lookup(dev, rule->qpn)) {
+                mlx4_err_rule(dev, "QP doesn't exist\n", rule);
+                ret = -EINVAL;
+                goto out;
+        }
+
         trans_rule_ctrl_to_hw(rule, mailbox->buf);
 
         size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
 
         list_for_each_entry(cur, &rule->list, list) {
                 ret = parse_trans_rule(dev, cur, mailbox->buf + size);
-                if (ret < 0) {
-                        mlx4_free_cmd_mailbox(dev, mailbox);
-                        return ret;
-                }
+                if (ret < 0)
+                        goto out;
+
                 size += ret;
         }
 
@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
                 }
         }
 
+out:
         mlx4_free_cmd_mailbox(dev, mailbox);
 
         return ret;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2d6abd4662b1..5a310d313e94 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -384,6 +384,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
                 __mlx4_qp_free_icm(dev, qpn);
 }
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
+{
+        struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
+        struct mlx4_qp *qp;
+
+        spin_lock(&qp_table->lock);
+
+        qp = __mlx4_qp_lookup(dev, qpn);
+
+        spin_unlock(&qp_table->lock);
+        return qp;
+}
+
 int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -471,6 +484,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
         }
 
         if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
+                if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
+                        mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
                 qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
                 cmd->qp_context.qos_vport = params->qos_vport;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 07516545474f..812783865205 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -5255,6 +5255,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
 
+static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
+                           struct mlx4_vf_immed_vlan_work *work)
+{
+        ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
+        ctx->qp_context.qos_vport = work->qos_vport;
+}
+
 void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
 {
         struct mlx4_vf_immed_vlan_work *work =
@@ -5369,11 +5376,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
                                         qp->sched_queue & 0xC7;
                                 upd_context->qp_context.pri_path.sched_queue |=
                                         ((work->qos & 0x7) << 3);
-                                upd_context->qp_mask |=
-                                        cpu_to_be64(1ULL <<
-                                                    MLX4_UPD_QP_MASK_QOS_VPP);
-                                upd_context->qp_context.qos_vport =
-                                        work->qos_vport;
+
+                                if (dev->caps.flags2 &
+                                    MLX4_DEV_CAP_FLAG2_QOS_VPP)
+                                        update_qos_vpp(upd_context, work);
                         }
 
                         err = mlx4_cmd(dev, mailbox->dma,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index fe5546bb4153..af945edfee19 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -621,10 +621,9 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                         priv->irq_info[i].mask);
 
-#ifdef CONFIG_SMP
-        if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+        if (IS_ENABLED(CONFIG_SMP) &&
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
                 mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
-#endif
 
         return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 537d1236a4fe..715b3aaf83ac 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1730,7 +1730,8 @@ void qed_get_protocol_stats(struct qed_dev *cdev,
                 qed_get_protocol_stats_iscsi(cdev, &stats->iscsi_stats);
                 break;
         default:
-                DP_ERR(cdev, "Invalid protocol type = %d\n", type);
+                DP_VERBOSE(cdev, QED_MSG_SP,
+                           "Invalid protocol type = %d\n", type);
                 return;
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 7245b1072518..81312924df14 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1824,22 +1824,44 @@ struct qlcnic_hardware_ops {
         u32 (*get_cap_size)(void *, int);
         void (*set_sys_info)(void *, int, u32);
         void (*store_cap_mask)(void *, u32);
+        bool (*encap_rx_offload) (struct qlcnic_adapter *adapter);
+        bool (*encap_tx_offload) (struct qlcnic_adapter *adapter);
 };
 
 extern struct qlcnic_nic_template qlcnic_vf_ops;
 
-static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_tx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_TX_OFFLOAD;
 }
 
-static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_rx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_RX_OFFLOAD;
 }
 
+static inline bool qlcnic_82xx_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_82xx_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_rx_offload(adapter);
+}
+
+static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_tx_offload(adapter);
+}
+
 static inline int qlcnic_start_firmware(struct qlcnic_adapter *adapter)
 {
         return adapter->nic_ops->start_firmware(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4fb68797630e..f7080d0ab874 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -242,6 +242,8 @@ static struct qlcnic_hardware_ops qlcnic_83xx_hw_ops = {
         .get_cap_size                   = qlcnic_83xx_get_cap_size,
         .set_sys_info                   = qlcnic_83xx_set_sys_info,
         .store_cap_mask                 = qlcnic_83xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_83xx_ops = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 838cc0ceafd8..7848cf04b29a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
                         }
                         return -EIO;
                 }
-                usleep_range(1000, 1500);
+                udelay(1200);
         }
 
         if (id_reg)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index b6628aaa6e4a..1b5f7d57b6f8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -632,6 +632,8 @@ static struct qlcnic_hardware_ops qlcnic_hw_ops = {
         .get_cap_size                   = qlcnic_82xx_get_cap_size,
         .set_sys_info                   = qlcnic_82xx_set_sys_info,
         .store_cap_mask                 = qlcnic_82xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_82xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_82xx_encap_tx_offload,
 };
 
 static int qlcnic_check_multi_tx_capability(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 2f656f395f39..c58180f40844 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -77,6 +77,8 @@ static struct qlcnic_hardware_ops qlcnic_sriov_vf_hw_ops = {
         .free_mac_list                  = qlcnic_sriov_vf_free_mac_list,
         .enable_sds_intr                = qlcnic_83xx_enable_sds_intr,
         .disable_sds_intr               = qlcnic_83xx_disable_sds_intr,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_sriov_vf_ops = {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index cc065ffbe4b5..bcd4708b3745 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -931,7 +931,7 @@ int emac_mac_up(struct emac_adapter *adpt)
         emac_mac_config(adpt);
         emac_mac_rx_descs_refill(adpt, &adpt->rx_q);
 
-        adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
+        adpt->phydev->irq = PHY_POLL;
         ret = phy_connect_direct(netdev, adpt->phydev, emac_adjust_link,
                                  PHY_INTERFACE_MODE_SGMII);
         if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 441c19366489..18461fcb9815 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -13,15 +13,11 @@
 /* Qualcomm Technologies, Inc. EMAC PHY Controller driver.
  */
 
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_net.h>
 #include <linux/of_mdio.h>
 #include <linux/phy.h>
 #include <linux/iopoll.h>
 #include <linux/acpi.h>
 #include "emac.h"
-#include "emac-mac.h"
 
 /* EMAC base register offsets */
 #define EMAC_MDIO_CTRL                                        0x001414
@@ -52,62 +48,10 @@
 
 #define MDIO_WAIT_TIMES                                           1000
 
-#define EMAC_LINK_SPEED_DEFAULT (\
-                EMAC_LINK_SPEED_10_HALF  |\
-                EMAC_LINK_SPEED_10_FULL  |\
-                EMAC_LINK_SPEED_100_HALF |\
-                EMAC_LINK_SPEED_100_FULL |\
-                EMAC_LINK_SPEED_1GB_FULL)
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The autopoll feature takes over the MDIO bus.  In order for
- * the PHY driver to be able to talk to the PHY over the MDIO
- * bus, we need to temporarily disable the autopoll feature.
- */
-static int emac_phy_mdio_autopoll_disable(struct emac_adapter *adpt)
-{
-        u32 val;
-
-        /* disable autopoll */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, MDIO_AP_EN, 0);
-
-        /* wait for any mdio polling to complete */
-        if (!readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, val,
-                                !(val & MDIO_BUSY), 100, MDIO_WAIT_TIMES * 100))
-                return 0;
-
-        /* failed to disable; ensure it is enabled before returning */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-
-        return -EBUSY;
-}
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The EMAC has the ability to poll the external PHY on the MDIO
- * bus for link state changes.  This eliminates the need for the
- * driver to poll the phy.  If if the link state does change,
- * the EMAC issues an interrupt on behalf of the PHY.
- */
-static void emac_phy_mdio_autopoll_enable(struct emac_adapter *adpt)
-{
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-}
-
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -122,24 +66,15 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)),
                                100, MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
-        else
-                ret = (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
 }
 
 static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -155,11 +90,9 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)), 100,
                                MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return 0;
 }
 
 /* Configure the MDIO bus and connect the external PHY */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 28a8cdc36485..98a326faea29 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -50,19 +50,7 @@
 #define DMAR_DLY_CNT_DEF                                    15
 #define DMAW_DLY_CNT_DEF                                     4
 
-#define IMR_NORMAL_MASK         (\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
-
-#define IMR_EXTENDED_MASK       (\
-                SW_MAN_INT      |\
-                ISR_OVER        |\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
+#define IMR_NORMAL_MASK         (ISR_ERROR | ISR_OVER | ISR_TX_PKT)
 
 #define ISR_TX_PKT      (\
         TX_PKT_INT      |\
@@ -70,10 +58,6 @@
         TX_PKT_INT2     |\
         TX_PKT_INT3)
 
-#define ISR_GPHY_LINK        (\
-        GPHY_LINK_UP_INT     |\
-        GPHY_LINK_DOWN_INT)
-
 #define ISR_OVER        (\
         RFD0_UR_INT     |\
         RFD1_UR_INT     |\
@@ -187,10 +171,6 @@ irqreturn_t emac_isr(int _irq, void *data)
         if (status & ISR_OVER)
                 net_warn_ratelimited("warning: TX/RX overflow\n");
 
-        /* link event */
-        if (status & ISR_GPHY_LINK)
-                phy_mac_interrupt(adpt->phydev, !!(status & GPHY_LINK_UP_INT));
-
 exit:
         /* enable the interrupt */
         writel(irq->mask, adpt->base + EMAC_INT_MASK);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 3cd7989c007d..784782da3a85 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -230,18 +230,6 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         int ring_size;
         int i;
 
-        /* Free RX skb ringbuffer */
-        if (priv->rx_skb[q]) {
-                for (i = 0; i < priv->num_rx_ring[q]; i++)
-                        dev_kfree_skb(priv->rx_skb[q][i]);
-        }
-        kfree(priv->rx_skb[q]);
-        priv->rx_skb[q] = NULL;
-
-        /* Free aligned TX buffers */
-        kfree(priv->tx_align[q]);
-        priv->tx_align[q] = NULL;
-
         if (priv->rx_ring[q]) {
                 for (i = 0; i < priv->num_rx_ring[q]; i++) {
                         struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
@@ -270,6 +258,18 @@ static void ravb_ring_free(struct net_device *ndev, int q)
                 priv->tx_ring[q] = NULL;
         }
 
+        /* Free RX skb ringbuffer */
+        if (priv->rx_skb[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++)
+                        dev_kfree_skb(priv->rx_skb[q][i]);
+        }
+        kfree(priv->rx_skb[q]);
+        priv->rx_skb[q] = NULL;
+
+        /* Free aligned TX buffers */
+        kfree(priv->tx_align[q]);
+        priv->tx_align[q] = NULL;
+
         /* Free TX skb ringbuffer.
          * SKBs are freed by ravb_tx_free() call above.
          */
diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 489ef146201e..6a9c954492f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -37,6 +37,7 @@
 #define TSE_PCS_CONTROL_AN_EN_MASK                      BIT(12)
 #define TSE_PCS_CONTROL_REG                             0x00
 #define TSE_PCS_CONTROL_RESTART_AN_MASK                 BIT(9)
+#define TSE_PCS_CTRL_AUTONEG_SGMII                      0x1140
 #define TSE_PCS_IF_MODE_REG                             0x28
 #define TSE_PCS_LINK_TIMER_0_REG                        0x24
 #define TSE_PCS_LINK_TIMER_1_REG                        0x26
@@ -65,6 +66,7 @@
 #define TSE_PCS_SW_RESET_TIMEOUT                        100
 #define TSE_PCS_USE_SGMII_AN_MASK                       BIT(1)
 #define TSE_PCS_USE_SGMII_ENA                           BIT(0)
+#define TSE_PCS_IF_USE_SGMII                            0x03
 
 #define SGMII_ADAPTER_CTRL_REG                          0x00
 #define SGMII_ADAPTER_DISABLE                           0x0001
@@ -101,7 +103,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs)
 {
         int ret = 0;
 
-        writew(TSE_PCS_USE_SGMII_ENA, base + TSE_PCS_IF_MODE_REG);
+        writew(TSE_PCS_IF_USE_SGMII, base + TSE_PCS_IF_MODE_REG);
+
+        writew(TSE_PCS_CTRL_AUTONEG_SGMII, base + TSE_PCS_CONTROL_REG);
 
         writew(TSE_PCS_SGMII_LINK_TIMER_0, base + TSE_PCS_LINK_TIMER_0_REG);
         writew(TSE_PCS_SGMII_LINK_TIMER_1, base + TSE_PCS_LINK_TIMER_1_REG);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a74c481401c4..12236daf7bb6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1208,7 +1208,7 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
         u32 rx_count = priv->plat->rx_queues_to_use;
         unsigned int bfsize = 0;
         int ret = -ENOMEM;
-        u32 queue;
+        int queue;
         int i;
 
         if (priv->hw->mode->set_16kib_bfsize)
@@ -2724,7 +2724,7 @@ static void stmmac_tso_allocator(struct stmmac_priv *priv, unsigned int des,
 
                 priv->hw->desc->prepare_tso_tx_desc(desc, 0, buff_size,
                         0, 1,
-                        (last_segment) && (buff_size < TSO_MAX_BUFF_SIZE),
+                        (last_segment) && (tmp_len <= TSO_MAX_BUFF_SIZE),
                         0, 0);
 
                 tmp_len -= TSO_MAX_BUFF_SIZE;
@@ -2947,7 +2947,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         int i, csum_insertion = 0, is_jumbo = 0;
         u32 queue = skb_get_queue_mapping(skb);
         int nfrags = skb_shinfo(skb)->nr_frags;
-        unsigned int entry, first_entry;
+        int entry;
+        unsigned int first_entry;
         struct dma_desc *desc, *first;
         struct stmmac_tx_queue *tx_q;
         unsigned int enh_desc;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 959fd12d2e67..6ebb0f559a42 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1133,7 +1133,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
 
         /* make enough headroom for basic scenario */
         encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (!metadata && ip_tunnel_info_af(info) == AF_INET) {
                 encap_len += sizeof(struct iphdr);
                 dev->max_mtu -= sizeof(struct iphdr);
         } else {
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c1d078..97e3bc60c3e7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case HDLCDRVCTL_CALIBRATE:
                 if(!capable(CAP_SYS_RAWIO))
                         return -EPERM;
+                if (s->par.bitrate <= 0)
+                        return -EINVAL;
                 if (bi.data.calibrate > INT_MAX / s->par.bitrate)
                         return -EINVAL;
                 s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 9097e42bec2e..57297ba23987 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1127,8 +1127,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
-
                 if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
                         phydev->duplex = DUPLEX_FULL;
                 else
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 8e73f5f36e71..f99c21f78b63 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -658,6 +658,18 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
         return 0;
 }
 
+static int mdio_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        int rc;
+
+        /* Some devices have extra OF data and an OF-style MODALIAS */
+        rc = of_device_uevent_modalias(dev, env);
+        if (rc != -ENODEV)
+                return rc;
+
+        return 0;
+}
+
 #ifdef CONFIG_PM
 static int mdio_bus_suspend(struct device *dev)
 {
@@ -708,6 +720,7 @@ static const struct dev_pm_ops mdio_bus_pm_ops = {
 struct bus_type mdio_bus_type = {
         .name           = "mdio_bus",
         .match          = mdio_bus_match,
+        .uevent         = mdio_uevent,
         .pm             = MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6a5fd18f062c..b9252b8d81ff 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -268,23 +268,12 @@ out:
         return ret;
 }
 
-static int kszphy_config_init(struct phy_device *phydev)
+/* Some config bits need to be set again on resume, handle them here. */
+static int kszphy_config_reset(struct phy_device *phydev)
 {
         struct kszphy_priv *priv = phydev->priv;
-        const struct kszphy_type *type;
         int ret;
 
-        if (!priv)
-                return 0;
-
-        type = priv->type;
-
-        if (type->has_broadcast_disable)
-                kszphy_broadcast_disable(phydev);
-
-        if (type->has_nand_tree_disable)
-                kszphy_nand_tree_disable(phydev);
-
         if (priv->rmii_ref_clk_sel) {
                 ret = kszphy_rmii_clk_sel(phydev, priv->rmii_ref_clk_sel_val);
                 if (ret) {
@@ -295,11 +284,30 @@ static int kszphy_config_init(struct phy_device *phydev)
         }
 
         if (priv->led_mode >= 0)
-                kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
+                kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
 
         return 0;
 }
 
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        struct kszphy_priv *priv = phydev->priv;
+        const struct kszphy_type *type;
+
+        if (!priv)
+                return 0;
+
+        type = priv->type;
+
+        if (type->has_broadcast_disable)
+                kszphy_broadcast_disable(phydev);
+
+        if (type->has_nand_tree_disable)
+                kszphy_nand_tree_disable(phydev);
+
+        return kszphy_config_reset(phydev);
+}
+
 static int ksz8041_config_init(struct phy_device *phydev)
 {
         struct device_node *of_node = phydev->mdio.dev.of_node;
@@ -700,8 +708,14 @@ static int kszphy_suspend(struct phy_device *phydev)
 
 static int kszphy_resume(struct phy_device *phydev)
 {
+        int ret;
+
         genphy_resume(phydev);
 
+        ret = kszphy_config_reset(phydev);
+        if (ret)
+                return ret;
+
         /* Enable PHY Interrupts */
         if (phy_interrupt_is_valid(phydev)) {
                 phydev->interrupts = PHY_INTERRUPT_ENABLED;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 82ab8fb82587..7524caa0f29d 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -241,7 +241,7 @@ static const struct phy_setting settings[] = {
  * phy_lookup_setting - lookup a PHY setting
  * @speed: speed to match
  * @duplex: duplex to match
- * @feature: allowed link modes
+ * @features: allowed link modes
  * @exact: an exact match is required
  *
  * Search the settings array for a setting that matches the speed and
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e9246cc49c3..a871f45ecc79 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -869,7 +869,7 @@ static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
         unsigned int len;
 
         len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
-                                rq->min_buf_len - hdr_len, PAGE_SIZE - hdr_len);
+                                rq->min_buf_len, PAGE_SIZE - hdr_len);
         return ALIGN(len, L1_CACHE_BYTES);
 }
 
@@ -2144,7 +2144,8 @@ static unsigned int mergeable_min_buf_len(struct virtnet_info *vi, struct virtqu
         unsigned int buf_len = hdr_len + ETH_HLEN + VLAN_HLEN + packet_len;
         unsigned int min_buf_len = DIV_ROUND_UP(buf_len, rq_size);
 
-        return max(min_buf_len, hdr_len);
+        return max(max(min_buf_len, hdr_len) - hdr_len,
+                   (unsigned int)GOOD_PACKET_LEN);
 }
 
 static int virtnet_find_vqs(struct virtnet_info *vi)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 328b4712683c..a6b5052c1d36 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -59,6 +59,8 @@ static const u8 all_zeros_mac[ETH_ALEN + 2];
 
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
 /* per-network namespace private data for this module */
 struct vxlan_net {
         struct list_head  vxlan_list;
@@ -740,6 +742,22 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
         call_rcu(&f->rcu, vxlan_fdb_free);
 }
 
+static void vxlan_dst_free(struct rcu_head *head)
+{
+        struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
+
+        dst_cache_destroy(&rd->dst_cache);
+        kfree(rd);
+}
+
+static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                                  struct vxlan_rdst *rd)
+{
+        list_del_rcu(&rd->list);
+        vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
+        call_rcu(&rd->rcu, vxlan_dst_free);
+}
+
 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
                            union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
                            __be32 *vni, u32 *ifindex)
@@ -864,9 +882,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
          * otherwise destroy the fdb entry
          */
         if (rd && !list_is_singular(&f->remotes)) {
-                list_del_rcu(&rd->list);
-                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
-                kfree_rcu(rd, rcu);
+                vxlan_fdb_dst_destroy(vxlan, f, rd);
                 goto out;
         }
 
@@ -1067,6 +1083,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
         rcu_assign_pointer(vxlan->vn4_sock, NULL);
         synchronize_net();
 
+        vxlan_vs_del_dev(vxlan);
+
         if (__vxlan_sock_release_prep(sock4)) {
                 udp_tunnel_sock_release(sock4->sock);
                 kfree(sock4);
@@ -2342,6 +2360,15 @@ static void vxlan_cleanup(unsigned long arg)
         mod_timer(&vxlan->age_timer, next_timer);
 }
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+        spin_lock(&vn->sock_lock);
+        hlist_del_init_rcu(&vxlan->hlist);
+        spin_unlock(&vn->sock_lock);
+}
+
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
@@ -3286,15 +3313,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
         vxlan_flush(vxlan, true);
 
-        spin_lock(&vn->sock_lock);
-        if (!hlist_unhashed(&vxlan->hlist))
-                hlist_del_rcu(&vxlan->hlist);
-        spin_unlock(&vn->sock_lock);
-
         gro_cells_destroy(&vxlan->gro_cells);
         list_del(&vxlan->next);
         unregister_netdevice_queue(dev, head);
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index d5e993dc9b23..517a315e259b 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1271,6 +1271,8 @@ static int wcn36xx_remove(struct platform_device *pdev)
         qcom_smem_state_put(wcn->tx_enable_state);
         qcom_smem_state_put(wcn->tx_rings_empty_state);
 
+        rpmsg_destroy_ept(wcn->smd_channel);
+
         iounmap(wcn->dxe_base);
         iounmap(wcn->ccu_base);
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index fc64b8913aa6..e03450059b06 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3422,7 +3422,7 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 /* otherwise, set txglomalign */
                 value = sdiodev->settings->bus.sdio.sd_sgentry_align;
                 /* SDIO ADMA requires at least 32 bit alignment */
-                value = max_t(u32, value, 4);
+                value = max_t(u32, value, ALIGNMENT);
                 err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
                                            sizeof(u32));
         }
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
index 3b3e076571d6..45e2efc70d19 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
@@ -79,8 +79,8 @@
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   17
 #define IWL7265_UCODE_API_MIN   17
-#define IWL7265D_UCODE_API_MIN  17
-#define IWL3168_UCODE_API_MIN   20
+#define IWL7265D_UCODE_API_MIN  22
+#define IWL3168_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index b9718c0cf174..89137717c1fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -74,8 +74,8 @@
 #define IWL8265_UCODE_API_MAX   30
 
 /* Lowest firmware API version supported */
-#define IWL8000_UCODE_API_MIN   17
-#define IWL8265_UCODE_API_MIN   20
+#define IWL8000_UCODE_API_MIN   22
+#define IWL8265_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL8000_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 306bc967742e..77efbb78e867 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -370,6 +370,7 @@
 #define MON_DMARB_RD_DATA_ADDR          (0xa03c5c)
 
 #define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
 
 /* enable the ID buf for read */
 #define WFPM_PS_CTL_CLR                 0xA0300C
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
index 1b7d265ffb0a..a10c6aae9ab9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
@@ -307,6 +307,11 @@ enum {
 /* Bit 1-3: LQ command color. Used to match responses to LQ commands */
 #define LQ_FLAG_COLOR_POS               1
 #define LQ_FLAG_COLOR_MSK               (7 << LQ_FLAG_COLOR_POS)
+#define LQ_FLAG_COLOR_GET(_f)           (((_f) & LQ_FLAG_COLOR_MSK) >>\
+                                         LQ_FLAG_COLOR_POS)
+#define LQ_FLAGS_COLOR_INC(_c)          ((((_c) + 1) << LQ_FLAG_COLOR_POS) &\
+                                         LQ_FLAG_COLOR_MSK)
+#define LQ_FLAG_COLOR_SET(_f, _c)       ((_c) | ((_f) & ~LQ_FLAG_COLOR_MSK))
 
 /* Bit 4-5: Tx RTS BW Signalling
  * (0) No RTS BW signalling
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
index 81b98915b1a4..1360ebfdc51b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
@@ -519,8 +519,11 @@ struct agg_tx_status {
  * bit-7 invalid rate indication
  */
 #define TX_RES_INIT_RATE_INDEX_MSK 0x0f
+#define TX_RES_RATE_TABLE_COLOR_POS 4
 #define TX_RES_RATE_TABLE_COLOR_MSK 0x70
 #define TX_RES_INV_RATE_INDEX_MSK 0x80
+#define TX_RES_RATE_TABLE_COL_GET(_f) (((_f) & TX_RES_RATE_TABLE_COLOR_MSK) >>\
+                                       TX_RES_RATE_TABLE_COLOR_POS)
 
 #define IWL_MVM_TX_RES_GET_TID(_ra_tid) ((_ra_tid) & 0x0f)
 #define IWL_MVM_TX_RES_GET_RA(_ra_tid) ((_ra_tid) >> 4)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 7b86a4f1b574..c8712e6eea74 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -1002,14 +1002,6 @@ int iwl_mvm_fw_dbg_collect_trig(struct iwl_mvm *mvm,
         return 0;
 }
 
-static inline void iwl_mvm_restart_early_start(struct iwl_mvm *mvm)
-{
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
-                iwl_clear_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
-        else
-                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 1);
-}
-
 int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
 {
         u8 *ptr;
@@ -1023,10 +1015,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         /* EARLY START - firmware's configuration is hard coded */
         if ((!mvm->fw->dbg_conf_tlv[conf_id] ||
              !mvm->fw->dbg_conf_tlv[conf_id]->num_of_hcmds) &&
-            conf_id == FW_DBG_START_FROM_ALIVE) {
-                iwl_mvm_restart_early_start(mvm);
+            conf_id == FW_DBG_START_FROM_ALIVE)
                 return 0;
-        }
 
         if (!mvm->fw->dbg_conf_tlv[conf_id])
                 return -EINVAL;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 0f1831b41915..fd2fc46e2fe5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1040,7 +1040,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
                 struct iwl_mac_beacon_cmd_v6 beacon_cmd_v6;
                 struct iwl_mac_beacon_cmd_v7 beacon_cmd;
         } u = {};
-        struct iwl_mac_beacon_cmd beacon_cmd;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
         struct ieee80211_tx_info *info;
         u32 beacon_skb_len;
         u32 rate, tx_flags;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4e74a6b90e70..52f8d7a6a7dc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1730,8 +1730,11 @@ int iwl_mvm_find_free_queue(struct iwl_mvm *mvm, u8 sta_id, u8 minq, u8 maxq);
  */
 static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 {
+        u32 cmd_queue = iwl_mvm_is_dqa_supported(mvm) ? IWL_MVM_DQA_CMD_QUEUE :
+                IWL_MVM_CMD_QUEUE;
+
         return ((BIT(mvm->cfg->base_params->num_of_queues) - 1) &
-                ~BIT(IWL_MVM_CMD_QUEUE));
+                ~BIT(cmd_queue));
 }
 
 static inline
@@ -1753,6 +1756,7 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
         if (!iwl_mvm_has_new_tx_api(mvm))
                 iwl_free_fw_paging(mvm);
         mvm->ucode_loaded = false;
+        mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_trans_stop_device(mvm->trans);
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 9ffff6ed8133..3da5ec40aaea 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1149,21 +1149,37 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
 
         mutex_lock(&mvm->mutex);
 
-        /* stop recording */
         if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                /* stop recording */
                 iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+
+                iwl_mvm_fw_error_dump(mvm);
+
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv)
+                        iwl_clear_bits_prph(mvm->trans,
+                                            MON_BUFF_SAMPLE_CTL, 0x100);
         } else {
+                u32 in_sample = iwl_read_prph(mvm->trans, DBGC_IN_SAMPLE);
+                u32 out_ctrl = iwl_read_prph(mvm->trans, DBGC_OUT_CTRL);
+
+                /* stop recording */
                 iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
-                /* wait before we collect the data till the DBGC stop */
                 udelay(100);
-        }
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+                /* wait before we collect the data till the DBGC stop */
+                udelay(500);
 
-        iwl_mvm_fw_error_dump(mvm);
+                iwl_mvm_fw_error_dump(mvm);
 
-        /* start recording again if the firmware is not crashed */
-        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
-                     mvm->fw->dbg_dest_tlv &&
-                     iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv) {
+                        iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, in_sample);
+                        iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, out_ctrl);
+                }
+        }
 
         mutex_unlock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 7788eefcd2bd..aa785cf3cf68 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2,7 +2,7 @@
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016 Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -1083,34 +1083,6 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
                 rs_get_lower_rate_in_column(lq_sta, rate);
 }
 
-/* Check if both rates are identical
- * allow_ant_mismatch enables matching a SISO rate on ANT_A or ANT_B
- * with a rate indicating STBC/BFER and ANT_AB.
- */
-static inline bool rs_rate_equal(struct rs_rate *a,
-                                 struct rs_rate *b,
-                                 bool allow_ant_mismatch)
-
-{
-        bool ant_match = (a->ant == b->ant) && (a->stbc == b->stbc) &&
-                (a->bfer == b->bfer);
-
-        if (allow_ant_mismatch) {
-                if (a->stbc || a->bfer) {
-                        WARN_ONCE(a->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  a->stbc, a->bfer, a->ant);
-                        ant_match |= (b->ant == ANT_A || b->ant == ANT_B);
-                } else if (b->stbc || b->bfer) {
-                        WARN_ONCE(b->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  b->stbc, b->bfer, b->ant);
-                        ant_match |= (a->ant == ANT_A || a->ant == ANT_B);
-                }
-        }
-
-        return (a->type == b->type) && (a->bw == b->bw) && (a->sgi == b->sgi) &&
-                (a->ldpc == b->ldpc) && (a->index == b->index) && ant_match;
-}
-
 /* Check if both rates share the same column */
 static inline bool rs_rate_column_match(struct rs_rate *a,
                                         struct rs_rate *b)
@@ -1182,12 +1154,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         u32 lq_hwrate;
         struct rs_rate lq_rate, tx_resp_rate;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        u8 reduced_txp = (uintptr_t)info->status.status_driver_data[0];
+        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
+        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
+        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
         u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta;
-        bool allow_ant_mismatch = fw_has_api(&mvm->fw->ucode_capa,
-                                             IWL_UCODE_TLV_API_LQ_SS_PARAMS);
 
         /* Treat uninitialized rate scaling data same as non-existing. */
         if (!lq_sta) {
@@ -1262,10 +1234,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
 
         /* Here we actually compare this rate to the latest LQ command */
-        if (!rs_rate_equal(&tx_resp_rate, &lq_rate, allow_ant_mismatch)) {
+        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
                 IWL_DEBUG_RATE(mvm,
-                               "initial tx resp rate 0x%x does not match 0x%x\n",
-                               tx_resp_hwrate, lq_hwrate);
+                               "tx resp color 0x%x does not match 0x%x\n",
+                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
 
                 /*
                  * Since rates mis-match, the last LQ command may have failed.
@@ -3326,6 +3298,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         u8 valid_tx_ant = 0;
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
         bool toggle_ant = false;
+        u32 color;
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
@@ -3380,6 +3353,9 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
                                  num_rates, num_retries, valid_tx_ant,
                                  toggle_ant);
 
+        /* update the color of the LQ command (as a counter at bits 1-3) */
+        color = LQ_FLAGS_COLOR_INC(LQ_FLAG_COLOR_GET(lq_cmd->flags));
+        lq_cmd->flags = LQ_FLAG_COLOR_SET(lq_cmd->flags, color);
 }
 
 struct rs_bfer_active_iter_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
index ee207f2c0a90..3abde1cb0303 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -2,6 +2,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -357,6 +358,20 @@ struct iwl_lq_sta {
         } pers;
 };
 
+/* ieee80211_tx_info's status_driver_data[0] is packed with lq color and txp
+ * Note, it's iwlmvm <-> mac80211 interface.
+ * bits 0-7: reduced tx power
+ * bits 8-10: LQ command's color
+ */
+#define RS_DRV_DATA_TXP_MSK 0xff
+#define RS_DRV_DATA_LQ_COLOR_POS 8
+#define RS_DRV_DATA_LQ_COLOR_MSK (7 << RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_LQ_COLOR_GET(_f) (((_f) & RS_DRV_DATA_LQ_COLOR_MSK) >>\
+                                      RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_PACK(_c, _p) ((void *)(uintptr_t)\
+                                  (((uintptr_t)_p) |\
+                                   ((_c) << RS_DRV_DATA_LQ_COLOR_POS)))
+
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           enum nl80211_band band, bool init);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index f5c786ddc526..614d67810d05 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2120,7 +2120,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (!iwl_mvm_is_dqa_supported(mvm))
                 return 0;
 
-        if (WARN_ON(vif->type != NL80211_IFTYPE_AP))
+        if (WARN_ON(vif->type != NL80211_IFTYPE_AP &&
+                    vif->type != NL80211_IFTYPE_ADHOC))
                 return -ENOTSUPP;
 
         /*
@@ -2155,6 +2156,16 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 mvmvif->cab_queue = queue;
         } else if (!fw_has_api(&mvm->fw->ucode_capa,
                                IWL_UCODE_TLV_API_STA_TYPE)) {
+                /*
+                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+                 * invalid, so make sure we use the queue we want.
+                 * Note that this is done here as we want to avoid making DQA
+                 * changes in mac80211 layer.
+                 */
+                if (vif->type == NL80211_IFTYPE_ADHOC) {
+                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                        mvmvif->cab_queue = vif->cab_queue;
+                }
                 iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                    &cfg, timeout);
         }
@@ -3321,18 +3332,15 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
 
         /* Get the station from the mvm local station table */
         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
-        if (!mvm_sta) {
-                IWL_ERR(mvm, "Failed to find station\n");
-                return -EINVAL;
-        }
-        sta_id = mvm_sta->sta_id;
+        if (mvm_sta)
+                sta_id = mvm_sta->sta_id;
 
         IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
                       keyconf->keyidx, sta_id);
 
-        if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+        if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))
                 return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
 
         if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 2716cb5483bf..ad62b67dceb2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -313,6 +313,7 @@ enum iwl_mvm_agg_state {
  *      This is basically (last acked packet++).
  * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
  *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @lq_color: the color of the LQ command as it appears in tx response.
  * @amsdu_in_ampdu_allowed: true if A-MSDU in A-MPDU is allowed.
  * @state: state of the BA agreement establishment / tear down.
  * @txq_id: Tx queue used by the BA session / DQA
@@ -331,6 +332,7 @@ struct iwl_mvm_tid_data {
         u16 next_reclaimed;
         /* The rest is Tx AGG related */
         u32 rate_n_flags;
+        u8 lq_color;
         bool amsdu_in_ampdu_allowed;
         enum iwl_mvm_agg_state state;
         u16 txq_id;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index f9cbd197246f..506d58104e1c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -790,11 +790,13 @@ static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
         struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
         int ret;
 
-        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
-                return -EIO;
-
         mutex_lock(&mvm->mutex);
 
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto unlock;
+        }
+
         if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
                 ret = -EINVAL;
                 goto unlock;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index bcaceb64a6e8..f21901cd4a4f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1323,6 +1323,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct sk_buff_head skbs;
         u8 skb_freed = 0;
+        u8 lq_color;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
 
@@ -1405,8 +1406,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                 info->status.tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
                 BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
+                lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
                 info->status.status_driver_data[0] =
-                                (void *)(uintptr_t)tx_resp->reduced_tpc;
+                        RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);
 
                 ieee80211_tx_status(mvm->hw, skb);
         }
@@ -1638,6 +1640,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
                         le32_to_cpu(tx_resp->initial_rate);
                 mvmsta->tid_data[tid].tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
+                mvmsta->tid_data[tid].lq_color =
+                        (tx_resp->tlc_info & TX_RES_RATE_TABLE_COLOR_MSK) >>
+                        TX_RES_RATE_TABLE_COLOR_POS;
         }
 
         rcu_read_unlock();
@@ -1707,6 +1712,11 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
         iwl_mvm_check_ratid_empty(mvm, sta, tid);
 
         freed = 0;
+
+        /* pack lq color from tid_data along the reduced txp */
+        ba_info->status.status_driver_data[0] =
+                RS_DRV_DATA_PACK(tid_data->lq_color,
+                                 ba_info->status.status_driver_data[0]);
         ba_info->status.status_driver_data[1] = (void *)(uintptr_t)rate;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 70acf850a9f1..93cbc7a69bcd 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2803,7 +2803,8 @@ static struct iwl_trans_dump_data
 #ifdef CONFIG_PM_SLEEP
 static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 return iwl_pci_fw_enter_d0i3(trans);
 
         return 0;
@@ -2811,7 +2812,8 @@ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_resume(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 iwl_pci_fw_exit_d0i3(trans);
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..9c9bfbbabdf1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -906,7 +906,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
 
         if (WARN_ON(iwl_rx_packet_payload_len(hcmd.resp_pkt) != sizeof(*rsp))) {
                 ret = -EINVAL;
-                goto error;
+                goto error_free_resp;
         }
 
         rsp = (void *)hcmd.resp_pkt->data;
@@ -915,13 +915,13 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
         if (qid > ARRAY_SIZE(trans_pcie->txq)) {
                 WARN_ONCE(1, "queue index %d unsupported", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         if (test_and_set_bit(qid, trans_pcie->queue_used)) {
                 WARN_ONCE(1, "queue %d already used", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         txq->id = qid;
@@ -934,8 +934,11 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
                            (txq->write_ptr) | (qid << 16));
         IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d\n", qid);
 
+        iwl_free_resp(&hcmd);
         return qid;
 
+error_free_resp:
+        iwl_free_resp(&hcmd);
 error:
         iwl_pcie_gen2_txq_free_memory(trans, txq);
         return ret;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index a60926410438..903d5813023a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(max_retries, "max number of retries a command may have");
 static int nvme_char_major;
 module_param(nvme_char_major, int, 0);
 
-static unsigned long default_ps_max_latency_us = 25000;
+static unsigned long default_ps_max_latency_us = 100000;
 module_param(default_ps_max_latency_us, ulong, 0644);
 MODULE_PARM_DESC(default_ps_max_latency_us,
                  "max power saving latency for new devices; use PM QOS to change per device");
@@ -1342,7 +1342,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
          * transitioning between power states.  Therefore, when running
          * in any given state, we will enter the next lower-power
          * non-operational state after waiting 50 * (enlat + exlat)
-         * microseconds, as long as that state's total latency is under
+         * microseconds, as long as that state's exit latency is under
          * the requested maximum latency.
          *
          * We will not autonomously enter any non-operational state for
@@ -1387,7 +1387,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                  * lowest-power state, not the number of states.
                  */
                 for (state = (int)ctrl->npss; state >= 0; state--) {
-                        u64 total_latency_us, transition_ms;
+                        u64 total_latency_us, exit_latency_us, transition_ms;
 
                         if (target)
                                 table->entries[state] = target;
@@ -1408,12 +1408,15 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                               NVME_PS_FLAGS_NON_OP_STATE))
                                 continue;
 
-                        total_latency_us =
-                                (u64)le32_to_cpu(ctrl->psd[state].entry_lat) +
-                                + le32_to_cpu(ctrl->psd[state].exit_lat);
-                        if (total_latency_us > ctrl->ps_max_latency_us)
+                        exit_latency_us =
+                                (u64)le32_to_cpu(ctrl->psd[state].exit_lat);
+                        if (exit_latency_us > ctrl->ps_max_latency_us)
                                 continue;
 
+                        total_latency_us =
+                                exit_latency_us +
+                                le32_to_cpu(ctrl->psd[state].entry_lat);
+
                         /*
                          * This state is good.  Use it as the APST idle
                          * target for higher power states.
@@ -2438,6 +2441,10 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns;
 
         mutex_lock(&ctrl->namespaces_mutex);
+
+        /* Forcibly start all queues to avoid having stuck requests */
+        blk_mq_start_hw_queues(ctrl->admin_q);
+
         list_for_each_entry(ns, &ctrl->namespaces, list) {
                 /*
                  * Revalidating a dead namespace sets capacity to 0. This will
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 5b14cbefb724..92964cef0f4b 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1139,6 +1139,7 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 /* *********************** NVME Ctrl Routines **************************** */
 
 static void __nvme_fc_final_op_cleanup(struct request *rq);
+static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
 nvme_fc_reinit_request(void *data, struct request *rq)
@@ -1265,7 +1266,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         struct nvme_command *sqe = &op->cmd_iu.sqe;
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
-        bool complete_rq;
+        bool complete_rq, terminate_assoc = true;
 
         /*
          * WARNING:
@@ -1294,6 +1295,14 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * fabricate a CQE, the following fields will not be set as they
          * are not referenced:
          *      cqe.sqid,  cqe.sqhd,  cqe.command_id
+         *
+         * Failure or error of an individual i/o, in a transport
+         * detected fashion unrelated to the nvme completion status,
+         * potentially cause the initiator and target sides to get out
+         * of sync on SQ head/tail (aka outstanding io count allowed).
+         * Per FC-NVME spec, failure of an individual command requires
+         * the connection to be terminated, which in turn requires the
+         * association to be terminated.
          */
 
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
@@ -1359,6 +1368,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 goto done;
         }
 
+        terminate_assoc = false;
+
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
@@ -1366,7 +1377,7 @@ done:
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
-                return;
+                goto check_error;
         }
 
         complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
@@ -1379,6 +1390,10 @@ done:
                 nvme_end_request(rq, status, result);
         } else
                 __nvme_fc_final_op_cleanup(rq);
+
+check_error:
+        if (terminate_assoc)
+                nvme_fc_error_recovery(ctrl, "transport detected io error");
 }
 
 static int
@@ -2791,6 +2806,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 ctrl->ctrl.opts = NULL;
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
+                nvme_put_ctrl(&ctrl->ctrl);
 
                 /* as we're past the point where we transition to the ref
                  * counting teardown path, if we return a bad pointer here,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d52701df7245..951042a375d6 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1367,7 +1367,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO);
 
         /* If there is a reset ongoing, we shouldn't reset again. */
-        if (work_busy(&dev->reset_work))
+        if (dev->ctrl.state == NVME_CTRL_RESETTING)
                 return false;
 
         /* We shouldn't reset unless the controller is on fatal error state
@@ -1903,7 +1903,7 @@ static void nvme_reset_work(struct work_struct *work)
         bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
         int result = -ENODEV;
 
-        if (WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING))
+        if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
                 goto out;
 
         /*
@@ -1913,9 +1913,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
-                goto out;
-
         result = nvme_pci_enable(dev);
         if (result)
                 goto out;
@@ -2009,8 +2006,8 @@ static int nvme_reset(struct nvme_dev *dev)
 {
         if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
                 return -ENODEV;
-        if (work_busy(&dev->reset_work))
-                return -ENODEV;
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
+                return -EBUSY;
         if (!queue_work(nvme_workq, &dev->reset_work))
                 return -EBUSY;
         return 0;
@@ -2136,6 +2133,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (result)
                 goto release_pools;
 
+        nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING);
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
         queue_work(nvme_workq, &dev->reset_work);
@@ -2179,6 +2177,7 @@ static void nvme_remove(struct pci_dev *pdev)
 
         nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
 
+        cancel_work_sync(&dev->reset_work);
         pci_set_drvdata(pdev, NULL);
 
         if (!pci_device_is_present(pdev)) {
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 28bd255c144d..24397d306d53 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -753,28 +753,26 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         if (ret)
                 goto requeue;
 
-        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
-
         ret = nvmf_connect_admin_queue(&ctrl->ctrl);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
 
         ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         nvme_start_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 ret = nvme_rdma_init_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
 
                 ret = nvme_rdma_connect_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -782,7 +780,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
-                nvme_start_queues(&ctrl->ctrl);
                 nvme_queue_scan(&ctrl->ctrl);
                 nvme_queue_async_events(&ctrl->ctrl);
         }
@@ -791,8 +788,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
 
         return;
 
-stop_admin_q:
-        blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
 requeue:
         dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
                         ctrl->ctrl.opts->nr_reconnects);
@@ -823,6 +818,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                 nvme_cancel_request, &ctrl->ctrl);
 
+        /*
+         * queues are not a live anymore, so restart the queues to fail fast
+         * new IO
+         */
+        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
+        nvme_start_queues(&ctrl->ctrl);
+
         nvme_rdma_reconnect_or_remove(ctrl);
 }
 
@@ -1433,7 +1435,7 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
 /*
  * We cannot accept any other command until the Connect command has completed.
  */
-static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+static inline int nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
                 struct request *rq)
 {
         if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
@@ -1441,11 +1443,22 @@ static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
 
                 if (!blk_rq_is_passthrough(rq) ||
                     cmd->common.opcode != nvme_fabrics_command ||
-                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
-                        return false;
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect) {
+                        /*
+                         * reconnecting state means transport disruption, which
+                         * can take a long time and even might fail permanently,
+                         * so we can't let incoming I/O be requeued forever.
+                         * fail it fast to allow upper layers a chance to
+                         * failover.
+                         */
+                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING)
+                                return -EIO;
+                        else
+                                return -EAGAIN;
+                }
         }
 
-        return true;
+        return 0;
 }
 
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1463,8 +1476,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         WARN_ON_ONCE(rq->tag < 0);
 
-        if (!nvme_rdma_queue_is_ready(queue, rq))
-                return BLK_MQ_RQ_QUEUE_BUSY;
+        ret = nvme_rdma_queue_is_ready(queue, rq);
+        if (unlikely(ret))
+                goto err;
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 9416d052cb89..28c38c756f92 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -144,8 +144,8 @@ int of_dma_configure(struct device *dev, struct device_node *np)
                 coherent ? " " : " not ");
 
         iommu = of_iommu_configure(dev, np);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         dev_dbg(dev, "device is%sbehind an iommu\n",
                 iommu ? " " : " not ");
diff --git a/drivers/phy/phy-qcom-qmp.c b/drivers/phy/phy-qcom-qmp.c
index 727e23be7cac..78ca62897784 100644
--- a/drivers/phy/phy-qcom-qmp.c
+++ b/drivers/phy/phy-qcom-qmp.c
@@ -844,7 +844,7 @@ static int qcom_qmp_phy_vreg_init(struct device *dev)
         int num = qmp->cfg->num_vregs;
         int i;
 
-        qmp->vregs = devm_kcalloc(dev, num, sizeof(qmp->vregs), GFP_KERNEL);
+        qmp->vregs = devm_kcalloc(dev, num, sizeof(*qmp->vregs), GFP_KERNEL);
         if (!qmp->vregs)
                 return -ENOMEM;
 
@@ -983,16 +983,16 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
          * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
          */
         qphy->tx = of_iomap(np, 0);
-        if (IS_ERR(qphy->tx))
-                return PTR_ERR(qphy->tx);
+        if (!qphy->tx)
+                return -ENOMEM;
 
         qphy->rx = of_iomap(np, 1);
-        if (IS_ERR(qphy->rx))
-                return PTR_ERR(qphy->rx);
+        if (!qphy->rx)
+                return -ENOMEM;
 
         qphy->pcs = of_iomap(np, 2);
-        if (IS_ERR(qphy->pcs))
-                return PTR_ERR(qphy->pcs);
+        if (!qphy->pcs)
+                return -ENOMEM;
 
         /*
          * Get PHY's Pipe clock, if any. USB3 and PCIe are PIPE3
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 2de1e603bd2b..5f3672153b12 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -704,7 +704,7 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
                 /* Reallocate the array */
                 u32 new_capacity = 2 * dev->pipes_capacity;
                 struct goldfish_pipe **pipes =
-                        kcalloc(new_capacity, sizeof(*pipes), GFP_KERNEL);
+                        kcalloc(new_capacity, sizeof(*pipes), GFP_ATOMIC);
                 if (!pipes)
                         return -ENOMEM;
                 memcpy(pipes, dev->pipes, sizeof(*pipes) * dev->pipes_capacity);
diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index 35ce53edabf9..d5e5229308f2 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c
@@ -155,3 +155,5 @@ static int __init hi6220_reset_init(void)
 }
 
 postcore_initcall(hi6220_reset_init);
+
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
index e72abbc18ee3..a66a317f3e4f 100644
--- a/drivers/s390/cio/vfio_ccw_ops.c
+++ b/drivers/s390/cio/vfio_ccw_ops.c
@@ -70,14 +70,14 @@ static ssize_t name_show(struct kobject *kobj, struct device *dev, char *buf)
 {
         return sprintf(buf, "I/O subchannel (Non-QDIO)\n");
 }
-MDEV_TYPE_ATTR_RO(name);
+static MDEV_TYPE_ATTR_RO(name);
 
 static ssize_t device_api_show(struct kobject *kobj, struct device *dev,
                                char *buf)
 {
         return sprintf(buf, "%s\n", VFIO_DEVICE_API_CCW_STRING);
 }
-MDEV_TYPE_ATTR_RO(device_api);
+static MDEV_TYPE_ATTR_RO(device_api);
 
 static ssize_t available_instances_show(struct kobject *kobj,
                                         struct device *dev, char *buf)
@@ -86,7 +86,7 @@ static ssize_t available_instances_show(struct kobject *kobj,
 
         return sprintf(buf, "%d\n", atomic_read(&private->avail));
 }
-MDEV_TYPE_ATTR_RO(available_instances);
+static MDEV_TYPE_ATTR_RO(available_instances);
 
 static struct attribute *mdev_types_attrs[] = {
         &mdev_type_attr_name.attr,
@@ -100,7 +100,7 @@ static struct attribute_group mdev_type_group = {
         .attrs = mdev_types_attrs,
 };
 
-struct attribute_group *mdev_type_groups[] = {
+static struct attribute_group *mdev_type_groups[] = {
         &mdev_type_group,
         NULL,
 };
@@ -152,7 +152,7 @@ static int vfio_ccw_mdev_open(struct mdev_device *mdev)
                                       &events, &private->nb);
 }
 
-void vfio_ccw_mdev_release(struct mdev_device *mdev)
+static void vfio_ccw_mdev_release(struct mdev_device *mdev)
 {
         struct vfio_ccw_private *private =
                 dev_get_drvdata(mdev_parent_dev(mdev));
@@ -233,7 +233,7 @@ static int vfio_ccw_mdev_get_region_info(struct vfio_region_info *info,
         }
 }
 
-int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
+static int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
 {
         if (info->index != VFIO_CCW_IO_IRQ_INDEX)
                 return -EINVAL;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 9be4596d8a08..ea099910b4e9 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -668,10 +668,28 @@ static int ap_device_probe(struct device *dev)
         struct ap_driver *ap_drv = to_ap_drv(dev->driver);
         int rc;
 
+        /* Add queue/card to list of active queues/cards */
+        spin_lock_bh(&ap_list_lock);
+        if (is_card_dev(dev))
+                list_add(&to_ap_card(dev)->list, &ap_card_list);
+        else
+                list_add(&to_ap_queue(dev)->list,
+                         &to_ap_queue(dev)->card->queues);
+        spin_unlock_bh(&ap_list_lock);
+
         ap_dev->drv = ap_drv;
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (rc)
+
+        if (rc) {
+                spin_lock_bh(&ap_list_lock);
+                if (is_card_dev(dev))
+                        list_del_init(&to_ap_card(dev)->list);
+                else
+                        list_del_init(&to_ap_queue(dev)->list);
+                spin_unlock_bh(&ap_list_lock);
                 ap_dev->drv = NULL;
+        }
+
         return rc;
 }
 
@@ -680,14 +698,17 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (ap_drv->remove)
+                ap_drv->remove(ap_dev);
+
+        /* Remove queue/card from list of active queues/cards */
         spin_lock_bh(&ap_list_lock);
         if (is_card_dev(dev))
                 list_del_init(&to_ap_card(dev)->list);
         else
                 list_del_init(&to_ap_queue(dev)->list);
         spin_unlock_bh(&ap_list_lock);
-        if (ap_drv->remove)
-                ap_drv->remove(ap_dev);
+
         return 0;
 }
 
@@ -1056,10 +1077,6 @@ static void ap_scan_bus(struct work_struct *unused)
                                 }
                                 /* get it and thus adjust reference counter */
                                 get_device(&ac->ap_dev.device);
-                                /* Add card device to card list */
-                                spin_lock_bh(&ap_list_lock);
-                                list_add(&ac->list, &ap_card_list);
-                                spin_unlock_bh(&ap_list_lock);
                         }
                         /* now create the new queue device */
                         aq = ap_queue_create(qid, type);
@@ -1070,10 +1087,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Add queue device to card queue list */
-                        spin_lock_bh(&ap_list_lock);
-                        list_add(&aq->list, &ac->queues);
-                        spin_unlock_bh(&ap_list_lock);
                         /* Start with a device reset */
                         spin_lock_bh(&aq->lock);
                         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
@@ -1081,9 +1094,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
-                                spin_lock_bh(&ap_list_lock);
-                                list_del_init(&aq->list);
-                                spin_unlock_bh(&ap_list_lock);
                                 put_device(&aq->ap_dev.device);
                                 continue;
                         }
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index cfa161ccc74e..836efac96813 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -160,7 +160,14 @@ static struct device_type ap_card_type = {
 
 static void ap_card_device_release(struct device *dev)
 {
-        kfree(to_ap_card(dev));
+        struct ap_card *ac = to_ap_card(dev);
+
+        if (!list_empty(&ac->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&ac->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(ac);
 }
 
 struct ap_card *ap_card_create(int id, int queue_depth, int device_type,
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 480c58a63769..0f1a5d02acb0 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -584,7 +584,14 @@ static struct device_type ap_queue_type = {
 
 static void ap_queue_device_release(struct device *dev)
 {
-        kfree(to_ap_queue(dev));
+        struct ap_queue *aq = to_ap_queue(dev);
+
+        if (!list_empty(&aq->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&aq->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(aq);
 }
 
 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
index 4fc8ed5fe067..1f424e40afdf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc.h
+++ b/drivers/scsi/bnx2fc/bnx2fc.h
@@ -191,6 +191,7 @@ struct bnx2fc_hba {
         struct bnx2fc_cmd_mgr *cmd_mgr;
         spinlock_t hba_lock;
         struct mutex hba_mutex;
+        struct mutex hba_stats_mutex;
         unsigned long adapter_state;
                 #define ADAPTER_STATE_UP                0
                 #define ADAPTER_STATE_GOING_DOWN        1
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 93b5a0012417..902722dc4ce3 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -663,15 +663,17 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
         if (!fw_stats)
                 return NULL;
 
+        mutex_lock(&hba->hba_stats_mutex);
+
         bnx2fc_stats = fc_get_host_stats(shost);
 
         init_completion(&hba->stat_req_done);
         if (bnx2fc_send_stat_req(hba))
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ));
         if (!rc) {
                 BNX2FC_HBA_DBG(lport, "FW stat req timed out\n");
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         }
         BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt);
         bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt;
@@ -693,6 +695,9 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
 
         memcpy(&hba->prev_stats, hba->stats_buffer,
                sizeof(struct fcoe_statistics_params));
+
+unlock_stats_mutex:
+        mutex_unlock(&hba->hba_stats_mutex);
         return bnx2fc_stats;
 }
 
@@ -1340,6 +1345,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic)
         }
         spin_lock_init(&hba->hba_lock);
         mutex_init(&hba->hba_mutex);
+        mutex_init(&hba->hba_stats_mutex);
 
         hba->cnic = cnic;
 
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 1076c1578322..0aae094ab91c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1595,7 +1595,6 @@ static void release_offload_resources(struct cxgbi_sock *csk)
                 cxgbi_sock_put(csk);
         }
         csk->dst = NULL;
-        csk->cdev = NULL;
 }
 
 static int init_act_open(struct cxgbi_sock *csk)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index fb06974c88c1..e4c83b7c96a8 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -867,7 +867,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         log_debug(1 << CXGBI_DBG_SOCK, "csk 0x%p,%u,0x%lx,%u.\n",
                 csk, (csk)->state, (csk)->flags, (csk)->tid);
         spin_lock_bh(&csk->lock);
-        dst_confirm(csk->dst);
+        if (csk->dst)
+                dst_confirm(csk->dst);
         data_lost = skb_queue_len(&csk->receive_queue);
         __skb_queue_purge(&csk->receive_queue);
 
@@ -882,7 +883,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         }
 
         if (close_req) {
-                if (data_lost)
+                if (!cxgbi_sock_flag(csk, CTPF_LOGOUT_RSP_RCVD) ||
+                    data_lost)
                         csk->cdev->csk_send_abort_req(csk);
                 else
                         csk->cdev->csk_send_close_req(csk);
@@ -1186,9 +1188,10 @@ static int cxgbi_sock_send_pdus(struct cxgbi_sock *csk, struct sk_buff *skb)
                                 cxgbi_ulp_extra_len(cxgbi_skcb_ulp_mode(skb));
                 skb = next;
         }
-done:
+
         if (likely(skb_queue_len(&csk->write_queue)))
                 cdev->csk_push_tx_frames(csk, 1);
+done:
         spin_unlock_bh(&csk->lock);
         return copied;
 
@@ -1568,9 +1571,12 @@ static inline int read_pdu_skb(struct iscsi_conn *conn,
         }
 }
 
-static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
+static int
+skb_read_pdu_bhs(struct cxgbi_sock *csk, struct iscsi_conn *conn,
+                 struct sk_buff *skb)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+        int err;
 
         log_debug(1 << CXGBI_DBG_PDU_RX,
                 "conn 0x%p, skb 0x%p, len %u, flag 0x%lx.\n",
@@ -1608,7 +1614,16 @@ static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
                 }
         }
 
-        return read_pdu_skb(conn, skb, 0, 0);
+        err = read_pdu_skb(conn, skb, 0, 0);
+        if (likely(err >= 0)) {
+                struct iscsi_hdr *hdr = (struct iscsi_hdr *)skb->data;
+                u8 opcode = hdr->opcode & ISCSI_OPCODE_MASK;
+
+                if (unlikely(opcode == ISCSI_OP_LOGOUT_RSP))
+                        cxgbi_sock_set_flag(csk, CTPF_LOGOUT_RSP_RCVD);
+        }
+
+        return err;
 }
 
 static int skb_read_pdu_data(struct iscsi_conn *conn, struct sk_buff *lskb,
@@ -1713,7 +1728,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                         cxgbi_skcb_rx_pdulen(skb));
 
                 if (cxgbi_skcb_test_flag(skb, SKCBF_RX_COALESCED)) {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("coalesced bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1731,7 +1746,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                                         cxgbi_skcb_flags(skb),
                                         cxgbi_skcb_rx_pdulen(skb));
                 } else {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 239462a75760..37f07aaab1e4 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -187,6 +187,7 @@ enum cxgbi_sock_flags {
         CTPF_HAS_ATID,          /* reserved atid */
         CTPF_HAS_TID,           /* reserved hw tid */
         CTPF_OFFLOAD_DOWN,      /* offload function off */
+        CTPF_LOGOUT_RSP_RCVD,   /* received logout response */
 };
 
 struct cxgbi_skb_rx_cb {
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 8912767e7bc8..da669dce12fe 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -127,7 +127,7 @@ int lpfc_disc_state_machine(struct lpfc_vport *, struct lpfc_nodelist *, void *,
 void lpfc_do_scr_ns_plogi(struct lpfc_hba *, struct lpfc_vport *);
 int lpfc_check_sparm(struct lpfc_vport *, struct lpfc_nodelist *,
                      struct serv_parm *, uint32_t, int);
-int lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
+void lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
 void lpfc_more_plogi(struct lpfc_vport *);
 void lpfc_more_adisc(struct lpfc_vport *);
 void lpfc_end_rscn(struct lpfc_vport *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index f2cd19c6c2df..24ce96dcc94d 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -978,9 +978,10 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                                          ndlp, did, ndlp->nlp_fc4_type,
                                          FC_TYPE_FCP, FC_TYPE_NVME);
                         ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
+
+                        lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
+                        lpfc_issue_els_prli(vport, ndlp, 0);
                 }
-                lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
-                lpfc_issue_els_prli(vport, ndlp, 0);
         } else
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_DISCOVERY,
                                  "3065 GFT_ID failed x%08x\n", irsp->ulpStatus);
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index bff3de053df4..f74cb0142fd4 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -206,7 +206,7 @@ lpfc_check_elscmpl_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
  * associated with a LPFC_NODELIST entry. This
  * routine effectively results in a "software abort".
  */
-int
+void
 lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 {
         LIST_HEAD(abort_list);
@@ -215,6 +215,10 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 
         pring = lpfc_phba_elsring(phba);
 
+        /* In case of error recovery path, we might have a NULL pring here */
+        if (!pring)
+                return;
+
         /* Abort outstanding I/O on NPort <nlp_DID> */
         lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_DISCOVERY,
                          "2819 Abort outstanding I/O on NPort x%x "
@@ -273,7 +277,6 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
                               IOSTAT_LOCAL_REJECT, IOERR_SLI_ABORTED);
 
         lpfc_cancel_retry_delay_tmo(phba->pport, ndlp);
-        return 0;
 }
 
 static int
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 074a6b5e7763..518b15e6f222 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -799,8 +799,8 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         }
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
 
-        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid,
-                         ctxp->state, 0);
+        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d abt %d\n", ctxp->oxid,
+                         ctxp->state, aborting);
 
         atomic_inc(&lpfc_nvmep->xmt_fcp_release);
 
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 16d1cd50feed..ca3420de5a01 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -730,6 +730,8 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
                 return -EIO;
         }
 
+        memset(&elreq, 0, sizeof(elreq));
+
         elreq.req_sg_cnt = dma_map_sg(&ha->pdev->dev,
                 bsg_job->request_payload.sg_list, bsg_job->request_payload.sg_cnt,
                 DMA_TO_DEVICE);
@@ -795,10 +797,9 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
 
         if (atomic_read(&vha->loop_state) == LOOP_READY &&
             (ha->current_topology == ISP_CFG_F ||
-            ((IS_QLA81XX(ha) || IS_QLA8031(ha) || IS_QLA8044(ha)) &&
-            le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE
-            && req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
-                elreq.options == EXTERNAL_LOOPBACK) {
+            (le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE &&
+             req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
+            elreq.options == EXTERNAL_LOOPBACK) {
                 type = "FC_BSG_HST_VENDOR_ECHO_DIAG";
                 ql_dbg(ql_dbg_user, vha, 0x701e,
                     "BSG request type: %s.\n", type);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 51b4179469d1..88748a6ab73f 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -1131,7 +1131,7 @@ qla24xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
@@ -2090,7 +2090,7 @@ qla83xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index ae119018dfaa..eddbc1218a39 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -3425,6 +3425,7 @@ struct qla_hw_data {
         uint8_t         max_req_queues;
         uint8_t         max_rsp_queues;
         uint8_t         max_qpairs;
+        uint8_t         num_qpairs;
         struct qla_qpair *base_qpair;
         struct qla_npiv_entry *npiv_info;
         uint16_t        nvram_npiv_size;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 034743309ada..0391fc317003 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -7543,12 +7543,13 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, int v
                 /* Assign available que pair id */
                 mutex_lock(&ha->mq_lock);
                 qpair_id = find_first_zero_bit(ha->qpair_qid_map, ha->max_qpairs);
-                if (qpair_id >= ha->max_qpairs) {
+                if (ha->num_qpairs >= ha->max_qpairs) {
                         mutex_unlock(&ha->mq_lock);
                         ql_log(ql_log_warn, vha, 0x0183,
                             "No resources to create additional q pair.\n");
                         goto fail_qid_map;
                 }
+                ha->num_qpairs++;
                 set_bit(qpair_id, ha->qpair_qid_map);
                 ha->queue_pair_map[qpair_id] = qpair;
                 qpair->id = qpair_id;
@@ -7635,6 +7636,7 @@ fail_rsp:
 fail_msix:
         ha->queue_pair_map[qpair_id] = NULL;
         clear_bit(qpair_id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         mutex_unlock(&ha->mq_lock);
 fail_qid_map:
         kfree(qpair);
@@ -7660,6 +7662,7 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair)
         mutex_lock(&ha->mq_lock);
         ha->queue_pair_map[qpair->id] = NULL;
         clear_bit(qpair->id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         list_del(&qpair->qp_list_elem);
         if (list_empty(&vha->qp_list))
                 vha->flags.qpairs_available = 0;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 66df6cec59da..c61a6a871c8e 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -129,28 +129,16 @@ qla2x00_clear_loop_id(fc_port_t *fcport) {
 }
 
 static inline void
-qla2x00_clean_dsd_pool(struct qla_hw_data *ha, srb_t *sp,
-        struct qla_tgt_cmd *tc)
+qla2x00_clean_dsd_pool(struct qla_hw_data *ha, struct crc_context *ctx)
 {
-        struct dsd_dma *dsd_ptr, *tdsd_ptr;
-        struct crc_context *ctx;
-
-        if (sp)
-                ctx = (struct crc_context *)GET_CMD_CTX_SP(sp);
-        else if (tc)
-                ctx = (struct crc_context *)tc->ctx;
-        else {
-                BUG();
-                return;
-        }
+        struct dsd_dma *dsd, *tdsd;
 
         /* clean up allocated prev pool */
-        list_for_each_entry_safe(dsd_ptr, tdsd_ptr,
-            &ctx->dsd_list, list) {
-                dma_pool_free(ha->dl_dma_pool, dsd_ptr->dsd_addr,
-                    dsd_ptr->dsd_list_dma);
-                list_del(&dsd_ptr->list);
-                kfree(dsd_ptr);
+        list_for_each_entry_safe(dsd, tdsd, &ctx->dsd_list, list) {
+                dma_pool_free(ha->dl_dma_pool, dsd->dsd_addr,
+                    dsd->dsd_list_dma);
+                list_del(&dsd->list);
+                kfree(dsd);
         }
         INIT_LIST_HEAD(&ctx->dsd_list);
 }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index aac03504d9a3..2572121b765b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3282,7 +3282,7 @@ msix_register_fail:
         }
 
         /* Enable MSI-X vector for response queue update for queue 0 */
-        if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
+        if (IS_QLA25XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                 if (ha->msixbase && ha->mqiobase &&
                     (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 ||
                      ql2xmqsupport))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index a113ab3592a7..cba1fc5e8be9 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3676,15 +3676,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                                 qlt_update_host_map(vha, id);
                         }
 
-                        fc_host_port_name(vha->host) =
-                            wwn_to_u64(vha->port_name);
-
-                        if (qla_ini_mode_enabled(vha))
-                                ql_dbg(ql_dbg_mbx, vha, 0x1018,
-                                    "FA-WWN portname %016llx (%x)\n",
-                                    fc_host_port_name(vha->host),
-                                    rptid_entry->vp_status);
-
                         set_bit(REGISTER_FC4_NEEDED, &vha->dpc_flags);
                         set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
                 } else {
@@ -4821,9 +4812,9 @@ qla2x00_echo_test(scsi_qla_host_t *vha, struct msg_echo_lb *mreq,
 
         memset(mcp->mb, 0 , sizeof(mcp->mb));
         mcp->mb[0] = MBC_DIAGNOSTIC_ECHO;
-        mcp->mb[1] = mreq->options | BIT_6;     /* BIT_6 specifies 64bit address */
+        /* BIT_6 specifies 64bit address */
+        mcp->mb[1] = mreq->options | BIT_15 | BIT_6;
         if (IS_CNA_CAPABLE(ha)) {
-                mcp->mb[1] |= BIT_15;
                 mcp->mb[2] = vha->fcoe_fcf_idx;
         }
         mcp->mb[16] = LSW(mreq->rcv_dma);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1c7957903283..79f050256c55 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -630,29 +630,34 @@ qla2x00_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx0, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
+                struct ct6_dsd *ctx1 = ctx;
 
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
-                        ctx1->fcp_cmnd_dma);
+                    ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
                 ha->gbl_dsd_inuse -= ctx1->dsd_use_cnt;
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
 
+end:
         CMD_SP(cmd) = NULL;
         qla2x00_rel_sp(sp);
 }
@@ -699,21 +704,24 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
-
+                struct ct6_dsd *ctx1 = ctx;
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
                     ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
@@ -721,7 +729,7 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
-
+end:
         CMD_SP(cmd) = NULL;
         qla2xxx_rel_qpair_sp(sp->qpair, sp);
 }
@@ -1632,7 +1640,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 void
 qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
 {
-        int que, cnt;
+        int que, cnt, status;
         unsigned long flags;
         srb_t *sp;
         struct qla_hw_data *ha = vha->hw;
@@ -1662,8 +1670,12 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                          */
                                         sp_get(sp);
                                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
-                                        qla2xxx_eh_abort(GET_CMD_SP(sp));
+                                        status = qla2xxx_eh_abort(GET_CMD_SP(sp));
                                         spin_lock_irqsave(&ha->hardware_lock, flags);
+                                        /* Get rid of extra reference if immediate exit
+                                         * from ql2xxx_eh_abort */
+                                        if (status == FAILED && (qla2x00_isp_reg_stat(ha)))
+                                                atomic_dec(&sp->ref_count);
                                 }
                                 req->outstanding_cmds[cnt] = NULL;
                                 sp->done(sp, res);
@@ -2623,10 +2635,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         if (mem_only) {
                 if (pci_enable_device_mem(pdev))
-                        goto probe_out;
+                        return ret;
         } else {
                 if (pci_enable_device(pdev))
-                        goto probe_out;
+                        return ret;
         }
 
         /* This may fail but that's ok */
@@ -2636,7 +2648,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         if (!ha) {
                 ql_log_pci(ql_log_fatal, pdev, 0x0009,
                     "Unable to allocate memory for ha.\n");
-                goto probe_out;
+                goto disable_device;
         }
         ql_dbg_pci(ql_dbg_init, pdev, 0x000a,
             "Memory allocated for ha=%p.\n", ha);
@@ -3254,7 +3266,7 @@ iospace_config_failed:
         pci_release_selected_regions(ha->pdev, ha->bars);
         kfree(ha);
 
-probe_out:
+disable_device:
         pci_disable_device(pdev);
         return ret;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0e03ca2ab3e5..e766d8412384 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2245,11 +2245,13 @@ static void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
                 pci_unmap_sg(ha->pdev, cmd->prot_sg, cmd->prot_sg_cnt,
                         cmd->dma_data_direction);
 
+        if (!cmd->ctx)
+                return;
+
         if (cmd->ctx_dsd_alloced)
-                qla2x00_clean_dsd_pool(ha, NULL, cmd);
+                qla2x00_clean_dsd_pool(ha, cmd->ctx);
 
-        if (cmd->ctx)
-                dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
+        dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
 }
 
 static int qlt_check_reserve_free_req(struct scsi_qla_host *vha,
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 8a58ef3adab4..c197972a3e2d 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -371,7 +371,7 @@ qla27xx_fwdt_entry_t262(struct scsi_qla_host *vha,
                 goto done;
         }
 
-        if (end <= start || start == 0 || end == 0) {
+        if (end < start || start == 0 || end == 0) {
                 ql_dbg(ql_dbg_misc, vha, 0xd023,
                     "%s: unusable range (start=%x end=%x)\n", __func__,
                     ent->t262.end_addr, ent->t262.start_addr);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 17249c3650fe..dc095a292c61 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1404,7 +1404,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
         arr[5] = (int)have_dif_prot;    /* PROTECT bit */
         if (sdebug_vpd_use_hostno == 0)
-                arr[5] = 0x10; /* claim: implicit TGPS */
+                arr[5] |= 0x10; /* claim: implicit TPGS */
         arr[6] = 0x10; /* claim: MultiP */
         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
diff --git a/drivers/staging/ccree/Kconfig b/drivers/staging/ccree/Kconfig
index ae627049c499..4be87f503e3b 100644
--- a/drivers/staging/ccree/Kconfig
+++ b/drivers/staging/ccree/Kconfig
@@ -1,6 +1,6 @@
 config CRYPTO_DEV_CCREE
         tristate "Support for ARM TrustZone CryptoCell C7XX family of Crypto accelerators"
-        depends on CRYPTO_HW && OF && HAS_DMA
+        depends on CRYPTO && CRYPTO_HW && OF && HAS_DMA
         default n
         select CRYPTO_HASH
         select CRYPTO_BLKCIPHER
diff --git a/drivers/staging/ccree/ssi_buffer_mgr.c b/drivers/staging/ccree/ssi_buffer_mgr.c
index 038e2ff5e545..6471d3d2d375 100644
--- a/drivers/staging/ccree/ssi_buffer_mgr.c
+++ b/drivers/staging/ccree/ssi_buffer_mgr.c
@@ -216,7 +216,8 @@ void ssi_buffer_mgr_copy_scatterlist_portion(
         uint32_t nents, lbytes;
 
         nents = ssi_buffer_mgr_get_sgl_nents(sg, end, &lbytes, NULL);
-        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip), 0, (direct == SSI_SG_TO_BUF));
+        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip + 1), to_skip,
+                       (direct == SSI_SG_TO_BUF));
 }
 
 static inline int ssi_buffer_mgr_render_buff_to_mlli(
diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c
index 2e1bd47337fd..e6727cefde05 100644
--- a/drivers/staging/lustre/lustre/lov/lov_pack.c
+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c
@@ -293,18 +293,10 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
         size_t lmmk_size;
         size_t lum_size;
         int rc;
-        mm_segment_t seg;
 
         if (!lsm)
                 return -ENODATA;
 
-        /*
-         * "Switch to kernel segment" to allow copying from kernel space by
-         * copy_{to,from}_user().
-         */
-        seg = get_fs();
-        set_fs(KERNEL_DS);
-
         if (lsm->lsm_magic != LOV_MAGIC_V1 && lsm->lsm_magic != LOV_MAGIC_V3) {
                 CERROR("bad LSM MAGIC: 0x%08X != 0x%08X nor 0x%08X\n",
                        lsm->lsm_magic, LOV_MAGIC_V1, LOV_MAGIC_V3);
@@ -406,6 +398,5 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
 out_free:
         kvfree(lmmk);
 out:
-        set_fs(seg);
         return rc;
 }
diff --git a/drivers/staging/media/atomisp/i2c/Makefile b/drivers/staging/media/atomisp/i2c/Makefile
index 8ea01904c0ea..466517c7c8e6 100644
--- a/drivers/staging/media/atomisp/i2c/Makefile
+++ b/drivers/staging/media/atomisp/i2c/Makefile
@@ -19,5 +19,3 @@ obj-$(CONFIG_VIDEO_AP1302)     += ap1302.o
 
 obj-$(CONFIG_VIDEO_LM3554) += lm3554.o
 
-ccflags-y += -Werror
-
diff --git a/drivers/staging/media/atomisp/i2c/imx/Makefile b/drivers/staging/media/atomisp/i2c/imx/Makefile
index 1d7f7ab94cac..6b13a3a66e49 100644
--- a/drivers/staging/media/atomisp/i2c/imx/Makefile
+++ b/drivers/staging/media/atomisp/i2c/imx/Makefile
@@ -4,5 +4,3 @@ imx1x5-objs := imx.o drv201.o ad5816g.o dw9714.o dw9719.o dw9718.o vcm.o otp.o o
 
 ov8858_driver-objs := ../ov8858.o dw9718.o vcm.o
 obj-$(CONFIG_VIDEO_OV8858)     += ov8858_driver.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/i2c/ov5693/Makefile b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
index fceb9e9b881b..c9c0e1245858 100644
--- a/drivers/staging/media/atomisp/i2c/ov5693/Makefile
+++ b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
@@ -1,3 +1 @@
 obj-$(CONFIG_VIDEO_OV5693) += ov5693.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
index 3fa7c1c1479f..f126a89a08e9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile
+++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
@@ -351,5 +351,5 @@ DEFINES := -DHRT_HW -DHRT_ISP_CSS_CUSTOM_HOST -DHRT_USE_VIR_ADDRS -D__HOST__
 DEFINES += -DATOMISP_POSTFIX=\"css2400b0_v21\" -DISP2400B0
 DEFINES += -DSYSTEM_hive_isp_css_2400_system -DISP2400
 
-ccflags-y += $(INCLUDES) $(DEFINES) -fno-common -Werror
+ccflags-y += $(INCLUDES) $(DEFINES) -fno-common
 
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 9e217b1361ea..fe4fe2440729 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -843,7 +843,10 @@ static ssize_t ci_role_show(struct device *dev, struct device_attribute *attr,
 {
         struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-        return sprintf(buf, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                return sprintf(buf, "%s\n", ci_role(ci)->name);
+
+        return 0;
 }
 
 static ssize_t ci_role_store(struct device *dev,
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index 6d23eede4d8c..1c31e8a08810 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -294,7 +294,8 @@ static int ci_role_show(struct seq_file *s, void *data)
 {
         struct ci_hdrc *ci = s->private;
 
-        seq_printf(s, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                seq_printf(s, "%s\n", ci_role(ci)->name);
 
         return 0;
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 56d2d3213076..d68b125796f9 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1993,6 +1993,7 @@ static void udc_id_switch_for_host(struct ci_hdrc *ci)
 int ci_hdrc_gadget_init(struct ci_hdrc *ci)
 {
         struct ci_role_driver *rdrv;
+        int ret;
 
         if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC))
                 return -ENXIO;
@@ -2005,7 +2006,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *ci)
         rdrv->stop      = udc_id_switch_for_host;
         rdrv->irq       = udc_irq;
         rdrv->name      = "gadget";
-        ci->roles[CI_ROLE_GADGET] = rdrv;
 
-        return udc_start(ci);
+        ret = udc_start(ci);
+        if (!ret)
+                ci->roles[CI_ROLE_GADGET] = rdrv;
+
+        return ret;
 }
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index e77a4ed4f021..9f4a0185dd60 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -108,6 +108,8 @@ struct imx_usbmisc {
         const struct usbmisc_ops *ops;
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data);
+
 static int usbmisc_imx25_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
@@ -242,10 +244,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
-                        writel(val, reg);
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
+                                writel(val, reg);
+                        }
+
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH2_CTRL_OFFSET;
@@ -267,10 +274,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
-                        writel(val, reg);
+
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
+                                writel(val, reg);
+                        }
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH3_CTRL_OFFSET;
@@ -456,6 +468,10 @@ static const struct usbmisc_ops imx27_usbmisc_ops = {
         .init = usbmisc_imx27_init,
 };
 
+static const struct usbmisc_ops imx51_usbmisc_ops = {
+        .init = usbmisc_imx53_init,
+};
+
 static const struct usbmisc_ops imx53_usbmisc_ops = {
         .init = usbmisc_imx53_init,
 };
@@ -479,6 +495,13 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = {
         .set_wakeup = usbmisc_imx7d_set_wakeup,
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data)
+{
+        struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
+
+        return usbmisc->ops == &imx53_usbmisc_ops;
+}
+
 int imx_usbmisc_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc;
@@ -536,7 +559,7 @@ static const struct of_device_id usbmisc_imx_dt_ids[] = {
         },
         {
                 .compatible = "fsl,imx51-usbmisc",
-                .data = &imx53_usbmisc_ops,
+                .data = &imx51_usbmisc_ops,
         },
         {
                 .compatible = "fsl,imx53-usbmisc",
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 9cd8722f24f6..a3ffe97170ff 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -144,6 +144,8 @@ const struct of_device_id dwc2_of_match_table[] = {
         { .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
         { .compatible = "snps,dwc2" },
         { .compatible = "samsung,s3c6400-hsotg" },
+        { .compatible = "amlogic,meson8-usb",
+          .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson8b-usb",
           .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson-gxbb-usb",
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 4c8aacc232c0..74d57d6994da 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -396,7 +396,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 /* Caller must hold fsg->lock */
 static void wakeup_thread(struct fsg_common *common)
 {
-        smp_wmb();      /* ensure the write of bh->state is complete */
+        /*
+         * Ensure the reading of thread_wakeup_needed
+         * and the writing of bh->state are completed
+         */
+        smp_mb();
         /* Tell the main thread that something has happened */
         common->thread_wakeup_needed = 1;
         if (common->thread_task)
@@ -627,7 +631,12 @@ static int sleep_thread(struct fsg_common *common, bool can_freeze)
         }
         __set_current_state(TASK_RUNNING);
         common->thread_wakeup_needed = 0;
-        smp_rmb();      /* ensure the latest bh->state is visible */
+
+        /*
+         * Ensure the writing of thread_wakeup_needed
+         * and the reading of bh->state are completed
+         */
+        smp_mb();
         return rc;
 }
 
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 5a2d845fb1a6..cd4c88529721 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -623,7 +623,6 @@ static void renesas_usb3_stop_controller(struct renesas_usb3 *usb3)
 {
         usb3_disconnect(usb3);
         usb3_write(usb3, 0, USB3_P0_INT_ENA);
-        usb3_write(usb3, 0, USB3_PN_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_OTG_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_1);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_2);
@@ -1475,7 +1474,13 @@ static void usb3_request_done_pipen(struct renesas_usb3 *usb3,
                                     struct renesas_usb3_request *usb3_req,
                                     int status)
 {
-        usb3_pn_stop(usb3);
+        unsigned long flags;
+
+        spin_lock_irqsave(&usb3->lock, flags);
+        if (usb3_pn_change(usb3, usb3_ep->num))
+                usb3_pn_stop(usb3);
+        spin_unlock_irqrestore(&usb3->lock, flags);
+
         usb3_disable_pipe_irq(usb3, usb3_ep->num);
         usb3_request_done(usb3_ep, usb3_req, status);
 
@@ -1504,30 +1509,46 @@ static void usb3_irq_epc_pipen_bfrdy(struct renesas_usb3 *usb3, int num)
 {
         struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num);
         struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep);
+        bool done = false;
 
         if (!usb3_req)
                 return;
 
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num))
+                goto out;
+
         if (usb3_ep->dir_in) {
                 /* Do not stop the IN pipe here to detect LSTTR interrupt */
                 if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE))
                         usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA);
         } else {
                 if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ))
-                        usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
+                        done = true;
         }
+
+out:
+        /* need to unlock because usb3_request_done_pipen() locks it */
+        spin_unlock(&usb3->lock);
+
+        if (done)
+                usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
 }
 
 static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num)
 {
         u32 pn_int_sta;
 
-        if (usb3_pn_change(usb3, num) < 0)
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num) < 0) {
+                spin_unlock(&usb3->lock);
                 return;
+        }
 
         pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA);
         pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA);
         usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA);
+        spin_unlock(&usb3->lock);
         if (pn_int_sta & PN_INT_LSTTR)
                 usb3_irq_epc_pipen_lsttr(usb3, num);
         if (pn_int_sta & PN_INT_BFRDY)
@@ -1660,6 +1681,7 @@ static int usb3_disable_pipe_n(struct renesas_usb3_ep *usb3_ep)
 
         spin_lock_irqsave(&usb3->lock, flags);
         if (!usb3_pn_change(usb3, usb3_ep->num)) {
+                usb3_write(usb3, 0, USB3_PN_INT_ENA);
                 usb3_write(usb3, 0, USB3_PN_RAMMAP);
                 usb3_clear_bit(usb3, PN_CON_EN, USB3_PN_CON);
         }
@@ -1799,6 +1821,9 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
         /* hook up the driver */
         usb3->driver = driver;
 
+        pm_runtime_enable(usb3_to_dev(usb3));
+        pm_runtime_get_sync(usb3_to_dev(usb3));
+
         renesas_usb3_init_controller(usb3);
 
         return 0;
@@ -1807,14 +1832,14 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
 static int renesas_usb3_stop(struct usb_gadget *gadget)
 {
         struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget);
-        unsigned long flags;
 
-        spin_lock_irqsave(&usb3->lock, flags);
         usb3->softconnect = false;
         usb3->gadget.speed = USB_SPEED_UNKNOWN;
         usb3->driver = NULL;
         renesas_usb3_stop_controller(usb3);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+
+        pm_runtime_put(usb3_to_dev(usb3));
+        pm_runtime_disable(usb3_to_dev(usb3));
 
         return 0;
 }
@@ -1891,9 +1916,6 @@ static int renesas_usb3_remove(struct platform_device *pdev)
 
         device_remove_file(&pdev->dev, &dev_attr_role);
 
-        pm_runtime_put(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
-
         usb_del_gadget_udc(&usb3->gadget);
 
         __renesas_usb3_ep_free_request(usb3->ep0_req);
@@ -2099,9 +2121,6 @@ static int renesas_usb3_probe(struct platform_device *pdev)
 
         usb3->workaround_for_vbus = priv->workaround_for_vbus;
 
-        pm_runtime_enable(&pdev->dev);
-        pm_runtime_get_sync(&pdev->dev);
-
         dev_info(&pdev->dev, "probed\n");
 
         return 0;
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 9c7ee26ef388..bc6a9be2ccc5 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -245,6 +245,11 @@ static int dsps_check_status(struct musb *musb, void *unused)
                 dsps_mod_timer_optional(glue);
                 break;
         case OTG_STATE_A_WAIT_BCON:
+                /* keep VBUS on for host-only mode */
+                if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                        dsps_mod_timer_optional(glue);
+                        break;
+                }
                 musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
                 skip_session = 1;
                 /* fall */
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7a92a5e1d40c..feca75b07fdd 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -362,8 +362,8 @@ static int mmap_batch_fn(void *data, int nr, void *state)
                                 st->global_error = 1;
                 }
         }
-        st->va += PAGE_SIZE * nr;
-        st->index += nr;
+        st->va += XEN_PAGE_SIZE * nr;
+        st->index += nr / XEN_PFN_PER_PAGE;
 
         return 0;
 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 643c70d2b2e6..4f8f75d9e839 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2563,7 +2563,7 @@ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
 static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
                                                  unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
 }
 
 /*
@@ -2573,7 +2573,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
 static inline u64 btrfs_calc_trunc_metadata_size(struct btrfs_fs_info *fs_info,
                                                  unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
 }
 
 int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
index 60a750678a82..c24d615e3d7f 100644
--- a/fs/btrfs/dir-item.c
+++ b/fs/btrfs/dir-item.c
@@ -468,7 +468,7 @@ int verify_dir_item(struct btrfs_fs_info *fs_info,
 
         if (btrfs_dir_name_len(leaf, dir_item) > namelen) {
                 btrfs_crit(fs_info, "invalid dir item name len: %u",
-                       (unsigned)btrfs_dir_data_len(leaf, dir_item));
+                       (unsigned)btrfs_dir_name_len(leaf, dir_item));
                 return 1;
         }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8685d67185d0..5f678dcb20e6 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3467,10 +3467,12 @@ static int write_dev_supers(struct btrfs_device *device,
                  * we fua the first super.  The others we allow
                  * to go down lazy.
                  */
-                if (i == 0)
-                        ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_FUA, bh);
-                else
+                if (i == 0) {
+                        ret = btrfsic_submit_bh(REQ_OP_WRITE,
+                                                REQ_SYNC | REQ_FUA, bh);
+                } else {
                         ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
+                }
                 if (ret)
                         errors++;
         }
@@ -3535,7 +3537,7 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
 
         bio->bi_end_io = btrfs_end_empty_barrier;
         bio->bi_bdev = device->bdev;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH;
         init_completion(&device->flush_wait);
         bio->bi_private = &device->flush_wait;
         device->flush_bio = bio;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e390451c72e6..33d979e9ea2a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3993,6 +3993,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
                                     info->space_info_kobj, "%s",
                                     alloc_name(found->flags));
         if (ret) {
+                percpu_counter_destroy(&found->total_bytes_pinned);
                 kfree(found);
                 return ret;
         }
@@ -4844,7 +4845,7 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
         spin_unlock(&delayed_rsv->lock);
 
 commit:
-        trans = btrfs_join_transaction(fs_info->fs_root);
+        trans = btrfs_join_transaction(fs_info->extent_root);
         if (IS_ERR(trans))
                 return -ENOSPC;
 
@@ -4862,7 +4863,7 @@ static int flush_space(struct btrfs_fs_info *fs_info,
                        struct btrfs_space_info *space_info, u64 num_bytes,
                        u64 orig_bytes, int state)
 {
-        struct btrfs_root *root = fs_info->fs_root;
+        struct btrfs_root *root = fs_info->extent_root;
         struct btrfs_trans_handle *trans;
         int nr;
         int ret = 0;
@@ -5062,7 +5063,7 @@ static void priority_reclaim_metadata_space(struct btrfs_fs_info *fs_info,
         int flush_state = FLUSH_DELAYED_ITEMS_NR;
 
         spin_lock(&space_info->lock);
-        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->fs_root,
+        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->extent_root,
                                                       space_info);
         if (!to_reclaim) {
                 spin_unlock(&space_info->lock);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index d8da3edf2ac3..d3619e010005 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2458,7 +2458,7 @@ void end_extent_writepage(struct page *page, int err, u64 start, u64 end)
         if (!uptodate) {
                 ClearPageUptodate(page);
                 SetPageError(page);
-                ret = ret < 0 ? ret : -EIO;
+                ret = err < 0 ? err : -EIO;
                 mapping_set_error(page->mapping, ret);
         }
 }
@@ -4377,6 +4377,123 @@ static struct extent_map *get_extent_skip_holes(struct inode *inode,
         return NULL;
 }
 
+/*
+ * To cache previous fiemap extent
+ *
+ * Will be used for merging fiemap extent
+ */
+struct fiemap_cache {
+        u64 offset;
+        u64 phys;
+        u64 len;
+        u32 flags;
+        bool cached;
+};
+
+/*
+ * Helper to submit fiemap extent.
+ *
+ * Will try to merge current fiemap extent specified by @offset, @phys,
+ * @len and @flags with cached one.
+ * And only when we fails to merge, cached one will be submitted as
+ * fiemap extent.
+ *
+ * Return value is the same as fiemap_fill_next_extent().
+ */
+static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+                                struct fiemap_cache *cache,
+                                u64 offset, u64 phys, u64 len, u32 flags)
+{
+        int ret = 0;
+
+        if (!cache->cached)
+                goto assign;
+
+        /*
+         * Sanity check, extent_fiemap() should have ensured that new
+         * fiemap extent won't overlap with cahced one.
+         * Not recoverable.
+         *
+         * NOTE: Physical address can overlap, due to compression
+         */
+        if (cache->offset + cache->len > offset) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
+        /*
+         * Only merges fiemap extents if
+         * 1) Their logical addresses are continuous
+         *
+         * 2) Their physical addresses are continuous
+         *    So truly compressed (physical size smaller than logical size)
+         *    extents won't get merged with each other
+         *
+         * 3) Share same flags except FIEMAP_EXTENT_LAST
+         *    So regular extent won't get merged with prealloc extent
+         */
+        if (cache->offset + cache->len  == offset &&
+            cache->phys + cache->len == phys  &&
+            (cache->flags & ~FIEMAP_EXTENT_LAST) ==
+                        (flags & ~FIEMAP_EXTENT_LAST)) {
+                cache->len += len;
+                cache->flags |= flags;
+                goto try_submit_last;
+        }
+
+        /* Not mergeable, need to submit cached one */
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret)
+                return ret;
+assign:
+        cache->cached = true;
+        cache->offset = offset;
+        cache->phys = phys;
+        cache->len = len;
+        cache->flags = flags;
+try_submit_last:
+        if (cache->flags & FIEMAP_EXTENT_LAST) {
+                ret = fiemap_fill_next_extent(fieinfo, cache->offset,
+                                cache->phys, cache->len, cache->flags);
+                cache->cached = false;
+        }
+        return ret;
+}
+
+/*
+ * Sanity check for fiemap cache
+ *
+ * All fiemap cache should be submitted by emit_fiemap_extent()
+ * Iteration should be terminated either by last fiemap extent or
+ * fieinfo->fi_extents_max.
+ * So no cached fiemap should exist.
+ */
+static int check_fiemap_cache(struct btrfs_fs_info *fs_info,
+                               struct fiemap_extent_info *fieinfo,
+                               struct fiemap_cache *cache)
+{
+        int ret;
+
+        if (!cache->cached)
+                return 0;
+
+        /* Small and recoverbale problem, only to info developer */
+#ifdef CONFIG_BTRFS_DEBUG
+        WARN_ON(1);
+#endif
+        btrfs_warn(fs_info,
+                   "unhandled fiemap cache detected: offset=%llu phys=%llu len=%llu flags=0x%x",
+                   cache->offset, cache->phys, cache->len, cache->flags);
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret > 0)
+                ret = 0;
+        return ret;
+}
+
 int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 __u64 start, __u64 len, get_extent_t *get_extent)
 {
@@ -4394,6 +4511,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         struct extent_state *cached_state = NULL;
         struct btrfs_path *path;
         struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct fiemap_cache cache = { 0 };
         int end = 0;
         u64 em_start = 0;
         u64 em_len = 0;
@@ -4573,8 +4691,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                         flags |= FIEMAP_EXTENT_LAST;
                         end = 1;
                 }
-                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
-                                              em_len, flags);
+                ret = emit_fiemap_extent(fieinfo, &cache, em_start, disko,
+                                           em_len, flags);
                 if (ret) {
                         if (ret == 1)
                                 ret = 0;
@@ -4582,6 +4700,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 }
         }
 out_free:
+        if (!ret)
+                ret = check_fiemap_cache(root->fs_info, fieinfo, &cache);
         free_extent_map(em);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 17cbe9306faf..ef3c98c527c1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2952,7 +2952,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
 
         ret = test_range_bit(io_tree, ordered_extent->file_offset,
                         ordered_extent->file_offset + ordered_extent->len - 1,
-                        EXTENT_DEFRAG, 1, cached_state);
+                        EXTENT_DEFRAG, 0, cached_state);
         if (ret) {
                 u64 last_snapshot = btrfs_root_last_snapshot(&root->root_item);
                 if (0 && last_snapshot >= BTRFS_I(inode)->generation)
@@ -7483,8 +7483,8 @@ bool btrfs_page_exists_in_range(struct inode *inode, loff_t start, loff_t end)
         int found = false;
         void **pagep = NULL;
         struct page *page = NULL;
-        int start_idx;
-        int end_idx;
+        unsigned long start_idx;
+        unsigned long end_idx;
 
         start_idx = start >> PAGE_SHIFT;
 
diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
index fd389935ecd1..3ec0e46de95f 100644
--- a/fs/ext4/acl.c
+++ b/fs/ext4/acl.c
@@ -4,6 +4,7 @@
  * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de>
  */
 
+#include <linux/quotaops.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 #include "xattr.h"
@@ -232,6 +233,9 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type)
         handle_t *handle;
         int error, retries = 0;
 
+        error = dquot_initialize(inode);
+        if (error)
+                return error;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_XATTR,
                                     ext4_jbd2_credits_xattr(inode));
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 8e8046104f4d..32191548abed 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2523,7 +2523,6 @@ extern int ext4_search_dir(struct buffer_head *bh,
                            int buf_size,
                            struct inode *dir,
                            struct ext4_filename *fname,
-                           const struct qstr *d_name,
                            unsigned int offset,
                            struct ext4_dir_entry_2 **res_dir);
 extern int ext4_generic_delete_entry(handle_t *handle,
@@ -3007,7 +3006,6 @@ extern int htree_inlinedir_to_tree(struct file *dir_file,
                                    int *has_inline_data);
 extern struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                         struct ext4_filename *fname,
-                                        const struct qstr *d_name,
                                         struct ext4_dir_entry_2 **res_dir,
                                         int *has_inline_data);
 extern int ext4_delete_inline_entry(handle_t *handle,
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 2a97dff87b96..3e36508610b7 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3413,13 +3413,13 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         struct ext4_sb_info *sbi;
         struct ext4_extent_header *eh;
         struct ext4_map_blocks split_map;
-        struct ext4_extent zero_ex;
+        struct ext4_extent zero_ex1, zero_ex2;
         struct ext4_extent *ex, *abut_ex;
         ext4_lblk_t ee_block, eof_block;
         unsigned int ee_len, depth, map_len = map->m_len;
         int allocated = 0, max_zeroout = 0;
         int err = 0;
-        int split_flag = 0;
+        int split_flag = EXT4_EXT_DATA_VALID2;
 
         ext_debug("ext4_ext_convert_to_initialized: inode %lu, logical"
                 "block %llu, max_blocks %u\n", inode->i_ino,
@@ -3436,7 +3436,8 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         ex = path[depth].p_ext;
         ee_block = le32_to_cpu(ex->ee_block);
         ee_len = ext4_ext_get_actual_len(ex);
-        zero_ex.ee_len = 0;
+        zero_ex1.ee_len = 0;
+        zero_ex2.ee_len = 0;
 
         trace_ext4_ext_convert_to_initialized_enter(inode, map, ex);
 
@@ -3576,62 +3577,52 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         if (ext4_encrypted_inode(inode))
                 max_zeroout = 0;
 
-        /* If extent is less than s_max_zeroout_kb, zeroout directly */
-        if (max_zeroout && (ee_len <= max_zeroout)) {
-                err = ext4_ext_zeroout(inode, ex);
-                if (err)
-                        goto out;
-                zero_ex.ee_block = ex->ee_block;
-                zero_ex.ee_len = cpu_to_le16(ext4_ext_get_actual_len(ex));
-                ext4_ext_store_pblock(&zero_ex, ext4_ext_pblock(ex));
-
-                err = ext4_ext_get_access(handle, inode, path + depth);
-                if (err)
-                        goto out;
-                ext4_ext_mark_initialized(ex);
-                ext4_ext_try_to_merge(handle, inode, path, ex);
-                err = ext4_ext_dirty(handle, inode, path + path->p_depth);
-                goto out;
-        }
-
         /*
-         * four cases:
+         * five cases:
          * 1. split the extent into three extents.
-         * 2. split the extent into two extents, zeroout the first half.
-         * 3. split the extent into two extents, zeroout the second half.
+         * 2. split the extent into two extents, zeroout the head of the first
+         *    extent.
+         * 3. split the extent into two extents, zeroout the tail of the second
+         *    extent.
          * 4. split the extent into two extents with out zeroout.
+         * 5. no splitting needed, just possibly zeroout the head and / or the
+         *    tail of the extent.
          */
         split_map.m_lblk = map->m_lblk;
         split_map.m_len = map->m_len;
 
-        if (max_zeroout && (allocated > map->m_len)) {
+        if (max_zeroout && (allocated > split_map.m_len)) {
                 if (allocated <= max_zeroout) {
-                        /* case 3 */
-                        zero_ex.ee_block =
-                                         cpu_to_le32(map->m_lblk);
-                        zero_ex.ee_len = cpu_to_le16(allocated);
-                        ext4_ext_store_pblock(&zero_ex,
-                                ext4_ext_pblock(ex) + map->m_lblk - ee_block);
-                        err = ext4_ext_zeroout(inode, &zero_ex);
+                        /* case 3 or 5 */
+                        zero_ex1.ee_block =
+                                 cpu_to_le32(split_map.m_lblk +
+                                             split_map.m_len);
+                        zero_ex1.ee_len =
+                                cpu_to_le16(allocated - split_map.m_len);
+                        ext4_ext_store_pblock(&zero_ex1,
+                                ext4_ext_pblock(ex) + split_map.m_lblk +
+                                split_map.m_len - ee_block);
+                        err = ext4_ext_zeroout(inode, &zero_ex1);
                         if (err)
                                 goto out;
-                        split_map.m_lblk = map->m_lblk;
                         split_map.m_len = allocated;
-                } else if (map->m_lblk - ee_block + map->m_len < max_zeroout) {
-                        /* case 2 */
-                        if (map->m_lblk != ee_block) {
-                                zero_ex.ee_block = ex->ee_block;
-                                zero_ex.ee_len = cpu_to_le16(map->m_lblk -
+                }
+                if (split_map.m_lblk - ee_block + split_map.m_len <
+                                                                max_zeroout) {
+                        /* case 2 or 5 */
+                        if (split_map.m_lblk != ee_block) {
+                                zero_ex2.ee_block = ex->ee_block;
+                                zero_ex2.ee_len = cpu_to_le16(split_map.m_lblk -
                                                         ee_block);
-                                ext4_ext_store_pblock(&zero_ex,
+                                ext4_ext_store_pblock(&zero_ex2,
                                                       ext4_ext_pblock(ex));
-                                err = ext4_ext_zeroout(inode, &zero_ex);
+                                err = ext4_ext_zeroout(inode, &zero_ex2);
                                 if (err)
                                         goto out;
                         }
 
+                        split_map.m_len += split_map.m_lblk - ee_block;
                         split_map.m_lblk = ee_block;
-                        split_map.m_len = map->m_lblk - ee_block + map->m_len;
                         allocated = map->m_len;
                 }
         }
@@ -3642,8 +3633,11 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                 err = 0;
 out:
         /* If we have gotten a failure, don't zero out status tree */
-        if (!err)
-                err = ext4_zeroout_es(inode, &zero_ex);
+        if (!err) {
+                err = ext4_zeroout_es(inode, &zero_ex1);
+                if (!err)
+                        err = ext4_zeroout_es(inode, &zero_ex2);
+        }
         return err ? err : allocated;
 }
 
@@ -4883,6 +4877,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
         /* Zero out partial block at the edges of the range */
         ret = ext4_zero_partial_blocks(handle, inode, offset, len);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 
         if (file->f_flags & O_SYNC)
                 ext4_handle_sync(handle);
@@ -5569,6 +5565,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
                 ext4_handle_sync(handle);
         inode->i_mtime = inode->i_ctime = current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
+        ext4_update_inode_fsync_trans(handle, inode, 1);
 
 out_stop:
         ext4_journal_stop(handle);
@@ -5742,6 +5739,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
         up_write(&EXT4_I(inode)->i_data_sem);
         if (IS_SYNC(inode))
                 ext4_handle_sync(handle);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 
 out_stop:
         ext4_journal_stop(handle);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 831fd6beebf0..02ce7e7bbdf5 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -474,57 +474,37 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
         endoff = (loff_t)end_blk << blkbits;
 
         index = startoff >> PAGE_SHIFT;
-        end = endoff >> PAGE_SHIFT;
+        end = (endoff - 1) >> PAGE_SHIFT;
 
         pagevec_init(&pvec, 0);
         do {
                 int i, num;
                 unsigned long nr_pages;
 
-                num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+                num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
                 nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
                                           (pgoff_t)num);
-                if (nr_pages == 0) {
-                        if (whence == SEEK_DATA)
-                                break;
-
-                        BUG_ON(whence != SEEK_HOLE);
-                        /*
-                         * If this is the first time to go into the loop and
-                         * offset is not beyond the end offset, it will be a
-                         * hole at this offset
-                         */
-                        if (lastoff == startoff || lastoff < endoff)
-                                found = 1;
-                        break;
-                }
-
-                /*
-                 * If this is the first time to go into the loop and
-                 * offset is smaller than the first page offset, it will be a
-                 * hole at this offset.
-                 */
-                if (lastoff == startoff && whence == SEEK_HOLE &&
-                    lastoff < page_offset(pvec.pages[0])) {
-                        found = 1;
+                if (nr_pages == 0)
                         break;
-                }
 
                 for (i = 0; i < nr_pages; i++) {
                         struct page *page = pvec.pages[i];
                         struct buffer_head *bh, *head;
 
                         /*
-                         * If the current offset is not beyond the end of given
-                         * range, it will be a hole.
+                         * If current offset is smaller than the page offset,
+                         * there is a hole at this offset.
                          */
-                        if (lastoff < endoff && whence == SEEK_HOLE &&
-                            page->index > end) {
+                        if (whence == SEEK_HOLE && lastoff < endoff &&
+                            lastoff < page_offset(pvec.pages[i])) {
                                 found = 1;
                                 *offset = lastoff;
                                 goto out;
                         }
 
+                        if (page->index > end)
+                                goto out;
+
                         lock_page(page);
 
                         if (unlikely(page->mapping != inode->i_mapping)) {
@@ -564,20 +544,18 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
                         unlock_page(page);
                 }
 
-                /*
-                 * The no. of pages is less than our desired, that would be a
-                 * hole in there.
-                 */
-                if (nr_pages < num && whence == SEEK_HOLE) {
-                        found = 1;
-                        *offset = lastoff;
+                /* The no. of pages is less than our desired, we are done. */
+                if (nr_pages < num)
                         break;
-                }
 
                 index = pvec.pages[i - 1]->index + 1;
                 pagevec_release(&pvec);
         } while (index <= end);
 
+        if (whence == SEEK_HOLE && lastoff < endoff) {
+                found = 1;
+                *offset = lastoff;
+        }
 out:
         pagevec_release(&pvec);
         return found;
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index d5dea4c293ef..8d141c0c8ff9 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1627,7 +1627,6 @@ out:
 
 struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                         struct ext4_filename *fname,
-                                        const struct qstr *d_name,
                                         struct ext4_dir_entry_2 **res_dir,
                                         int *has_inline_data)
 {
@@ -1649,7 +1648,7 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                                 EXT4_INLINE_DOTDOT_SIZE;
         inline_size = EXT4_MIN_INLINE_DATA_SIZE - EXT4_INLINE_DOTDOT_SIZE;
         ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
-                              dir, fname, d_name, 0, res_dir);
+                              dir, fname, 0, res_dir);
         if (ret == 1)
                 goto out_find;
         if (ret < 0)
@@ -1662,7 +1661,7 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
         inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
 
         ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
-                              dir, fname, d_name, 0, res_dir);
+                              dir, fname, 0, res_dir);
         if (ret == 1)
                 goto out_find;
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 1bd0bfa547f6..5cf82d03968c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2124,15 +2124,29 @@ static int ext4_writepage(struct page *page,
 static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
 {
         int len;
-        loff_t size = i_size_read(mpd->inode);
+        loff_t size;
         int err;
 
         BUG_ON(page->index != mpd->first_page);
+        clear_page_dirty_for_io(page);
+        /*
+         * We have to be very careful here!  Nothing protects writeback path
+         * against i_size changes and the page can be writeably mapped into
+         * page tables. So an application can be growing i_size and writing
+         * data through mmap while writeback runs. clear_page_dirty_for_io()
+         * write-protects our page in page tables and the page cannot get
+         * written to again until we release page lock. So only after
+         * clear_page_dirty_for_io() we are safe to sample i_size for
+         * ext4_bio_write_page() to zero-out tail of the written page. We rely
+         * on the barrier provided by TestClearPageDirty in
+         * clear_page_dirty_for_io() to make sure i_size is really sampled only
+         * after page tables are updated.
+         */
+        size = i_size_read(mpd->inode);
         if (page->index == size >> PAGE_SHIFT)
                 len = size & ~PAGE_MASK;
         else
                 len = PAGE_SIZE;
-        clear_page_dirty_for_io(page);
         err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false);
         if (!err)
                 mpd->wbc->nr_to_write--;
@@ -3629,9 +3643,6 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter)
                 get_block_func = ext4_dio_get_block_unwritten_async;
                 dio_flags = DIO_LOCKING;
         }
-#ifdef CONFIG_EXT4_FS_ENCRYPTION
-        BUG_ON(ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode));
-#endif
         ret = __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev, iter,
                                    get_block_func, ext4_end_io_dio, NULL,
                                    dio_flags);
@@ -3713,7 +3724,7 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
          */
         inode_lock_shared(inode);
         ret = filemap_write_and_wait_range(mapping, iocb->ki_pos,
-                                           iocb->ki_pos + count);
+                                           iocb->ki_pos + count - 1);
         if (ret)
                 goto out_unlock;
         ret = __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev,
@@ -4207,6 +4218,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
 
         inode->i_mtime = inode->i_ctime = current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 out_stop:
         ext4_journal_stop(handle);
 out_dio:
@@ -5637,8 +5650,9 @@ static int ext4_expand_extra_isize(struct inode *inode,
         /* No extended attributes present */
         if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
             header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
-                memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
-                        new_extra_isize);
+                memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
+                       EXT4_I(inode)->i_extra_isize, 0,
+                       new_extra_isize - EXT4_I(inode)->i_extra_isize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
                 return 0;
         }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 5083bce20ac4..b7928cddd539 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3887,7 +3887,8 @@ ext4_mb_discard_group_preallocations(struct super_block *sb,
 
         err = ext4_mb_load_buddy(sb, group, &e4b);
         if (err) {
-                ext4_error(sb, "Error loading buddy information for %u", group);
+                ext4_warning(sb, "Error %d loading buddy information for %u",
+                             err, group);
                 put_bh(bitmap_bh);
                 return 0;
         }
@@ -4044,10 +4045,11 @@ repeat:
                 BUG_ON(pa->pa_type != MB_INODE_PA);
                 group = ext4_get_group_number(sb, pa->pa_pstart);
 
-                err = ext4_mb_load_buddy(sb, group, &e4b);
+                err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+                                             GFP_NOFS|__GFP_NOFAIL);
                 if (err) {
-                        ext4_error(sb, "Error loading buddy information for %u",
-                                        group);
+                        ext4_error(sb, "Error %d loading buddy information for %u",
+                                   err, group);
                         continue;
                 }
 
@@ -4303,11 +4305,14 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
         spin_unlock(&lg->lg_prealloc_lock);
 
         list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) {
+                int err;
 
                 group = ext4_get_group_number(sb, pa->pa_pstart);
-                if (ext4_mb_load_buddy(sb, group, &e4b)) {
-                        ext4_error(sb, "Error loading buddy information for %u",
-                                        group);
+                err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+                                             GFP_NOFS|__GFP_NOFAIL);
+                if (err) {
+                        ext4_error(sb, "Error %d loading buddy information for %u",
+                                   err, group);
                         continue;
                 }
                 ext4_lock_group(sb, group);
@@ -5127,8 +5132,8 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group,
 
         ret = ext4_mb_load_buddy(sb, group, &e4b);
         if (ret) {
-                ext4_error(sb, "Error in loading buddy "
-                                "information for %u", group);
+                ext4_warning(sb, "Error %d loading buddy information for %u",
+                             ret, group);
                 return ret;
         }
         bitmap = e4b.bd_bitmap;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b81f7d46f344..404256caf9cf 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1155,12 +1155,11 @@ errout:
 static inline int search_dirblock(struct buffer_head *bh,
                                   struct inode *dir,
                                   struct ext4_filename *fname,
-                                  const struct qstr *d_name,
                                   unsigned int offset,
                                   struct ext4_dir_entry_2 **res_dir)
 {
         return ext4_search_dir(bh, bh->b_data, dir->i_sb->s_blocksize, dir,
-                               fname, d_name, offset, res_dir);
+                               fname, offset, res_dir);
 }
 
 /*
@@ -1262,7 +1261,6 @@ static inline bool ext4_match(const struct ext4_filename *fname,
  */
 int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
                     struct inode *dir, struct ext4_filename *fname,
-                    const struct qstr *d_name,
                     unsigned int offset, struct ext4_dir_entry_2 **res_dir)
 {
         struct ext4_dir_entry_2 * de;
@@ -1355,7 +1353,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
 
         if (ext4_has_inline_data(dir)) {
                 int has_inline_data = 1;
-                ret = ext4_find_inline_entry(dir, &fname, d_name, res_dir,
+                ret = ext4_find_inline_entry(dir, &fname, res_dir,
                                              &has_inline_data);
                 if (has_inline_data) {
                         if (inlined)
@@ -1447,7 +1445,7 @@ restart:
                         goto next;
                 }
                 set_buffer_verified(bh);
-                i = search_dirblock(bh, dir, &fname, d_name,
+                i = search_dirblock(bh, dir, &fname,
                             block << EXT4_BLOCK_SIZE_BITS(sb), res_dir);
                 if (i == 1) {
                         EXT4_I(dir)->i_dir_start_lookup = block;
@@ -1488,7 +1486,6 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 {
         struct super_block * sb = dir->i_sb;
         struct dx_frame frames[2], *frame;
-        const struct qstr *d_name = fname->usr_fname;
         struct buffer_head *bh;
         ext4_lblk_t block;
         int retval;
@@ -1505,7 +1502,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
                 if (IS_ERR(bh))
                         goto errout;
 
-                retval = search_dirblock(bh, dir, fname, d_name,
+                retval = search_dirblock(bh, dir, fname,
                                          block << EXT4_BLOCK_SIZE_BITS(sb),
                                          res_dir);
                 if (retval == 1)
@@ -1530,7 +1527,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 
         bh = NULL;
 errout:
-        dxtrace(printk(KERN_DEBUG "%s not found\n", d_name->name));
+        dxtrace(printk(KERN_DEBUG "%s not found\n", fname->usr_fname->name));
 success:
         dx_release(frames);
         return bh;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 0b177da9ea82..d37c81f327e7 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -848,14 +848,9 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
 {
         int type;
 
-        if (ext4_has_feature_quota(sb)) {
-                dquot_disable(sb, -1,
-                              DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED);
-        } else {
-                /* Use our quota_off function to clear inode flags etc. */
-                for (type = 0; type < EXT4_MAXQUOTAS; type++)
-                        ext4_quota_off(sb, type);
-        }
+        /* Use our quota_off function to clear inode flags etc. */
+        for (type = 0; type < EXT4_MAXQUOTAS; type++)
+                ext4_quota_off(sb, type);
 }
 #else
 static inline void ext4_quota_off_umount(struct super_block *sb)
@@ -1179,6 +1174,9 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                 return res;
         }
 
+        res = dquot_initialize(inode);
+        if (res)
+                return res;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_MISC,
                         ext4_jbd2_credits_xattr(inode));
@@ -5485,7 +5483,7 @@ static int ext4_quota_off(struct super_block *sb, int type)
                 goto out;
 
         err = dquot_quota_off(sb, type);
-        if (err)
+        if (err || ext4_has_feature_quota(sb))
                 goto out_put;
 
         inode_lock(inode);
@@ -5505,6 +5503,7 @@ static int ext4_quota_off(struct super_block *sb, int type)
 out_unlock:
         inode_unlock(inode);
 out_put:
+        lockdep_set_quota_inode(inode, I_DATA_SEM_NORMAL);
         iput(inode);
         return err;
 out:
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 8fb7ce14e6eb..5d3c2536641c 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -888,6 +888,8 @@ inserted:
                         else {
                                 u32 ref;
 
+                                WARN_ON_ONCE(dquot_initialize_needed(inode));
+
                                 /* The old block is released after updating
                                    the inode. */
                                 error = dquot_alloc_block(inode,
@@ -954,6 +956,8 @@ inserted:
                         /* We need to allocate a new block */
                         ext4_fsblk_t goal, block;
 
+                        WARN_ON_ONCE(dquot_initialize_needed(inode));
+
                         goal = ext4_group_first_block_no(sb,
                                                 EXT4_I(inode)->i_block_group);
 
@@ -1166,6 +1170,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
                 return -EINVAL;
         if (strlen(name) > 255)
                 return -ERANGE;
+
         ext4_write_lock_xattr(inode, &no_expand);
 
         error = ext4_reserve_inode_write(handle, inode, &is.iloc);
@@ -1267,6 +1272,9 @@ ext4_xattr_set(struct inode *inode, int name_index, const char *name,
         int error, retries = 0;
         int credits = ext4_jbd2_credits_xattr(inode);
 
+        error = dquot_initialize(inode);
+        if (error)
+                return error;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_XATTR, credits);
         if (IS_ERR(handle)) {
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 9ee4832b6f8b..2d30a6da7013 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -680,6 +680,12 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask)
 
         rwsem_release(&journal->j_trans_commit_map, 1, _THIS_IP_);
         handle->h_buffer_credits = nblocks;
+        /*
+         * Restore the original nofs context because the journal restart
+         * is basically the same thing as journal stop and start.
+         * start_this_handle will start a new nofs context.
+         */
+        memalloc_nofs_restore(handle->saved_alloc_context);
         ret = start_this_handle(journal, handle, gfp_mask);
         return ret;
 }
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index ebf80c7739e1..48813aeaab80 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1512,6 +1512,22 @@ int dquot_initialize(struct inode *inode)
 }
 EXPORT_SYMBOL(dquot_initialize);
 
+bool dquot_initialize_needed(struct inode *inode)
+{
+        struct dquot **dquots;
+        int i;
+
+        if (!dquot_active(inode))
+                return false;
+
+        dquots = i_dquot(inode);
+        for (i = 0; i < MAXQUOTAS; i++)
+                if (!dquots[i] && sb_has_quota_active(inode->i_sb, i))
+                        return true;
+        return false;
+}
+EXPORT_SYMBOL(dquot_initialize_needed);
+
 /*
  * Release all quotas referenced by inode.
  *
diff --git a/fs/stat.c b/fs/stat.c
index f494b182c7c7..c35610845ab1 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -672,6 +672,7 @@ void __inode_add_bytes(struct inode *inode, loff_t bytes)
                 inode->i_bytes -= 512;
         }
 }
+EXPORT_SYMBOL(__inode_add_bytes);
 
 void inode_add_bytes(struct inode *inode, loff_t bytes)
 {
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index a0376a2c1c29..d642cc0a8271 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -82,7 +82,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
                         ufs_error (sb, "ufs_free_fragments",
                                    "bit already cleared for fragment %u", i);
         }
-        
+
+        inode_sub_bytes(inode, count << uspi->s_fshift);
         fs32_add(sb, &ucg->cg_cs.cs_nffree, count);
         uspi->cs_total.cs_nffree += count;
         fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count);
@@ -184,6 +185,7 @@ do_more:
                         ufs_error(sb, "ufs_free_blocks", "freeing free fragment");
                 }
                 ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
+                inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift);
                 if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
                         ufs_clusteracct (sb, ucpi, blkno, 1);
 
@@ -494,6 +496,20 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         return 0;
 }               
 
+static bool try_add_frags(struct inode *inode, unsigned frags)
+{
+        unsigned size = frags * i_blocksize(inode);
+        spin_lock(&inode->i_lock);
+        __inode_add_bytes(inode, size);
+        if (unlikely((u32)inode->i_blocks != inode->i_blocks)) {
+                __inode_sub_bytes(inode, size);
+                spin_unlock(&inode->i_lock);
+                return false;
+        }
+        spin_unlock(&inode->i_lock);
+        return true;
+}
+
 static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
                              unsigned oldcount, unsigned newcount)
 {
@@ -530,6 +546,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
         for (i = oldcount; i < newcount; i++)
                 if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i))
                         return 0;
+
+        if (!try_add_frags(inode, count))
+                return 0;
         /*
          * Block can be extended
          */
@@ -647,6 +666,7 @@ cg_found:
                         ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i);
                 i = uspi->s_fpb - count;
 
+                inode_sub_bytes(inode, i << uspi->s_fshift);
                 fs32_add(sb, &ucg->cg_cs.cs_nffree, i);
                 uspi->cs_total.cs_nffree += i;
                 fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i);
@@ -657,6 +677,8 @@ cg_found:
         result = ufs_bitmap_search (sb, ucpi, goal, allocsize);
         if (result == INVBLOCK)
                 return 0;
+        if (!try_add_frags(inode, count))
+                return 0;
         for (i = 0; i < count; i++)
                 ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i);
         
@@ -716,6 +738,8 @@ norot:
                 return INVBLOCK;
         ucpi->c_rotor = result;
 gotit:
+        if (!try_add_frags(inode, uspi->s_fpb))
+                return 0;
         blkno = ufs_fragstoblks(result);
         ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
         if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7e41aee7b69a..da553ffec85b 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -235,7 +235,8 @@ ufs_extend_tail(struct inode *inode, u64 writes_to,
 
         p = ufs_get_direct_data_ptr(uspi, ufsi, block);
         tmp = ufs_new_fragments(inode, p, lastfrag, ufs_data_ptr_to_cpu(sb, p),
-                                new_size, err, locked_page);
+                                new_size - (lastfrag & uspi->s_fpbmask), err,
+                                locked_page);
         return tmp != 0;
 }
 
@@ -284,7 +285,7 @@ ufs_inode_getfrag(struct inode *inode, unsigned index,
                         goal += uspi->s_fpb;
         }
         tmp = ufs_new_fragments(inode, p, ufs_blknum(new_fragment),
-                                goal, uspi->s_fpb, err, locked_page);
+                                goal, nfrags, err, locked_page);
 
         if (!tmp) {
                 *err = -ENOSPC;
@@ -402,7 +403,9 @@ static int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buff
 
         if (!create) {
                 phys64 = ufs_frag_map(inode, offsets, depth);
-                goto out;
+                if (phys64)
+                        map_bh(bh_result, sb, phys64 + frag);
+                return 0;
         }
 
         /* This code entered only while writing ....? */
@@ -841,8 +844,11 @@ void ufs_evict_inode(struct inode * inode)
         truncate_inode_pages_final(&inode->i_data);
         if (want_delete) {
                 inode->i_size = 0;
-                if (inode->i_blocks)
+                if (inode->i_blocks &&
+                    (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                     S_ISLNK(inode->i_mode)))
                         ufs_truncate_blocks(inode);
+                ufs_update_inode(inode, inode_needs_sync(inode));
         }
 
         invalidate_inode_buffers(inode);
@@ -1100,7 +1106,7 @@ out:
        return err;
 }
 
-static void __ufs_truncate_blocks(struct inode *inode)
+static void ufs_truncate_blocks(struct inode *inode)
 {
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
@@ -1183,7 +1189,7 @@ static int ufs_truncate(struct inode *inode, loff_t size)
 
         truncate_setsize(inode, size);
 
-        __ufs_truncate_blocks(inode);
+        ufs_truncate_blocks(inode);
         inode->i_mtime = inode->i_ctime = current_time(inode);
         mark_inode_dirty(inode);
 out:
@@ -1191,16 +1197,6 @@ out:
         return err;
 }
 
-static void ufs_truncate_blocks(struct inode *inode)
-{
-        if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
-              S_ISLNK(inode->i_mode)))
-                return;
-        if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                return;
-        __ufs_truncate_blocks(inode);
-}
-
 int ufs_setattr(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = d_inode(dentry);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 29ecaf739449..878cc6264f1a 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -746,6 +746,23 @@ static void ufs_put_super(struct super_block *sb)
         return;
 }
 
+static u64 ufs_max_bytes(struct super_block *sb)
+{
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+        int bits = uspi->s_apbshift;
+        u64 res;
+
+        if (bits > 21)
+                res = ~0ULL;
+        else
+                res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) +
+                        (1LL << (3*bits));
+
+        if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift))
+                return MAX_LFS_FILESIZE;
+        return res << uspi->s_bshift;
+}
+
 static int ufs_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct ufs_sb_info * sbi;
@@ -1211,6 +1228,7 @@ magic_found:
                             "fast symlink size (%u)\n", uspi->s_maxsymlinklen);
                 uspi->s_maxsymlinklen = maxsymlen;
         }
+        sb->s_maxbytes = ufs_max_bytes(sb);
         sb->s_max_links = UFS_LINK_MAX;
 
         inode = ufs_iget(sb, UFS_ROOTINO);
diff --git a/fs/ufs/util.h b/fs/ufs/util.h
index b7fbf53dbc81..398019fb1448 100644
--- a/fs/ufs/util.h
+++ b/fs/ufs/util.h
@@ -473,15 +473,19 @@ static inline unsigned _ubh_find_last_zero_bit_(
 static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi,
         struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
 {
+        u8 mask;
         switch (uspi->s_fpb) {
         case 8:
                 return (*ubh_get_addr (ubh, begin + block) == 0xff);
         case 4:
-                return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2)));
+                mask = 0x0f << ((block & 0x01) << 2);
+                return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask;
         case 2:
-                return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1)));
+                mask = 0x03 << ((block & 0x03) << 1);
+                return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask;
         case 1:
-                return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07)));
+                mask = 0x01 << (block & 0x07);
+                return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask;
         }
         return 0;       
 }
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index de179993e039..d614c5ea1b5e 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -15,3 +15,11 @@
  * with any version that can compile the kernel
  */
 #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+
+/*
+ * GCC does not warn about unused static inline functions for
+ * -Wunused-function.  This turns out to avoid the need for complex #ifdef
+ * directives.  Suppress the warning in clang as well.
+ */
+#undef inline
+#define inline inline __attribute__((unused)) notrace
diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h
index 4eac2670bfa1..92f20832fd28 100644
--- a/include/linux/dma-iommu.h
+++ b/include/linux/dma-iommu.h
@@ -78,6 +78,7 @@ void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list);
 
 struct iommu_domain;
 struct msi_msg;
+struct device;
 
 static inline int iommu_dma_init(void)
 {
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 9ec5e22846e0..0e306c5a86d6 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -153,7 +153,7 @@ struct elevator_type
 #endif
 
         /* managed by elevator core */
-        char icq_cache_name[ELV_NAME_MAX + 5];  /* elvname + "_io_cq" */
+        char icq_cache_name[ELV_NAME_MAX + 6];  /* elvname + "_io_cq" */
         struct list_head list;
 };
 
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index fffb91202bc9..1fa293a37f4a 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -417,6 +417,10 @@
 #define ICH_HCR_EN                      (1 << 0)
 #define ICH_HCR_UIE                     (1 << 1)
 
+#define ICH_VMCR_ACK_CTL_SHIFT          2
+#define ICH_VMCR_ACK_CTL_MASK           (1 << ICH_VMCR_ACK_CTL_SHIFT)
+#define ICH_VMCR_FIQ_EN_SHIFT           3
+#define ICH_VMCR_FIQ_EN_MASK            (1 << ICH_VMCR_FIQ_EN_SHIFT)
 #define ICH_VMCR_CBPR_SHIFT             4
 #define ICH_VMCR_CBPR_MASK              (1 << ICH_VMCR_CBPR_SHIFT)
 #define ICH_VMCR_EOIM_SHIFT             9
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index dc30f3d057eb..d3453ee072fc 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -25,7 +25,18 @@
 #define GICC_ENABLE                     0x1
 #define GICC_INT_PRI_THRESHOLD          0xf0
 
-#define GIC_CPU_CTRL_EOImodeNS          (1 << 9)
+#define GIC_CPU_CTRL_EnableGrp0_SHIFT   0
+#define GIC_CPU_CTRL_EnableGrp0         (1 << GIC_CPU_CTRL_EnableGrp0_SHIFT)
+#define GIC_CPU_CTRL_EnableGrp1_SHIFT   1
+#define GIC_CPU_CTRL_EnableGrp1         (1 << GIC_CPU_CTRL_EnableGrp1_SHIFT)
+#define GIC_CPU_CTRL_AckCtl_SHIFT       2
+#define GIC_CPU_CTRL_AckCtl             (1 << GIC_CPU_CTRL_AckCtl_SHIFT)
+#define GIC_CPU_CTRL_FIQEn_SHIFT        3
+#define GIC_CPU_CTRL_FIQEn              (1 << GIC_CPU_CTRL_FIQEn_SHIFT)
+#define GIC_CPU_CTRL_CBPR_SHIFT         4
+#define GIC_CPU_CTRL_CBPR               (1 << GIC_CPU_CTRL_CBPR_SHIFT)
+#define GIC_CPU_CTRL_EOImodeNS_SHIFT    9
+#define GIC_CPU_CTRL_EOImodeNS          (1 << GIC_CPU_CTRL_EOImodeNS_SHIFT)
 
 #define GICC_IAR_INT_ID_MASK            0x3ff
 #define GICC_INT_SPURIOUS               1023
@@ -84,8 +95,19 @@
 #define GICH_LR_EOI                     (1 << 19)
 #define GICH_LR_HW                      (1 << 31)
 
-#define GICH_VMCR_CTRL_SHIFT            0
-#define GICH_VMCR_CTRL_MASK             (0x21f << GICH_VMCR_CTRL_SHIFT)
+#define GICH_VMCR_ENABLE_GRP0_SHIFT     0
+#define GICH_VMCR_ENABLE_GRP0_MASK      (1 << GICH_VMCR_ENABLE_GRP0_SHIFT)
+#define GICH_VMCR_ENABLE_GRP1_SHIFT     1
+#define GICH_VMCR_ENABLE_GRP1_MASK      (1 << GICH_VMCR_ENABLE_GRP1_SHIFT)
+#define GICH_VMCR_ACK_CTL_SHIFT         2
+#define GICH_VMCR_ACK_CTL_MASK          (1 << GICH_VMCR_ACK_CTL_SHIFT)
+#define GICH_VMCR_FIQ_EN_SHIFT          3
+#define GICH_VMCR_FIQ_EN_MASK           (1 << GICH_VMCR_FIQ_EN_SHIFT)
+#define GICH_VMCR_CBPR_SHIFT            4
+#define GICH_VMCR_CBPR_MASK             (1 << GICH_VMCR_CBPR_SHIFT)
+#define GICH_VMCR_EOI_MODE_SHIFT        9
+#define GICH_VMCR_EOI_MODE_MASK         (1 << GICH_VMCR_EOI_MODE_SHIFT)
+
 #define GICH_VMCR_PRIMASK_SHIFT         27
 #define GICH_VMCR_PRIMASK_MASK          (0x1f << GICH_VMCR_PRIMASK_SHIFT)
 #define GICH_VMCR_BINPOINT_SHIFT        21
diff --git a/include/linux/key.h b/include/linux/key.h
index 0c9b93b0d1f7..78e25aabedaf 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -173,7 +173,6 @@ struct key {
 #ifdef KEY_DEBUGGING
         unsigned                magic;
 #define KEY_DEBUG_MAGIC         0x18273645u
-#define KEY_DEBUG_MAGIC_X       0xf8e9dacbu
 #endif
 
         unsigned long           flags;          /* status flags (change with bitops) */
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index b4ee8f62ce8d..8e2828d48d7f 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -470,6 +470,7 @@ struct mlx4_update_qp_params {
         u16     rate_val;
 };
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn);
 int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
                    enum mlx4_update_qp_attr attr,
                    struct mlx4_update_qp_params *params);
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 9c6f768b7d32..dda22f45fc1b 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -44,6 +44,7 @@ void inode_sub_rsv_space(struct inode *inode, qsize_t number);
 void inode_reclaim_rsv_space(struct inode *inode, qsize_t number);
 
 int dquot_initialize(struct inode *inode);
+bool dquot_initialize_needed(struct inode *inode);
 void dquot_drop(struct inode *inode);
 struct dquot *dqget(struct super_block *sb, struct kqid qid);
 static inline struct dquot *dqgrab(struct dquot *dquot)
@@ -207,6 +208,11 @@ static inline int dquot_initialize(struct inode *inode)
         return 0;
 }
 
+static inline bool dquot_initialize_needed(struct inode *inode)
+{
+        return false;
+}
+
 static inline void dquot_drop(struct inode *inode)
 {
 }
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 167ad8831aaf..4c1d5f7e62c4 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -172,9 +172,7 @@ static inline int srcu_read_lock(struct srcu_struct *sp) __acquires(sp)
 {
         int retval;
 
-        preempt_disable();
         retval = __srcu_read_lock(sp);
-        preempt_enable();
         rcu_lock_acquire(&(sp)->dep_map);
         return retval;
 }
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 0b1cf32edfd7..d9718378a8be 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -189,8 +189,6 @@ struct platform_suspend_ops {
 struct platform_freeze_ops {
         int (*begin)(void);
         int (*prepare)(void);
-        void (*wake)(void);
-        void (*sync)(void);
         void (*restore)(void);
         void (*end)(void);
 };
@@ -430,8 +428,7 @@ extern unsigned int pm_wakeup_irq;
 
 extern bool pm_wakeup_pending(void);
 extern void pm_system_wakeup(void);
-extern void pm_system_cancel_wakeup(void);
-extern void pm_wakeup_clear(bool reset);
+extern void pm_wakeup_clear(void);
 extern void pm_system_irq_wakeup(unsigned int irq_number);
 extern bool pm_get_wakeup_count(unsigned int *count, bool block);
 extern bool pm_save_wakeup_count(unsigned int count);
@@ -481,7 +478,7 @@ static inline int unregister_pm_notifier(struct notifier_block *nb)
 
 static inline bool pm_wakeup_pending(void) { return false; }
 static inline void pm_system_wakeup(void) {}
-static inline void pm_wakeup_clear(bool reset) {}
+static inline void pm_wakeup_clear(void) {}
 static inline void pm_system_irq_wakeup(unsigned int irq_number) {}
 
 static inline void lock_system_sleep(void) {}
diff --git a/include/media/cec-notifier.h b/include/media/cec-notifier.h
index eb50ce54b759..413335c8cb52 100644
--- a/include/media/cec-notifier.h
+++ b/include/media/cec-notifier.h
@@ -29,7 +29,7 @@ struct edid;
 struct cec_adapter;
 struct cec_notifier;
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#if IS_REACHABLE(CONFIG_CEC_CORE) && IS_ENABLED(CONFIG_CEC_NOTIFIER)
 
 /**
  * cec_notifier_get - find or create a new cec_notifier for the given device.
diff --git a/include/media/cec.h b/include/media/cec.h
index b8eb895731d5..bfa88d4d67e1 100644
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -173,7 +173,7 @@ struct cec_adapter {
         bool passthrough;
         struct cec_log_addrs log_addrs;
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         struct cec_notifier *notifier;
 #endif
 
@@ -300,7 +300,7 @@ u16 cec_phys_addr_for_input(u16 phys_addr, u8 input);
  */
 int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 void cec_register_cec_notifier(struct cec_adapter *adap,
                                struct cec_notifier *notifier);
 #endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index dbf0abba33b8..3e505bbff8ca 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1007,6 +1007,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
  */
 extern const struct proto_ops inet6_stream_ops;
 extern const struct proto_ops inet6_dgram_ops;
+extern const struct proto_ops inet6_sockraw_ops;
 
 struct group_source_req;
 struct group_filter;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 38a7427ae902..be6223c586fa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -924,7 +924,7 @@ struct tcp_congestion_ops {
         void (*cwnd_event)(struct sock *sk, enum tcp_ca_event ev);
         /* call when ack arrives (optional) */
         void (*in_ack_event)(struct sock *sk, u32 flags);
-        /* new value of cwnd after loss (optional) */
+        /* new value of cwnd after loss (required) */
         u32  (*undo_cwnd)(struct sock *sk);
         /* hook for packet ack accounting (optional) */
         void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index 201c6644b237..ef16df06642a 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -70,8 +70,8 @@ struct keyctl_dh_params {
 };
 
 struct keyctl_kdf_params {
-        char *hashname;
-        char *otherinfo;
+        char __user *hashname;
+        char __user *otherinfo;
         __u32 otherinfolen;
         __u32 __spare[8];
 };
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 9ae6fbe5b5cf..cb5103413bd8 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1658,13 +1658,13 @@ static ssize_t write_cpuhp_target(struct device *dev,
         ret = !sp->name || sp->cant_stop ? -EINVAL : 0;
         mutex_unlock(&cpuhp_state_mutex);
         if (ret)
-                return ret;
+                goto out;
 
         if (st->state < target)
                 ret = do_cpu_up(dev->id, target);
         else
                 ret = do_cpu_down(dev->id, target);
-
+out:
         unlock_device_hotplug();
         return ret ? ret : count;
 }
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 78672d324a6e..c7209f060eeb 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -132,7 +132,7 @@ int freeze_processes(void)
         if (!pm_freezing)
                 atomic_inc(&system_freezing_cnt);
 
-        pm_wakeup_clear(true);
+        pm_wakeup_clear();
         pr_info("Freezing user space processes ... ");
         pm_freezing = true;
         error = try_to_freeze_tasks(true);
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index c0248c74d6d4..15e6baef5c73 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -72,8 +72,6 @@ static void freeze_begin(void)
 
 static void freeze_enter(void)
 {
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, true);
-
         spin_lock_irq(&suspend_freeze_lock);
         if (pm_wakeup_pending())
                 goto out;
@@ -100,27 +98,6 @@ static void freeze_enter(void)
  out:
         suspend_freeze_state = FREEZE_STATE_NONE;
         spin_unlock_irq(&suspend_freeze_lock);
-
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, false);
-}
-
-static void s2idle_loop(void)
-{
-        do {
-                freeze_enter();
-
-                if (freeze_ops && freeze_ops->wake)
-                        freeze_ops->wake();
-
-                dpm_resume_noirq(PMSG_RESUME);
-                if (freeze_ops && freeze_ops->sync)
-                        freeze_ops->sync();
-
-                if (pm_wakeup_pending())
-                        break;
-
-                pm_wakeup_clear(false);
-        } while (!dpm_suspend_noirq(PMSG_SUSPEND));
 }
 
 void freeze_wake(void)
@@ -394,8 +371,10 @@ static int suspend_enter(suspend_state_t state, bool *wakeup)
          * all the devices are suspended.
          */
         if (state == PM_SUSPEND_FREEZE) {
-                s2idle_loop();
-                goto Platform_early_resume;
+                trace_suspend_resume(TPS("machine_suspend"), state, true);
+                freeze_enter();
+                trace_suspend_resume(TPS("machine_suspend"), state, false);
+                goto Platform_wake;
         }
 
         error = disable_nonboot_cpus();
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a1aecf44ab07..a1db38abac5b 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -269,7 +269,6 @@ static struct console *exclusive_console;
 #define MAX_CMDLINECONSOLES 8
 
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
-static int console_cmdline_cnt;
 
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -1906,25 +1905,12 @@ static int __add_preferred_console(char *name, int idx, char *options,
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for (i = 0, c = console_cmdline; i < console_cmdline_cnt; i++, c++) {
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                 if (strcmp(c->name, name) == 0 && c->index == idx) {
-                        if (brl_options)
-                                return 0;
-
-                        /*
-                         * Maintain an invariant that will help to find if
-                         * the matching console is preferred, see
-                         * register_console():
-                         *
-                         * The last non-braille console is always
-                         * the preferred one.
-                         */
-                        if (i != console_cmdline_cnt - 1)
-                                swap(console_cmdline[i],
-                                     console_cmdline[console_cmdline_cnt - 1]);
-
-                        preferred_console = console_cmdline_cnt - 1;
-
+                        if (!brl_options)
+                                preferred_console = i;
                         return 0;
                 }
         }
@@ -1937,7 +1923,6 @@ static int __add_preferred_console(char *name, int idx, char *options,
         braille_set_options(c, brl_options);
 
         c->index = idx;
-        console_cmdline_cnt++;
         return 0;
 }
 /*
@@ -2477,23 +2462,12 @@ void register_console(struct console *newcon)
         }
 
         /*
-         * See if this console matches one we selected on the command line.
-         *
-         * There may be several entries in the console_cmdline array matching
-         * with the same console, one with newcon->match(), another by
-         * name/index:
-         *
-         *      pl011,mmio,0x87e024000000,115200 -- added from SPCR
-         *      ttyAMA0 -- added from command line
-         *
-         * Traverse the console_cmdline array in reverse order to be
-         * sure that if this console is preferred then it will be the first
-         * matching entry.  We use the invariant that is maintained in
-         * __add_preferred_console().
+         *      See if this console matches one we selected on
+         *      the command line.
          */
-        for (i = console_cmdline_cnt - 1; i >= 0; i--) {
-                c = console_cmdline + i;
-
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                 if (!newcon->match ||
                     newcon->match(newcon, c->name, c->index, c->options) != 0) {
                         /* default matching */
diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
index 584d8a983883..dea03614263f 100644
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -263,7 +263,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
  * Returns an index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -271,7 +271,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
         int idx;
 
         idx = READ_ONCE(sp->completed) & 0x1;
-        __this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
+        this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
         smp_mb(); /* B */  /* Avoid leaking the critical section. */
         return idx;
 }
@@ -281,7 +281,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
  * Removes the count for the old reader from the appropriate per-CPU
  * element of the srcu_struct.  Note that this may well be a different
  * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 36e1f82faed1..32798eb14853 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -97,8 +97,9 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
- * Returns an index that must be passed to the matching srcu_read_unlock().
+ * srcu_struct.  Can be invoked from irq/bh handlers, but the matching
+ * __srcu_read_unlock() must be in the same handler instance.  Returns an
+ * index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
 {
@@ -112,7 +113,7 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
 
 /*
  * Removes the count for the old reader from the appropriate element of
- * the srcu_struct.  Must be called from process context.
+ * the srcu_struct.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 3ae8474557df..157654fa436a 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -357,7 +357,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
  * Returns an index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -365,7 +365,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
         int idx;
 
         idx = READ_ONCE(sp->srcu_idx) & 0x1;
-        __this_cpu_inc(sp->sda->srcu_lock_count[idx]);
+        this_cpu_inc(sp->sda->srcu_lock_count[idx]);
         smp_mb(); /* B */  /* Avoid leaking the critical section. */
         return idx;
 }
@@ -375,7 +375,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
  * Removes the count for the old reader from the appropriate per-CPU
  * element of the srcu_struct.  Note that this may well be a different
  * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 574f78824d8a..32bd3ead9ba1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -595,7 +595,7 @@ static int br_afspec(struct net_bridge *br,
                 err = 0;
                 switch (nla_type(attr)) {
                 case IFLA_BRIDGE_VLAN_TUNNEL_INFO:
-                        if (!(p->flags & BR_VLAN_TUNNEL))
+                        if (!p || !(p->flags & BR_VLAN_TUNNEL))
                                 return -EINVAL;
                         err = br_parse_vlan_tunnel_info(attr, &tinfo_curr);
                         if (err)
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 0db8102995a5..6f12a5271219 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,7 +179,8 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
-                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                 br_port_state_selection(br);
         }
 
diff --git a/net/core/devlink.c b/net/core/devlink.c
index b0b87a292e7c..a0adfc31a3fe 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1680,8 +1680,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
@@ -2098,8 +2100,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 346d3e85dfbc..b1be7c01efe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3754,8 +3754,11 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 
         spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
-        if (skb && (skb_next = skb_peek(q)))
+        if (skb && (skb_next = skb_peek(q))) {
                 icmp_next = is_icmp_err_skb(skb_next);
+                if (icmp_next)
+                        sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
+        }
         spin_unlock_irqrestore(&q->lock, flags);
 
         if (is_icmp_err_skb(skb) && !icmp_next)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 26130ae438da..90038d45a547 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -223,6 +223,53 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+int dsa_switch_suspend(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        /* Suspend slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        if (ds->ops->suspend)
+                ret = ds->ops->suspend(ds);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_suspend);
+
+int dsa_switch_resume(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        if (ds->ops->resume)
+                ret = ds->ops->resume(ds);
+
+        if (ret)
+                return ret;
+
+        /* Resume slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_resume(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_resume);
+#endif
+
 static struct packet_type dsa_pack_type __read_mostly = {
         .type   = cpu_to_be16(ETH_P_XDSA),
         .func   = dsa_switch_rcv,
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 033b3bfb63dc..7796580e99ee 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -484,8 +484,10 @@ static void dsa_dst_unapply(struct dsa_switch_tree *dst)
                 dsa_ds_unapply(dst, ds);
         }
 
-        if (dst->cpu_switch)
+        if (dst->cpu_switch) {
                 dsa_cpu_port_ethtool_restore(dst->cpu_switch);
+                dst->cpu_switch = NULL;
+        }
 
         pr_info("DSA: tree %d unapplied\n", dst->tree);
         dst->applied = false;
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index ad345c8b0b06..7281098df04e 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -289,53 +289,6 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
         dsa_switch_unregister_notifier(ds);
 }
 
-#ifdef CONFIG_PM_SLEEP
-int dsa_switch_suspend(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        /* Suspend slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        if (ds->ops->suspend)
-                ret = ds->ops->suspend(ds);
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_suspend);
-
-int dsa_switch_resume(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        if (ds->ops->resume)
-                ret = ds->ops->resume(ds);
-
-        if (ret)
-                return ret;
-
-        /* Resume slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_resume(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_resume);
-#endif
-
 /* platform driver init and cleanup *****************************************/
 static int dev_is_class(struct device *dev, void *class)
 {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f3dad1661343..58925b6597de 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[] =
                 .type =       SOCK_DGRAM,
                 .protocol =   IPPROTO_ICMP,
                 .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                 .flags =      INET_PROTOSW_REUSE,
        },
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 59792d283ff8..b5ea036ca781 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2381,9 +2381,10 @@ static int tcp_repair_set_window(struct tcp_sock *tp, char __user *optbuf, int l
         return 0;
 }
 
-static int tcp_repair_options_est(struct tcp_sock *tp,
+static int tcp_repair_options_est(struct sock *sk,
                 struct tcp_repair_opt __user *optbuf, unsigned int len)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_repair_opt opt;
 
         while (len >= sizeof(opt)) {
@@ -2396,6 +2397,7 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                 switch (opt.opt_code) {
                 case TCPOPT_MSS:
                         tp->rx_opt.mss_clamp = opt.opt_val;
+                        tcp_mtup_init(sk);
                         break;
                 case TCPOPT_WINDOW:
                         {
@@ -2555,7 +2557,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 if (!tp->repair)
                         err = -EINVAL;
                 else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
+                        err = tcp_repair_options_est(sk,
                                         (struct tcp_repair_opt __user *)optval,
                                         optlen);
                 else
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6e3c512054a6..324c9bcc5456 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -180,6 +180,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
 
+        tcp_sk(sk)->prior_ssthresh = 0;
         if (icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
         if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de713c6..8d772fea1dde 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         struct ipv6hdr *ip6_hdr;
         struct ipv6_opt_hdr *hop;
         unsigned char buf[CALIPSO_MAX_BUFFER];
-        int len_delta, new_end, pad;
+        int len_delta, new_end, pad, payload;
         unsigned int start, end;
 
         ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         if (ret_val < 0)
                 return ret_val;
 
+        ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
+
         if (len_delta) {
                 if (len_delta > 0)
                         skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
                         sizeof(*ip6_hdr) + start);
                 skb_reset_network_header(skb);
                 ip6_hdr = ipv6_hdr(skb);
+                payload = ntohs(ip6_hdr->payload_len);
+                ip6_hdr->payload_len = htons(payload + len_delta);
         }
 
         hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 280268f1dd7b..cdb3728faca7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -116,8 +116,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
                 if (udpfrag) {
                         int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        if (err < 0)
+                        if (err < 0) {
+                                kfree_skb_list(segs);
                                 return ERR_PTR(err);
+                        }
                         fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                         fptr->frag_off = htons(offset);
                         if (skb->next)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7ae6c503f1ca..9b37f9747fc6 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1095,6 +1095,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 
         if (!dst) {
 route_lookup:
+                /* add dsfield to flowlabel for route lookup */
+                fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
+
                 dst = ip6_route_output(net, NULL, fl6);
 
                 if (dst->error)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 9b522fa90e6d..ac826dd338ff 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protosw = {
         .type =      SOCK_DGRAM,
         .protocol =  IPPROTO_ICMPV6,
         .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
         .flags =     INET_PROTOSW_REUSE,
 };
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f992d9e261d..60be012fe708 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
         .family            = PF_INET6,
         .owner             = THIS_MODULE,
         .release           = inet6_release,
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
         iph = ipv6_hdr(skb);
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 7a92c0f31912..9ad07a91708e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 60e2a62f7bef..cf2392b2ac71 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_start_txq(sta, tid, true);
 }
 
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
 
-        trace_api_start_tx_ba_cb(sdata, ra, tid);
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                return;
+
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
+                ieee80211_agg_tx_operational(local, sta, tid);
+}
+
+static struct tid_ampdu_tx *
+ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
+                        const u8 *ra, u16 tid, struct sta_info **sta)
+{
+        struct tid_ampdu_tx *tid_tx;
 
         if (tid >= IEEE80211_NUM_TIDS) {
                 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
                        tid, IEEE80211_NUM_TIDS);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                mutex_unlock(&local->sta_mtx);
+        *sta = sta_info_get_bss(sdata, ra);
+        if (!*sta) {
                 ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
 
-        if (WARN_ON(!tid_tx)) {
+        if (WARN_ON(!tid_tx))
                 ht_dbg(sdata, "addBA was not requested!\n");
-                goto unlock;
-        }
 
-        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
-                goto unlock;
-
-        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
-                ieee80211_agg_tx_operational(local, sta, tid);
-
- unlock:
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-        mutex_unlock(&local->sta_mtx);
+        return tid_tx;
 }
 
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_start_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         bool send_delba = false;
 
-        trace_api_stop_tx_ba_cb(sdata, ra, tid);
-
-        if (tid >= IEEE80211_NUM_TIDS) {
-                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
-                       tid, IEEE80211_NUM_TIDS);
-                return;
-        }
-
-        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid);
-
-        mutex_lock(&local->sta_mtx);
-
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                goto unlock;
-        }
+        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+               sta->sta.addr, tid);
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
         spin_lock_bh(&sta->lock);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+        if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sdata,
                        "unexpected callback to A-MPDU stop for %pM tid %d\n",
                        sta->sta.addr, tid);
@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         spin_unlock_bh(&sta->lock);
 
         if (send_delba)
-                ieee80211_send_delba(sdata, ra, tid,
+                ieee80211_send_delba(sdata, sta->sta.addr, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        mutex_unlock(&sta->ampdu_mlme.mtx);
- unlock:
-        mutex_unlock(&local->sta_mtx);
 }
 
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_stop_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f4a528773563..6ca5442b1e03 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -7,6 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017       Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
         int i;
 
-        cancel_work_sync(&sta->ampdu_mlme.work);
-
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
                 __ieee80211_stop_tx_ba_session(sta, i, reason);
                 __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                                reason != AGG_STOP_DESTROY_STA &&
                                                reason != AGG_STOP_PEER_REQUEST);
         }
+
+        /* stopping might queue the work again - so cancel only afterwards */
+        cancel_work_sync(&sta->ampdu_mlme.work);
 }
 
 void ieee80211_ba_session_work(struct work_struct *work)
@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work)
                 spin_unlock_bh(&sta->lock);
 
                 tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
-                                                 &tid_tx->state))
+                if (!tid_tx)
+                        continue;
+
+                if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state))
+                        ieee80211_start_tx_ba_cb(sta, tid, tid_tx);
+                if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))
                         ___ieee80211_stop_tx_ba_session(sta, tid,
                                                         AGG_STOP_LOCAL_REQUEST);
+                if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state))
+                        ieee80211_stop_tx_ba_cb(sta, tid, tid_tx);
         }
         mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f8f6c148f554..665501ac358f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1036,8 +1036,6 @@ struct ieee80211_rx_agg {
 
 enum sdata_queue_type {
         IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
-        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
-        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
         IEEE80211_SDATA_QUEUE_RX_AGG_START      = 3,
         IEEE80211_SDATA_QUEUE_RX_AGG_STOP       = 4,
 };
@@ -1427,12 +1425,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
         return local->hw.wiphy->bands[band];
 }
 
-/* this struct represents 802.11n's RA/TID combination */
-struct ieee80211_ra_tid {
-        u8 ra[ETH_ALEN];
-        u16 tid;
-};
-
 /* this struct holds the value parsing from channel switch IE  */
 struct ieee80211_csa_ie {
         struct cfg80211_chan_def chandef;
@@ -1794,8 +1786,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     enum ieee80211_agg_stop_reason reason);
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx);
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3bd5b81f5d81..8fae1a72e6a7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1237,7 +1237,6 @@ static void ieee80211_iface_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
-        struct ieee80211_ra_tid *ra_tid;
         struct ieee80211_rx_agg *rx_agg;
 
         if (!ieee80211_sdata_running(sdata))
@@ -1253,15 +1252,7 @@ static void ieee80211_iface_work(struct work_struct *work)
         while ((skb = skb_dequeue(&sdata->skb_queue))) {
                 struct ieee80211_mgmt *mgmt = (void *)skb->data;
 
-                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
                         rx_agg = (void *)&skb->cb;
                         mutex_lock(&local->sta_mtx);
                         sta = sta_info_get_bss(sdata, rx_agg->addr);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7cdf7a835bb0..403e3cc58b57 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2155,7 +2155,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         struct ieee80211_sta_rx_stats *cpurxs;
 
                         cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-                        sinfo->rx_packets += cpurxs->dropped;
+                        sinfo->rx_dropped_misc += cpurxs->dropped;
                 }
         }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5609cacb20d5..ea0747d6a6da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -116,6 +116,8 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_STOPPING           3
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+#define HT_AGG_STATE_START_CB           6
+#define HT_AGG_STATE_STOP_CB            7
 
 enum ieee80211_agg_stop_reason {
         AGG_STOP_DECLINED,
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 257ec66009da..7b05fd1497ce 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1418,7 +1418,7 @@ static void mpls_ifup(struct net_device *dev, unsigned int flags)
                                 continue;
                         alive++;
                         nh_flags &= ~flags;
-                        WRITE_ONCE(nh->nh_flags, flags);
+                        WRITE_ONCE(nh->nh_flags, nh_flags);
                 } endfor_nexthops(rt);
 
                 WRITE_ONCE(rt->rt_nhn_alive, alive);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9799a50bc604..a8be9b72e6cd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -890,8 +890,13 @@ restart:
         }
 out:
         local_bh_enable();
-        if (last)
+        if (last) {
+                /* nf ct hash resize happened, now clear the leftover. */
+                if ((struct nf_conn *)cb->args[1] == last)
+                        cb->args[1] = 0;
+
                 nf_ct_put(last);
+        }
 
         while (i) {
                 i--;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 13875d599a85..1c5b14a6cab3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
                       u8 pf, unsigned int hooknum)
 {
         const struct sctphdr *sh;
-        struct sctphdr _sctph;
         const char *logmsg;
 
-        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
-        if (!sh) {
+        if (skb->len < dataoff + sizeof(struct sctphdr)) {
                 logmsg = "nf_ct_sctp: short packet ";
                 goto out_invalid;
         }
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             skb->ip_summed == CHECKSUM_NONE) {
+                if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
+                        logmsg = "nf_ct_sctp: failed to read header ";
+                        goto out_invalid;
+                }
+                sh = (const struct sctphdr *)(skb->data + dataoff);
                 if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                         logmsg = "nf_ct_sctp: bad CRC ";
                         goto out_invalid;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index ef0be325a0c6..6c72922d20ca 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
          * will delete entry from already-freed table.
          */
-        ct->status &= ~IPS_NAT_DONE_MASK;
+        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
         rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
                         nf_nat_bysource_params);
 
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e97e2fb53f0a..fbdbaa00dd5f 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                 else if (d > 0)
                         p = &parent->rb_right;
                 else {
-                        if (nft_set_elem_active(&rbe->ext, genmask)) {
-                                if (nft_rbtree_interval_end(rbe) &&
-                                    !nft_rbtree_interval_end(new))
-                                        p = &parent->rb_left;
-                                else if (!nft_rbtree_interval_end(rbe) &&
-                                         nft_rbtree_interval_end(new))
-                                        p = &parent->rb_right;
-                                else {
-                                        *ext = &rbe->ext;
-                                        return -EEXIST;
-                                }
+                        if (nft_rbtree_interval_end(rbe) &&
+                            !nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_left;
+                        } else if (!nft_rbtree_interval_end(rbe) &&
+                                   nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_right;
+                        } else if (nft_set_elem_active(&rbe->ext, genmask)) {
+                                *ext = &rbe->ext;
+                                return -EEXIST;
+                        } else {
+                                p = &parent->rb_left;
                         }
                 }
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ee841f00a6ec..7586d446d7dc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -62,6 +62,7 @@
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
 #include <linux/genetlink.h>
+#include <linux/net_namespace.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1415,7 +1416,8 @@ static void do_one_broadcast(struct sock *sk,
                 goto out;
         }
         NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
-        NETLINK_CB(p->skb2).nsid_is_set = true;
+        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
+                NETLINK_CB(p->skb2).nsid_is_set = true;
         val = netlink_broadcast_deliver(sk, p->skb2);
         if (val < 0) {
                 netlink_overrun(sk);
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index 6fd95f76bfae..a7a23b5541f8 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -20,6 +20,10 @@ config KEYS
 
           If you are unsure as to whether this is required, answer N.
 
+config KEYS_COMPAT
+        def_bool y
+        depends on COMPAT && KEYS
+
 config PERSISTENT_KEYRINGS
         bool "Enable register of persistent per-UID keyrings"
         depends on KEYS
@@ -89,9 +93,9 @@ config ENCRYPTED_KEYS
 config KEY_DH_OPERATIONS
        bool "Diffie-Hellman operations on retained keys"
        depends on KEYS
-       select MPILIB
        select CRYPTO
        select CRYPTO_HASH
+       select CRYPTO_DH
        help
          This option provides support for calculating Diffie-Hellman
          public keys and shared secrets using values stored as keys
diff --git a/security/keys/dh.c b/security/keys/dh.c
index e603bd912e4c..4755d4b4f945 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -8,34 +8,17 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#include <linux/mpi.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <crypto/hash.h>
+#include <crypto/kpp.h>
+#include <crypto/dh.h>
 #include <keys/user-type.h>
 #include "internal.h"
 
-/*
- * Public key or shared secret generation function [RFC2631 sec 2.1.1]
- *
- * ya = g^xa mod p;
- * or
- * ZZ = yb^xa mod p;
- *
- * where xa is the local private key, ya is the local public key, g is
- * the generator, p is the prime, yb is the remote public key, and ZZ
- * is the shared secret.
- *
- * Both are the same calculation, so g or yb are the "base" and ya or
- * ZZ are the "result".
- */
-static int do_dh(MPI result, MPI base, MPI xa, MPI p)
-{
-        return mpi_powm(result, base, xa, p);
-}
-
-static ssize_t mpi_from_key(key_serial_t keyid, size_t maxlen, MPI *mpi)
+static ssize_t dh_data_from_key(key_serial_t keyid, void **data)
 {
         struct key *key;
         key_ref_t key_ref;
@@ -56,19 +39,17 @@ static ssize_t mpi_from_key(key_serial_t keyid, size_t maxlen, MPI *mpi)
                 status = key_validate(key);
                 if (status == 0) {
                         const struct user_key_payload *payload;
+                        uint8_t *duplicate;
 
                         payload = user_key_payload_locked(key);
 
-                        if (maxlen == 0) {
-                                *mpi = NULL;
+                        duplicate = kmemdup(payload->data, payload->datalen,
+                                            GFP_KERNEL);
+                        if (duplicate) {
+                                *data = duplicate;
                                 ret = payload->datalen;
-                        } else if (payload->datalen <= maxlen) {
-                                *mpi = mpi_read_raw_data(payload->data,
-                                                         payload->datalen);
-                                if (*mpi)
-                                        ret = payload->datalen;
                         } else {
-                                ret = -EINVAL;
+                                ret = -ENOMEM;
                         }
                 }
                 up_read(&key->sem);
@@ -79,6 +60,29 @@ error:
         return ret;
 }
 
+static void dh_free_data(struct dh *dh)
+{
+        kzfree(dh->key);
+        kzfree(dh->p);
+        kzfree(dh->g);
+}
+
+struct dh_completion {
+        struct completion completion;
+        int err;
+};
+
+static void dh_crypto_done(struct crypto_async_request *req, int err)
+{
+        struct dh_completion *compl = req->data;
+
+        if (err == -EINPROGRESS)
+                return;
+
+        compl->err = err;
+        complete(&compl->completion);
+}
+
 struct kdf_sdesc {
         struct shash_desc shash;
         char ctx[];
@@ -89,6 +93,7 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
         struct crypto_shash *tfm;
         struct kdf_sdesc *sdesc;
         int size;
+        int err;
 
         /* allocate synchronous hash */
         tfm = crypto_alloc_shash(hashname, 0, 0);
@@ -97,16 +102,25 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
                 return PTR_ERR(tfm);
         }
 
+        err = -EINVAL;
+        if (crypto_shash_digestsize(tfm) == 0)
+                goto out_free_tfm;
+
+        err = -ENOMEM;
         size = sizeof(struct shash_desc) + crypto_shash_descsize(tfm);
         sdesc = kmalloc(size, GFP_KERNEL);
         if (!sdesc)
-                return -ENOMEM;
+                goto out_free_tfm;
         sdesc->shash.tfm = tfm;
         sdesc->shash.flags = 0x0;
 
         *sdesc_ret = sdesc;
 
         return 0;
+
+out_free_tfm:
+        crypto_free_shash(tfm);
+        return err;
 }
 
 static void kdf_dealloc(struct kdf_sdesc *sdesc)
@@ -120,14 +134,6 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc)
         kzfree(sdesc);
 }
 
-/* convert 32 bit integer into its string representation */
-static inline void crypto_kw_cpu_to_be32(u32 val, u8 *buf)
-{
-        __be32 *a = (__be32 *)buf;
-
-        *a = cpu_to_be32(val);
-}
-
 /*
  * Implementation of the KDF in counter mode according to SP800-108 section 5.1
  * as well as SP800-56A section 5.8.1 (Single-step KDF).
@@ -138,25 +144,39 @@ static inline void crypto_kw_cpu_to_be32(u32 val, u8 *buf)
  * 5.8.1.2).
  */
 static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
-                   u8 *dst, unsigned int dlen)
+                   u8 *dst, unsigned int dlen, unsigned int zlen)
 {
         struct shash_desc *desc = &sdesc->shash;
         unsigned int h = crypto_shash_digestsize(desc->tfm);
         int err = 0;
         u8 *dst_orig = dst;
-        u32 i = 1;
-        u8 iteration[sizeof(u32)];
+        __be32 counter = cpu_to_be32(1);
 
         while (dlen) {
                 err = crypto_shash_init(desc);
                 if (err)
                         goto err;
 
-                crypto_kw_cpu_to_be32(i, iteration);
-                err = crypto_shash_update(desc, iteration, sizeof(u32));
+                err = crypto_shash_update(desc, (u8 *)&counter, sizeof(__be32));
                 if (err)
                         goto err;
 
+                if (zlen && h) {
+                        u8 tmpbuffer[h];
+                        size_t chunk = min_t(size_t, zlen, h);
+                        memset(tmpbuffer, 0, chunk);
+
+                        do {
+                                err = crypto_shash_update(desc, tmpbuffer,
+                                                          chunk);
+                                if (err)
+                                        goto err;
+
+                                zlen -= chunk;
+                                chunk = min_t(size_t, zlen, h);
+                        } while (zlen);
+                }
+
                 if (src && slen) {
                         err = crypto_shash_update(desc, src, slen);
                         if (err)
@@ -179,7 +199,7 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
 
                         dlen -= h;
                         dst += h;
-                        i++;
+                        counter = cpu_to_be32(be32_to_cpu(counter) + 1);
                 }
         }
 
@@ -192,7 +212,7 @@ err:
 
 static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
                                  char __user *buffer, size_t buflen,
-                                 uint8_t *kbuf, size_t kbuflen)
+                                 uint8_t *kbuf, size_t kbuflen, size_t lzero)
 {
         uint8_t *outbuf = NULL;
         int ret;
@@ -203,7 +223,7 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
                 goto err;
         }
 
-        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen);
+        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen, lzero);
         if (ret)
                 goto err;
 
@@ -221,21 +241,26 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
                          struct keyctl_kdf_params *kdfcopy)
 {
         long ret;
-        MPI base, private, prime, result;
-        unsigned nbytes;
+        ssize_t dlen;
+        int secretlen;
+        int outlen;
         struct keyctl_dh_params pcopy;
-        uint8_t *kbuf;
-        ssize_t keylen;
-        size_t resultlen;
+        struct dh dh_inputs;
+        struct scatterlist outsg;
+        struct dh_completion compl;
+        struct crypto_kpp *tfm;
+        struct kpp_request *req;
+        uint8_t *secret;
+        uint8_t *outbuf;
         struct kdf_sdesc *sdesc = NULL;
 
         if (!params || (!buffer && buflen)) {
                 ret = -EINVAL;
-                goto out;
+                goto out1;
         }
         if (copy_from_user(&pcopy, params, sizeof(pcopy)) != 0) {
                 ret = -EFAULT;
-                goto out;
+                goto out1;
         }
 
         if (kdfcopy) {
@@ -244,104 +269,147 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
                 if (buflen > KEYCTL_KDF_MAX_OUTPUT_LEN ||
                     kdfcopy->otherinfolen > KEYCTL_KDF_MAX_OI_LEN) {
                         ret = -EMSGSIZE;
-                        goto out;
+                        goto out1;
                 }
 
                 /* get KDF name string */
                 hashname = strndup_user(kdfcopy->hashname, CRYPTO_MAX_ALG_NAME);
                 if (IS_ERR(hashname)) {
                         ret = PTR_ERR(hashname);
-                        goto out;
+                        goto out1;
                 }
 
                 /* allocate KDF from the kernel crypto API */
                 ret = kdf_alloc(&sdesc, hashname);
                 kfree(hashname);
                 if (ret)
-                        goto out;
+                        goto out1;
         }
 
-        /*
-         * If the caller requests postprocessing with a KDF, allow an
-         * arbitrary output buffer size since the KDF ensures proper truncation.
-         */
-        keylen = mpi_from_key(pcopy.prime, kdfcopy ? SIZE_MAX : buflen, &prime);
-        if (keylen < 0 || !prime) {
-                /* buflen == 0 may be used to query the required buffer size,
-                 * which is the prime key length.
-                 */
-                ret = keylen;
-                goto out;
+        memset(&dh_inputs, 0, sizeof(dh_inputs));
+
+        dlen = dh_data_from_key(pcopy.prime, &dh_inputs.p);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out1;
+        }
+        dh_inputs.p_size = dlen;
+
+        dlen = dh_data_from_key(pcopy.base, &dh_inputs.g);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out2;
         }
+        dh_inputs.g_size = dlen;
 
-        /* The result is never longer than the prime */
-        resultlen = keylen;
+        dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out2;
+        }
+        dh_inputs.key_size = dlen;
 
-        keylen = mpi_from_key(pcopy.base, SIZE_MAX, &base);
-        if (keylen < 0 || !base) {
-                ret = keylen;
-                goto error1;
+        secretlen = crypto_dh_key_len(&dh_inputs);
+        secret = kmalloc(secretlen, GFP_KERNEL);
+        if (!secret) {
+                ret = -ENOMEM;
+                goto out2;
         }
+        ret = crypto_dh_encode_key(secret, secretlen, &dh_inputs);
+        if (ret)
+                goto out3;
 
-        keylen = mpi_from_key(pcopy.private, SIZE_MAX, &private);
-        if (keylen < 0 || !private) {
-                ret = keylen;
-                goto error2;
+        tfm = crypto_alloc_kpp("dh", CRYPTO_ALG_TYPE_KPP, 0);
+        if (IS_ERR(tfm)) {
+                ret = PTR_ERR(tfm);
+                goto out3;
+        }
+
+        ret = crypto_kpp_set_secret(tfm, secret, secretlen);
+        if (ret)
+                goto out4;
+
+        outlen = crypto_kpp_maxsize(tfm);
+
+        if (!kdfcopy) {
+                /*
+                 * When not using a KDF, buflen 0 is used to read the
+                 * required buffer length
+                 */
+                if (buflen == 0) {
+                        ret = outlen;
+                        goto out4;
+                } else if (outlen > buflen) {
+                        ret = -EOVERFLOW;
+                        goto out4;
+                }
         }
 
-        result = mpi_alloc(0);
-        if (!result) {
+        outbuf = kzalloc(kdfcopy ? (outlen + kdfcopy->otherinfolen) : outlen,
+                         GFP_KERNEL);
+        if (!outbuf) {
                 ret = -ENOMEM;
-                goto error3;
+                goto out4;
         }
 
-        /* allocate space for DH shared secret and SP800-56A otherinfo */
-        kbuf = kmalloc(kdfcopy ? (resultlen + kdfcopy->otherinfolen) : resultlen,
-                       GFP_KERNEL);
-        if (!kbuf) {
+        sg_init_one(&outsg, outbuf, outlen);
+
+        req = kpp_request_alloc(tfm, GFP_KERNEL);
+        if (!req) {
                 ret = -ENOMEM;
-                goto error4;
+                goto out5;
         }
 
+        kpp_request_set_input(req, NULL, 0);
+        kpp_request_set_output(req, &outsg, outlen);
+        init_completion(&compl.completion);
+        kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+                                 CRYPTO_TFM_REQ_MAY_SLEEP,
+                                 dh_crypto_done, &compl);
+
         /*
-         * Concatenate SP800-56A otherinfo past DH shared secret -- the
-         * input to the KDF is (DH shared secret || otherinfo)
+         * For DH, generate_public_key and generate_shared_secret are
+         * the same calculation
          */
-        if (kdfcopy && kdfcopy->otherinfo &&
-            copy_from_user(kbuf + resultlen, kdfcopy->otherinfo,
-                           kdfcopy->otherinfolen) != 0) {
-                ret = -EFAULT;
-                goto error5;
+        ret = crypto_kpp_generate_public_key(req);
+        if (ret == -EINPROGRESS) {
+                wait_for_completion(&compl.completion);
+                ret = compl.err;
+                if (ret)
+                        goto out6;
         }
 
-        ret = do_dh(result, base, private, prime);
-        if (ret)
-                goto error5;
-
-        ret = mpi_read_buffer(result, kbuf, resultlen, &nbytes, NULL);
-        if (ret != 0)
-                goto error5;
-
         if (kdfcopy) {
-                ret = keyctl_dh_compute_kdf(sdesc, buffer, buflen, kbuf,
-                                            resultlen + kdfcopy->otherinfolen);
-        } else {
-                ret = nbytes;
-                if (copy_to_user(buffer, kbuf, nbytes) != 0)
+                /*
+                 * Concatenate SP800-56A otherinfo past DH shared secret -- the
+                 * input to the KDF is (DH shared secret || otherinfo)
+                 */
+                if (copy_from_user(outbuf + req->dst_len, kdfcopy->otherinfo,
+                                   kdfcopy->otherinfolen) != 0) {
                         ret = -EFAULT;
+                        goto out6;
+                }
+
+                ret = keyctl_dh_compute_kdf(sdesc, buffer, buflen, outbuf,
+                                            req->dst_len + kdfcopy->otherinfolen,
+                                            outlen - req->dst_len);
+        } else if (copy_to_user(buffer, outbuf, req->dst_len) == 0) {
+                ret = req->dst_len;
+        } else {
+                ret = -EFAULT;
         }
 
-error5:
-        kzfree(kbuf);
-error4:
-        mpi_free(result);
-error3:
-        mpi_free(private);
-error2:
-        mpi_free(base);
-error1:
-        mpi_free(prime);
-out:
+out6:
+        kpp_request_free(req);
+out5:
+        kzfree(outbuf);
+out4:
+        crypto_free_kpp(tfm);
+out3:
+        kzfree(secret);
+out2:
+        dh_free_data(&dh_inputs);
+out1:
         kdf_dealloc(sdesc);
         return ret;
 }
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 0010955d7876..bb6324d1ccec 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -30,6 +30,7 @@
 #include <linux/scatterlist.h>
 #include <linux/ctype.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 #include <crypto/hash.h>
 #include <crypto/sha.h>
 #include <crypto/skcipher.h>
@@ -54,13 +55,7 @@ static int blksize;
 #define MAX_DATA_SIZE 4096
 #define MIN_DATA_SIZE  20
 
-struct sdesc {
-        struct shash_desc shash;
-        char ctx[];
-};
-
-static struct crypto_shash *hashalg;
-static struct crypto_shash *hmacalg;
+static struct crypto_shash *hash_tfm;
 
 enum {
         Opt_err = -1, Opt_new, Opt_load, Opt_update
@@ -141,23 +136,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc)
  */
 static int valid_master_desc(const char *new_desc, const char *orig_desc)
 {
-        if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) {
-                if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN)
-                        goto out;
-                if (orig_desc)
-                        if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN))
-                                goto out;
-        } else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) {
-                if (strlen(new_desc) == KEY_USER_PREFIX_LEN)
-                        goto out;
-                if (orig_desc)
-                        if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN))
-                                goto out;
-        } else
-                goto out;
+        int prefix_len;
+
+        if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
+                prefix_len = KEY_TRUSTED_PREFIX_LEN;
+        else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
+                prefix_len = KEY_USER_PREFIX_LEN;
+        else
+                return -EINVAL;
+
+        if (!new_desc[prefix_len])
+                return -EINVAL;
+
+        if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
+                return -EINVAL;
+
         return 0;
-out:
-        return -EINVAL;
 }
 
 /*
@@ -321,53 +315,38 @@ error:
         return ukey;
 }
 
-static struct sdesc *alloc_sdesc(struct crypto_shash *alg)
-{
-        struct sdesc *sdesc;
-        int size;
-
-        size = sizeof(struct shash_desc) + crypto_shash_descsize(alg);
-        sdesc = kmalloc(size, GFP_KERNEL);
-        if (!sdesc)
-                return ERR_PTR(-ENOMEM);
-        sdesc->shash.tfm = alg;
-        sdesc->shash.flags = 0x0;
-        return sdesc;
-}
-
-static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
+static int calc_hash(struct crypto_shash *tfm, u8 *digest,
                      const u8 *buf, unsigned int buflen)
 {
-        struct sdesc *sdesc;
-        int ret;
+        SHASH_DESC_ON_STACK(desc, tfm);
+        int err;
 
-        sdesc = alloc_sdesc(hmacalg);
-        if (IS_ERR(sdesc)) {
-                pr_info("encrypted_key: can't alloc %s\n", hmac_alg);
-                return PTR_ERR(sdesc);
-        }
+        desc->tfm = tfm;
+        desc->flags = 0;
 
-        ret = crypto_shash_setkey(hmacalg, key, keylen);
-        if (!ret)
-                ret = crypto_shash_digest(&sdesc->shash, buf, buflen, digest);
-        kfree(sdesc);
-        return ret;
+        err = crypto_shash_digest(desc, buf, buflen, digest);
+        shash_desc_zero(desc);
+        return err;
 }
 
-static int calc_hash(u8 *digest, const u8 *buf, unsigned int buflen)
+static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
+                     const u8 *buf, unsigned int buflen)
 {
-        struct sdesc *sdesc;
-        int ret;
+        struct crypto_shash *tfm;
+        int err;
 
-        sdesc = alloc_sdesc(hashalg);
-        if (IS_ERR(sdesc)) {
-                pr_info("encrypted_key: can't alloc %s\n", hash_alg);
-                return PTR_ERR(sdesc);
+        tfm = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(tfm)) {
+                pr_err("encrypted_key: can't alloc %s transform: %ld\n",
+                       hmac_alg, PTR_ERR(tfm));
+                return PTR_ERR(tfm);
         }
 
-        ret = crypto_shash_digest(&sdesc->shash, buf, buflen, digest);
-        kfree(sdesc);
-        return ret;
+        err = crypto_shash_setkey(tfm, key, keylen);
+        if (!err)
+                err = calc_hash(tfm, digest, buf, buflen);
+        crypto_free_shash(tfm);
+        return err;
 }
 
 enum derived_key_type { ENC_KEY, AUTH_KEY };
@@ -385,10 +364,9 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
                 derived_buf_len = HASH_SIZE;
 
         derived_buf = kzalloc(derived_buf_len, GFP_KERNEL);
-        if (!derived_buf) {
-                pr_err("encrypted_key: out of memory\n");
+        if (!derived_buf)
                 return -ENOMEM;
-        }
+
         if (key_type)
                 strcpy(derived_buf, "AUTH_KEY");
         else
@@ -396,8 +374,8 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
 
         memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
                master_keylen);
-        ret = calc_hash(derived_key, derived_buf, derived_buf_len);
-        kfree(derived_buf);
+        ret = calc_hash(hash_tfm, derived_key, derived_buf, derived_buf_len);
+        kzfree(derived_buf);
         return ret;
 }
 
@@ -480,12 +458,9 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
         u8 iv[AES_BLOCK_SIZE];
-        unsigned int padlen;
-        char pad[16];
         int ret;
 
         encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
-        padlen = encrypted_datalen - epayload->decrypted_datalen;
 
         req = init_skcipher_req(derived_key, derived_keylen);
         ret = PTR_ERR(req);
@@ -493,11 +468,10 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_decrypted_data(epayload);
 
-        memset(pad, 0, sizeof pad);
         sg_init_table(sg_in, 2);
         sg_set_buf(&sg_in[0], epayload->decrypted_data,
                    epayload->decrypted_datalen);
-        sg_set_buf(&sg_in[1], pad, padlen);
+        sg_set_page(&sg_in[1], ZERO_PAGE(0), AES_BLOCK_SIZE, 0);
 
         sg_init_table(sg_out, 1);
         sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
@@ -533,6 +507,7 @@ static int datablob_hmac_append(struct encrypted_key_payload *epayload,
         if (!ret)
                 dump_hmac(NULL, digest, HASH_SIZE);
 out:
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -561,8 +536,8 @@ static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
         ret = calc_hmac(digest, derived_key, sizeof derived_key, p, len);
         if (ret < 0)
                 goto out;
-        ret = memcmp(digest, epayload->format + epayload->datablob_len,
-                     sizeof digest);
+        ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
+                            sizeof(digest));
         if (ret) {
                 ret = -EINVAL;
                 dump_hmac("datablob",
@@ -571,6 +546,7 @@ static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
                 dump_hmac("calc", digest, HASH_SIZE);
         }
 out:
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -584,9 +560,14 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
         u8 iv[AES_BLOCK_SIZE];
-        char pad[16];
+        u8 *pad;
         int ret;
 
+        /* Throwaway buffer to hold the unused zero padding at the end */
+        pad = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL);
+        if (!pad)
+                return -ENOMEM;
+
         encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
         req = init_skcipher_req(derived_key, derived_keylen);
         ret = PTR_ERR(req);
@@ -594,13 +575,12 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_encrypted_data(epayload, encrypted_datalen);
 
-        memset(pad, 0, sizeof pad);
         sg_init_table(sg_in, 1);
         sg_init_table(sg_out, 2);
         sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
         sg_set_buf(&sg_out[0], epayload->decrypted_data,
                    epayload->decrypted_datalen);
-        sg_set_buf(&sg_out[1], pad, sizeof pad);
+        sg_set_buf(&sg_out[1], pad, AES_BLOCK_SIZE);
 
         memcpy(iv, epayload->iv, sizeof(iv));
         skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
@@ -612,6 +592,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_decrypted_data(epayload);
 out:
+        kfree(pad);
         return ret;
 }
 
@@ -722,6 +703,7 @@ static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
 out:
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -828,13 +810,13 @@ static int encrypted_instantiate(struct key *key,
         ret = encrypted_init(epayload, key->description, format, master_desc,
                              decrypted_datalen, hex_encoded_iv);
         if (ret < 0) {
-                kfree(epayload);
+                kzfree(epayload);
                 goto out;
         }
 
         rcu_assign_keypointer(key, epayload);
 out:
-        kfree(datablob);
+        kzfree(datablob);
         return ret;
 }
 
@@ -843,8 +825,7 @@ static void encrypted_rcu_free(struct rcu_head *rcu)
         struct encrypted_key_payload *epayload;
 
         epayload = container_of(rcu, struct encrypted_key_payload, rcu);
-        memset(epayload->decrypted_data, 0, epayload->decrypted_datalen);
-        kfree(epayload);
+        kzfree(epayload);
 }
 
 /*
@@ -902,7 +883,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
         rcu_assign_keypointer(key, new_epayload);
         call_rcu(&epayload->rcu, encrypted_rcu_free);
 out:
-        kfree(buf);
+        kzfree(buf);
         return ret;
 }
 
@@ -960,33 +941,26 @@ static long encrypted_read(const struct key *key, char __user *buffer,
 
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
 
         if (copy_to_user(buffer, ascii_buf, asciiblob_len) != 0)
                 ret = -EFAULT;
-        kfree(ascii_buf);
+        kzfree(ascii_buf);
 
         return asciiblob_len;
 out:
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
 /*
- * encrypted_destroy - before freeing the key, clear the decrypted data
- *
- * Before freeing the key, clear the memory containing the decrypted
- * key data.
+ * encrypted_destroy - clear and free the key's payload
  */
 static void encrypted_destroy(struct key *key)
 {
-        struct encrypted_key_payload *epayload = key->payload.data[0];
-
-        if (!epayload)
-                return;
-
-        memzero_explicit(epayload->decrypted_data, epayload->decrypted_datalen);
-        kfree(key->payload.data[0]);
+        kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_encrypted = {
@@ -999,47 +973,17 @@ struct key_type key_type_encrypted = {
 };
 EXPORT_SYMBOL_GPL(key_type_encrypted);
 
-static void encrypted_shash_release(void)
-{
-        if (hashalg)
-                crypto_free_shash(hashalg);
-        if (hmacalg)
-                crypto_free_shash(hmacalg);
-}
-
-static int __init encrypted_shash_alloc(void)
+static int __init init_encrypted(void)
 {
         int ret;
 
-        hmacalg = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hmacalg)) {
-                pr_info("encrypted_key: could not allocate crypto %s\n",
-                        hmac_alg);
-                return PTR_ERR(hmacalg);
-        }
-
-        hashalg = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hashalg)) {
-                pr_info("encrypted_key: could not allocate crypto %s\n",
-                        hash_alg);
-                ret = PTR_ERR(hashalg);
-                goto hashalg_fail;
+        hash_tfm = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(hash_tfm)) {
+                pr_err("encrypted_key: can't allocate %s transform: %ld\n",
+                       hash_alg, PTR_ERR(hash_tfm));
+                return PTR_ERR(hash_tfm);
         }
 
-        return 0;
-
-hashalg_fail:
-        crypto_free_shash(hmacalg);
-        return ret;
-}
-
-static int __init init_encrypted(void)
-{
-        int ret;
-
-        ret = encrypted_shash_alloc();
-        if (ret < 0)
-                return ret;
         ret = aes_get_sizes();
         if (ret < 0)
                 goto out;
@@ -1048,14 +992,14 @@ static int __init init_encrypted(void)
                 goto out;
         return 0;
 out:
-        encrypted_shash_release();
+        crypto_free_shash(hash_tfm);
         return ret;
 
 }
 
 static void __exit cleanup_encrypted(void)
 {
-        encrypted_shash_release();
+        crypto_free_shash(hash_tfm);
         unregister_key_type(&key_type_encrypted);
 }
 
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 595becc6d0d2..87cb260e4890 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -158,9 +158,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 
                 kfree(key->description);
 
-#ifdef KEY_DEBUGGING
-                key->magic = KEY_DEBUG_MAGIC_X;
-#endif
+                memzero_explicit(key, sizeof(*key));
                 kmem_cache_free(key_jar, key);
         }
 }
diff --git a/security/keys/key.c b/security/keys/key.c
index 455c04d80bbb..83da68d98b40 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -660,14 +660,11 @@ not_found:
         goto error;
 
 found:
-        /* pretend it doesn't exist if it is awaiting deletion */
-        if (refcount_read(&key->usage) == 0)
-                goto not_found;
-
-        /* this races with key_put(), but that doesn't matter since key_put()
-         * doesn't actually change the key
+        /* A key is allowed to be looked up only if someone still owns a
+         * reference to it - otherwise it's awaiting the gc.
          */
-        __key_get(key);
+        if (!refcount_inc_not_zero(&key->usage))
+                goto not_found;
 
 error:
         spin_unlock(&key_serial_lock);
@@ -966,12 +963,11 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
         /* the key must be writable */
         ret = key_permission(key_ref, KEY_NEED_WRITE);
         if (ret < 0)
-                goto error;
+                return ret;
 
         /* attempt to update it if supported */
-        ret = -EOPNOTSUPP;
         if (!key->type->update)
-                goto error;
+                return -EOPNOTSUPP;
 
         memset(&prep, 0, sizeof(prep));
         prep.data = payload;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 447a7d5cee0f..ab0b337c84b4 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -99,7 +99,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
         /* pull the payload in if one was supplied */
         payload = NULL;
 
-        if (_payload) {
+        if (plen) {
                 ret = -ENOMEM;
                 payload = kvmalloc(plen, GFP_KERNEL);
                 if (!payload)
@@ -132,7 +132,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 
         key_ref_put(keyring_ref);
  error3:
-        kvfree(payload);
+        if (payload) {
+                memzero_explicit(payload, plen);
+                kvfree(payload);
+        }
  error2:
         kfree(description);
  error:
@@ -324,7 +327,7 @@ long keyctl_update_key(key_serial_t id,
 
         /* pull the payload in if one was supplied */
         payload = NULL;
-        if (_payload) {
+        if (plen) {
                 ret = -ENOMEM;
                 payload = kmalloc(plen, GFP_KERNEL);
                 if (!payload)
@@ -347,7 +350,7 @@ long keyctl_update_key(key_serial_t id,
 
         key_ref_put(key_ref);
 error2:
-        kfree(payload);
+        kzfree(payload);
 error:
         return ret;
 }
@@ -1093,7 +1096,10 @@ long keyctl_instantiate_key_common(key_serial_t id,
                 keyctl_change_reqkey_auth(NULL);
 
 error2:
-        kvfree(payload);
+        if (payload) {
+                memzero_explicit(payload, plen);
+                kvfree(payload);
+        }
 error:
         return ret;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 4d1678e4586f..de81793f9920 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -706,7 +706,7 @@ descend_to_keyring:
          * Non-keyrings avoid the leftmost branch of the root entirely (root
          * slots 1-15).
          */
-        ptr = ACCESS_ONCE(keyring->keys.root);
+        ptr = READ_ONCE(keyring->keys.root);
         if (!ptr)
                 goto not_this_keyring;
 
@@ -720,7 +720,7 @@ descend_to_keyring:
                 if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0)
                         goto not_this_keyring;
 
-                ptr = ACCESS_ONCE(shortcut->next_node);
+                ptr = READ_ONCE(shortcut->next_node);
                 node = assoc_array_ptr_to_node(ptr);
                 goto begin_node;
         }
@@ -740,7 +740,7 @@ descend_to_node:
         if (assoc_array_ptr_is_shortcut(ptr)) {
                 shortcut = assoc_array_ptr_to_shortcut(ptr);
                 smp_read_barrier_depends();
-                ptr = ACCESS_ONCE(shortcut->next_node);
+                ptr = READ_ONCE(shortcut->next_node);
                 BUG_ON(!assoc_array_ptr_is_node(ptr));
         }
         node = assoc_array_ptr_to_node(ptr);
@@ -752,7 +752,7 @@ begin_node:
 ascend_to_node:
         /* Go through the slots in a node */
         for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
-                ptr = ACCESS_ONCE(node->slots[slot]);
+                ptr = READ_ONCE(node->slots[slot]);
 
                 if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
                         goto descend_to_node;
@@ -790,13 +790,13 @@ ascend_to_node:
         /* We've dealt with all the slots in the current node, so now we need
          * to ascend to the parent and continue processing there.
          */
-        ptr = ACCESS_ONCE(node->back_pointer);
+        ptr = READ_ONCE(node->back_pointer);
         slot = node->parent_slot;
 
         if (ptr && assoc_array_ptr_is_shortcut(ptr)) {
                 shortcut = assoc_array_ptr_to_shortcut(ptr);
                 smp_read_barrier_depends();
-                ptr = ACCESS_ONCE(shortcut->back_pointer);
+                ptr = READ_ONCE(shortcut->back_pointer);
                 slot = shortcut->parent_slot;
         }
         if (!ptr)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 2217dfec7996..86bced9fdbdf 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -809,15 +809,14 @@ long join_session_keyring(const char *name)
                 ret = PTR_ERR(keyring);
                 goto error2;
         } else if (keyring == new->session_keyring) {
-                key_put(keyring);
                 ret = 0;
-                goto error2;
+                goto error3;
         }
 
         /* we've got a keyring - now to install it */
         ret = install_session_keyring_to_cred(new, keyring);
         if (ret < 0)
-                goto error2;
+                goto error3;
 
         commit_creds(new);
         mutex_unlock(&key_session_mutex);
@@ -827,6 +826,8 @@ long join_session_keyring(const char *name)
 okay:
         return ret;
 
+error3:
+        key_put(keyring);
 error2:
         mutex_unlock(&key_session_mutex);
 error:
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 2ae31c5a87de..435e86e13879 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -70,7 +70,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int datalen,
         }
 
         ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -114,7 +114,7 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
         if (!ret)
                 ret = crypto_shash_final(&sdesc->shash, digest);
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -165,7 +165,7 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                                   paramdigest, TPM_NONCE_SIZE, h1,
                                   TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -246,7 +246,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
         if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
                 ret = -EINVAL;
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -347,7 +347,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
         if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
                 ret = -EINVAL;
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -564,7 +564,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
                 *bloblen = storedsize;
         }
 out:
-        kfree(td);
+        kzfree(td);
         return ret;
 }
 
@@ -678,7 +678,7 @@ static int key_seal(struct trusted_key_payload *p,
         if (ret < 0)
                 pr_info("trusted_key: srkseal failed (%d)\n", ret);
 
-        kfree(tb);
+        kzfree(tb);
         return ret;
 }
 
@@ -703,7 +703,7 @@ static int key_unseal(struct trusted_key_payload *p,
                 /* pull migratable flag out of sealed key */
                 p->migratable = p->key[--p->key_len];
 
-        kfree(tb);
+        kzfree(tb);
         return ret;
 }
 
@@ -1037,12 +1037,12 @@ static int trusted_instantiate(struct key *key,
         if (!ret && options->pcrlock)
                 ret = pcrlock(options->pcrlock);
 out:
-        kfree(datablob);
-        kfree(options);
+        kzfree(datablob);
+        kzfree(options);
         if (!ret)
                 rcu_assign_keypointer(key, payload);
         else
-                kfree(payload);
+                kzfree(payload);
         return ret;
 }
 
@@ -1051,8 +1051,7 @@ static void trusted_rcu_free(struct rcu_head *rcu)
         struct trusted_key_payload *p;
 
         p = container_of(rcu, struct trusted_key_payload, rcu);
-        memset(p->key, 0, p->key_len);
-        kfree(p);
+        kzfree(p);
 }
 
 /*
@@ -1094,13 +1093,13 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         ret = datablob_parse(datablob, new_p, new_o);
         if (ret != Opt_update) {
                 ret = -EINVAL;
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
 
         if (!new_o->keyhandle) {
                 ret = -EINVAL;
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
 
@@ -1114,22 +1113,22 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         ret = key_seal(new_p, new_o);
         if (ret < 0) {
                 pr_info("trusted_key: key_seal failed (%d)\n", ret);
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
         if (new_o->pcrlock) {
                 ret = pcrlock(new_o->pcrlock);
                 if (ret < 0) {
                         pr_info("trusted_key: pcrlock failed (%d)\n", ret);
-                        kfree(new_p);
+                        kzfree(new_p);
                         goto out;
                 }
         }
         rcu_assign_keypointer(key, new_p);
         call_rcu(&p->rcu, trusted_rcu_free);
 out:
-        kfree(datablob);
-        kfree(new_o);
+        kzfree(datablob);
+        kzfree(new_o);
         return ret;
 }
 
@@ -1158,24 +1157,19 @@ static long trusted_read(const struct key *key, char __user *buffer,
         for (i = 0; i < p->blob_len; i++)
                 bufp = hex_byte_pack(bufp, p->blob[i]);
         if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
-                kfree(ascii_buf);
+                kzfree(ascii_buf);
                 return -EFAULT;
         }
-        kfree(ascii_buf);
+        kzfree(ascii_buf);
         return 2 * p->blob_len;
 }
 
 /*
- * trusted_destroy - before freeing the key, clear the decrypted data
+ * trusted_destroy - clear and free the key's payload
  */
 static void trusted_destroy(struct key *key)
 {
-        struct trusted_key_payload *p = key->payload.data[0];
-
-        if (!p)
-                return;
-        memset(p->key, 0, p->key_len);
-        kfree(key->payload.data[0]);
+        kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_trusted = {
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 26605134f17a..3d8c68eba516 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -86,10 +86,18 @@ EXPORT_SYMBOL_GPL(user_preparse);
  */
 void user_free_preparse(struct key_preparsed_payload *prep)
 {
-        kfree(prep->payload.data[0]);
+        kzfree(prep->payload.data[0]);
 }
 EXPORT_SYMBOL_GPL(user_free_preparse);
 
+static void user_free_payload_rcu(struct rcu_head *head)
+{
+        struct user_key_payload *payload;
+
+        payload = container_of(head, struct user_key_payload, rcu);
+        kzfree(payload);
+}
+
 /*
  * update a user defined key
  * - the key's semaphore is write-locked
@@ -112,7 +120,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
         prep->payload.data[0] = NULL;
 
         if (zap)
-                kfree_rcu(zap, rcu);
+                call_rcu(&zap->rcu, user_free_payload_rcu);
         return ret;
 }
 EXPORT_SYMBOL_GPL(user_update);
@@ -130,7 +138,7 @@ void user_revoke(struct key *key)
 
         if (upayload) {
                 rcu_assign_keypointer(key, NULL);
-                kfree_rcu(upayload, rcu);
+                call_rcu(&upayload->rcu, user_free_payload_rcu);
         }
 }
 
@@ -143,7 +151,7 @@ void user_destroy(struct key *key)
 {
         struct user_key_payload *upayload = key->payload.data[0];
 
-        kfree(upayload);
+        kzfree(upayload);
 }
 
 EXPORT_SYMBOL_GPL(user_destroy);
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 2f836ca09860..cd67d1c12cf1 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1618,6 +1618,7 @@ static int snd_timer_user_tselect(struct file *file,
         if (err < 0)
                 goto __err;
 
+        tu->qhead = tu->qtail = tu->qused = 0;
         kfree(tu->queue);
         tu->queue = NULL;
         kfree(tu->tqueue);
@@ -1959,6 +1960,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
 
         tu = file->private_data;
         unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
+        mutex_lock(&tu->ioctl_lock);
         spin_lock_irq(&tu->qlock);
         while ((long)count - result >= unit) {
                 while (!tu->qused) {
@@ -1974,7 +1976,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                         add_wait_queue(&tu->qchange_sleep, &wait);
 
                         spin_unlock_irq(&tu->qlock);
+                        mutex_unlock(&tu->ioctl_lock);
                         schedule();
+                        mutex_lock(&tu->ioctl_lock);
                         spin_lock_irq(&tu->qlock);
 
                         remove_wait_queue(&tu->qchange_sleep, &wait);
@@ -1994,7 +1998,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                 tu->qused--;
                 spin_unlock_irq(&tu->qlock);
 
-                mutex_lock(&tu->ioctl_lock);
                 if (tu->tread) {
                         if (copy_to_user(buffer, &tu->tqueue[qhead],
                                          sizeof(struct snd_timer_tread)))
@@ -2004,7 +2007,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                          sizeof(struct snd_timer_read)))
                                 err = -EFAULT;
                 }
-                mutex_unlock(&tu->ioctl_lock);
 
                 spin_lock_irq(&tu->qlock);
                 if (err < 0)
@@ -2014,6 +2016,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
         }
  _error:
         spin_unlock_irq(&tu->qlock);
+        mutex_unlock(&tu->ioctl_lock);
         return result > 0 ? result : err;
 }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a57988d617e9..cbeebc0a9711 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5854,7 +5854,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
         SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+        SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
@@ -5862,13 +5866,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
         SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+        SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
-        SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
         SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c
index 7ae46c2647d4..b7ef8c59b49a 100644
--- a/sound/soc/atmel/atmel-classd.c
+++ b/sound/soc/atmel/atmel-classd.c
@@ -301,6 +301,14 @@ static int atmel_classd_codec_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
+static int atmel_classd_codec_resume(struct snd_soc_codec *codec)
+{
+        struct snd_soc_card *card = snd_soc_codec_get_drvdata(codec);
+        struct atmel_classd *dd = snd_soc_card_get_drvdata(card);
+
+        return regcache_sync(dd->regmap);
+}
+
 static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 {
         return dev_get_regmap(dev, NULL);
@@ -308,6 +316,7 @@ static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 
 static struct snd_soc_codec_driver soc_codec_dev_classd = {
         .probe          = atmel_classd_codec_probe,
+        .resume         = atmel_classd_codec_resume,
         .get_regmap     = atmel_classd_codec_get_remap,
         .component_driver = {
                 .controls               = atmel_classd_snd_controls,
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index 6dd7578f0bb8..024d83fa6a7f 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -772,7 +772,7 @@ static int da7213_dai_event(struct snd_soc_dapm_widget *w,
                                 ++i;
                                 msleep(50);
                         }
-                } while ((i < DA7213_SRM_CHECK_RETRIES) & (!srm_lock));
+                } while ((i < DA7213_SRM_CHECK_RETRIES) && (!srm_lock));
 
                 if (!srm_lock)
                         dev_warn(codec->dev, "SRM failed to lock\n");
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index 9c365a7f758d..7899a2cdeb42 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1108,6 +1108,13 @@ static const struct dmi_system_id force_combo_jack_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform")
                 }
         },
+        {
+                .ident = "Thinkpad Helix 2nd",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix 2nd")
+                }
+        },
 
         { }
 };
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 2c9dedab5184..bc136d2bd7cd 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -202,7 +202,7 @@ static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
         if (ret < 0)
                 return ret;
 
-        ret = asoc_simple_card_init_mic(rtd->card, &priv->hp_jack, PREFIX);
+        ret = asoc_simple_card_init_mic(rtd->card, &priv->mic_jack, PREFIX);
         if (ret < 0)
                 return ret;
 
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index 58c525096a7c..498b15345b1a 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -413,8 +413,11 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
         u32 reply = header.primary & IPC_GLB_REPLY_STATUS_MASK;
         u64 *ipc_header = (u64 *)(&header);
         struct skl_sst *skl = container_of(ipc, struct skl_sst, ipc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&ipc->dsp->spinlock, flags);
         msg = skl_ipc_reply_get_msg(ipc, *ipc_header);
+        spin_unlock_irqrestore(&ipc->dsp->spinlock, flags);
         if (msg == NULL) {
                 dev_dbg(ipc->dev, "ipc: rx list is empty\n");
                 return;
@@ -456,8 +459,10 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
                 }
         }
 
+        spin_lock_irqsave(&ipc->dsp->spinlock, flags);
         list_del(&msg->list);
         sst_ipc_tx_msg_reply_complete(ipc, msg);
+        spin_unlock_irqrestore(&ipc->dsp->spinlock, flags);
 }
 
 irqreturn_t skl_dsp_irq_thread_handler(int irq, void *context)
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 3a99712e44a8..64a0f8ed33e1 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -2502,7 +2502,7 @@ static int skl_tplg_get_manifest_tkn(struct device *dev,
 
                         if (ret < 0)
                                 return ret;
-                        tkn_count += ret;
+                        tkn_count = ret;
 
                         tuple_size += tkn_count *
                                 sizeof(struct snd_soc_tplg_vendor_string_elem);
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 6df3b317a476..4c9b5781282b 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -410,7 +410,7 @@ static int skl_free(struct hdac_ext_bus *ebus)
         struct skl *skl  = ebus_to_skl(ebus);
         struct hdac_bus *bus = ebus_to_hbus(ebus);
 
-        skl->init_failed = 1; /* to be sure */
+        skl->init_done = 0; /* to be sure */
 
         snd_hdac_ext_stop_streams(ebus);
 
@@ -428,8 +428,10 @@ static int skl_free(struct hdac_ext_bus *ebus)
 
         snd_hdac_ext_bus_exit(ebus);
 
+        cancel_work_sync(&skl->probe_work);
         if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
                 snd_hdac_i915_exit(&ebus->bus);
+
         return 0;
 }
 
@@ -566,6 +568,84 @@ static const struct hdac_bus_ops bus_core_ops = {
         .get_response = snd_hdac_bus_get_response,
 };
 
+static int skl_i915_init(struct hdac_bus *bus)
+{
+        int err;
+
+        /*
+         * The HDMI codec is in GPU so we need to ensure that it is powered
+         * up and ready for probe
+         */
+        err = snd_hdac_i915_init(bus);
+        if (err < 0)
+                return err;
+
+        err = snd_hdac_display_power(bus, true);
+        if (err < 0)
+                dev_err(bus->dev, "Cannot turn on display power on i915\n");
+
+        return err;
+}
+
+static void skl_probe_work(struct work_struct *work)
+{
+        struct skl *skl = container_of(work, struct skl, probe_work);
+        struct hdac_ext_bus *ebus = &skl->ebus;
+        struct hdac_bus *bus = ebus_to_hbus(ebus);
+        struct hdac_ext_link *hlink = NULL;
+        int err;
+
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                err = skl_i915_init(bus);
+                if (err < 0)
+                        return;
+        }
+
+        err = skl_init_chip(bus, true);
+        if (err < 0) {
+                dev_err(bus->dev, "Init chip failed with err: %d\n", err);
+                goto out_err;
+        }
+
+        /* codec detection */
+        if (!bus->codec_mask)
+                dev_info(bus->dev, "no hda codecs found!\n");
+
+        /* create codec instances */
+        err = skl_codec_create(ebus);
+        if (err < 0)
+                goto out_err;
+
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                err = snd_hdac_display_power(bus, false);
+                if (err < 0) {
+                        dev_err(bus->dev, "Cannot turn off display power on i915\n");
+                        return;
+                }
+        }
+
+        /* register platform dai and controls */
+        err = skl_platform_register(bus->dev);
+        if (err < 0)
+                return;
+        /*
+         * we are done probing so decrement link counts
+         */
+        list_for_each_entry(hlink, &ebus->hlink_list, list)
+                snd_hdac_ext_bus_link_put(ebus, hlink);
+
+        /* configure PM */
+        pm_runtime_put_noidle(bus->dev);
+        pm_runtime_allow(bus->dev);
+        skl->init_done = 1;
+
+        return;
+
+out_err:
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+                err = snd_hdac_display_power(bus, false);
+}
+
 /*
  * constructor
  */
@@ -593,6 +673,7 @@ static int skl_create(struct pci_dev *pci,
         snd_hdac_ext_bus_init(ebus, &pci->dev, &bus_core_ops, io_ops);
         ebus->bus.use_posbuf = 1;
         skl->pci = pci;
+        INIT_WORK(&skl->probe_work, skl_probe_work);
 
         ebus->bus.bdl_pos_adj = 0;
 
@@ -601,27 +682,6 @@ static int skl_create(struct pci_dev *pci,
         return 0;
 }
 
-static int skl_i915_init(struct hdac_bus *bus)
-{
-        int err;
-
-        /*
-         * The HDMI codec is in GPU so we need to ensure that it is powered
-         * up and ready for probe
-         */
-        err = snd_hdac_i915_init(bus);
-        if (err < 0)
-                return err;
-
-        err = snd_hdac_display_power(bus, true);
-        if (err < 0) {
-                dev_err(bus->dev, "Cannot turn on display power on i915\n");
-                return err;
-        }
-
-        return err;
-}
-
 static int skl_first_init(struct hdac_ext_bus *ebus)
 {
         struct skl *skl = ebus_to_skl(ebus);
@@ -684,20 +744,7 @@ static int skl_first_init(struct hdac_ext_bus *ebus)
         /* initialize chip */
         skl_init_pci(skl);
 
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
-                err = skl_i915_init(bus);
-                if (err < 0)
-                        return err;
-        }
-
-        skl_init_chip(bus, true);
-
-        /* codec detection */
-        if (!bus->codec_mask) {
-                dev_info(bus->dev, "no hda codecs found!\n");
-        }
-
-        return 0;
+        return skl_init_chip(bus, true);
 }
 
 static int skl_probe(struct pci_dev *pci,
@@ -706,7 +753,6 @@ static int skl_probe(struct pci_dev *pci,
         struct skl *skl;
         struct hdac_ext_bus *ebus = NULL;
         struct hdac_bus *bus = NULL;
-        struct hdac_ext_link *hlink = NULL;
         int err;
 
         /* we use ext core ops, so provide NULL for ops here */
@@ -729,7 +775,7 @@ static int skl_probe(struct pci_dev *pci,
 
         if (skl->nhlt == NULL) {
                 err = -ENODEV;
-                goto out_display_power_off;
+                goto out_free;
         }
 
         err = skl_nhlt_create_sysfs(skl);
@@ -760,56 +806,24 @@ static int skl_probe(struct pci_dev *pci,
         if (bus->mlcap)
                 snd_hdac_ext_bus_get_ml_capabilities(ebus);
 
+        snd_hdac_bus_stop_chip(bus);
+
         /* create device for soc dmic */
         err = skl_dmic_device_register(skl);
         if (err < 0)
                 goto out_dsp_free;
 
-        /* register platform dai and controls */
-        err = skl_platform_register(bus->dev);
-        if (err < 0)
-                goto out_dmic_free;
-
-        /* create codec instances */
-        err = skl_codec_create(ebus);
-        if (err < 0)
-                goto out_unregister;
-
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
-                err = snd_hdac_display_power(bus, false);
-                if (err < 0) {
-                        dev_err(bus->dev, "Cannot turn off display power on i915\n");
-                        return err;
-                }
-        }
-
-        /*
-         * we are done probling so decrement link counts
-         */
-        list_for_each_entry(hlink, &ebus->hlink_list, list)
-                snd_hdac_ext_bus_link_put(ebus, hlink);
-
-        /* configure PM */
-        pm_runtime_put_noidle(bus->dev);
-        pm_runtime_allow(bus->dev);
+        schedule_work(&skl->probe_work);
 
         return 0;
 
-out_unregister:
-        skl_platform_unregister(bus->dev);
-out_dmic_free:
-        skl_dmic_device_unregister(skl);
 out_dsp_free:
         skl_free_dsp(skl);
 out_mach_free:
         skl_machine_device_unregister(skl);
 out_nhlt_free:
         skl_nhlt_free(skl->nhlt);
-out_display_power_off:
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, false);
 out_free:
-        skl->init_failed = 1;
         skl_free(ebus);
 
         return err;
@@ -828,7 +842,7 @@ static void skl_shutdown(struct pci_dev *pci)
 
         skl = ebus_to_skl(ebus);
 
-        if (skl->init_failed)
+        if (!skl->init_done)
                 return;
 
         snd_hdac_ext_stop_streams(ebus);
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index a454f6035f3e..2a630fcb7f08 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -46,7 +46,7 @@ struct skl {
         struct hdac_ext_bus ebus;
         struct pci_dev *pci;
 
-        unsigned int init_failed:1; /* delayed init failed */
+        unsigned int init_done:1; /* delayed init status */
         struct platform_device *dmic_dev;
         struct platform_device *i2s_dev;
         struct snd_soc_platform *platform;
@@ -64,6 +64,8 @@ struct skl {
         const struct firmware *tplg;
 
         int supend_active;
+
+        struct work_struct probe_work;
 };
 
 #define skl_to_ebus(s)  (&(s)->ebus)
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index 66203d107a11..d3b0dc145a56 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -507,7 +507,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                 rbga = rbgx;
                                 adg->rbga_rate_for_441khz = rate / div;
                                 ckr |= brg_table[i] << 20;
-                                if (req_441kHz_rate)
+                                if (req_441kHz_rate &&
+                                    !(adg_mode_flags(adg) & AUDIO_OUT_48))
                                         parent_clk_name = __clk_get_name(clk);
                         }
                 }
@@ -522,7 +523,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                 rbgb = rbgx;
                                 adg->rbgb_rate_for_48khz = rate / div;
                                 ckr |= brg_table[i] << 16;
-                                if (req_48kHz_rate)
+                                if (req_48kHz_rate &&
+                                    (adg_mode_flags(adg) & AUDIO_OUT_48))
                                         parent_clk_name = __clk_get_name(clk);
                         }
                 }
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index 7d92a24b7cfa..d879c010cf03 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -89,6 +89,7 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         dev_dbg(dev, "ctu/mix path = 0x%08x", data);
 
         rsnd_mod_write(mod, CMD_ROUTE_SLCT, data);
+        rsnd_mod_write(mod, CMD_BUSIF_MODE, rsnd_get_busif_shift(io, mod) | 1);
         rsnd_mod_write(mod, CMD_BUSIF_DALIGN, rsnd_get_dalign(mod, io));
 
         rsnd_adg_set_cmd_timsel_gen2(mod, io);
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 1744015408c3..8c1f4e2e0c4f 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -343,6 +343,57 @@ u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io)
                 return 0x76543210;
 }
 
+u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod)
+{
+        enum rsnd_mod_type playback_mods[] = {
+                RSND_MOD_SRC,
+                RSND_MOD_CMD,
+                RSND_MOD_SSIU,
+        };
+        enum rsnd_mod_type capture_mods[] = {
+                RSND_MOD_CMD,
+                RSND_MOD_SRC,
+                RSND_MOD_SSIU,
+        };
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        struct rsnd_mod *tmod = NULL;
+        enum rsnd_mod_type *mods =
+                rsnd_io_is_play(io) ?
+                playback_mods : capture_mods;
+        int i;
+
+        /*
+         * This is needed for 24bit data
+         * We need to shift 8bit
+         *
+         * Linux 24bit data is located as 0x00******
+         * HW    24bit data is located as 0x******00
+         *
+         */
+        switch (runtime->sample_bits) {
+        case 16:
+                return 0;
+        case 32:
+                break;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(playback_mods); i++) {
+                tmod = rsnd_io_to_mod(io, mods[i]);
+                if (tmod)
+                        break;
+        }
+
+        if (tmod != mod)
+                return 0;
+
+        if (rsnd_io_is_play(io))
+                return  (0 << 20) | /* shift to Left */
+                        (8 << 16);  /* 8bit */
+        else
+                return  (1 << 20) | /* shift to Right */
+                        (8 << 16);  /* 8bit */
+}
+
 /*
  *      rsnd_dai functions
  */
diff --git a/sound/soc/sh/rcar/gen.c b/sound/soc/sh/rcar/gen.c
index 63b6d3c28021..4b0980728e13 100644
--- a/sound/soc/sh/rcar/gen.c
+++ b/sound/soc/sh/rcar/gen.c
@@ -236,6 +236,7 @@ static int rsnd_gen2_probe(struct rsnd_priv *priv)
                 RSND_GEN_M_REG(SRC_ROUTE_MODE0, 0xc,    0x20),
                 RSND_GEN_M_REG(SRC_CTRL,        0x10,   0x20),
                 RSND_GEN_M_REG(SRC_INT_ENABLE0, 0x18,   0x20),
+                RSND_GEN_M_REG(CMD_BUSIF_MODE,  0x184,  0x20),
                 RSND_GEN_M_REG(CMD_BUSIF_DALIGN,0x188,  0x20),
                 RSND_GEN_M_REG(CMD_ROUTE_SLCT,  0x18c,  0x20),
                 RSND_GEN_M_REG(CMD_CTRL,        0x190,  0x20),
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index dbf4163427e8..323af41ecfcb 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -73,6 +73,7 @@ enum rsnd_reg {
         RSND_REG_SCU_SYS_INT_EN0,
         RSND_REG_SCU_SYS_INT_EN1,
         RSND_REG_CMD_CTRL,
+        RSND_REG_CMD_BUSIF_MODE,
         RSND_REG_CMD_BUSIF_DALIGN,
         RSND_REG_CMD_ROUTE_SLCT,
         RSND_REG_CMDOUT_TIMSEL,
@@ -204,6 +205,7 @@ void rsnd_bset(struct rsnd_priv *priv, struct rsnd_mod *mod, enum rsnd_reg reg,
                     u32 mask, u32 data);
 u32 rsnd_get_adinr_bit(struct rsnd_mod *mod, struct rsnd_dai_stream *io);
 u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io);
+u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod);
 
 /*
  *      R-Car DMA
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 20b5b2ec625e..76a477a3ccb5 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -190,11 +190,13 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
         struct device *dev = rsnd_priv_to_dev(priv);
         struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        int is_play = rsnd_io_is_play(io);
         int use_src = 0;
         u32 fin, fout;
         u32 ifscr, fsrate, adinr;
         u32 cr, route;
         u32 bsdsr, bsisr;
+        u32 i_busif, o_busif, tmp;
         uint ratio;
 
         if (!runtime)
@@ -270,6 +272,11 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
                 break;
         }
 
+        /* BUSIF_MODE */
+        tmp = rsnd_get_busif_shift(io, mod);
+        i_busif = ( is_play ? tmp : 0) | 1;
+        o_busif = (!is_play ? tmp : 0) | 1;
+
         rsnd_mod_write(mod, SRC_ROUTE_MODE0, route);
 
         rsnd_mod_write(mod, SRC_SRCIR, 1);      /* initialize */
@@ -281,8 +288,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         rsnd_mod_write(mod, SRC_BSISR, bsisr);
         rsnd_mod_write(mod, SRC_SRCIR, 0);      /* cancel initialize */
 
-        rsnd_mod_write(mod, SRC_I_BUSIF_MODE, 1);
-        rsnd_mod_write(mod, SRC_O_BUSIF_MODE, 1);
+        rsnd_mod_write(mod, SRC_I_BUSIF_MODE, i_busif);
+        rsnd_mod_write(mod, SRC_O_BUSIF_MODE, o_busif);
+
         rsnd_mod_write(mod, SRC_BUSIF_DALIGN, rsnd_get_dalign(mod, io));
 
         rsnd_adg_set_src_timesel_gen2(mod, io, fin, fout);
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 135c5669f796..91e5c07911b4 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -302,7 +302,7 @@ static void rsnd_ssi_config_init(struct rsnd_mod *mod,
          * always use 32bit system word.
          * see also rsnd_ssi_master_clk_enable()
          */
-        cr_own = FORCE | SWL_32 | PDTA;
+        cr_own = FORCE | SWL_32;
 
         if (rdai->bit_clk_inv)
                 cr_own |= SCKP;
@@ -550,6 +550,13 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                 struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
                 u32 *buf = (u32 *)(runtime->dma_area +
                                    rsnd_dai_pointer_offset(io, 0));
+                int shift = 0;
+
+                switch (runtime->sample_bits) {
+                case 32:
+                        shift = 8;
+                        break;
+                }
 
                 /*
                  * 8/16/32 data can be assesse to TDR/RDR register
@@ -557,9 +564,9 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                  * see rsnd_ssi_init()
                  */
                 if (rsnd_io_is_play(io))
-                        rsnd_mod_write(mod, SSITDR, *buf);
+                        rsnd_mod_write(mod, SSITDR, (*buf) << shift);
                 else
-                        *buf = rsnd_mod_read(mod, SSIRDR);
+                        *buf = (rsnd_mod_read(mod, SSIRDR) >> shift);
 
                 elapsed = rsnd_dai_pointer_update(io, sizeof(*buf));
         }
@@ -709,6 +716,11 @@ static int rsnd_ssi_dma_remove(struct rsnd_mod *mod,
                                struct rsnd_priv *priv)
 {
         struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        struct rsnd_mod *ssi_parent_mod = rsnd_io_to_mod_ssip(io);
+
+        /* Do nothing for SSI parent mod */
+        if (ssi_parent_mod == mod)
+                return 0;
 
         /* PIO will request IRQ again */
         free_irq(ssi->irq, mod);
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 14fafdaf1395..512d238b79e2 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -144,7 +144,8 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
                                (rsnd_io_is_play(io) ?
                                 rsnd_runtime_channel_after_ctu(io) :
                                 rsnd_runtime_channel_original(io)));
-                rsnd_mod_write(mod, SSI_BUSIF_MODE,  1);
+                rsnd_mod_write(mod, SSI_BUSIF_MODE,
+                               rsnd_get_busif_shift(io, mod) | 1);
                 rsnd_mod_write(mod, SSI_BUSIF_DALIGN,
                                rsnd_get_dalign(mod, io));
         }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index aae099c0e502..754e3ef8d7ae 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2286,6 +2286,9 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
         list_for_each_entry(rtd, &card->rtd_list, list)
                 flush_delayed_work(&rtd->delayed_work);
 
+        /* free the ALSA card at first; this syncs with pending operations */
+        snd_card_free(card->snd_card);
+
         /* remove and free each DAI */
         soc_remove_dai_links(card);
         soc_remove_pcm_runtimes(card);
@@ -2300,9 +2303,7 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
         if (card->remove)
                 card->remove(card);
 
-        snd_card_free(card->snd_card);
         return 0;
-
 }
 
 /* removes a socdev */
diff --git a/tools/perf/Documentation/perf-probe.txt b/tools/perf/Documentation/perf-probe.txt
index e6c9902c6d82..165c2b1d4317 100644
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -240,9 +240,13 @@ Add a probe on schedule() function 12th line with recording cpu local variable:
  or
  ./perf probe --add='schedule:12 cpu'
 
- this will add one or more probes which has the name start with "schedule".
+Add one or more probes which has the name start with "schedule".
 
- Add probes on lines in schedule() function which calls update_rq_clock().
+ ./perf probe schedule*
+ or
+ ./perf probe --add='schedule*'
+
+Add probes on lines in schedule() function which calls update_rq_clock().
 
  ./perf probe 'schedule;update_rq_clock*'
  or
diff --git a/tools/perf/Documentation/perf-script-perl.txt b/tools/perf/Documentation/perf-script-perl.txt
index dfbb506d2c34..142606c0ec9c 100644
--- a/tools/perf/Documentation/perf-script-perl.txt
+++ b/tools/perf/Documentation/perf-script-perl.txt
@@ -39,7 +39,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 
 Most of the event's field values are passed as arguments to the
diff --git a/tools/perf/Documentation/perf-script-python.txt b/tools/perf/Documentation/perf-script-python.txt
index 54acba221558..51ec2d20068a 100644
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -149,10 +149,8 @@ def raw_syscalls__sys_enter(event_name, context, common_cpu,
                 print "id=%d, args=%s\n" % \
                 (id, args),
 
-def trace_unhandled(event_name, context, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm):
-                print_header(event_name, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm)
+def trace_unhandled(event_name, context, event_fields_dict):
+                print ' '.join(['%s=%s'%(k,str(v))for k,v in sorted(event_fields_dict.items())])
 
 def print_header(event_name, cpu, secs, nsecs, pid, comm):
         print "%-20s %5u %05u.%09u %8u %-20s " % \
@@ -321,7 +319,7 @@ So those are the essential steps in writing and running a script.  The
 process can be generalized to any tracepoint or set of tracepoints
 you're interested in - basically find the tracepoint(s) you're
 interested in by looking at the list of available events shown by
-'perf list' and/or look in /sys/kernel/debug/tracing events for
+'perf list' and/or look in /sys/kernel/debug/tracing/events/ for
 detailed event and field info, record the corresponding trace data
 using 'perf record', passing it the list of interesting events,
 generate a skeleton script using 'perf script -g python' and modify the
@@ -334,7 +332,7 @@ right place, you can have your script listed alongside the other
 scripts listed by the 'perf script -l' command e.g.:
 
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
   wakeup-latency                       system-wide min/max/avg wakeup latency
   rw-by-file <comm>                    r/w activity for a program, by file
@@ -383,8 +381,6 @@ source tree:
 
 ----
 # ls -al kernel-source/tools/perf/scripts/python
-
-root@tropicana:/home/trz/src/tip# ls -al tools/perf/scripts/python
 total 32
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:30 .
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:29 ..
@@ -399,7 +395,7 @@ otherwise your script won't show up at run-time), 'perf script -l'
 should show a new entry for your script:
 
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
   wakeup-latency                       system-wide min/max/avg wakeup latency
   rw-by-file <comm>                    r/w activity for a program, by file
@@ -437,7 +433,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 
 Most of the event's field values are passed as arguments to the
@@ -532,7 +528,7 @@ can implement a set of optional functions:
 gives scripts a chance to do setup tasks:
 
 ----
-def trace_begin:
+def trace_begin():
     pass
 ----
 
@@ -541,7 +537,7 @@ def trace_begin:
  as display results:
 
 ----
-def trace_end:
+def trace_end():
     pass
 ----
 
@@ -550,8 +546,7 @@ def trace_end:
  of common arguments are passed into it:
 
 ----
-def trace_unhandled(event_name, context, common_cpu, common_secs,
-        common_nsecs, common_pid, common_comm):
+def trace_unhandled(event_name, context, event_fields_dict):
     pass
 ----
 
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index 8354d04b392f..1f4fbc9a3292 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -19,18 +19,18 @@ CFLAGS := $(EXTRA_CFLAGS) $(EXTRA_WARNINGS)
 
 include $(srctree)/tools/scripts/Makefile.arch
 
-$(call detected_var,ARCH)
+$(call detected_var,SRCARCH)
 
 NO_PERF_REGS := 1
 
 # Additional ARCH settings for ppc
-ifeq ($(ARCH),powerpc)
+ifeq ($(SRCARCH),powerpc)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS := -lunwind -lunwind-ppc64
 endif
 
 # Additional ARCH settings for x86
-ifeq ($(ARCH),x86)
+ifeq ($(SRCARCH),x86)
   $(call detected,CONFIG_X86)
   ifeq (${IS_64_BIT}, 1)
     CFLAGS += -DHAVE_ARCH_X86_64_SUPPORT -DHAVE_SYSCALL_TABLE -I$(OUTPUT)arch/x86/include/generated
@@ -43,12 +43,12 @@ ifeq ($(ARCH),x86)
   NO_PERF_REGS := 0
 endif
 
-ifeq ($(ARCH),arm)
+ifeq ($(SRCARCH),arm)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS = -lunwind -lunwind-arm
 endif
 
-ifeq ($(ARCH),arm64)
+ifeq ($(SRCARCH),arm64)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS = -lunwind -lunwind-aarch64
 endif
@@ -61,7 +61,7 @@ endif
 # Disable it on all other architectures in case libdw unwind
 # support is detected in system. Add supported architectures
 # to the check.
-ifneq ($(ARCH),$(filter $(ARCH),x86 arm))
+ifneq ($(SRCARCH),$(filter $(SRCARCH),x86 arm))
   NO_LIBDW_DWARF_UNWIND := 1
 endif
 
@@ -115,9 +115,9 @@ endif
 FEATURE_CHECK_CFLAGS-libbabeltrace := $(LIBBABELTRACE_CFLAGS)
 FEATURE_CHECK_LDFLAGS-libbabeltrace := $(LIBBABELTRACE_LDFLAGS) -lbabeltrace-ctf
 
-FEATURE_CHECK_CFLAGS-bpf = -I. -I$(srctree)/tools/include -I$(srctree)/tools/arch/$(ARCH)/include/uapi -I$(srctree)/tools/include/uapi
+FEATURE_CHECK_CFLAGS-bpf = -I. -I$(srctree)/tools/include -I$(srctree)/tools/arch/$(SRCARCH)/include/uapi -I$(srctree)/tools/include/uapi
 # include ARCH specific config
--include $(src-perf)/arch/$(ARCH)/Makefile
+-include $(src-perf)/arch/$(SRCARCH)/Makefile
 
 ifdef PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET
   CFLAGS += -DHAVE_ARCH_REGS_QUERY_REGISTER_OFFSET
@@ -228,12 +228,12 @@ ifeq ($(DEBUG),0)
 endif
 
 INC_FLAGS += -I$(src-perf)/util/include
-INC_FLAGS += -I$(src-perf)/arch/$(ARCH)/include
+INC_FLAGS += -I$(src-perf)/arch/$(SRCARCH)/include
 INC_FLAGS += -I$(srctree)/tools/include/uapi
 INC_FLAGS += -I$(srctree)/tools/include/
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/include/uapi
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/include/
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/include/uapi
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/include/
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/
 
 # $(obj-perf)      for generated common-cmds.h
 # $(obj-perf)/util for generated bison/flex headers
@@ -355,7 +355,7 @@ ifndef NO_LIBELF
 
   ifndef NO_DWARF
     ifeq ($(origin PERF_HAVE_DWARF_REGS), undefined)
-      msg := $(warning DWARF register mappings have not been defined for architecture $(ARCH), DWARF support disabled);
+      msg := $(warning DWARF register mappings have not been defined for architecture $(SRCARCH), DWARF support disabled);
       NO_DWARF := 1
     else
       CFLAGS += -DHAVE_DWARF_SUPPORT $(LIBDW_CFLAGS)
@@ -380,7 +380,7 @@ ifndef NO_LIBELF
         CFLAGS += -DHAVE_BPF_PROLOGUE
         $(call detected,CONFIG_BPF_PROLOGUE)
       else
-        msg := $(warning BPF prologue is not supported by architecture $(ARCH), missing regs_query_register_offset());
+        msg := $(warning BPF prologue is not supported by architecture $(SRCARCH), missing regs_query_register_offset());
       endif
     else
       msg := $(warning DWARF support is off, BPF prologue is disabled);
@@ -406,7 +406,7 @@ ifdef PERF_HAVE_JITDUMP
   endif
 endif
 
-ifeq ($(ARCH),powerpc)
+ifeq ($(SRCARCH),powerpc)
   ifndef NO_DWARF
     CFLAGS += -DHAVE_SKIP_CALLCHAIN_IDX
   endif
@@ -487,7 +487,7 @@ else
 endif
 
 ifndef NO_LOCAL_LIBUNWIND
-  ifeq ($(ARCH),$(filter $(ARCH),arm arm64))
+  ifeq ($(SRCARCH),$(filter $(SRCARCH),arm arm64))
     $(call feature_check,libunwind-debug-frame)
     ifneq ($(feature-libunwind-debug-frame), 1)
       msg := $(warning No debug_frame support found in libunwind);
@@ -740,7 +740,7 @@ ifeq (${IS_64_BIT}, 1)
       NO_PERF_READ_VDSO32 := 1
     endif
   endif
-  ifneq ($(ARCH), x86)
+  ifneq ($(SRCARCH), x86)
     NO_PERF_READ_VDSOX32 := 1
   endif
   ifndef NO_PERF_READ_VDSOX32
@@ -769,7 +769,7 @@ ifdef LIBBABELTRACE
 endif
 
 ifndef NO_AUXTRACE
-  ifeq ($(ARCH),x86)
+  ifeq ($(SRCARCH),x86)
     ifeq ($(feature-get_cpuid), 0)
       msg := $(warning Your gcc lacks the __get_cpuid() builtin, disables support for auxtrace/Intel PT, please install a newer gcc);
       NO_AUXTRACE := 1
@@ -872,7 +872,7 @@ sysconfdir = $(prefix)/etc
 ETC_PERFCONFIG = etc/perfconfig
 endif
 ifndef lib
-ifeq ($(ARCH)$(IS_64_BIT), x861)
+ifeq ($(SRCARCH)$(IS_64_BIT), x861)
 lib = lib64
 else
 lib = lib
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 79fe31f20a17..5008f51a08a2 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -226,7 +226,7 @@ endif
 
 ifeq ($(config),0)
 include $(srctree)/tools/scripts/Makefile.arch
--include arch/$(ARCH)/Makefile
+-include arch/$(SRCARCH)/Makefile
 endif
 
 # The FEATURE_DUMP_EXPORT holds location of the actual
diff --git a/tools/perf/arch/Build b/tools/perf/arch/Build
index 109eb75cf7de..d9b6af837c7d 100644
--- a/tools/perf/arch/Build
+++ b/tools/perf/arch/Build
@@ -1,2 +1,2 @@
 libperf-y += common.o
-libperf-y += $(ARCH)/
+libperf-y += $(SRCARCH)/
diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
index 9213a1273697..999a4e878162 100644
--- a/tools/perf/pmu-events/Build
+++ b/tools/perf/pmu-events/Build
@@ -2,7 +2,7 @@ hostprogs := jevents
 
 jevents-y       += json.o jsmn.o jevents.o
 pmu-events-y    += pmu-events.o
-JDIR            =  pmu-events/arch/$(ARCH)
+JDIR            =  pmu-events/arch/$(SRCARCH)
 JSON            =  $(shell [ -d $(JDIR) ] &&                            \
                         find $(JDIR) -name '*.json' -o -name 'mapfile.csv')
 #
@@ -10,4 +10,4 @@ JSON		=  $(shell [ -d $(JDIR) ] &&				\
 # directory and create tables in pmu-events.c.
 #
 $(OUTPUT)pmu-events/pmu-events.c: $(JSON) $(JEVENTS)
-        $(Q)$(call echo-cmd,gen)$(JEVENTS) $(ARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V)
+        $(Q)$(call echo-cmd,gen)$(JEVENTS) $(SRCARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V)
diff --git a/tools/perf/tests/Build b/tools/perf/tests/Build
index af58ebc243ef..84222bdb8689 100644
--- a/tools/perf/tests/Build
+++ b/tools/perf/tests/Build
@@ -75,7 +75,7 @@ $(OUTPUT)tests/llvm-src-relocation.c: tests/bpf-script-test-relocation.c tests/B
         $(Q)sed -e 's/"/\\"/g' -e 's/\(.*\)/"\1\\n"/g' $< >> $@
         $(Q)echo ';' >> $@
 
-ifeq ($(ARCH),$(filter $(ARCH),x86 arm arm64 powerpc))
+ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 arm arm64 powerpc))
 perf-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o
 endif
 
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 1f14e7612cbb..94b7c7b02bde 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -229,6 +229,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
         unsigned char buf2[BUFSZ];
         size_t ret_len;
         u64 objdump_addr;
+        const char *objdump_name;
+        char decomp_name[KMOD_DECOMP_LEN];
         int ret;
 
         pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
@@ -289,9 +291,25 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
                 state->done[state->done_cnt++] = al.map->start;
         }
 
+        objdump_name = al.map->dso->long_name;
+        if (dso__needs_decompress(al.map->dso)) {
+                if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
+                                                 decomp_name,
+                                                 sizeof(decomp_name)) < 0) {
+                        pr_debug("decompression failed\n");
+                        return -1;
+                }
+
+                objdump_name = decomp_name;
+        }
+
         /* Read the object code using objdump */
         objdump_addr = map__rip_2objdump(al.map, al.addr);
-        ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
+        ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
+
+        if (dso__needs_decompress(al.map->dso))
+                unlink(objdump_name);
+
         if (ret > 0) {
                 /*
                  * The kernel maps are inaccurate - assume objdump is right in
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 32873ec91a4e..cf00ebad2ef5 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -83,7 +83,7 @@ int test__task_exit(int subtest __maybe_unused)
 
         evsel = perf_evlist__first(evlist);
         evsel->attr.task = 1;
-        evsel->attr.sample_freq = 0;
+        evsel->attr.sample_freq = 1;
         evsel->attr.inherit = 0;
         evsel->attr.watermark = 0;
         evsel->attr.wakeup_events = 1;
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 1367d7e35242..ddbd56df9187 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1321,6 +1321,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
         char linkname[PATH_MAX];
         char *build_id_filename;
         char *build_id_path = NULL;
+        char *pos;
 
         if (dso->symtab_type == DSO_BINARY_TYPE__KALLSYMS &&
             !dso__is_kcore(dso))
@@ -1340,7 +1341,14 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
         if (!build_id_path)
                 return -1;
 
-        dirname(build_id_path);
+        /*
+         * old style build-id cache has name of XX/XXXXXXX.. while
+         * new style has XX/XXXXXXX../{elf,kallsyms,vdso}.
+         * extract the build-id part of dirname in the new style only.
+         */
+        pos = strrchr(build_id_path, '/');
+        if (pos && strlen(pos) < SBUILD_ID_SIZE - 2)
+                dirname(build_id_path);
 
         if (dso__is_kcore(dso) ||
             readlink(build_id_path, linkname, sizeof(linkname)) < 0 ||
@@ -1423,31 +1431,10 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
                                 sizeof(symfs_filename));
                 }
         } else if (dso__needs_decompress(dso)) {
-                char tmp[PATH_MAX];
-                struct kmod_path m;
-                int fd;
-                bool ret;
-
-                if (kmod_path__parse_ext(&m, symfs_filename))
-                        goto out;
-
-                snprintf(tmp, PATH_MAX, "/tmp/perf-kmod-XXXXXX");
-
-                fd = mkstemp(tmp);
-                if (fd < 0) {
-                        free(m.ext);
-                        goto out;
-                }
-
-                ret = decompress_to_file(m.ext, symfs_filename, fd);
-
-                if (ret)
-                        pr_err("Cannot decompress %s %s\n", m.ext, symfs_filename);
-
-                free(m.ext);
-                close(fd);
+                char tmp[KMOD_DECOMP_LEN];
 
-                if (!ret)
+                if (dso__decompress_kmodule_path(dso, symfs_filename,
+                                                 tmp, sizeof(tmp)) < 0)
                         goto out;
 
                 strcpy(symfs_filename, tmp);
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index 168cc49654e7..e0148b081bdf 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -278,51 +278,6 @@ char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size)
         return bf;
 }
 
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size)
-{
-        char *id_name = NULL, *ch;
-        struct stat sb;
-        char sbuild_id[SBUILD_ID_SIZE];
-
-        if (!dso->has_build_id)
-                goto err;
-
-        build_id__sprintf(dso->build_id, sizeof(dso->build_id), sbuild_id);
-        id_name = build_id_cache__linkname(sbuild_id, NULL, 0);
-        if (!id_name)
-                goto err;
-        if (access(id_name, F_OK))
-                goto err;
-        if (lstat(id_name, &sb) == -1)
-                goto err;
-        if ((size_t)sb.st_size > size - 1)
-                goto err;
-        if (readlink(id_name, bf, size - 1) < 0)
-                goto err;
-
-        bf[sb.st_size] = '\0';
-
-        /*
-         * link should be:
-         * ../../lib/modules/4.4.0-rc4/kernel/net/ipv4/netfilter/nf_nat_ipv4.ko/a09fe3eb3147dafa4e3b31dbd6257e4d696bdc92
-         */
-        ch = strrchr(bf, '/');
-        if (!ch)
-                goto err;
-        if (ch - 3 < bf)
-                goto err;
-
-        free(id_name);
-        return strncmp(".ko", ch - 3, 3) == 0;
-err:
-        pr_err("Invalid build id: %s\n", id_name ? :
-                                         dso->long_name ? :
-                                         dso->short_name ? :
-                                         "[unknown]");
-        free(id_name);
-        return false;
-}
-
 #define dsos__for_each_with_build_id(pos, head) \
         list_for_each_entry(pos, head, node)    \
                 if (!pos->has_build_id)         \
diff --git a/tools/perf/util/build-id.h b/tools/perf/util/build-id.h
index 8a89b195c1fc..96690a55c62c 100644
--- a/tools/perf/util/build-id.h
+++ b/tools/perf/util/build-id.h
@@ -17,7 +17,6 @@ char *build_id_cache__kallsyms_path(const char *sbuild_id, char *bf,
                                     size_t size);
 
 char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size);
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size);
 
 int build_id__mark_dso_hit(struct perf_tool *tool, union perf_event *event,
                            struct perf_sample *sample, struct perf_evsel *evsel,
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index b27d127cdf68..4e7ab611377a 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -248,6 +248,64 @@ bool dso__needs_decompress(struct dso *dso)
                 dso->symtab_type == DSO_BINARY_TYPE__GUEST_KMODULE_COMP;
 }
 
+static int decompress_kmodule(struct dso *dso, const char *name, char *tmpbuf)
+{
+        int fd = -1;
+        struct kmod_path m;
+
+        if (!dso__needs_decompress(dso))
+                return -1;
+
+        if (kmod_path__parse_ext(&m, dso->long_name))
+                return -1;
+
+        if (!m.comp)
+                goto out;
+
+        fd = mkstemp(tmpbuf);
+        if (fd < 0) {
+                dso->load_errno = errno;
+                goto out;
+        }
+
+        if (!decompress_to_file(m.ext, name, fd)) {
+                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
+                close(fd);
+                fd = -1;
+        }
+
+out:
+        free(m.ext);
+        return fd;
+}
+
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        unlink(tmpbuf);
+        return fd;
+}
+
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        if (fd < 0) {
+                unlink(tmpbuf);
+                return -1;
+        }
+
+        strncpy(pathname, tmpbuf, len);
+        close(fd);
+        return 0;
+}
+
 /*
  * Parses kernel module specified in @path and updates
  * @m argument like:
@@ -396,7 +454,7 @@ static int do_open(char *name)
 
 static int __open_dso(struct dso *dso, struct machine *machine)
 {
-        int fd;
+        int fd = -EINVAL;
         char *root_dir = (char *)"";
         char *name = malloc(PATH_MAX);
 
@@ -407,15 +465,30 @@ static int __open_dso(struct dso *dso, struct machine *machine)
                 root_dir = machine->root_dir;
 
         if (dso__read_binary_type_filename(dso, dso->binary_type,
-                                            root_dir, name, PATH_MAX)) {
-                free(name);
-                return -EINVAL;
-        }
+                                            root_dir, name, PATH_MAX))
+                goto out;
 
         if (!is_regular_file(name))
-                return -EINVAL;
+                goto out;
+
+        if (dso__needs_decompress(dso)) {
+                char newpath[KMOD_DECOMP_LEN];
+                size_t len = sizeof(newpath);
+
+                if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
+                        fd = -dso->load_errno;
+                        goto out;
+                }
+
+                strcpy(name, newpath);
+        }
 
         fd = do_open(name);
+
+        if (dso__needs_decompress(dso))
+                unlink(name);
+
+out:
         free(name);
         return fd;
 }
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 5fe2ab5877bd..bd061ba7b47c 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -244,6 +244,12 @@ bool is_supported_compression(const char *ext);
 bool is_kernel_module(const char *pathname, int cpumode);
 bool decompress_to_file(const char *ext, const char *filename, int output_fd);
 bool dso__needs_decompress(struct dso *dso);
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len);
+
+#define KMOD_DECOMP_NAME  "/tmp/perf-kmod-XXXXXX"
+#define KMOD_DECOMP_LEN   sizeof(KMOD_DECOMP_NAME)
 
 struct kmod_path {
         char *name;
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index e4f7902d5afa..cda44b0e821c 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -273,8 +273,20 @@ struct perf_evsel *perf_evsel__new_cycles(void)
         struct perf_evsel *evsel;
 
         event_attr_init(&attr);
+        /*
+         * Unnamed union member, not supported as struct member named
+         * initializer in older compilers such as gcc 4.4.7
+         *
+         * Just for probing the precise_ip:
+         */
+        attr.sample_period = 1;
 
         perf_event_attr__set_max_precise_ip(&attr);
+        /*
+         * Now let the usual logic to set up the perf_event_attr defaults
+         * to kick in when we return and before perf_evsel__open() is called.
+         */
+        attr.sample_period = 0;
 
         evsel = perf_evsel__new(&attr);
         if (evsel == NULL)
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 5cac8d5e009a..b5baff3007bb 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -841,7 +841,7 @@ static int write_group_desc(int fd, struct perf_header *h __maybe_unused,
 
 /*
  * default get_cpuid(): nothing gets recorded
- * actual implementation must be in arch/$(ARCH)/util/header.c
+ * actual implementation must be in arch/$(SRCARCH)/util/header.c
  */
 int __weak get_cpuid(char *buffer __maybe_unused, size_t sz __maybe_unused)
 {
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 9d92af7d0718..40de3cb40d21 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -1219,7 +1219,7 @@ static int python_generate_script(struct pevent *pevent, const char *outfile)
         fprintf(ofp, "# be retrieved using Python functions of the form "
                 "common_*(context).\n");
 
-        fprintf(ofp, "# See the perf-trace-python Documentation for the list "
+        fprintf(ofp, "# See the perf-script-python Documentation for the list "
                 "of available functions.\n\n");
 
         fprintf(ofp, "import os\n");
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 1fb2efae4f02..502505cf236a 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -637,40 +637,6 @@ static int dso__swap_init(struct dso *dso, unsigned char eidata)
         return 0;
 }
 
-static int decompress_kmodule(struct dso *dso, const char *name,
-                              enum dso_binary_type type)
-{
-        int fd = -1;
-        char tmpbuf[] = "/tmp/perf-kmod-XXXXXX";
-        struct kmod_path m;
-
-        if (type != DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__GUEST_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                return -1;
-
-        if (kmod_path__parse_ext(&m, dso->long_name) || !m.comp)
-                return -1;
-
-        fd = mkstemp(tmpbuf);
-        if (fd < 0) {
-                dso->load_errno = errno;
-                goto out;
-        }
-
-        if (!decompress_to_file(m.ext, name, fd)) {
-                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
-                close(fd);
-                fd = -1;
-        }
-
-        unlink(tmpbuf);
-
-out:
-        free(m.ext);
-        return fd;
-}
-
 bool symsrc__possibly_runtime(struct symsrc *ss)
 {
         return ss->dynsym || ss->opdsec;
@@ -702,9 +668,11 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
         int fd;
 
         if (dso__needs_decompress(dso)) {
-                fd = decompress_kmodule(dso, name, type);
+                fd = dso__decompress_kmodule_fd(dso, name);
                 if (fd < 0)
                         return -1;
+
+                type = dso->symtab_type;
         } else {
                 fd = open(name, O_RDONLY);
                 if (fd < 0) {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 8f2b068ff756..e7a98dbd2aed 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1562,10 +1562,6 @@ int dso__load(struct dso *dso, struct map *map)
         if (!runtime_ss && syms_ss)
                 runtime_ss = syms_ss;
 
-        if (syms_ss && syms_ss->type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                if (dso__build_id_is_kmod(dso, name, PATH_MAX))
-                        kmod = true;
-
         if (syms_ss)
                 ret = dso__load_sym(dso, map, syms_ss, runtime_ss, kmod);
         else
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index da45c4be5fb3..7755a5e0fe5e 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -178,6 +178,14 @@ frame_callback(Dwfl_Frame *state, void *arg)
         Dwarf_Addr pc;
         bool isactivation;
 
+        if (!dwfl_frame_pc(state, &pc, NULL)) {
+                pr_err("%s", dwfl_errmsg(-1));
+                return DWARF_CB_ABORT;
+        }
+
+        // report the module before we query for isactivation
+        report_module(pc, ui);
+
         if (!dwfl_frame_pc(state, &pc, &isactivation)) {
                 pr_err("%s", dwfl_errmsg(-1));
                 return DWARF_CB_ABORT;
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index 32c3295929b0..87940364570b 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -22,7 +22,7 @@
 #include <asm/kvm_hyp.h>
 
 #define vtr_to_max_lr_idx(v)            ((v) & 0xf)
-#define vtr_to_nr_pre_bits(v)           (((u32)(v) >> 26) + 1)
+#define vtr_to_nr_pre_bits(v)           ((((u32)(v) >> 26) & 7) + 1)
 
 static u64 __hyp_text __gic_v3_get_lr(unsigned int lr)
 {
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index a2d63247d1bb..e2e5effba2a9 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -879,6 +879,9 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pmd_t *pmd;
 
         pud = stage2_get_pud(kvm, cache, addr);
+        if (!pud)
+                return NULL;
+
         if (stage2_pud_none(*pud)) {
                 if (!cache)
                         return NULL;
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index 0a4283ed9aa7..63e0bbdcddcc 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -226,7 +226,13 @@ static unsigned long vgic_mmio_read_vcpuif(struct kvm_vcpu *vcpu,
 
         switch (addr & 0xff) {
         case GIC_CPU_CTRL:
-                val = vmcr.ctlr;
+                val = vmcr.grpen0 << GIC_CPU_CTRL_EnableGrp0_SHIFT;
+                val |= vmcr.grpen1 << GIC_CPU_CTRL_EnableGrp1_SHIFT;
+                val |= vmcr.ackctl << GIC_CPU_CTRL_AckCtl_SHIFT;
+                val |= vmcr.fiqen << GIC_CPU_CTRL_FIQEn_SHIFT;
+                val |= vmcr.cbpr << GIC_CPU_CTRL_CBPR_SHIFT;
+                val |= vmcr.eoim << GIC_CPU_CTRL_EOImodeNS_SHIFT;
+
                 break;
         case GIC_CPU_PRIMASK:
                 /*
@@ -267,7 +273,13 @@ static void vgic_mmio_write_vcpuif(struct kvm_vcpu *vcpu,
 
         switch (addr & 0xff) {
         case GIC_CPU_CTRL:
-                vmcr.ctlr = val;
+                vmcr.grpen0 = !!(val & GIC_CPU_CTRL_EnableGrp0);
+                vmcr.grpen1 = !!(val & GIC_CPU_CTRL_EnableGrp1);
+                vmcr.ackctl = !!(val & GIC_CPU_CTRL_AckCtl);
+                vmcr.fiqen = !!(val & GIC_CPU_CTRL_FIQEn);
+                vmcr.cbpr = !!(val & GIC_CPU_CTRL_CBPR);
+                vmcr.eoim = !!(val & GIC_CPU_CTRL_EOImodeNS);
+
                 break;
         case GIC_CPU_PRIMASK:
                 /*
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 504b4bd0d651..e4187e52bb26 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -177,7 +177,18 @@ void vgic_v2_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
         struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
         u32 vmcr;
 
-        vmcr  = (vmcrp->ctlr << GICH_VMCR_CTRL_SHIFT) & GICH_VMCR_CTRL_MASK;
+        vmcr = (vmcrp->grpen0 << GICH_VMCR_ENABLE_GRP0_SHIFT) &
+                GICH_VMCR_ENABLE_GRP0_MASK;
+        vmcr |= (vmcrp->grpen1 << GICH_VMCR_ENABLE_GRP1_SHIFT) &
+                GICH_VMCR_ENABLE_GRP1_MASK;
+        vmcr |= (vmcrp->ackctl << GICH_VMCR_ACK_CTL_SHIFT) &
+                GICH_VMCR_ACK_CTL_MASK;
+        vmcr |= (vmcrp->fiqen << GICH_VMCR_FIQ_EN_SHIFT) &
+                GICH_VMCR_FIQ_EN_MASK;
+        vmcr |= (vmcrp->cbpr << GICH_VMCR_CBPR_SHIFT) &
+                GICH_VMCR_CBPR_MASK;
+        vmcr |= (vmcrp->eoim << GICH_VMCR_EOI_MODE_SHIFT) &
+                GICH_VMCR_EOI_MODE_MASK;
         vmcr |= (vmcrp->abpr << GICH_VMCR_ALIAS_BINPOINT_SHIFT) &
                 GICH_VMCR_ALIAS_BINPOINT_MASK;
         vmcr |= (vmcrp->bpr << GICH_VMCR_BINPOINT_SHIFT) &
@@ -195,8 +206,19 @@ void vgic_v2_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 
         vmcr = cpu_if->vgic_vmcr;
 
-        vmcrp->ctlr = (vmcr & GICH_VMCR_CTRL_MASK) >>
-                        GICH_VMCR_CTRL_SHIFT;
+        vmcrp->grpen0 = (vmcr & GICH_VMCR_ENABLE_GRP0_MASK) >>
+                GICH_VMCR_ENABLE_GRP0_SHIFT;
+        vmcrp->grpen1 = (vmcr & GICH_VMCR_ENABLE_GRP1_MASK) >>
+                GICH_VMCR_ENABLE_GRP1_SHIFT;
+        vmcrp->ackctl = (vmcr & GICH_VMCR_ACK_CTL_MASK) >>
+                GICH_VMCR_ACK_CTL_SHIFT;
+        vmcrp->fiqen = (vmcr & GICH_VMCR_FIQ_EN_MASK) >>
+                GICH_VMCR_FIQ_EN_SHIFT;
+        vmcrp->cbpr = (vmcr & GICH_VMCR_CBPR_MASK) >>
+                GICH_VMCR_CBPR_SHIFT;
+        vmcrp->eoim = (vmcr & GICH_VMCR_EOI_MODE_MASK) >>
+                GICH_VMCR_EOI_MODE_SHIFT;
+
         vmcrp->abpr = (vmcr & GICH_VMCR_ALIAS_BINPOINT_MASK) >>
                         GICH_VMCR_ALIAS_BINPOINT_SHIFT;
         vmcrp->bpr  = (vmcr & GICH_VMCR_BINPOINT_MASK) >>
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 6fe3f003636a..030248e669f6 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -159,15 +159,24 @@ void vgic_v3_clear_lr(struct kvm_vcpu *vcpu, int lr)
 void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 {
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+        u32 model = vcpu->kvm->arch.vgic.vgic_model;
         u32 vmcr;
 
-        /*
-         * Ignore the FIQen bit, because GIC emulation always implies
-         * SRE=1 which means the vFIQEn bit is also RES1.
-         */
-        vmcr = ((vmcrp->ctlr >> ICC_CTLR_EL1_EOImode_SHIFT) <<
-                 ICH_VMCR_EOIM_SHIFT) & ICH_VMCR_EOIM_MASK;
-        vmcr |= (vmcrp->ctlr << ICH_VMCR_CBPR_SHIFT) & ICH_VMCR_CBPR_MASK;
+        if (model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                vmcr = (vmcrp->ackctl << ICH_VMCR_ACK_CTL_SHIFT) &
+                        ICH_VMCR_ACK_CTL_MASK;
+                vmcr |= (vmcrp->fiqen << ICH_VMCR_FIQ_EN_SHIFT) &
+                        ICH_VMCR_FIQ_EN_MASK;
+        } else {
+                /*
+                 * When emulating GICv3 on GICv3 with SRE=1 on the
+                 * VFIQEn bit is RES1 and the VAckCtl bit is RES0.
+                 */
+                vmcr = ICH_VMCR_FIQ_EN_MASK;
+        }
+
+        vmcr |= (vmcrp->cbpr << ICH_VMCR_CBPR_SHIFT) & ICH_VMCR_CBPR_MASK;
+        vmcr |= (vmcrp->eoim << ICH_VMCR_EOIM_SHIFT) & ICH_VMCR_EOIM_MASK;
         vmcr |= (vmcrp->abpr << ICH_VMCR_BPR1_SHIFT) & ICH_VMCR_BPR1_MASK;
         vmcr |= (vmcrp->bpr << ICH_VMCR_BPR0_SHIFT) & ICH_VMCR_BPR0_MASK;
         vmcr |= (vmcrp->pmr << ICH_VMCR_PMR_SHIFT) & ICH_VMCR_PMR_MASK;
@@ -180,17 +189,27 @@ void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 void vgic_v3_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 {
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+        u32 model = vcpu->kvm->arch.vgic.vgic_model;
         u32 vmcr;
 
         vmcr = cpu_if->vgic_vmcr;
 
-        /*
-         * Ignore the FIQen bit, because GIC emulation always implies
-         * SRE=1 which means the vFIQEn bit is also RES1.
-         */
-        vmcrp->ctlr = ((vmcr >> ICH_VMCR_EOIM_SHIFT) <<
-                        ICC_CTLR_EL1_EOImode_SHIFT) & ICC_CTLR_EL1_EOImode_MASK;
-        vmcrp->ctlr |= (vmcr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT;
+        if (model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                vmcrp->ackctl = (vmcr & ICH_VMCR_ACK_CTL_MASK) >>
+                        ICH_VMCR_ACK_CTL_SHIFT;
+                vmcrp->fiqen = (vmcr & ICH_VMCR_FIQ_EN_MASK) >>
+                        ICH_VMCR_FIQ_EN_SHIFT;
+        } else {
+                /*
+                 * When emulating GICv3 on GICv3 with SRE=1 on the
+                 * VFIQEn bit is RES1 and the VAckCtl bit is RES0.
+                 */
+                vmcrp->fiqen = 1;
+                vmcrp->ackctl = 0;
+        }
+
+        vmcrp->cbpr = (vmcr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT;
+        vmcrp->eoim = (vmcr & ICH_VMCR_EOIM_MASK) >> ICH_VMCR_EOIM_SHIFT;
         vmcrp->abpr = (vmcr & ICH_VMCR_BPR1_MASK) >> ICH_VMCR_BPR1_SHIFT;
         vmcrp->bpr  = (vmcr & ICH_VMCR_BPR0_MASK) >> ICH_VMCR_BPR0_SHIFT;
         vmcrp->pmr  = (vmcr & ICH_VMCR_PMR_MASK) >> ICH_VMCR_PMR_SHIFT;
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index da83e4caa272..bba7fa22a7f7 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -111,14 +111,18 @@ static inline bool irq_is_pending(struct vgic_irq *irq)
  * registers regardless of the hardware backed GIC used.
  */
 struct vgic_vmcr {
-        u32     ctlr;
+        u32     grpen0;
+        u32     grpen1;
+
+        u32     ackctl;
+        u32     fiqen;
+        u32     cbpr;
+        u32     eoim;
+
         u32     abpr;
         u32     bpr;
         u32     pmr;  /* Priority mask field in the GICC_PMR and
                        * ICC_PMR_EL1 priority field format */
-        /* Below member variable are valid only for GICv3 */
-        u32     grpen0;
-        u32     grpen1;
 };
 
 struct vgic_reg_attr {