Merge branch 'WIP.sched/core' into sched/core

 Conflicts:
	kernel/sched/Makefile

Pick up the waitqueue related renames - it didn't get much feedback,
so it appears to be uncontroversial. Famous last words? ;-)

Signed-off-by: Ingo Molnar <mingo@kernel.org>

1212 files changed, 12862 insertions, 8186 deletions

diff --git a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
index da5c087462b1..c3c705591532 100644
--- a/Documentation/DocBook/kernel-hacking.tmpl
+++ b/Documentation/DocBook/kernel-hacking.tmpl
@@ -819,7 +819,7 @@ printk(KERN_INFO "my ip: %pI4\n", &ipaddress);
    certain condition is true.  They must be used carefully to ensure
    there is no race condition.  You declare a
    <type>wait_queue_head_t</type>, and then processes which want to
-   wait for that condition declare a <type>wait_queue_t</type>
+   wait for that condition declare a <type>wait_queue_entry_t</type>
    referring to themselves, and place that in the queue.
   </para>
 
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 15f79c27748d..7737ab5d04b2 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -866,6 +866,15 @@
 
         dscc4.setup=    [NET]
 
+        dt_cpu_ftrs=    [PPC]
+                        Format: {"off" | "known"}
+                        Control how the dt_cpu_ftrs device-tree binding is
+                        used for CPU feature discovery and setup (if it
+                        exists).
+                        off: Do not use it, fall back to legacy cpu table.
+                        known: Do not pass through unknown features to guests
+                        or userspace, only those that the kernel is aware of.
+
         dump_apple_properties   [X86]
                         Dump name and content of EFI device properties on
                         x86 Macs.  Useful for driver authors to determine
@@ -3802,6 +3811,13 @@
                         expediting.  Set to zero to disable automatic
                         expediting.
 
+        stack_guard_gap=        [MM]
+                        override the default stack gap protection. The value
+                        is in page units and it defines how many pages prior
+                        to (for stacks growing down) resp. after (for stacks
+                        growing up) the main stack are reserved for no other
+                        mapping. Default value is 256 pages.
+
         stacktrace      [FTRACE]
                         Enabled the stack tracer on boot up.
 
diff --git a/Documentation/devicetree/bindings/clock/sunxi-ccu.txt b/Documentation/devicetree/bindings/clock/sunxi-ccu.txt
index e9c5a1d9834a..f465647a4dd2 100644
--- a/Documentation/devicetree/bindings/clock/sunxi-ccu.txt
+++ b/Documentation/devicetree/bindings/clock/sunxi-ccu.txt
@@ -22,7 +22,8 @@ Required properties :
 - #clock-cells : must contain 1
 - #reset-cells : must contain 1
 
-For the PRCM CCUs on H3/A64, one more clock is needed:
+For the PRCM CCUs on H3/A64, two more clocks are needed:
+- "pll-periph": the SoC's peripheral PLL from the main CCU
 - "iosc": the SoC's internal frequency oscillator
 
 Example for generic CCU:
@@ -39,8 +40,8 @@ Example for PRCM CCU:
 r_ccu: clock@01f01400 {
         compatible = "allwinner,sun50i-a64-r-ccu";
         reg = <0x01f01400 0x100>;
-        clocks = <&osc24M>, <&osc32k>, <&iosc>;
-        clock-names = "hosc", "losc", "iosc";
+        clocks = <&osc24M>, <&osc32k>, <&iosc>, <&ccu CLK_PLL_PERIPH0>;
+        clock-names = "hosc", "losc", "iosc", "pll-periph";
         #clock-cells = <1>;
         #reset-cells = <1>;
 };
diff --git a/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt b/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
index 6db22103e2dd..025cf8c9324a 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
@@ -36,7 +36,7 @@ Optional properties:
                 control gpios
 
  - threshold:   allows setting the "click"-threshold in the range
-                from 20 to 80.
+                from 0 to 80.
 
  - gain:        allows setting the sensitivity in the range from 0 to
                 31. Note that lower values indicate higher
diff --git a/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt b/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
index 05485699d70e..9630ac0e4b56 100644
--- a/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
+++ b/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
@@ -16,6 +16,11 @@ Required properties:
 - reg:                  Base address of PMIC on Hi6220 SoC.
 - interrupt-controller: Hi655x has internal IRQs (has own IRQ domain).
 - pmic-gpios:           The GPIO used by PMIC IRQ.
+- #clock-cells:         From common clock binding; shall be set to 0
+
+Optional properties:
+- clock-output-names: From common clock binding to override the
+  default output clock name
 
 Example:
         pmic: pmic@f8000000 {
@@ -24,4 +29,5 @@ Example:
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 pmic-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+                #clock-cells = <0>;
         }
diff --git a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
index e25436861867..9029b45b8a22 100644
--- a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
+++ b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
@@ -18,6 +18,8 @@ Optional properties:
   "ext_clock" (External clock provided to the card).
 - post-power-on-delay-ms : Delay in ms after powering the card and
         de-asserting the reset-gpios (if any)
+- power-off-delay-us : Delay in us after asserting the reset-gpios (if any)
+        during power off of the card.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/net/dsa/marvell.txt b/Documentation/devicetree/bindings/net/dsa/marvell.txt
index 7ef9dbb08957..1d4d0f49c9d0 100644
--- a/Documentation/devicetree/bindings/net/dsa/marvell.txt
+++ b/Documentation/devicetree/bindings/net/dsa/marvell.txt
@@ -26,6 +26,10 @@ Optional properties:
 - interrupt-controller  : Indicates the switch is itself an interrupt
                           controller. This is used for the PHY interrupts.
 #interrupt-cells = <2>  : Controller uses two cells, number and flag
+- eeprom-length         : Set to the length of an EEPROM connected to the
+                          switch. Must be set if the switch can not detect
+                          the presence and/or size of a connected EEPROM,
+                          otherwise optional.
 - mdio                  : Container of PHY and devices on the switches MDIO
                           bus.
 - mdio?         : Container of PHYs and devices on the external MDIO
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index a1e3693cca16..6f55bdd52f8a 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -15,6 +15,10 @@ Optional properties:
 - phy-reset-active-high : If present then the reset sequence using the GPIO
   specified in the "phy-reset-gpios" property is reversed (H=reset state,
   L=operation state).
+- phy-reset-post-delay : Post reset delay in milliseconds. If present then
+  a delay of phy-reset-post-delay milliseconds will be observed after the
+  phy-reset-gpios has been toggled. Can be omitted thus no delay is
+  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
 - phy-supply : regulator that powers the Ethernet PHY.
 - phy-handle : phandle to the PHY device connected to this device.
 - fixed-link : Assume a fixed link. See fixed-link.txt in the same directory.
diff --git a/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt b/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
index 71a3c134af1b..f01d154090da 100644
--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
+++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt
@@ -247,7 +247,6 @@ bias-bus-hold		- latch weakly
 bias-pull-up            - pull up the pin
 bias-pull-down          - pull down the pin
 bias-pull-pin-default   - use pin-default pull state
-bi-directional          - pin supports simultaneous input/output operations
 drive-push-pull         - drive actively high and low
 drive-open-drain        - drive with open drain
 drive-open-source       - drive with open source
@@ -260,7 +259,6 @@ input-debounce		- debounce mode with debound time X
 power-source            - select between different power supplies
 low-power-enable        - enable low power mode
 low-power-disable       - disable low power mode
-output-enable           - enable output on pin regardless of output value
 output-low              - set the pin to output mode with low level
 output-high             - set the pin to output mode with high level
 slew-rate               - set the slew rate
diff --git a/Documentation/devicetree/bindings/usb/dwc2.txt b/Documentation/devicetree/bindings/usb/dwc2.txt
index 00bea038639e..fcf199b64d3d 100644
--- a/Documentation/devicetree/bindings/usb/dwc2.txt
+++ b/Documentation/devicetree/bindings/usb/dwc2.txt
@@ -10,6 +10,7 @@ Required properties:
   - "rockchip,rk3288-usb", "rockchip,rk3066-usb", "snps,dwc2": for rk3288 Soc;
   - "lantiq,arx100-usb": The DWC2 USB controller instance in Lantiq ARX SoCs;
   - "lantiq,xrx200-usb": The DWC2 USB controller instance in Lantiq XRX SoCs;
+  - "amlogic,meson8-usb": The DWC2 USB controller instance in Amlogic Meson8 SoCs;
   - "amlogic,meson8b-usb": The DWC2 USB controller instance in Amlogic Meson8b SoCs;
   - "amlogic,meson-gxbb-usb": The DWC2 USB controller instance in Amlogic S905 SoCs;
   - "amcc,dwc-otg": The DWC2 USB controller instance in AMCC Canyonlands 460EX SoCs;
diff --git a/Documentation/filesystems/autofs4.txt b/Documentation/filesystems/autofs4.txt
index f10dd590f69f..8444dc3d57e8 100644
--- a/Documentation/filesystems/autofs4.txt
+++ b/Documentation/filesystems/autofs4.txt
@@ -316,7 +316,7 @@ For version 5, the format of the message is:
         struct autofs_v5_packet {
                 int proto_version;                /* Protocol version */
                 int type;                        /* Type of packet */
-                autofs_wqt_t wait_queue_token;
+                autofs_wqt_t wait_queue_entry_token;
                 __u32 dev;
                 __u64 ino;
                 __u32 uid;
@@ -341,12 +341,12 @@ The pipe will be set to "packet mode" (equivalent to passing
 `O_DIRECT`) to _pipe2(2)_ so that a read from the pipe will return at
 most one packet, and any unread portion of a packet will be discarded.
 
-The `wait_queue_token` is a unique number which can identify a
+The `wait_queue_entry_token` is a unique number which can identify a
 particular request to be acknowledged.  When a message is sent over
 the pipe the affected dentry is marked as either "active" or
 "expiring" and other accesses to it block until the message is
 acknowledged using one of the ioctls below and the relevant
-`wait_queue_token`.
+`wait_queue_entry_token`.
 
 Communicating with autofs: root directory ioctls
 ------------------------------------------------
@@ -358,7 +358,7 @@ capability, or must be the automount daemon.
 The available ioctl commands are:
 
 - **AUTOFS_IOC_READY**: a notification has been handled.  The argument
-    to the ioctl command is the "wait_queue_token" number
+    to the ioctl command is the "wait_queue_entry_token" number
     corresponding to the notification being acknowledged.
 - **AUTOFS_IOC_FAIL**: similar to above, but indicates failure with
     the error code `ENOENT`.
@@ -382,14 +382,14 @@ The available ioctl commands are:
         struct autofs_packet_expire_multi {
                 int proto_version;              /* Protocol version */
                 int type;                       /* Type of packet */
-                autofs_wqt_t wait_queue_token;
+                autofs_wqt_t wait_queue_entry_token;
                 int len;
                 char name[NAME_MAX+1];
         };
 
      is required.  This is filled in with the name of something
      that can be unmounted or removed.  If nothing can be expired,
-     `errno` is set to `EAGAIN`.  Even though a `wait_queue_token`
+     `errno` is set to `EAGAIN`.  Even though a `wait_queue_entry_token`
      is present in the structure, no "wait queue" is established
      and no acknowledgment is needed.
 - **AUTOFS_IOC_EXPIRE_MULTI**:  This is similar to
diff --git a/Documentation/input/devices/edt-ft5x06.rst b/Documentation/input/devices/edt-ft5x06.rst
index 2032f0b7a8fa..1ccc94b192b7 100644
--- a/Documentation/input/devices/edt-ft5x06.rst
+++ b/Documentation/input/devices/edt-ft5x06.rst
@@ -15,7 +15,7 @@ It has been tested with the following devices:
 The driver allows configuration of the touch screen via a set of sysfs files:
 
 /sys/class/input/eventX/device/device/threshold:
-    allows setting the "click"-threshold in the range from 20 to 80.
+    allows setting the "click"-threshold in the range from 0 to 80.
 
 /sys/class/input/eventX/device/device/gain:
     allows setting the sensitivity in the range from 0 to 31. Note that
diff --git a/Documentation/networking/dpaa.txt b/Documentation/networking/dpaa.txt
new file mode 100644
index 000000000000..76e016d4d344
--- /dev/null
+++ b/Documentation/networking/dpaa.txt
@@ -0,0 +1,194 @@
+The QorIQ DPAA Ethernet Driver
+==============================
+
+Authors:
+Madalin Bucur <madalin.bucur@nxp.com>
+Camelia Groza <camelia.groza@nxp.com>
+
+Contents
+========
+
+        - DPAA Ethernet Overview
+        - DPAA Ethernet Supported SoCs
+        - Configuring DPAA Ethernet in your kernel
+        - DPAA Ethernet Frame Processing
+        - DPAA Ethernet Features
+        - Debugging
+
+DPAA Ethernet Overview
+======================
+
+DPAA stands for Data Path Acceleration Architecture and it is a
+set of networking acceleration IPs that are available on several
+generations of SoCs, both on PowerPC and ARM64.
+
+The Freescale DPAA architecture consists of a series of hardware blocks
+that support Ethernet connectivity. The Ethernet driver depends upon the
+following drivers in the Linux kernel:
+
+ - Peripheral Access Memory Unit (PAMU) (* needed only for PPC platforms)
+    drivers/iommu/fsl_*
+ - Frame Manager (FMan)
+    drivers/net/ethernet/freescale/fman
+ - Queue Manager (QMan), Buffer Manager (BMan)
+    drivers/soc/fsl/qbman
+
+A simplified view of the dpaa_eth interfaces mapped to FMan MACs:
+
+  dpaa_eth       /eth0\     ...       /ethN\
+  driver        |      |             |      |
+  -------------   ----   -----------   ----   -------------
+       -Ports  / Tx  Rx \    ...    / Tx  Rx \
+  FMan        |          |         |          |
+       -MACs  |   MAC0   |         |   MACN   |
+             /   dtsec0   \  ...  /   dtsecN   \ (or tgec)
+            /              \     /              \(or memac)
+  ---------  --------------  ---  --------------  ---------
+      FMan, FMan Port, FMan SP, FMan MURAM drivers
+  ---------------------------------------------------------
+      FMan HW blocks: MURAM, MACs, Ports, SP
+  ---------------------------------------------------------
+
+The dpaa_eth relation to the QMan, BMan and FMan:
+              ________________________________
+  dpaa_eth   /            eth0                \
+  driver    /                                  \
+  ---------   -^-   -^-   -^-   ---    ---------
+  QMan driver / \   / \   / \  \   /  | BMan    |
+             |Rx | |Rx | |Tx | |Tx |  | driver  |
+  ---------  |Dfl| |Err| |Cnf| |FQs|  |         |
+  QMan HW    |FQ | |FQ | |FQs| |   |  |         |
+             /   \ /   \ /   \  \ /   |         |
+  ---------   ---   ---   ---   -v-    ---------
+            |        FMan QMI         |         |
+            | FMan HW       FMan BMI  | BMan HW |
+              -----------------------   --------
+
+where the acronyms used above (and in the code) are:
+DPAA = Data Path Acceleration Architecture
+FMan = DPAA Frame Manager
+QMan = DPAA Queue Manager
+BMan = DPAA Buffers Manager
+QMI = QMan interface in FMan
+BMI = BMan interface in FMan
+FMan SP = FMan Storage Profiles
+MURAM = Multi-user RAM in FMan
+FQ = QMan Frame Queue
+Rx Dfl FQ = default reception FQ
+Rx Err FQ = Rx error frames FQ
+Tx Cnf FQ = Tx confirmation FQs
+Tx FQs = transmission frame queues
+dtsec = datapath three speed Ethernet controller (10/100/1000 Mbps)
+tgec = ten gigabit Ethernet controller (10 Gbps)
+memac = multirate Ethernet MAC (10/100/1000/10000)
+
+DPAA Ethernet Supported SoCs
+============================
+
+The DPAA drivers enable the Ethernet controllers present on the following SoCs:
+
+# PPC
+P1023
+P2041
+P3041
+P4080
+P5020
+P5040
+T1023
+T1024
+T1040
+T1042
+T2080
+T4240
+B4860
+
+# ARM
+LS1043A
+LS1046A
+
+Configuring DPAA Ethernet in your kernel
+========================================
+
+To enable the DPAA Ethernet driver, the following Kconfig options are required:
+
+# common for arch/arm64 and arch/powerpc platforms
+CONFIG_FSL_DPAA=y
+CONFIG_FSL_FMAN=y
+CONFIG_FSL_DPAA_ETH=y
+CONFIG_FSL_XGMAC_MDIO=y
+
+# for arch/powerpc only
+CONFIG_FSL_PAMU=y
+
+# common options needed for the PHYs used on the RDBs
+CONFIG_VITESSE_PHY=y
+CONFIG_REALTEK_PHY=y
+CONFIG_AQUANTIA_PHY=y
+
+DPAA Ethernet Frame Processing
+==============================
+
+On Rx, buffers for the incoming frames are retrieved from one of the three
+existing buffers pools. The driver initializes and seeds these, each with
+buffers of different sizes: 1KB, 2KB and 4KB.
+
+On Tx, all transmitted frames are returned to the driver through Tx
+confirmation frame queues. The driver is then responsible for freeing the
+buffers. In order to do this properly, a backpointer is added to the buffer
+before transmission that points to the skb. When the buffer returns to the
+driver on a confirmation FQ, the skb can be correctly consumed.
+
+DPAA Ethernet Features
+======================
+
+Currently the DPAA Ethernet driver enables the basic features required for
+a Linux Ethernet driver. The support for advanced features will be added
+gradually.
+
+The driver has Rx and Tx checksum offloading for UDP and TCP. Currently the Rx
+checksum offload feature is enabled by default and cannot be controlled through
+ethtool.
+
+The driver has support for multiple prioritized Tx traffic classes. Priorities
+range from 0 (lowest) to 3 (highest). These are mapped to HW workqueues with
+strict priority levels. Each traffic class contains NR_CPU TX queues. By
+default, only one traffic class is enabled and the lowest priority Tx queues
+are used. Higher priority traffic classes can be enabled with the mqprio
+qdisc. For example, all four traffic classes are enabled on an interface with
+the following command. Furthermore, skb priority levels are mapped to traffic
+classes as follows:
+
+        * priorities 0 to 3 - traffic class 0 (low priority)
+        * priorities 4 to 7 - traffic class 1 (medium-low priority)
+        * priorities 8 to 11 - traffic class 2 (medium-high priority)
+        * priorities 12 to 15 - traffic class 3 (high priority)
+
+tc qdisc add dev <int> root handle 1: \
+         mqprio num_tc 4 map 0 0 0 0 1 1 1 1 2 2 2 2 3 3 3 3 hw 1
+
+Debugging
+=========
+
+The following statistics are exported for each interface through ethtool:
+
+        - interrupt count per CPU
+        - Rx packets count per CPU
+        - Tx packets count per CPU
+        - Tx confirmed packets count per CPU
+        - Tx S/G frames count per CPU
+        - Tx error count per CPU
+        - Rx error count per CPU
+        - Rx error count per type
+        - congestion related statistics:
+                - congestion status
+                - time spent in congestion
+                - number of time the device entered congestion
+                - dropped packets count per cause
+
+The driver also exports the following information in sysfs:
+
+        - the FQ IDs for each FQ type
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/fqids
+
+        - the IDs of the buffer pools in use
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/bpids
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index 59f4db2a0c85..f55639d71d35 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -122,7 +122,7 @@ associated flow of the packet. The hash is either provided by hardware
 or will be computed in the stack. Capable hardware can pass the hash in
 the receive descriptor for the packet; this would usually be the same
 hash used for RSS (e.g. computed Toeplitz hash). The hash is saved in
-skb->rx_hash and can be used elsewhere in the stack as a hash of the
+skb->hash and can be used elsewhere in the stack as a hash of the
 packet’s flow.
 
 Each receive hardware queue has an associated list of CPUs to which
diff --git a/Documentation/networking/tcp.txt b/Documentation/networking/tcp.txt
index bdc4c0db51e1..9c7139d57e57 100644
--- a/Documentation/networking/tcp.txt
+++ b/Documentation/networking/tcp.txt
@@ -1,7 +1,7 @@
 TCP protocol
 ============
 
-Last updated: 9 February 2008
+Last updated: 3 June 2017
 
 Contents
 ========
@@ -29,18 +29,19 @@ As of 2.6.13, Linux supports pluggable congestion control algorithms.
 A congestion control mechanism can be registered through functions in
 tcp_cong.c. The functions used by the congestion control mechanism are
 registered via passing a tcp_congestion_ops struct to
-tcp_register_congestion_control. As a minimum name, ssthresh,
-cong_avoid must be valid.
+tcp_register_congestion_control. As a minimum, the congestion control
+mechanism must provide a valid name and must implement either ssthresh,
+cong_avoid and undo_cwnd hooks or the "omnipotent" cong_control hook.
 
 Private data for a congestion control mechanism is stored in tp->ca_priv.
 tcp_ca(tp) returns a pointer to this space.  This is preallocated space - it
 is important to check the size of your private data will fit this space, or
-alternatively space could be allocated elsewhere and a pointer to it could
+alternatively, space could be allocated elsewhere and a pointer to it could
 be stored here.
 
 There are three kinds of congestion control algorithms currently: The
 simplest ones are derived from TCP reno (highspeed, scalable) and just
-provide an alternative the congestion window calculation. More complex
+provide an alternative congestion window calculation. More complex
 ones like BIC try to look at other events to provide better
 heuristics.  There are also round trip time based algorithms like
 Vegas and Westwood+.
@@ -49,21 +50,15 @@ Good TCP congestion control is a complex problem because the algorithm
 needs to maintain fairness and performance. Please review current
 research and RFC's before developing new modules.
 
-The method that is used to determine which congestion control mechanism is
-determined by the setting of the sysctl net.ipv4.tcp_congestion_control.
-The default congestion control will be the last one registered (LIFO);
-so if you built everything as modules, the default will be reno. If you
-build with the defaults from Kconfig, then CUBIC will be builtin (not a
-module) and it will end up the default.
+The default congestion control mechanism is chosen based on the
+DEFAULT_TCP_CONG Kconfig parameter. If you really want a particular default
+value then you can set it using sysctl net.ipv4.tcp_congestion_control. The
+module will be autoloaded if needed and you will get the expected protocol. If
+you ask for an unknown congestion method, then the sysctl attempt will fail.
 
-If you really want a particular default value then you will need
-to set it with the sysctl.  If you use a sysctl, the module will be autoloaded
-if needed and you will get the expected protocol. If you ask for an
-unknown congestion method, then the sysctl attempt will fail.
-
-If you remove a tcp congestion control module, then you will get the next
+If you remove a TCP congestion control module, then you will get the next
 available one. Since reno cannot be built as a module, and cannot be
-deleted, it will always be available.
+removed, it will always be available.
 
 How the new TCP output machine [nyi] works.
 ===========================================
diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
index 5338673c88d9..773d2bfacc6c 100644
--- a/Documentation/sound/hd-audio/models.rst
+++ b/Documentation/sound/hd-audio/models.rst
@@ -16,6 +16,8 @@ ALC880
     6-jack in back, 2-jack in front
 6stack-digout
     6-jack with a SPDIF out
+6stack-automute
+    6-jack with headphone jack detection
 
 ALC260
 ======
@@ -62,6 +64,8 @@ lenovo-dock
     Enables docking station I/O for some Lenovos
 hp-gpio-led
     GPIO LED support on HP laptops
+hp-dock-gpio-mic1-led
+    HP dock with mic LED support
 dell-headset-multi
     Headset jack, which can also be used as mic-in
 dell-headset-dock
@@ -72,6 +76,12 @@ alc283-sense-combo
     Combo jack sensing on ALC283
 tpt440-dock
     Pin configs for Lenovo Thinkpad Dock support
+tpt440
+    Lenovo Thinkpad T440s setup
+tpt460
+    Lenovo Thinkpad T460/560 setup
+dual-codecs
+    Lenovo laptops with dual codecs
 
 ALC66x/67x/892
 ==============
@@ -97,6 +107,8 @@ inv-dmic
     Inverted internal mic workaround
 dell-headset-multi
     Headset jack, which can also be used as mic-in
+dual-codecs
+    Lenovo laptops with dual codecs
 
 ALC680
 ======
@@ -114,6 +126,8 @@ inv-dmic
     Inverted internal mic workaround
 no-primary-hp
     VAIO Z/VGC-LN51JGB workaround (for fixed speaker DAC)
+dual-codecs
+    ALC1220 dual codecs for Gaming mobos
 
 ALC861/660
 ==========
@@ -206,65 +220,47 @@ auto
 
 Conexant 5045
 =============
-laptop-hpsense
-    Laptop with HP sense (old model laptop)
-laptop-micsense
-    Laptop with Mic sense (old model fujitsu)
-laptop-hpmicsense
-    Laptop with HP and Mic senses
-benq
-    Benq R55E
-laptop-hp530
-    HP 530 laptop
-test
-    for testing/debugging purpose, almost all controls can be
-    adjusted.  Appearing only when compiled with $CONFIG_SND_DEBUG=y
+cap-mix-amp
+    Fix max input level on mixer widget
+toshiba-p105
+    Toshiba P105 quirk
+hp-530
+    HP 530 quirk
 
 Conexant 5047
 =============
-laptop
-    Basic Laptop config 
-laptop-hp
-    Laptop config for some HP models (subdevice 30A5)
-laptop-eapd
-    Laptop config with EAPD support
-test
-    for testing/debugging purpose, almost all controls can be
-    adjusted.  Appearing only when compiled with $CONFIG_SND_DEBUG=y
+cap-mix-amp
+    Fix max input level on mixer widget
 
 Conexant 5051
 =============
-laptop
-    Basic Laptop config (default)
-hp
-    HP Spartan laptop
-hp-dv6736
-    HP dv6736
-hp-f700
-    HP Compaq Presario F700
-ideapad
-    Lenovo IdeaPad laptop
-toshiba
-    Toshiba Satellite M300
+lenovo-x200
+    Lenovo X200 quirk
 
 Conexant 5066
 =============
-laptop
-    Basic Laptop config (default)
-hp-laptop
-    HP laptops, e g G60
-asus
-    Asus K52JU, Lenovo G560
-dell-laptop
-    Dell laptops
-dell-vostro
-    Dell Vostro
-olpc-xo-1_5
-    OLPC XO 1.5
-ideapad
-    Lenovo IdeaPad U150
+stereo-dmic
+    Workaround for inverted stereo digital mic
+gpio1
+    Enable GPIO1 pin
+headphone-mic-pin
+    Enable headphone mic NID 0x18 without detection
+tp410
+    Thinkpad T400 & co quirks
 thinkpad
-    Lenovo Thinkpad
+    Thinkpad mute/mic LED quirk
+lemote-a1004
+    Lemote A1004 quirk
+lemote-a1205
+    Lemote A1205 quirk
+olpc-xo
+    OLPC XO quirk
+mute-led-eapd
+    Mute LED control via EAPD
+hp-dock
+    HP dock support
+mute-led-gpio
+    Mute LED control via GPIO
 
 STAC9200
 ========
@@ -444,6 +440,8 @@ dell-eq
     Dell desktops/laptops
 alienware
     Alienware M17x
+asus-mobo
+    Pin configs for ASUS mobo with 5.1/SPDIF out
 auto
     BIOS setup (default)
 
@@ -477,6 +475,8 @@ hp-envy-ts-bass
     Pin fixup for HP Envy TS bass speaker (NID 0x10)
 hp-bnb13-eq
     Hardware equalizer setup for HP laptops
+hp-envy-ts-bass
+    HP Envy TS bass support
 auto
     BIOS setup (default)
 
@@ -496,10 +496,22 @@ auto
 
 Cirrus Logic CS4206/4207
 ========================
+mbp53
+    MacBook Pro 5,3
 mbp55
     MacBook Pro 5,5
 imac27
     IMac 27 Inch
+imac27_122
+    iMac 12,2
+apple
+    Generic Apple quirk
+mbp101
+    MacBookPro 10,1
+mbp81
+    MacBookPro 8,1
+mba42
+    MacBookAir 4,2
 auto
     BIOS setup (default)
 
@@ -509,6 +521,10 @@ mba6
     MacBook Air 6,1 and 6,2
 gpio0
     Enable GPIO 0 amp
+mbp11
+    MacBookPro 11,2
+macmini
+    MacMini 7,1
 auto
     BIOS setup (default)
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 9e984645c4b0..09b5ab6a8a5c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1172,7 +1172,7 @@ N:	clps711x
 
 ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
-M:      Ryan Mallon <rmallon@gmail.com>
+M:      Alexander Sverdlin <alexander.sverdlin@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-ep93xx/
@@ -1489,13 +1489,15 @@ M:	Gregory Clement <gregory.clement@free-electrons.com>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-F:      arch/arm/mach-mvebu/
-F:      drivers/rtc/rtc-armada38x.c
 F:      arch/arm/boot/dts/armada*
 F:      arch/arm/boot/dts/kirkwood*
+F:      arch/arm/configs/mvebu_*_defconfig
+F:      arch/arm/mach-mvebu/
 F:      arch/arm64/boot/dts/marvell/armada*
 F:      drivers/cpufreq/mvebu-cpufreq.c
-F:      arch/arm/configs/mvebu_*_defconfig
+F:      drivers/irqchip/irq-armada-370-xp.c
+F:      drivers/irqchip/irq-mvebu-*
+F:      drivers/rtc/rtc-armada38x.c
 
 ARM/Marvell Berlin SoC support
 M:      Jisheng Zhang <jszhang@marvell.com>
@@ -1721,7 +1723,6 @@ N:	rockchip
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
-R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 Q:      https://patchwork.kernel.org/project/linux-samsung-soc/list/
@@ -1829,7 +1830,6 @@ F:	drivers/edac/altera_edac.
 ARM/STI ARCHITECTURE
 M:      Patrice Chotard <patrice.chotard@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      kernel@stlinux.com
 W:      http://www.stlinux.com
 S:      Maintained
 F:      arch/arm/mach-sti/
@@ -5622,7 +5622,7 @@ F:	scripts/get_maintainer.pl
 
 GENWQE (IBM Generic Workqueue Card)
 M:      Frank Haverkamp <haver@linux.vnet.ibm.com>
-M:      Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 S:      Supported
 F:      drivers/misc/genwqe/
 
@@ -5667,7 +5667,6 @@ F:	tools/testing/selftests/gpio/
 
 GPIO SUBSYSTEM
 M:      Linus Walleij <linus.walleij@linaro.org>
-M:      Alexandre Courbot <gnurou@gmail.com>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio.git
 S:      Maintained
@@ -7143,7 +7142,7 @@ S:	Maintained
 F:      drivers/media/platform/rcar_jpu.c
 
 JSM Neo PCI based serial card
-M:      Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 L:      linux-serial@vger.kernel.org
 S:      Maintained
 F:      drivers/tty/serial/jsm/
@@ -7707,7 +7706,7 @@ F:	drivers/platform/x86/hp_accel.c
 
 LIVE PATCHING
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Jiri Kosina <jikos@kernel.org>
 M:      Miroslav Benes <mbenes@suse.cz>
 R:      Petr Mladek <pmladek@suse.com>
@@ -8508,7 +8507,7 @@ S:	Odd Fixes
 F:      drivers/media/radio/radio-miropcm20*
 
 MELLANOX MLX4 core VPI driver
-M:      Yishai Hadas <yishaih@mellanox.com>
+M:      Tariq Toukan <tariqt@mellanox.com>
 L:      netdev@vger.kernel.org
 L:      linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
@@ -8516,7 +8515,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx4/
 F:      include/linux/mlx4/
-F:      include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX4 IB driver
 M:      Yishai Hadas <yishaih@mellanox.com>
@@ -8526,6 +8524,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx4/
 F:      include/linux/mlx4/
+F:      include/uapi/rdma/mlx4-abi.h
 
 MELLANOX MLX5 core VPI driver
 M:      Saeed Mahameed <saeedm@mellanox.com>
@@ -8538,7 +8537,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
-F:      include/uapi/rdma/mlx5-abi.h
 
 MELLANOX MLX5 IB driver
 M:      Matan Barak <matanb@mellanox.com>
@@ -8549,6 +8547,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx5/
 F:      include/linux/mlx5/
+F:      include/uapi/rdma/mlx5-abi.h
 
 MELEXIS MLX90614 DRIVER
 M:      Crt Mori <cmo@melexis.com>
@@ -8588,7 +8587,7 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/mn88473*
 
 MODULE SUPPORT
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Rusty Russell <rusty@rustcorp.com.au>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux.git modules-next
 S:      Maintained
@@ -10450,7 +10449,7 @@ S:	Orphan
 
 PXA RTC DRIVER
 M:      Robert Jarzmik <robert.jarzmik@free.fr>
-L:      rtc-linux@googlegroups.com
+L:      linux-rtc@vger.kernel.org
 S:      Maintained
 
 QAT DRIVER
@@ -10757,7 +10756,7 @@ X:	kernel/torture.c
 REAL TIME CLOCK (RTC) SUBSYSTEM
 M:      Alessandro Zummo <a.zummo@towertech.it>
 M:      Alexandre Belloni <alexandre.belloni@free-electrons.com>
-L:      rtc-linux@googlegroups.com
+L:      linux-rtc@vger.kernel.org
 Q:      http://patchwork.ozlabs.org/project/rtc-linux/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux.git
 S:      Maintained
@@ -11268,7 +11267,6 @@ F:	drivers/media/rc/serial_ir.c
 
 STI CEC DRIVER
 M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
-L:      kernel@stlinux.com
 S:      Maintained
 F:      drivers/staging/media/st-cec/
 F:      Documentation/devicetree/bindings/media/stih-cec.txt
@@ -11778,6 +11776,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git
 S:      Supported
 F:      arch/arm/mach-davinci/
 F:      drivers/i2c/busses/i2c-davinci.c
+F:      arch/arm/boot/dts/da850*
 
 TI DAVINCI SERIES MEDIA DRIVER
 M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
@@ -13861,7 +13860,7 @@ S:	Odd fixes
 F:      drivers/net/wireless/wl3501*
 
 WOLFSON MICROELECTRONICS DRIVERS
-L:      patches@opensource.wolfsonmicro.com
+L:      patches@opensource.cirrus.com
 T:      git https://github.com/CirrusLogic/linux-drivers.git
 W:      https://github.com/CirrusLogic/linux-drivers/wiki
 S:      Supported
diff --git a/Makefile b/Makefile
index 63e10bd4f14a..e40c471abe29 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arc/mm/mmap.c b/arch/arc/mm/mmap.c
index 3e25e8d6486b..2e13683dfb24 100644
--- a/arch/arc/mm/mmap.c
+++ b/arch/arc/mm/mmap.c
@@ -65,7 +65,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/arm/boot/compressed/efi-header.S b/arch/arm/boot/compressed/efi-header.S
index 9d5dc4fda3c1..3f7d1b74c5e0 100644
--- a/arch/arm/boot/compressed/efi-header.S
+++ b/arch/arm/boot/compressed/efi-header.S
@@ -17,14 +17,12 @@
                 @ there.
                 .inst   'M' | ('Z' << 8) | (0x1310 << 16)   @ tstne r0, #0x4d000
 #else
-                mov     r0, r0
+                W(mov)  r0, r0
 #endif
                 .endm
 
                 .macro  __EFI_HEADER
 #ifdef CONFIG_EFI_STUB
-                b       __efi_start
-
                 .set    start_offset, __efi_start - start
                 .org    start + 0x3c
                 @
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 7c711ba61417..8a756870c238 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -130,19 +130,22 @@ start:
                 .rept   7
                 __nop
                 .endr
-   ARM(         mov     r0, r0          )
-   ARM(         b       1f              )
- THUMB(         badr    r12, 1f         )
- THUMB(         bx      r12             )
+#ifndef CONFIG_THUMB2_KERNEL
+                mov     r0, r0
+#else
+ AR_CLASS(      sub     pc, pc, #3      )       @ A/R: switch to Thumb2 mode
+  M_CLASS(      nop.w                   )       @ M: already in Thumb2 mode
+                .thumb
+#endif
+                W(b)    1f
 
                 .word   _magic_sig      @ Magic numbers to help the loader
                 .word   _magic_start    @ absolute load/run zImage address
                 .word   _magic_end      @ zImage end address
                 .word   0x04030201      @ endianness flag
 
- THUMB(         .thumb                  )
-1:              __EFI_HEADER
-
+                __EFI_HEADER
+1:
  ARM_BE8(       setend  be              )       @ go BE8 if compiled for BE8
  AR_CLASS(      mrs     r9, cpsr        )
 #ifdef CONFIG_ARM_VIRT_EXT
diff --git a/arch/arm/boot/dts/am335x-sl50.dts b/arch/arm/boot/dts/am335x-sl50.dts
index c5d2589c55fc..fc864a855991 100644
--- a/arch/arm/boot/dts/am335x-sl50.dts
+++ b/arch/arm/boot/dts/am335x-sl50.dts
@@ -220,7 +220,7 @@
 
         mmc1_pins: pinmux_mmc1_pins {
                 pinctrl-single,pins = <
-                        AM33XX_IOPAD(0x960, PIN_INPUT | MUX_MODE7)              /* spi0_cs1.gpio0_6 */
+                        AM33XX_IOPAD(0x96c, PIN_INPUT | MUX_MODE7)              /* uart0_rtsn.gpio1_9 */
                 >;
         };
 
@@ -280,10 +280,6 @@
                         AM33XX_IOPAD(0x834, PIN_INPUT_PULLUP | MUX_MODE7)       /* nKbdReset - gpmc_ad13.gpio1_13 */
                         AM33XX_IOPAD(0x838, PIN_INPUT_PULLUP | MUX_MODE7)       /* nDispReset - gpmc_ad14.gpio1_14 */
                         AM33XX_IOPAD(0x844, PIN_INPUT_PULLUP | MUX_MODE7)       /* USB1_enPower - gpmc_a1.gpio1_17 */
-                        /* AVR Programming - SPI Bus (bit bang) - Screen and Keyboard */
-                        AM33XX_IOPAD(0x954, PIN_INPUT_PULLUP | MUX_MODE7)       /* Kbd/Disp/BattMOSI spi0_d0.gpio0_3 */
-                        AM33XX_IOPAD(0x958, PIN_INPUT_PULLUP | MUX_MODE7)       /* Kbd/Disp/BattMISO spi0_d1.gpio0_4 */
-                        AM33XX_IOPAD(0x950, PIN_INPUT_PULLUP | MUX_MODE7)       /* Kbd/Disp/BattSCLK spi0_clk.gpio0_2 */
                         /* PDI Bus - Battery system */
                         AM33XX_IOPAD(0x840, PIN_INPUT_PULLUP | MUX_MODE7)       /* nBattReset  gpmc_a0.gpio1_16 */
                         AM33XX_IOPAD(0x83c, PIN_INPUT_PULLUP | MUX_MODE7)       /* BattPDIData gpmc_ad15.gpio1_15 */
@@ -384,7 +380,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins>;
         bus-width = <4>;
-        cd-gpios = <&gpio0 6 GPIO_ACTIVE_LOW>;
+        cd-gpios = <&gpio1 9 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&vmmcsd_fixed>;
 };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 561f27d8d922..9444a9a9ba10 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -3,6 +3,11 @@
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
 
+/* firmware-provided startup stubs live here, where the secondary CPUs are
+ * spinning.
+ */
+/memreserve/ 0x00000000 0x00001000;
+
 /* This include file covers the common peripherals and configuration between
  * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
  * bcm2835.dtsi and bcm2836.dtsi.
diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dts b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
index f18e1f1d0ce2..d2be8aa3370b 100644
--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dts
+++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
@@ -120,10 +120,16 @@
 
                 ethphy0: ethernet-phy@2 {
                         reg = <2>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET_REF>;
+                        clock-names = "rmii-ref";
                 };
 
                 ethphy1: ethernet-phy@1 {
                         reg = <1>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET2_REF>;
+                        clock-names = "rmii-ref";
                 };
         };
 };
diff --git a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
index b6f26824e83a..66f615a74118 100644
--- a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
@@ -137,8 +137,8 @@ netcp: netcp@26000000 {
         /* NetCP address range */
         ranges = <0 0x26000000 0x1000000>;
 
-        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>, <&clkosr>;
-        clock-names = "pa_clk", "ethss_clk", "cpts", "osr_clk";
+        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>;
+        clock-names = "pa_clk", "ethss_clk", "cpts";
         dma-coherent;
 
         ti,navigator-dmas = <&dma_gbe 0>,
diff --git a/arch/arm/boot/dts/keystone-k2l.dtsi b/arch/arm/boot/dts/keystone-k2l.dtsi
index b58e7ebc0919..148650406cf7 100644
--- a/arch/arm/boot/dts/keystone-k2l.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l.dtsi
@@ -232,6 +232,14 @@
                         };
                 };
 
+                osr: sram@70000000 {
+                        compatible = "mmio-sram";
+                        reg = <0x70000000 0x10000>;
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        clocks = <&clkosr>;
+                };
+
                 dspgpio0: keystone_dsp_gpio@02620240 {
                         compatible = "ti,keystone-dsp-gpio";
                         gpio-controller;
diff --git a/arch/arm/boot/dts/sunxi-h3-h5.dtsi b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
index 1aeeacb3a884..d4f600dbb7eb 100644
--- a/arch/arm/boot/dts/sunxi-h3-h5.dtsi
+++ b/arch/arm/boot/dts/sunxi-h3-h5.dtsi
@@ -558,10 +558,11 @@
                 };
 
                 r_ccu: clock@1f01400 {
-                        compatible = "allwinner,sun50i-a64-r-ccu";
+                        compatible = "allwinner,sun8i-h3-r-ccu";
                         reg = <0x01f01400 0x100>;
-                        clocks = <&osc24M>, <&osc32k>, <&iosc>;
-                        clock-names = "hosc", "losc", "iosc";
+                        clocks = <&osc24M>, <&osc32k>, <&iosc>,
+                                 <&ccu 9>;
+                        clock-names = "hosc", "losc", "iosc", "pll-periph";
                         #clock-cells = <1>;
                         #reset-cells = <1>;
                 };
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 33a8eb28374e..06e2331f666d 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -1,4 +1,4 @@
-#include <versatile-ab.dts>
+#include "versatile-ab.dts"
 
 / {
         model = "ARM Versatile PB";
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index cf062472e07b..2b913f17d50f 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -235,7 +235,7 @@ int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster)
         return ret;
 }
 
-typedef void (*phys_reset_t)(unsigned long);
+typedef typeof(cpu_reset) phys_reset_t;
 
 void mcpm_cpu_power_down(void)
 {
@@ -300,7 +300,7 @@ void mcpm_cpu_power_down(void)
          * on the CPU.
          */
         phys_reset = (phys_reset_t)(unsigned long)__pa_symbol(cpu_reset);
-        phys_reset(__pa_symbol(mcpm_entry_point));
+        phys_reset(__pa_symbol(mcpm_entry_point), false);
 
         /* should never get here */
         BUG();
@@ -389,7 +389,7 @@ static int __init nocache_trampoline(unsigned long _arg)
         __mcpm_cpu_down(cpu, cluster);
 
         phys_reset = (phys_reset_t)(unsigned long)__pa_symbol(cpu_reset);
-        phys_reset(__pa_symbol(mcpm_entry_point));
+        phys_reset(__pa_symbol(mcpm_entry_point), false);
         BUG();
 }
 
diff --git a/arch/arm/include/asm/device.h b/arch/arm/include/asm/device.h
index 36ec9c8f6e16..3234fe9bba6e 100644
--- a/arch/arm/include/asm/device.h
+++ b/arch/arm/include/asm/device.h
@@ -19,7 +19,8 @@ struct dev_archdata {
 #ifdef CONFIG_XEN
         const struct dma_map_ops *dev_dma_ops;
 #endif
-        bool dma_coherent;
+        unsigned int dma_coherent:1;
+        unsigned int dma_ops_setup:1;
 };
 
 struct omap_device;
diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h
index 302240c19a5a..a0d726a47c8a 100644
--- a/arch/arm/include/asm/pgtable-nommu.h
+++ b/arch/arm/include/asm/pgtable-nommu.h
@@ -66,6 +66,7 @@ typedef pte_t *pte_addr_t;
 #define pgprot_noncached(prot)  (prot)
 #define pgprot_writecombine(prot) (prot)
 #define pgprot_dmacoherent(prot) (prot)
+#define pgprot_device(prot)     (prot)
 
 
 /*
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index 570ed4a9c261..5386528665b5 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -104,7 +104,6 @@ __do_hyp_init:
         @  - Write permission implies XN: disabled
         @  - Instruction cache: enabled
         @  - Data/Unified cache: enabled
-        @  - Memory alignment checks: enabled
         @  - MMU: enabled (this code must be run from an identity mapping)
         mrc     p15, 4, r0, c1, c0, 0   @ HSCR
         ldr     r2, =HSCTLR_MASK
@@ -112,8 +111,8 @@ __do_hyp_init:
         mrc     p15, 0, r1, c1, c0, 0   @ SCTLR
         ldr     r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C)
         and     r1, r1, r2
- ARM(   ldr     r2, =(HSCTLR_M | HSCTLR_A)                      )
- THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE)          )
+ ARM(   ldr     r2, =(HSCTLR_M)                                 )
+ THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_TE)                     )
         orr     r1, r1, r2
         orr     r0, r0, r1
         mcr     p15, 4, r0, c1, c0, 0   @ HSCR
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index 841e924143f9..cbd959b73654 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -1,6 +1,7 @@
 menuconfig ARCH_AT91
         bool "Atmel SoCs"
         depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V7
+        select ARM_CPU_SUSPEND if PM
         select COMMON_CLK_AT91
         select GPIOLIB
         select PINCTRL
diff --git a/arch/arm/mach-davinci/pm.c b/arch/arm/mach-davinci/pm.c
index efb80354f303..b5cc05dc2cb2 100644
--- a/arch/arm/mach-davinci/pm.c
+++ b/arch/arm/mach-davinci/pm.c
@@ -153,7 +153,8 @@ int __init davinci_pm_init(void)
         davinci_sram_suspend = sram_alloc(davinci_cpu_suspend_sz, NULL);
         if (!davinci_sram_suspend) {
                 pr_err("PM: cannot allocate SRAM memory\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto no_sram_mem;
         }
 
         davinci_sram_push(davinci_sram_suspend, davinci_cpu_suspend,
@@ -161,6 +162,10 @@ int __init davinci_pm_init(void)
 
         suspend_set_ops(&davinci_pm_ops);
 
+        return 0;
+
+no_sram_mem:
+        iounmap(pm_config.ddrpsc_reg_base);
 no_ddrpsc_mem:
         iounmap(pm_config.ddrpll_reg_base);
 no_ddrpll_mem:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c742dfd2967b..bd83c531828a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2311,7 +2311,14 @@ int arm_iommu_attach_device(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
 
-static void __arm_iommu_detach_device(struct device *dev)
+/**
+ * arm_iommu_detach_device
+ * @dev: valid struct device pointer
+ *
+ * Detaches the provided device from a previously attached map.
+ * This voids the dma operations (dma_map_ops pointer)
+ */
+void arm_iommu_detach_device(struct device *dev)
 {
         struct dma_iommu_mapping *mapping;
 
@@ -2324,22 +2331,10 @@ static void __arm_iommu_detach_device(struct device *dev)
         iommu_detach_device(mapping->domain, dev);
         kref_put(&mapping->kref, release_iommu_mapping);
         to_dma_iommu_mapping(dev) = NULL;
+        set_dma_ops(dev, NULL);
 
         pr_debug("Detached IOMMU controller from %s device.\n", dev_name(dev));
 }
-
-/**
- * arm_iommu_detach_device
- * @dev: valid struct device pointer
- *
- * Detaches the provided device from a previously attached map.
- * This voids the dma operations (dma_map_ops pointer)
- */
-void arm_iommu_detach_device(struct device *dev)
-{
-        __arm_iommu_detach_device(dev);
-        set_dma_ops(dev, NULL);
-}
 EXPORT_SYMBOL_GPL(arm_iommu_detach_device);
 
 static const struct dma_map_ops *arm_get_iommu_dma_map_ops(bool coherent)
@@ -2379,7 +2374,7 @@ static void arm_teardown_iommu_dma_ops(struct device *dev)
         if (!mapping)
                 return;
 
-        __arm_iommu_detach_device(dev);
+        arm_iommu_detach_device(dev);
         arm_iommu_release_mapping(mapping);
 }
 
@@ -2430,9 +2425,13 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                 dev->dma_ops = xen_dma_ops;
         }
 #endif
+        dev->archdata.dma_ops_setup = true;
 }
 
 void arch_teardown_dma_ops(struct device *dev)
 {
+        if (!dev->archdata.dma_ops_setup)
+                return;
+
         arm_teardown_iommu_dma_ops(dev);
 }
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 2239fde10b80..f0701d8d24df 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -90,7 +90,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -141,7 +141,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 3dcd7ec69bca..b2024db225a9 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1084,10 +1084,6 @@ config SYSVIPC_COMPAT
         def_bool y
         depends on COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-        def_bool y
-        depends on COMPAT && KEYS
-
 endmenu
 
 menu "Power management options"
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index c7f669f5884f..166c9ef884dc 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -406,8 +406,9 @@
                 r_ccu: clock@1f01400 {
                         compatible = "allwinner,sun50i-a64-r-ccu";
                         reg = <0x01f01400 0x100>;
-                        clocks = <&osc24M>, <&osc32k>, <&iosc>;
-                        clock-names = "hosc", "losc", "iosc";
+                        clocks = <&osc24M>, <&osc32k>, <&iosc>,
+                                 <&ccu 11>;
+                        clock-names = "hosc", "losc", "iosc", "pll-periph";
                         #clock-cells = <1>;
                         #reset-cells = <1>;
                 };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
index 4d314a253fd9..732e2e06f503 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
@@ -40,7 +40,7 @@
  *     OTHER DEALINGS IN THE SOFTWARE.
  */
 
-#include "sunxi-h3-h5.dtsi"
+#include <arm/sunxi-h3-h5.dtsi>
 
 / {
         cpus {
diff --git a/arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi b/arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi
deleted file mode 120000
index 036f01dc2b9b..000000000000
--- a/arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arm/boot/dts/sunxi-h3-h5.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
index 75bce2d0b1a8..49f6a6242cf9 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
@@ -81,6 +81,45 @@
                 };
         };
 
+        reg_sys_5v: regulator@0 {
+                compatible = "regulator-fixed";
+                regulator-name = "SYS_5V";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-boot-on;
+                regulator-always-on;
+        };
+
+        reg_vdd_3v3: regulator@1 {
+                compatible = "regulator-fixed";
+                regulator-name = "VDD_3V3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                regulator-boot-on;
+                regulator-always-on;
+                vin-supply = <&reg_sys_5v>;
+        };
+
+        reg_5v_hub: regulator@2 {
+                compatible = "regulator-fixed";
+                regulator-name = "5V_HUB";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-boot-on;
+                gpio = <&gpio0 7 0>;
+                regulator-always-on;
+                vin-supply = <&reg_sys_5v>;
+        };
+
+        wl1835_pwrseq: wl1835-pwrseq {
+                compatible = "mmc-pwrseq-simple";
+                /* WLAN_EN GPIO */
+                reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>;
+                clocks = <&pmic>;
+                clock-names = "ext_clock";
+                power-off-delay-us = <10>;
+        };
+
         soc {
                 spi0: spi@f7106000 {
                         status = "ok";
@@ -256,11 +295,31 @@
 
                 /* GPIO blocks 16 thru 19 do not appear to be routed to pins */
 
+                dwmmc_0: dwmmc0@f723d000 {
+                        cap-mmc-highspeed;
+                        non-removable;
+                        bus-width = <0x8>;
+                        vmmc-supply = <&ldo19>;
+                };
+
+                dwmmc_1: dwmmc1@f723e000 {
+                        card-detect-delay = <200>;
+                        cap-sd-highspeed;
+                        sd-uhs-sdr12;
+                        sd-uhs-sdr25;
+                        sd-uhs-sdr50;
+                        vqmmc-supply = <&ldo7>;
+                        vmmc-supply = <&ldo10>;
+                        bus-width = <0x4>;
+                        disable-wp;
+                        cd-gpios = <&gpio1 0 1>;
+                };
+
                 dwmmc_2: dwmmc2@f723f000 {
-                        ti,non-removable;
+                        bus-width = <0x4>;
                         non-removable;
-                        /* WL_EN */
-                        vmmc-supply = <&wlan_en_reg>;
+                        vmmc-supply = <&reg_vdd_3v3>;
+                        mmc-pwrseq = <&wl1835_pwrseq>;
 
                         #address-cells = <0x1>;
                         #size-cells = <0x0>;
@@ -272,18 +331,6 @@
                                 interrupts = <3 IRQ_TYPE_EDGE_RISING>;
                         };
                 };
-
-                wlan_en_reg: regulator@1 {
-                        compatible = "regulator-fixed";
-                        regulator-name = "wlan-en-regulator";
-                        regulator-min-microvolt = <1800000>;
-                        regulator-max-microvolt = <1800000>;
-                        /* WLAN_EN GPIO */
-                        gpio = <&gpio0 5 0>;
-                        /* WLAN card specific delay */
-                        startup-delay-us = <70000>;
-                        enable-active-high;
-                };
         };
 
         leds {
@@ -330,6 +377,7 @@
         pmic: pmic@f8000000 {
                 compatible = "hisilicon,hi655x-pmic";
                 reg = <0x0 0xf8000000 0x0 0x1000>;
+                #clock-cells = <0>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 pmic-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
index 1e5129b19280..5013e4b2ea71 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
@@ -725,20 +725,10 @@
                         status = "disabled";
                 };
 
-                fixed_5v_hub: regulator@0 {
-                        compatible = "regulator-fixed";
-                        regulator-name = "fixed_5v_hub";
-                        regulator-min-microvolt = <5000000>;
-                        regulator-max-microvolt = <5000000>;
-                        regulator-boot-on;
-                        gpio = <&gpio0 7 0>;
-                        regulator-always-on;
-                };
-
                 usb_phy: usbphy {
                         compatible = "hisilicon,hi6220-usb-phy";
                         #phy-cells = <0>;
-                        phy-supply = <&fixed_5v_hub>;
+                        phy-supply = <&reg_5v_hub>;
                         hisilicon,peripheral-syscon = <&sys_ctrl>;
                 };
 
@@ -766,17 +756,12 @@
 
                 dwmmc_0: dwmmc0@f723d000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
-                        cap-mmc-highspeed;
-                        non-removable;
                         reg = <0x0 0xf723d000 0x0 0x1000>;
                         interrupts = <0x0 0x48 0x4>;
                         clocks = <&sys_ctrl 2>, <&sys_ctrl 1>;
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC0>;
                         reset-names = "reset";
-                        bus-width = <0x8>;
-                        vmmc-supply = <&ldo19>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&emmc_pmx_func &emmc_clk_cfg_func
                                      &emmc_cfg_func &emmc_rst_cfg_func>;
@@ -784,13 +769,7 @@
 
                 dwmmc_1: dwmmc1@f723e000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
-                        card-detect-delay = <200>;
                         hisilicon,peripheral-syscon = <&ao_ctrl>;
-                        cap-sd-highspeed;
-                        sd-uhs-sdr12;
-                        sd-uhs-sdr25;
-                        sd-uhs-sdr50;
                         reg = <0x0 0xf723e000 0x0 0x1000>;
                         interrupts = <0x0 0x49 0x4>;
                         #address-cells = <0x1>;
@@ -799,11 +778,6 @@
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC1>;
                         reset-names = "reset";
-                        vqmmc-supply = <&ldo7>;
-                        vmmc-supply = <&ldo10>;
-                        bus-width = <0x4>;
-                        disable-wp;
-                        cd-gpios = <&gpio1 0 1>;
                         pinctrl-names = "default", "idle";
                         pinctrl-0 = <&sd_pmx_func &sd_clk_cfg_func &sd_cfg_func>;
                         pinctrl-1 = <&sd_pmx_idle &sd_clk_cfg_idle &sd_cfg_idle>;
@@ -811,15 +785,12 @@
 
                 dwmmc_2: dwmmc2@f723f000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
                         reg = <0x0 0xf723f000 0x0 0x1000>;
                         interrupts = <0x0 0x4a 0x4>;
                         clocks = <&sys_ctrl HI6220_MMC2_CIUCLK>, <&sys_ctrl HI6220_MMC2_CLK>;
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC2>;
                         reset-names = "reset";
-                        bus-width = <0x4>;
-                        broken-cd;
                         pinctrl-names = "default", "idle";
                         pinctrl-0 = <&sdio_pmx_func &sdio_clk_cfg_func &sdio_cfg_func>;
                         pinctrl-1 = <&sdio_pmx_idle &sdio_clk_cfg_idle &sdio_cfg_idle>;
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
index ac8df5201cd6..b4bc42ece754 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
@@ -231,8 +231,7 @@
                         cpm_crypto: crypto@800000 {
                                 compatible = "inside-secure,safexcel-eip197";
                                 reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
-                                | IRQ_TYPE_LEVEL_HIGH)>,
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
index 7740a75a8230..6e2058847ddc 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
@@ -221,8 +221,7 @@
                         cps_crypto: crypto@800000 {
                                 compatible = "inside-secure,safexcel-eip197";
                                 reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
-                                | IRQ_TYPE_LEVEL_HIGH)>,
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 278 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
                                              <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 65cdd878cfbd..97c123e09e45 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -68,6 +68,7 @@ CONFIG_PCIE_QCOM=y
 CONFIG_PCIE_ARMADA_8K=y
 CONFIG_PCI_AARDVARK=y
 CONFIG_PCIE_RCAR=y
+CONFIG_PCIE_ROCKCHIP=m
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCI_XGENE=y
 CONFIG_ARM64_VA_BITS_48=y
@@ -208,6 +209,8 @@ CONFIG_BRCMFMAC=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SDIO=m
 CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_ADC=m
+CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_PM8941_PWRKEY=y
@@ -263,6 +266,7 @@ CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
+CONFIG_SPI_ROCKCHIP=y
 CONFIG_SPI_S3C64XX=y
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
@@ -292,6 +296,7 @@ CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_EXYNOS_THERMAL=y
+CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_S3C2410_WATCHDOG=y
 CONFIG_MESON_GXBB_WATCHDOG=m
@@ -300,12 +305,14 @@ CONFIG_RENESAS_WDT=y
 CONFIG_BCM2835_WDT=y
 CONFIG_MFD_CROS_EC=y
 CONFIG_MFD_CROS_EC_I2C=y
+CONFIG_MFD_CROS_EC_SPI=y
 CONFIG_MFD_EXYNOS_LPASS=m
 CONFIG_MFD_HI655X_PMIC=y
 CONFIG_MFD_MAX77620=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
+CONFIG_REGULATOR_FAN53555=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI655X=y
@@ -473,8 +480,10 @@ CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_EXYNOS_ADC=y
+CONFIG_ROCKCHIP_SARADC=m
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=m
+CONFIG_PWM_CROS_EC=m
 CONFIG_PWM_MESON=m
 CONFIG_PWM_ROCKCHIP=y
 CONFIG_PWM_SAMSUNG=y
@@ -484,6 +493,7 @@ CONFIG_PHY_HI6220_USB=y
 CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_PCIE=m
 CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_ARM_SCPI_PROTOCOL=y
diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h
index 0e99978da3f0..59cca1d6ec54 100644
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@@ -23,9 +23,9 @@
 #define ACPI_MADT_GICC_LENGTH   \
         (acpi_gbl_FADT.header.revision < 6 ? 76 : 80)
 
-#define BAD_MADT_GICC_ENTRY(entry, end)                                         \
-        (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) ||       \
-         (entry)->header.length != ACPI_MADT_GICC_LENGTH)
+#define BAD_MADT_GICC_ENTRY(entry, end)                                 \
+        (!(entry) || (entry)->header.length != ACPI_MADT_GICC_LENGTH || \
+        (unsigned long)(entry) + ACPI_MADT_GICC_LENGTH > (end))
 
 /* Basic configuration for ACPI */
 #ifdef  CONFIG_ACPI
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 15c142ce991c..b4d13d9267ff 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -286,6 +286,10 @@
 #define SCTLR_ELx_A     (1 << 1)
 #define SCTLR_ELx_M     1
 
+#define SCTLR_EL2_RES1  ((1 << 4)  | (1 << 5)  | (1 << 11) | (1 << 16) | \
+                         (1 << 16) | (1 << 18) | (1 << 22) | (1 << 23) | \
+                         (1 << 28) | (1 << 29))
+
 #define SCTLR_ELx_FLAGS (SCTLR_ELx_M | SCTLR_ELx_A | SCTLR_ELx_C | \
                          SCTLR_ELx_SA | SCTLR_ELx_I)
 
diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
index 4f0e3ebfea4b..c7e3e6387a49 100644
--- a/arch/arm64/kernel/pci.c
+++ b/arch/arm64/kernel/pci.c
@@ -191,8 +191,10 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
                 return NULL;
 
         root_ops = kzalloc_node(sizeof(*root_ops), GFP_KERNEL, node);
-        if (!root_ops)
+        if (!root_ops) {
+                kfree(ri);
                 return NULL;
+        }
 
         ri->cfg = pci_acpi_setup_ecam_mapping(root);
         if (!ri->cfg) {
diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
index 839425c24b1c..3f9615582377 100644
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -106,10 +106,13 @@ __do_hyp_init:
         tlbi    alle2
         dsb     sy
 
-        mrs     x4, sctlr_el2
-        and     x4, x4, #SCTLR_ELx_EE   // preserve endianness of EL2
-        ldr     x5, =SCTLR_ELx_FLAGS
-        orr     x4, x4, x5
+        /*
+         * Preserve all the RES1 bits while setting the default flags,
+         * as well as the EE bit on BE. Drop the A flag since the compiler
+         * is allowed to generate unaligned accesses.
+         */
+        ldr     x4, =(SCTLR_EL2_RES1 | (SCTLR_ELx_FLAGS & ~SCTLR_ELx_A))
+CPU_BE( orr     x4, x4, #SCTLR_ELx_EE)
         msr     sctlr_el2, x4
         isb
 
diff --git a/arch/arm64/kvm/vgic-sys-reg-v3.c b/arch/arm64/kvm/vgic-sys-reg-v3.c
index 79f37e37d367..6260b69e5622 100644
--- a/arch/arm64/kvm/vgic-sys-reg-v3.c
+++ b/arch/arm64/kvm/vgic-sys-reg-v3.c
@@ -65,8 +65,8 @@ static bool access_gic_ctlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                  * Here set VMCR.CTLR in ICC_CTLR_EL1 layout.
                  * The vgic_set_vmcr() will convert to ICH_VMCR layout.
                  */
-                vmcr.ctlr = val & ICC_CTLR_EL1_CBPR_MASK;
-                vmcr.ctlr |= val & ICC_CTLR_EL1_EOImode_MASK;
+                vmcr.cbpr = (val & ICC_CTLR_EL1_CBPR_MASK) >> ICC_CTLR_EL1_CBPR_SHIFT;
+                vmcr.eoim = (val & ICC_CTLR_EL1_EOImode_MASK) >> ICC_CTLR_EL1_EOImode_SHIFT;
                 vgic_set_vmcr(vcpu, &vmcr);
         } else {
                 val = 0;
@@ -83,8 +83,8 @@ static bool access_gic_ctlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                  * The VMCR.CTLR value is in ICC_CTLR_EL1 layout.
                  * Extract it directly using ICC_CTLR_EL1 reg definitions.
                  */
-                val |= vmcr.ctlr & ICC_CTLR_EL1_CBPR_MASK;
-                val |= vmcr.ctlr & ICC_CTLR_EL1_EOImode_MASK;
+                val |= (vmcr.cbpr << ICC_CTLR_EL1_CBPR_SHIFT) & ICC_CTLR_EL1_CBPR_MASK;
+                val |= (vmcr.eoim << ICC_CTLR_EL1_EOImode_SHIFT) & ICC_CTLR_EL1_EOImode_MASK;
 
                 p->regval = val;
         }
@@ -135,7 +135,7 @@ static bool access_gic_bpr1(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
                 p->regval = 0;
 
         vgic_get_vmcr(vcpu, &vmcr);
-        if (!((vmcr.ctlr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT)) {
+        if (!vmcr.cbpr) {
                 if (p->is_write) {
                         vmcr.abpr = (p->regval & ICC_BPR1_EL1_MASK) >>
                                      ICC_BPR1_EL1_SHIFT;
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 71f930501ade..c870d6f01ac2 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -36,6 +36,7 @@ int bpf_jit_enable __read_mostly;
 #define TMP_REG_1 (MAX_BPF_JIT_REG + 0)
 #define TMP_REG_2 (MAX_BPF_JIT_REG + 1)
 #define TCALL_CNT (MAX_BPF_JIT_REG + 2)
+#define TMP_REG_3 (MAX_BPF_JIT_REG + 3)
 
 /* Map BPF registers to A64 registers */
 static const int bpf2a64[] = {
@@ -57,6 +58,7 @@ static const int bpf2a64[] = {
         /* temporary registers for internal BPF JIT */
         [TMP_REG_1] = A64_R(10),
         [TMP_REG_2] = A64_R(11),
+        [TMP_REG_3] = A64_R(12),
         /* tail_call_cnt */
         [TCALL_CNT] = A64_R(26),
         /* temporary register for blinding constants */
@@ -319,6 +321,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
         const u8 src = bpf2a64[insn->src_reg];
         const u8 tmp = bpf2a64[TMP_REG_1];
         const u8 tmp2 = bpf2a64[TMP_REG_2];
+        const u8 tmp3 = bpf2a64[TMP_REG_3];
         const s16 off = insn->off;
         const s32 imm = insn->imm;
         const int i = insn - ctx->prog->insnsi;
@@ -689,10 +692,10 @@ emit_cond_jmp:
                 emit(A64_PRFM(tmp, PST, L1, STRM), ctx);
                 emit(A64_LDXR(isdw, tmp2, tmp), ctx);
                 emit(A64_ADD(isdw, tmp2, tmp2, src), ctx);
-                emit(A64_STXR(isdw, tmp2, tmp, tmp2), ctx);
+                emit(A64_STXR(isdw, tmp2, tmp, tmp3), ctx);
                 jmp_offset = -3;
                 check_imm19(jmp_offset);
-                emit(A64_CBNZ(0, tmp2, jmp_offset), ctx);
+                emit(A64_CBNZ(0, tmp3, jmp_offset), ctx);
                 break;
 
         /* R0 = ntohx(*(size *)(((struct sk_buff *)R6)->data + imm)) */
diff --git a/arch/frv/include/asm/timex.h b/arch/frv/include/asm/timex.h
index a89bddefdacf..139093fab326 100644
--- a/arch/frv/include/asm/timex.h
+++ b/arch/frv/include/asm/timex.h
@@ -16,5 +16,11 @@ static inline cycles_t get_cycles(void)
 #define vxtime_lock()           do {} while (0)
 #define vxtime_unlock()         do {} while (0)
 
+/* This attribute is used in include/linux/jiffies.h alongside with
+ * __cacheline_aligned_in_smp. It is assumed that __cacheline_aligned_in_smp
+ * for frv does not contain another section specification.
+ */
+#define __jiffy_arch_data       __attribute__((__section__(".data")))
+
 #endif
 
diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
index da82c25301e7..46aa289c5102 100644
--- a/arch/frv/mm/elf-fdpic.c
+++ b/arch/frv/mm/elf-fdpic.c
@@ -75,7 +75,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(current->mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         goto success;
         }
 
diff --git a/arch/hexagon/mm/uaccess.c b/arch/hexagon/mm/uaccess.c
index ec90afdb3ad0..c599eb126c9e 100644
--- a/arch/hexagon/mm/uaccess.c
+++ b/arch/hexagon/mm/uaccess.c
@@ -37,15 +37,14 @@ __kernel_size_t __clear_user_hexagon(void __user *dest, unsigned long count)
         long uncleared;
 
         while (count > PAGE_SIZE) {
-                uncleared = __copy_to_user_hexagon(dest, &empty_zero_page,
-                                                PAGE_SIZE);
+                uncleared = raw_copy_to_user(dest, &empty_zero_page, PAGE_SIZE);
                 if (uncleared)
                         return count - (PAGE_SIZE - uncleared);
                 count -= PAGE_SIZE;
                 dest += PAGE_SIZE;
         }
         if (count)
-                count = __copy_to_user_hexagon(dest, &empty_zero_page, count);
+                count = raw_copy_to_user(dest, &empty_zero_page, count);
 
         return count;
 }
diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile
index 2728a9a9c7c5..145b5ce8eb7e 100644
--- a/arch/mips/boot/Makefile
+++ b/arch/mips/boot/Makefile
@@ -128,19 +128,19 @@ quiet_cmd_cpp_its_S = ITS     $@
                         -DADDR_BITS=$(ADDR_BITS) \
                         -DADDR_CELLS=$(itb_addr_cells)
 
-$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,none,vmlinux.bin)
 
-$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.gz.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,gzip,vmlinux.bin.gz)
 
-$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.bz2.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX)  FORCE
         $(call if_changed_dep,cpp_its_S,bzip2,vmlinux.bin.bz2)
 
-$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.lzma.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,lzma,vmlinux.bin.lzma)
 
-$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S FORCE
+$(obj)/vmlinux.lzo.its: $(srctree)/arch/mips/$(PLATFORM)/vmlinux.its.S $(VMLINUX) FORCE
         $(call if_changed_dep,cpp_its_S,lzo,vmlinux.bin.lzo)
 
 quiet_cmd_itb-image = ITB     $@
diff --git a/arch/mips/include/asm/highmem.h b/arch/mips/include/asm/highmem.h
index d34536e7653f..279b6d14ffeb 100644
--- a/arch/mips/include/asm/highmem.h
+++ b/arch/mips/include/asm/highmem.h
@@ -35,7 +35,12 @@ extern pte_t *pkmap_page_table;
  * easily, subsequent pte tables have to be allocated in one physical
  * chunk of RAM.
  */
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+#define LAST_PKMAP 512
+#else
 #define LAST_PKMAP 1024
+#endif
+
 #define LAST_PKMAP_MASK (LAST_PKMAP-1)
 #define PKMAP_NR(virt)  ((virt-PKMAP_BASE) >> PAGE_SHIFT)
 #define PKMAP_ADDR(nr)  (PKMAP_BASE + ((nr) << PAGE_SHIFT))
diff --git a/arch/mips/include/asm/kprobes.h b/arch/mips/include/asm/kprobes.h
index 291846d9ba83..ad1a99948f27 100644
--- a/arch/mips/include/asm/kprobes.h
+++ b/arch/mips/include/asm/kprobes.h
@@ -43,7 +43,8 @@ typedef union mips_instruction kprobe_opcode_t;
 
 #define flush_insn_slot(p)                                              \
 do {                                                                    \
-        flush_icache_range((unsigned long)p->addr,                      \
+        if (p->addr)                                                    \
+                flush_icache_range((unsigned long)p->addr,              \
                            (unsigned long)p->addr +                     \
                            (MAX_INSN_SIZE * sizeof(kprobe_opcode_t)));  \
 } while (0)
diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
index 6f94bed571c4..74afe8c76bdd 100644
--- a/arch/mips/include/asm/pgtable-32.h
+++ b/arch/mips/include/asm/pgtable-32.h
@@ -19,6 +19,10 @@
 #define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
+#ifdef CONFIG_HIGHMEM
+#include <asm/highmem.h>
+#endif
+
 extern int temp_tlb_entry;
 
 /*
@@ -62,7 +66,8 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 
 #define VMALLOC_START     MAP_BASE
 
-#define PKMAP_BASE              (0xfe000000UL)
+#define PKMAP_END       ((FIXADDR_START) & ~((LAST_PKMAP << PAGE_SHIFT)-1))
+#define PKMAP_BASE      (PKMAP_END - PAGE_SIZE * LAST_PKMAP)
 
 #ifdef CONFIG_HIGHMEM
 # define VMALLOC_END    (PKMAP_BASE-2*PAGE_SIZE)
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index b11facd11c9d..f702a459a830 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -804,8 +804,10 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                         break;
                 }
                 /* Compact branch: BNEZC || JIALC */
-                if (insn.i_format.rs)
+                if (!insn.i_format.rs) {
+                        /* JIALC: set $31/ra */
                         regs->regs[31] = epc + 4;
+                }
                 regs->cp0_epc += 8;
                 break;
 #endif
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 30a3b75e88eb..9d9b8fbae202 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -38,20 +38,6 @@ void arch_ftrace_update_code(int command)
 
 #endif
 
-/*
- * Check if the address is in kernel space
- *
- * Clone core_kernel_text() from kernel/extable.c, but doesn't call
- * init_kernel_text() for Ftrace doesn't trace functions in init sections.
- */
-static inline int in_kernel_space(unsigned long ip)
-{
-        if (ip >= (unsigned long)_stext &&
-            ip <= (unsigned long)_etext)
-                return 1;
-        return 0;
-}
-
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 #define JAL 0x0c000000          /* jump & link: ip --> ra, jump to target */
@@ -198,7 +184,7 @@ int ftrace_make_nop(struct module *mod,
          * If ip is in kernel space, no long call, otherwise, long call is
          * needed.
          */
-        new = in_kernel_space(ip) ? INSN_NOP : INSN_B_1F;
+        new = core_kernel_text(ip) ? INSN_NOP : INSN_B_1F;
 #ifdef CONFIG_64BIT
         return ftrace_modify_code(ip, new);
 #else
@@ -218,12 +204,12 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
         unsigned int new;
         unsigned long ip = rec->ip;
 
-        new = in_kernel_space(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0];
+        new = core_kernel_text(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0];
 
 #ifdef CONFIG_64BIT
         return ftrace_modify_code(ip, new);
 #else
-        return ftrace_modify_code_2r(ip, new, in_kernel_space(ip) ?
+        return ftrace_modify_code_2r(ip, new, core_kernel_text(ip) ?
                                                 INSN_NOP : insn_la_mcount[1]);
 #endif
 }
@@ -289,7 +275,7 @@ unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
          * instruction "lui v1, hi_16bit_of_mcount"(offset is 24), but for
          * kernel, move after the instruction "move ra, at"(offset is 16)
          */
-        ip = self_ra - (in_kernel_space(self_ra) ? 16 : 24);
+        ip = self_ra - (core_kernel_text(self_ra) ? 16 : 24);
 
         /*
          * search the text until finding the non-store instruction or "s{d,w}
@@ -394,7 +380,7 @@ void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
          * entries configured through the tracing/set_graph_function interface.
          */
 
-        insns = in_kernel_space(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
+        insns = core_kernel_text(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
         trace.func = self_ra - (MCOUNT_INSN_SIZE * insns);
 
         /* Only trace if the calling function expects to */
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 313a88b2973f..f3e301f95aef 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -1597,7 +1597,6 @@ static const struct mips_perf_event *mipsxx_pmu_map_raw_event(u64 config)
                 break;
         case CPU_P5600:
         case CPU_P6600:
-        case CPU_I6400:
                 /* 8-bit event numbers */
                 raw_id = config & 0x1ff;
                 base_id = raw_id & 0xff;
@@ -1610,6 +1609,11 @@ static const struct mips_perf_event *mipsxx_pmu_map_raw_event(u64 config)
                 raw_event.range = P;
 #endif
                 break;
+        case CPU_I6400:
+                /* 8-bit event numbers */
+                base_id = config & 0xff;
+                raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
+                break;
         case CPU_1004K:
                 if (IS_BOTH_COUNTERS_1004K_EVENT(base_id))
                         raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 918d4c73e951..5351e1f3950d 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -120,7 +120,6 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
         struct thread_info *ti = task_thread_info(p);
         struct pt_regs *childregs, *regs = current_pt_regs();
         unsigned long childksp;
-        p->set_child_tid = p->clear_child_tid = NULL;
 
         childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
 
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 64dd8bdd92c3..28adeabe851f 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -93,7 +93,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/mips/mm/pgtable-32.c b/arch/mips/mm/pgtable-32.c
index adc6911ba748..b19a3c506b1e 100644
--- a/arch/mips/mm/pgtable-32.c
+++ b/arch/mips/mm/pgtable-32.c
@@ -51,15 +51,15 @@ void __init pagetable_init(void)
         /*
          * Fixed mappings:
          */
-        vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
-        fixrange_init(vaddr, vaddr + FIXADDR_SIZE, pgd_base);
+        vaddr = __fix_to_virt(__end_of_fixed_addresses - 1);
+        fixrange_init(vaddr & PMD_MASK, vaddr + FIXADDR_SIZE, pgd_base);
 
 #ifdef CONFIG_HIGHMEM
         /*
          * Permanent kmaps:
          */
         vaddr = PKMAP_BASE;
-        fixrange_init(vaddr, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
+        fixrange_init(vaddr & PMD_MASK, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
 
         pgd = swapper_pg_dir + __pgd_offset(vaddr);
         pud = pud_offset(pgd, vaddr);
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index f8da545854f9..106859ae27ff 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -167,8 +167,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
 
         top_of_kernel_stack = sp;
 
-        p->set_child_tid = p->clear_child_tid = NULL;
-
         /* Locate userspace context on stack... */
         sp -= STACK_FRAME_OVERHEAD;     /* redzone */
         sp -= sizeof(struct pt_regs);
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index e5288638a1d9..378a754ca186 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -90,7 +90,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 unsigned long len, unsigned long pgoff, unsigned long flags)
 {
         struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         unsigned long task_size = TASK_SIZE;
         int do_color_align, last_mmap;
         struct vm_unmapped_area_info info;
@@ -117,9 +117,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 else
                         addr = PAGE_ALIGN(addr);
 
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         goto found_addr;
         }
 
@@ -143,7 +144,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                           const unsigned long len, const unsigned long pgoff,
                           const unsigned long flags)
 {
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct mm_struct *mm = current->mm;
         unsigned long addr = addr0;
         int do_color_align, last_mmap;
@@ -177,9 +178,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         addr = COLOR_ALIGN(addr, last_mmap, pgoff);
                 else
                         addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         goto found_addr;
         }
 
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index f7c8f9972f61..bf4391d18923 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -380,22 +380,6 @@ source "arch/powerpc/platforms/Kconfig"
 
 menu "Kernel options"
 
-config PPC_DT_CPU_FTRS
-        bool "Device-tree based CPU feature discovery & setup"
-        depends on PPC_BOOK3S_64
-        default n
-        help
-          This enables code to use a new device tree binding for describing CPU
-          compatibility and features. Saying Y here will attempt to use the new
-          binding if the firmware provides it. Currently only the skiboot
-          firmware provides this binding.
-          If you're not sure say Y.
-
-config PPC_CPUFEATURES_ENABLE_UNKNOWN
-        bool "cpufeatures pass through unknown features to guest/userspace"
-        depends on PPC_DT_CPU_FTRS
-        default y
-
 config HIGHMEM
         bool "High memory support"
         depends on PPC32
@@ -1215,11 +1199,6 @@ source "arch/powerpc/Kconfig.debug"
 
 source "security/Kconfig"
 
-config KEYS_COMPAT
-        bool
-        depends on COMPAT && KEYS
-        default y
-
 source "crypto/Kconfig"
 
 config PPC_LIB_RHEAP
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index b4b5e6b671ca..0c4e470571ca 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -8,7 +8,7 @@
 #define H_PTE_INDEX_SIZE  9
 #define H_PMD_INDEX_SIZE  7
 #define H_PUD_INDEX_SIZE  9
-#define H_PGD_INDEX_SIZE  12
+#define H_PGD_INDEX_SIZE  9
 
 #ifndef __ASSEMBLY__
 #define H_PTE_TABLE_SIZE        (sizeof(pte_t) << H_PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/bug.h b/arch/powerpc/include/asm/bug.h
index f2c562a0a427..0151af6c2a50 100644
--- a/arch/powerpc/include/asm/bug.h
+++ b/arch/powerpc/include/asm/bug.h
@@ -104,7 +104,7 @@
                 "1:     "PPC_TLNEI"     %4,0\n"                 \
                 _EMIT_BUG_ENTRY                                 \
                 : : "i" (__FILE__), "i" (__LINE__),             \
-                  "i" (BUGFLAG_TAINT(TAINT_WARN)),              \
+                  "i" (BUGFLAG_WARNING|BUGFLAG_TAINT(TAINT_WARN)),\
                   "i" (sizeof(struct bug_entry)),               \
                   "r" (__ret_warn_on));                         \
         }                                                       \
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index c2d509584a98..d02ad93bf708 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -214,7 +214,6 @@ enum {
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
 #define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #define CPU_FTR_PMAO_BUG                LONG_ASM_CONST(0x1000000000000000)
-#define CPU_FTR_SUBCORE                 LONG_ASM_CONST(0x2000000000000000)
 #define CPU_FTR_POWER9_DD1              LONG_ASM_CONST(0x4000000000000000)
 
 #ifndef __ASSEMBLY__
@@ -463,7 +462,7 @@ enum {
             CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
             CPU_FTR_ICSWX | CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
             CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \
-            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_SUBCORE)
+            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP)
 #define CPU_FTRS_POWER8E (CPU_FTRS_POWER8 | CPU_FTR_PMAO_BUG)
 #define CPU_FTRS_POWER8_DD1 (CPU_FTRS_POWER8 & ~CPU_FTR_DBELL)
 #define CPU_FTRS_POWER9 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index a2123f291ab0..bb99b651085a 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -110,13 +110,18 @@ void release_thread(struct task_struct *);
 #define TASK_SIZE_128TB (0x0000800000000000UL)
 #define TASK_SIZE_512TB (0x0002000000000000UL)
 
-#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * For now 512TB is only supported with book3s and 64K linux page size.
+ */
+#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_PPC_64K_PAGES)
 /*
  * Max value currently used:
  */
-#define TASK_SIZE_USER64        TASK_SIZE_512TB
+#define TASK_SIZE_USER64                TASK_SIZE_512TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_128TB
 #else
-#define TASK_SIZE_USER64        TASK_SIZE_64TB
+#define TASK_SIZE_USER64                TASK_SIZE_64TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_64TB
 #endif
 
 /*
@@ -132,7 +137,7 @@ void release_thread(struct task_struct *);
  * space during mmap's.
  */
 #define TASK_UNMAPPED_BASE_USER32 (PAGE_ALIGN(TASK_SIZE_USER32 / 4))
-#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(TASK_SIZE_128TB / 4))
+#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(DEFAULT_MAP_WINDOW_USER64 / 4))
 
 #define TASK_UNMAPPED_BASE ((is_32bit_task()) ? \
                 TASK_UNMAPPED_BASE_USER32 : TASK_UNMAPPED_BASE_USER64 )
@@ -143,21 +148,15 @@ void release_thread(struct task_struct *);
  * with 128TB and conditionally enable upto 512TB
  */
 #ifdef CONFIG_PPC_BOOK3S_64
-#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ? \
-                                 TASK_SIZE_USER32 : TASK_SIZE_128TB)
+#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ?                    \
+                                 TASK_SIZE_USER32 : DEFAULT_MAP_WINDOW_USER64)
 #else
 #define DEFAULT_MAP_WINDOW      TASK_SIZE
 #endif
 
 #ifdef __powerpc64__
 
-#ifdef CONFIG_PPC_BOOK3S_64
-/* Limit stack to 128TB */
-#define STACK_TOP_USER64 TASK_SIZE_128TB
-#else
-#define STACK_TOP_USER64 TASK_SIZE_USER64
-#endif
-
+#define STACK_TOP_USER64 DEFAULT_MAP_WINDOW_USER64
 #define STACK_TOP_USER32 TASK_SIZE_USER32
 
 #define STACK_TOP (is_32bit_task() ? \
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 8b3b46b7b0f2..329771559cbb 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topology(void);
 extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
 
+static inline int early_cpu_to_node(int cpu)
+{
+        int nid;
+
+        nid = numa_cpu_lookup_table[cpu];
+
+        /*
+         * Fall back to node 0 if nid is unset (it should be, except bugs).
+         * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
+         */
+        return (nid < 0) ? 0 : nid;
+}
 #else
 
+static inline int early_cpu_to_node(int cpu) { return 0; }
+
 static inline void dump_numa_cpu_topology(void) {}
 
 static inline int sysfs_add_device_to_node(struct device *dev, int nid)
diff --git a/arch/powerpc/include/asm/xive.h b/arch/powerpc/include/asm/xive.h
index c8a822acf962..c23ff4389ca2 100644
--- a/arch/powerpc/include/asm/xive.h
+++ b/arch/powerpc/include/asm/xive.h
@@ -94,11 +94,13 @@ struct xive_q {
  * store at 0 and some ESBs support doing a trigger via a
  * separate trigger page.
  */
-#define XIVE_ESB_GET            0x800
-#define XIVE_ESB_SET_PQ_00      0xc00
-#define XIVE_ESB_SET_PQ_01      0xd00
-#define XIVE_ESB_SET_PQ_10      0xe00
-#define XIVE_ESB_SET_PQ_11      0xf00
+#define XIVE_ESB_STORE_EOI      0x400 /* Store */
+#define XIVE_ESB_LOAD_EOI       0x000 /* Load */
+#define XIVE_ESB_GET            0x800 /* Load */
+#define XIVE_ESB_SET_PQ_00      0xc00 /* Load */
+#define XIVE_ESB_SET_PQ_01      0xd00 /* Load */
+#define XIVE_ESB_SET_PQ_10      0xe00 /* Load */
+#define XIVE_ESB_SET_PQ_11      0xf00 /* Load */
 
 #define XIVE_ESB_VAL_P          0x2
 #define XIVE_ESB_VAL_Q          0x1
diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h
index 3e7ce86d5c13..4d877144f377 100644
--- a/arch/powerpc/include/uapi/asm/cputable.h
+++ b/arch/powerpc/include/uapi/asm/cputable.h
@@ -46,6 +46,8 @@
 #define PPC_FEATURE2_HTM_NOSC           0x01000000
 #define PPC_FEATURE2_ARCH_3_00          0x00800000 /* ISA 3.00 */
 #define PPC_FEATURE2_HAS_IEEE128        0x00400000 /* VSX IEEE Binary Float 128-bit */
+#define PPC_FEATURE2_DARN               0x00200000 /* darn random number insn */
+#define PPC_FEATURE2_SCV                0x00100000 /* scv syscall */
 
 /*
  * IMPORTANT!
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 9b3e88b1a9c8..6f849832a669 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -124,7 +124,8 @@ extern void __restore_cpu_e6500(void);
 #define COMMON_USER_POWER9      COMMON_USER_POWER8
 #define COMMON_USER2_POWER9     (COMMON_USER2_POWER8 | \
                                  PPC_FEATURE2_ARCH_3_00 | \
-                                 PPC_FEATURE2_HAS_IEEE128)
+                                 PPC_FEATURE2_HAS_IEEE128 | \
+                                 PPC_FEATURE2_DARN )
 
 #ifdef CONFIG_PPC_BOOK3E_64
 #define COMMON_USER_BOOKE       (COMMON_USER_PPC64 | PPC_FEATURE_BOOKE)
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index fcc7588a96d6..4c7656dc4e04 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -8,6 +8,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/jump_label.h>
+#include <linux/libfdt.h>
 #include <linux/memblock.h>
 #include <linux/printk.h>
 #include <linux/sched.h>
@@ -642,7 +643,6 @@ static struct dt_cpu_feature_match __initdata
         {"processor-control-facility", feat_enable_dbell, CPU_FTR_DBELL},
         {"processor-control-facility-v3", feat_enable_dbell, CPU_FTR_DBELL},
         {"processor-utilization-of-resources-register", feat_enable_purr, 0},
-        {"subcore", feat_enable, CPU_FTR_SUBCORE},
         {"no-execute", feat_enable, 0},
         {"strong-access-ordering", feat_enable, CPU_FTR_SAO},
         {"cache-inhibited-large-page", feat_enable_large_ci, 0},
@@ -671,12 +671,24 @@ static struct dt_cpu_feature_match __initdata
         {"wait-v3", feat_enable, 0},
 };
 
-/* XXX: how to configure this? Default + boot time? */
-#ifdef CONFIG_PPC_CPUFEATURES_ENABLE_UNKNOWN
-#define CPU_FEATURE_ENABLE_UNKNOWN 1
-#else
-#define CPU_FEATURE_ENABLE_UNKNOWN 0
-#endif
+static bool __initdata using_dt_cpu_ftrs;
+static bool __initdata enable_unknown = true;
+
+static int __init dt_cpu_ftrs_parse(char *str)
+{
+        if (!str)
+                return 0;
+
+        if (!strcmp(str, "off"))
+                using_dt_cpu_ftrs = false;
+        else if (!strcmp(str, "known"))
+                enable_unknown = false;
+        else
+                return 1;
+
+        return 0;
+}
+early_param("dt_cpu_ftrs", dt_cpu_ftrs_parse);
 
 static void __init cpufeatures_setup_start(u32 isa)
 {
@@ -707,7 +719,7 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
                 }
         }
 
-        if (!known && CPU_FEATURE_ENABLE_UNKNOWN) {
+        if (!known && enable_unknown) {
                 if (!feat_try_enable_unknown(f)) {
                         pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
                                 f->name);
@@ -756,6 +768,26 @@ static void __init cpufeatures_setup_finished(void)
                 cur_cpu_spec->cpu_features, cur_cpu_spec->mmu_features);
 }
 
+static int __init disabled_on_cmdline(void)
+{
+        unsigned long root, chosen;
+        const char *p;
+
+        root = of_get_flat_dt_root();
+        chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
+        if (chosen == -FDT_ERR_NOTFOUND)
+                return false;
+
+        p = of_get_flat_dt_prop(chosen, "bootargs", NULL);
+        if (!p)
+                return false;
+
+        if (strstr(p, "dt_cpu_ftrs=off"))
+                return true;
+
+        return false;
+}
+
 static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
                                         int depth, void *data)
 {
@@ -766,8 +798,6 @@ static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
         return 0;
 }
 
-static bool __initdata using_dt_cpu_ftrs = false;
-
 bool __init dt_cpu_ftrs_in_use(void)
 {
         return using_dt_cpu_ftrs;
@@ -775,6 +805,8 @@ bool __init dt_cpu_ftrs_in_use(void)
 
 bool __init dt_cpu_ftrs_init(void *fdt)
 {
+        using_dt_cpu_ftrs = false;
+
         /* Setup and verify the FDT, if it fails we just bail */
         if (!early_init_dt_verify(fdt))
                 return false;
@@ -782,6 +814,9 @@ bool __init dt_cpu_ftrs_init(void *fdt)
         if (!of_scan_flat_dt(fdt_find_cpu_features, NULL))
                 return false;
 
+        if (disabled_on_cmdline())
+                return false;
+
         cpufeatures_setup_cpu();
 
         using_dt_cpu_ftrs = true;
@@ -1027,5 +1062,8 @@ static int __init dt_cpu_ftrs_scan_callback(unsigned long node, const char
 
 void __init dt_cpu_ftrs_scan(void)
 {
+        if (!using_dt_cpu_ftrs)
+                return;
+
         of_scan_flat_dt(dt_cpu_ftrs_scan_callback, NULL);
 }
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index baae104b16c7..2ad725ef4368 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1666,6 +1666,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
 #ifdef CONFIG_VSX
         current->thread.used_vsr = 0;
 #endif
+        current->thread.load_fp = 0;
         memset(&current->thread.fp_state, 0, sizeof(current->thread.fp_state));
         current->thread.fp_save_area = NULL;
 #ifdef CONFIG_ALTIVEC
@@ -1674,6 +1675,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         current->thread.vr_save_area = NULL;
         current->thread.vrsave = 0;
         current->thread.used_vr = 0;
+        current->thread.load_vec = 0;
 #endif /* CONFIG_ALTIVEC */
 #ifdef CONFIG_SPE
         memset(current->thread.evr, 0, sizeof(current->thread.evr));
@@ -1685,6 +1687,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
         current->thread.tm_tfhar = 0;
         current->thread.tm_texasr = 0;
         current->thread.tm_tfiar = 0;
+        current->thread.load_tm = 0;
 #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
 }
 EXPORT_SYMBOL(start_thread);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 40c4887c27b6..f83056297441 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -161,7 +161,9 @@ static struct ibm_pa_feature {
         { .pabyte = 0,  .pabit = 3, .cpu_features  = CPU_FTR_CTRL },
         { .pabyte = 0,  .pabit = 6, .cpu_features  = CPU_FTR_NOEXECUTE },
         { .pabyte = 1,  .pabit = 2, .mmu_features  = MMU_FTR_CI_LARGE_PAGE },
+#ifdef CONFIG_PPC_RADIX_MMU
         { .pabyte = 40, .pabit = 0, .mmu_features  = MMU_FTR_TYPE_RADIX },
+#endif
         { .pabyte = 1,  .pabit = 1, .invert = 1, .cpu_features = CPU_FTR_NODSISRALIGN },
         { .pabyte = 5,  .pabit = 0, .cpu_features  = CPU_FTR_REAL_LE,
                                     .cpu_user_ftrs = PPC_FEATURE_TRUE_LE },
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 71dcda91755d..857129acf960 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -928,7 +928,7 @@ void __init setup_arch(char **cmdline_p)
 
 #ifdef CONFIG_PPC_MM_SLICES
 #ifdef CONFIG_PPC64
-        init_mm.context.addr_limit = TASK_SIZE_128TB;
+        init_mm.context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 #else
 #error  "context.addr_limit not initialized."
 #endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index f35ff9dea4fb..a8c1f99e9607 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -661,7 +661,7 @@ void __init emergency_stack_init(void)
 
 static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
 {
-        return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
+        return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
                                     __pa(MAX_DMA_ADDRESS));
 }
 
@@ -672,7 +672,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size)
 
 static int pcpu_cpu_distance(unsigned int from, unsigned int to)
 {
-        if (cpu_to_node(from) == cpu_to_node(to))
+        if (early_cpu_to_node(from) == early_cpu_to_node(to))
                 return LOCAL_DISTANCE;
         else
                 return REMOTE_DISTANCE;
diff --git a/arch/powerpc/kvm/book3s_xive_template.c b/arch/powerpc/kvm/book3s_xive_template.c
index 023a31133c37..4636ca6e7d38 100644
--- a/arch/powerpc/kvm/book3s_xive_template.c
+++ b/arch/powerpc/kvm/book3s_xive_template.c
@@ -69,7 +69,7 @@ static void GLUE(X_PFX,source_eoi)(u32 hw_irq, struct xive_irq_data *xd)
 {
         /* If the XIVE supports the new "store EOI facility, use it */
         if (xd->flags & XIVE_IRQ_FLAG_STORE_EOI)
-                __x_writeq(0, __x_eoi_page(xd));
+                __x_writeq(0, __x_eoi_page(xd) + XIVE_ESB_STORE_EOI);
         else if (hw_irq && xd->flags & XIVE_IRQ_FLAG_EOI_FW) {
                 opal_int_eoi(hw_irq);
         } else {
@@ -89,7 +89,7 @@ static void GLUE(X_PFX,source_eoi)(u32 hw_irq, struct xive_irq_data *xd)
                  * properly.
                  */
                 if (xd->flags & XIVE_IRQ_FLAG_LSI)
-                        __x_readq(__x_eoi_page(xd));
+                        __x_readq(__x_eoi_page(xd) + XIVE_ESB_LOAD_EOI);
                 else {
                         eoi_val = GLUE(X_PFX,esb_load)(xd, XIVE_ESB_SET_PQ_00);
 
diff --git a/arch/powerpc/mm/hugetlbpage-radix.c b/arch/powerpc/mm/hugetlbpage-radix.c
index 6575b9aabef4..a12e86395025 100644
--- a/arch/powerpc/mm/hugetlbpage-radix.c
+++ b/arch/powerpc/mm/hugetlbpage-radix.c
@@ -68,7 +68,7 @@ radix__hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (mm->task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         /*
diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
index 9dbd2a733d6b..0ee6be4f1ba4 100644
--- a/arch/powerpc/mm/mmap.c
+++ b/arch/powerpc/mm/mmap.c
@@ -112,7 +112,7 @@ radix__arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -157,7 +157,7 @@ radix__arch_get_unmapped_area_topdown(struct file *filp,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (mm->task_size - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index c6dca2ae78ef..a3edf813d455 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -99,7 +99,7 @@ static int hash__init_new_context(struct mm_struct *mm)
          * mm->context.addr_limit. Default to max task size so that we copy the
          * default values to paca which will help us to handle slb miss early.
          */
-        mm->context.addr_limit = TASK_SIZE_128TB;
+        mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 
         /*
          * The old code would re-promote on fork, we don't do that when using
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index 966b9fccfa66..45f6740dd407 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -99,7 +99,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
         if ((mm->task_size - len) < addr)
                 return 0;
         vma = find_vma(mm, addr);
-        return (!vma || (addr + len) <= vma->vm_start);
+        return (!vma || (addr + len) <= vm_start_gap(vma));
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 018f8e90ac35..bb28e1a41257 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -402,7 +402,7 @@ static struct power_pmu power9_isa207_pmu = {
         .name                   = "POWER9",
         .n_counter              = MAX_PMU_COUNTERS,
         .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = ISA207_TEST_ADDER,
+        .test_adder             = P9_DD1_TEST_ADDER,
         .compute_mmcr           = isa207_compute_mmcr,
         .config_bhrb            = power9_config_bhrb,
         .bhrb_filter_map        = power9_bhrb_filter_map,
@@ -421,7 +421,7 @@ static struct power_pmu power9_pmu = {
         .name                   = "POWER9",
         .n_counter              = MAX_PMU_COUNTERS,
         .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = P9_DD1_TEST_ADDER,
+        .test_adder             = ISA207_TEST_ADDER,
         .compute_mmcr           = isa207_compute_mmcr,
         .config_bhrb            = power9_config_bhrb,
         .bhrb_filter_map        = power9_bhrb_filter_map,
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index 33244e3d9375..4fd64d3f5c44 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -59,6 +59,17 @@ config PPC_OF_BOOT_TRAMPOLINE
 
           In case of doubt, say Y
 
+config PPC_DT_CPU_FTRS
+        bool "Device-tree based CPU feature discovery & setup"
+        depends on PPC_BOOK3S_64
+        default y
+        help
+          This enables code to use a new device tree binding for describing CPU
+          compatibility and features. Saying Y here will attempt to use the new
+          binding if the firmware provides it. Currently only the skiboot
+          firmware provides this binding.
+          If you're not sure say Y.
+
 config UDBG_RTAS_CONSOLE
         bool "RTAS based debug console"
         depends on PPC_RTAS
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index 96c2b8a40630..0c45cdbac4cf 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -197,7 +197,9 @@ static int __spu_trap_data_map(struct spu *spu, unsigned long ea, u64 dsisr)
             (REGION_ID(ea) != USER_REGION_ID)) {
 
                 spin_unlock(&spu->register_lock);
-                ret = hash_page(ea, _PAGE_PRESENT | _PAGE_READ, 0x300, dsisr);
+                ret = hash_page(ea,
+                                _PAGE_PRESENT | _PAGE_READ | _PAGE_PRIVILEGED,
+                                0x300, dsisr);
                 spin_lock(&spu->register_lock);
 
                 if (!ret) {
diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
index e5a891ae80ee..84b7ac926ce6 100644
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -175,6 +175,8 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
         skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
         if (!dump_skip(cprm, skip))
                 goto Eio;
+
+        rc = 0;
 out:
         free_page((unsigned long)buf);
         return rc;
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 067defeea691..e6f444b46207 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -75,7 +75,8 @@ struct pci_dev *pnv_pci_get_npu_dev(struct pci_dev *gpdev, int index)
         if (WARN_ON(!gpdev))
                 return NULL;
 
-        if (WARN_ON(!gpdev->dev.of_node))
+        /* Not all PCI devices have device-tree nodes */
+        if (!gpdev->dev.of_node)
                 return NULL;
 
         /* Get assoicated PCI device */
@@ -714,7 +715,7 @@ static void pnv_npu2_release_context(struct kref *kref)
 void pnv_npu2_destroy_context(struct npu_context *npu_context,
                         struct pci_dev *gpdev)
 {
-        struct pnv_phb *nphb, *phb;
+        struct pnv_phb *nphb;
         struct npu *npu;
         struct pci_dev *npdev = pnv_pci_get_npu_dev(gpdev, 0);
         struct device_node *nvlink_dn;
@@ -728,13 +729,12 @@ void pnv_npu2_destroy_context(struct npu_context *npu_context,
 
         nphb = pci_bus_to_host(npdev->bus)->private_data;
         npu = &nphb->npu;
-        phb = pci_bus_to_host(gpdev->bus)->private_data;
         nvlink_dn = of_parse_phandle(npdev->dev.of_node, "ibm,nvlink", 0);
         if (WARN_ON(of_property_read_u32(nvlink_dn, "ibm,npu-link-index",
                                                         &nvlink_index)))
                 return;
         npu_context->npdev[npu->index][nvlink_index] = NULL;
-        opal_npu_destroy_context(phb->opal_id, npu_context->mm->context.id,
+        opal_npu_destroy_context(nphb->opal_id, npu_context->mm->context.id,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
         kref_put(&npu_context->kref, pnv_npu2_release_context);
 }
diff --git a/arch/powerpc/platforms/powernv/subcore.c b/arch/powerpc/platforms/powernv/subcore.c
index 0babef11136f..8c6119280c13 100644
--- a/arch/powerpc/platforms/powernv/subcore.c
+++ b/arch/powerpc/platforms/powernv/subcore.c
@@ -407,7 +407,13 @@ static DEVICE_ATTR(subcores_per_core, 0644,
 
 static int subcore_init(void)
 {
-        if (!cpu_has_feature(CPU_FTR_SUBCORE))
+        unsigned pvr_ver;
+
+        pvr_ver = PVR_VER(mfspr(SPRN_PVR));
+
+        if (pvr_ver != PVR_POWER8 &&
+            pvr_ver != PVR_POWER8E &&
+            pvr_ver != PVR_POWER8NVL)
                 return 0;
 
         /*
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index e104c71ea44a..1fb162ba9d1c 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -124,6 +124,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn)
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr);
                 lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index);
+                lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index);
                 lmbs[i].flags = be32_to_cpu(lmbs[i].flags);
         }
 
@@ -147,6 +148,7 @@ static void dlpar_update_drconf_property(struct device_node *dn,
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr);
                 lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index);
+                lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index);
                 lmbs[i].flags = cpu_to_be32(lmbs[i].flags);
         }
 
diff --git a/arch/powerpc/sysdev/simple_gpio.c b/arch/powerpc/sysdev/simple_gpio.c
index ef470b470b04..6afddae2fb47 100644
--- a/arch/powerpc/sysdev/simple_gpio.c
+++ b/arch/powerpc/sysdev/simple_gpio.c
@@ -75,7 +75,8 @@ static int u8_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 
 static void u8_gpio_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct u8_gpio_chip *u8_gc = gpiochip_get_data(&mm_gc->gc);
+        struct u8_gpio_chip *u8_gc =
+                container_of(mm_gc, struct u8_gpio_chip, mm_gc);
 
         u8_gc->data = in_8(mm_gc->regs);
 }
diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 913825086b8d..8f5e3035483b 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -297,7 +297,7 @@ void xive_do_source_eoi(u32 hw_irq, struct xive_irq_data *xd)
 {
         /* If the XIVE supports the new "store EOI facility, use it */
         if (xd->flags & XIVE_IRQ_FLAG_STORE_EOI)
-                out_be64(xd->eoi_mmio, 0);
+                out_be64(xd->eoi_mmio + XIVE_ESB_STORE_EOI, 0);
         else if (hw_irq && xd->flags & XIVE_IRQ_FLAG_EOI_FW) {
                 /*
                  * The FW told us to call it. This happens for some
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e161fafb495b..6967addc6a89 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -363,9 +363,6 @@ config COMPAT
 config SYSVIPC_COMPAT
         def_bool y if COMPAT && SYSVIPC
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
-
 config SMP
         def_bool y
         prompt "Symmetric multi-processing support"
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index a5039fa89314..282072206df7 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -30,6 +30,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -90,6 +94,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -359,6 +365,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -367,16 +374,19 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_RBD=m
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -442,6 +452,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -452,7 +464,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -471,6 +482,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -487,12 +499,18 @@ CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_XFS_DEBUG=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_BTRFS_DEBUG=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QUOTA_DEBUG=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
 CONFIG_AUTOFS4_FS=m
@@ -558,6 +576,7 @@ CONFIG_HEADERS_CHECK=y
 CONFIG_DEBUG_SECTION_MISMATCH=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_OBJECTS=y
 CONFIG_DEBUG_OBJECTS_SELFTEST=y
 CONFIG_DEBUG_OBJECTS_FREE=y
@@ -580,7 +599,6 @@ CONFIG_DETECT_HUNG_TASK=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_DEBUG_TIMEKEEPING=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
 CONFIG_PROVE_LOCKING=y
@@ -595,6 +613,7 @@ CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=300
 CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
+CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAILSLAB=y
 CONFIG_FAIL_PAGE_ALLOC=y
@@ -616,13 +635,12 @@ CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
+CONFIG_TEST_SORT=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_RBTREE_TEST=y
 CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_TEST_STRING_HELPERS=y
-CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
 CONFIG_TEST_BPF=m
 CONFIG_BUG_ON_DATA_CORRUPTION=y
@@ -630,6 +648,7 @@ CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -640,7 +659,9 @@ CONFIG_CRYPTO_RSA=m
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
@@ -648,6 +669,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -657,8 +679,10 @@ CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -674,6 +698,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -685,6 +710,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
@@ -692,6 +718,7 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
+CONFIG_RANDOM32_SELFTEST=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 83970b5afb2b..3c6b78189fbc 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -46,7 +47,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -88,6 +92,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -356,6 +362,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -364,16 +371,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -439,6 +448,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -449,7 +460,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -468,6 +478,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -483,11 +494,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -553,7 +568,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -576,6 +590,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -599,6 +614,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -611,6 +627,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -626,16 +643,19 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
+CONFIG_PKEY=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index fbc6542aaf59..653d72bcc007 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -86,6 +90,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -354,6 +360,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -362,16 +369,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -437,6 +446,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -447,7 +458,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -466,6 +476,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -481,11 +492,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -551,7 +566,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -574,6 +588,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -597,6 +612,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -609,6 +625,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -624,6 +641,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -635,6 +653,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index e23d97c13735..afa46a7406ea 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -12,8 +12,10 @@ CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=2
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_HZ_100=y
+# CONFIG_ARCH_RANDOM is not set
 # CONFIG_COMPACTION is not set
 # CONFIG_MIGRATION is not set
+# CONFIG_BOUNCE is not set
 # CONFIG_CHECK_STACK is not set
 # CONFIG_CHSC_SCH is not set
 # CONFIG_SCM_BUS is not set
@@ -36,11 +38,11 @@ CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_ZFCP=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_HVC_IUCV is not set
+# CONFIG_HW_RANDOM_S390 is not set
 CONFIG_RAW_DRIVER=y
 # CONFIG_SCLP_ASYNC is not set
 # CONFIG_HMC_DRV is not set
@@ -54,9 +56,9 @@ CONFIG_RAW_DRIVER=y
 # CONFIG_INOTIFY_USER is not set
 CONFIG_CONFIGFS_FS=y
 # CONFIG_MISC_FILESYSTEMS is not set
+# CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_PANIC_ON_OOPS=y
 # CONFIG_SCHED_DEBUG is not set
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 97189dbaf34b..20244a38c886 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -28,6 +28,7 @@ CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -108,7 +109,6 @@ CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
-CONFIG_MD_RAID0=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=m
@@ -131,6 +131,7 @@ CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 CONFIG_DEVKMEM=y
@@ -162,7 +163,6 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_LOCKING=y
 CONFIG_LOCK_STAT=y
@@ -172,14 +172,12 @@ CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_SG=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
@@ -190,7 +188,6 @@ CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
-CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_XTS=m
@@ -230,6 +227,7 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_ZCRYPT=m
 CONFIG_PKEY=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 426614a882a9..65d07ac34647 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -541,7 +541,6 @@ struct kvm_s390_float_interrupt {
         struct mutex ais_lock;
         u8 simm;
         u8 nimm;
-        int ais_enabled;
 };
 
 struct kvm_hw_wp_info_arch {
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index e408d9cc5b96..6315037335ba 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -231,12 +231,17 @@ ENTRY(sie64a)
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 .Lsie_done:
 # some program checks are suppressing. C code (e.g. do_protection_exception)
-# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions between sie64a and .Lsie_done should not cause program
-# interrupts. So lets use a nop (47 00 00 00) as a landing pad.
+# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There
+# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable.
+# Other instructions between sie64a and .Lsie_done should not cause program
+# interrupts. So lets use 3 nops as a landing pad for all possible rewinds.
 # See also .Lcleanup_sie
-.Lrewind_pad:
-        nop     0
+.Lrewind_pad6:
+        nopr    7
+.Lrewind_pad4:
+        nopr    7
+.Lrewind_pad2:
+        nopr    7
         .globl sie_exit
 sie_exit:
         lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
@@ -249,7 +254,9 @@ sie_exit:
         stg     %r14,__SF_EMPTY+16(%r15)        # set exit reason code
         j       sie_exit
 
-        EX_TABLE(.Lrewind_pad,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad6,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad4,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad2,.Lsie_fault)
         EX_TABLE(sie_exit,.Lsie_fault)
 EXPORT_SYMBOL(sie64a)
 EXPORT_SYMBOL(sie_exit)
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index caf15c8a8948..2d120fef7d90 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -2160,7 +2160,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
         struct kvm_s390_ais_req req;
         int ret = 0;
 
-        if (!fi->ais_enabled)
+        if (!test_kvm_facility(kvm, 72))
                 return -ENOTSUPP;
 
         if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
@@ -2204,7 +2204,7 @@ static int kvm_s390_inject_airq(struct kvm *kvm,
         };
         int ret = 0;
 
-        if (!fi->ais_enabled || !adapter->suppressible)
+        if (!test_kvm_facility(kvm, 72) || !adapter->suppressible)
                 return kvm_s390_inject_vm(kvm, &s390int);
 
         mutex_lock(&fi->ais_lock);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 689ac48361c6..f28e2e776931 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -558,7 +558,6 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
                 } else {
                         set_kvm_facility(kvm->arch.model.fac_mask, 72);
                         set_kvm_facility(kvm->arch.model.fac_list, 72);
-                        kvm->arch.float_int.ais_enabled = 1;
                         r = 0;
                 }
                 mutex_unlock(&kvm->lock);
@@ -1533,7 +1532,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         mutex_init(&kvm->arch.float_int.ais_lock);
         kvm->arch.float_int.simm = 0;
         kvm->arch.float_int.nimm = 0;
-        kvm->arch.float_int.ais_enabled = 0;
         spin_lock_init(&kvm->arch.float_int.lock);
         for (i = 0; i < FIRQ_LIST_COUNT; i++)
                 INIT_LIST_HEAD(&kvm->arch.float_int.lists[i]);
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index b017daed6887..b854b1da281a 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -101,7 +101,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         goto check_asce_limit;
         }
 
@@ -151,7 +151,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         goto check_asce_limit;
         }
 
diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
index 08e7af0be4a7..6a1a1297baae 100644
--- a/arch/sh/mm/mmap.c
+++ b/arch/sh/mm/mmap.c
@@ -64,7 +64,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -114,7 +114,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 58243b0d21c0..5639c9fe5b55 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -192,9 +192,9 @@ config NR_CPUS
         int "Maximum number of CPUs"
         depends on SMP
         range 2 32 if SPARC32
-        range 2 1024 if SPARC64
+        range 2 4096 if SPARC64
         default 32 if SPARC32
-        default 64 if SPARC64
+        default 4096 if SPARC64
 
 source kernel/Kconfig.hz
 
@@ -295,9 +295,13 @@ config NUMA
         depends on SPARC64 && SMP
 
 config NODES_SHIFT
-        int
-        default "4"
+        int "Maximum NUMA Nodes (as a power of 2)"
+        range 4 5 if SPARC64
+        default "5"
         depends on NEED_MULTIPLE_NODES
+        help
+          Specify the maximum number of NUMA Nodes available on the target
+          system.  Increases memory reserved to accommodate various tables.
 
 # Some NUMA nodes have memory ranges that span
 # other nodes.  Even though a pfn is valid and
@@ -573,9 +577,6 @@ config SYSVIPC_COMPAT
         depends on COMPAT && SYSVIPC
         default y
 
-config KEYS_COMPAT
-        def_bool y if COMPAT && KEYS
-
 endmenu
 
 source "net/Kconfig"
diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h
index f7de0dbc38af..83b36a5371ff 100644
--- a/arch/sparc/include/asm/mmu_64.h
+++ b/arch/sparc/include/asm/mmu_64.h
@@ -52,7 +52,7 @@
 #define CTX_NR_MASK             TAG_CONTEXT_BITS
 #define CTX_HW_MASK             (CTX_NR_MASK | CTX_PGSZ_MASK)
 
-#define CTX_FIRST_VERSION       ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL))
+#define CTX_FIRST_VERSION       BIT(CTX_VERSION_SHIFT)
 #define CTX_VALID(__ctx)        \
          (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK))
 #define CTX_HWBITS(__ctx)       ((__ctx.sparc64_ctx_val) & CTX_HW_MASK)
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index 22fede6eba11..2cddcda4f85f 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -19,13 +19,8 @@ extern spinlock_t ctx_alloc_lock;
 extern unsigned long tlb_context_cache;
 extern unsigned long mmu_context_bmap[];
 
+DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm);
 void get_new_mmu_context(struct mm_struct *mm);
-#ifdef CONFIG_SMP
-void smp_new_mmu_context_version(void);
-#else
-#define smp_new_mmu_context_version() do { } while (0)
-#endif
-
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
 void destroy_context(struct mm_struct *mm);
 
@@ -76,8 +71,9 @@ void __flush_tlb_mm(unsigned long, unsigned long);
 static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk)
 {
         unsigned long ctx_valid, flags;
-        int cpu;
+        int cpu = smp_processor_id();
 
+        per_cpu(per_cpu_secondary_mm, cpu) = mm;
         if (unlikely(mm == &init_mm))
                 return;
 
@@ -123,7 +119,6 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
          * for the first time, we must flush that context out of the
          * local TLB.
          */
-        cpu = smp_processor_id();
         if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) {
                 cpumask_set_cpu(cpu, mm_cpumask(mm));
                 __flush_tlb_mm(CTX_HWBITS(mm->context),
@@ -133,26 +128,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
-
-/* Activate a new MM instance for the current task. */
-static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm)
-{
-        unsigned long flags;
-        int cpu;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-        if (!CTX_VALID(mm->context))
-                get_new_mmu_context(mm);
-        cpu = smp_processor_id();
-        if (!cpumask_test_cpu(cpu, mm_cpumask(mm)))
-                cpumask_set_cpu(cpu, mm_cpumask(mm));
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT);
-        tsb_context_switch(mm);
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-}
-
+#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL)
 #endif /* !(__ASSEMBLY__) */
 
 #endif /* !(__SPARC64_MMU_CONTEXT_H) */
diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h
index 266937030546..522b43db2ed3 100644
--- a/arch/sparc/include/asm/pil.h
+++ b/arch/sparc/include/asm/pil.h
@@ -20,7 +20,6 @@
 #define PIL_SMP_CALL_FUNC       1
 #define PIL_SMP_RECEIVE_SIGNAL  2
 #define PIL_SMP_CAPTURE         3
-#define PIL_SMP_CTX_NEW_VERSION 4
 #define PIL_DEVICE_IRQ          5
 #define PIL_SMP_CALL_FUNC_SNGL  6
 #define PIL_DEFERRED_PCR_WORK   7
diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
index 8174f6cdbbbb..9dca7a892978 100644
--- a/arch/sparc/include/asm/vio.h
+++ b/arch/sparc/include/asm/vio.h
@@ -327,6 +327,7 @@ struct vio_dev {
         int                     compat_len;
 
         u64                     dev_no;
+        u64                     id;
 
         unsigned long           channel_id;
 
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index b542cc7c8d94..f87265afb175 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -909,7 +909,7 @@ static int register_services(struct ds_info *dp)
                 pbuf.req.handle = cp->handle;
                 pbuf.req.major = 1;
                 pbuf.req.minor = 0;
-                strcpy(pbuf.req.svc_id, cp->service_id);
+                strcpy(pbuf.id_buf, cp->service_id);
 
                 err = __ds_send(lp, &pbuf, msg_len);
                 if (err > 0)
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index 4d0248aa0928..99dd133a029f 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb)
 {
 #ifdef CONFIG_SMP
         unsigned long page;
+        void *mondo, *p;
 
-        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64));
+        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE);
+
+        /* Make sure mondo block is 64byte aligned */
+        p = kzalloc(127, GFP_KERNEL);
+        if (!p) {
+                prom_printf("SUN4V: Error, cannot allocate mondo block.\n");
+                prom_halt();
+        }
+        mondo = (void *)(((unsigned long)p + 63) & ~0x3f);
+        tb->cpu_mondo_block_pa = __pa(mondo);
 
         page = get_zeroed_page(GFP_KERNEL);
         if (!page) {
-                prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n");
+                prom_printf("SUN4V: Error, cannot allocate cpu list page.\n");
                 prom_halt();
         }
 
-        tb->cpu_mondo_block_pa = __pa(page);
-        tb->cpu_list_pa = __pa(page + 64);
+        tb->cpu_list_pa = __pa(page);
 #endif
 }
 
diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h
index c9804551262c..6ae1e77be0bf 100644
--- a/arch/sparc/kernel/kernel.h
+++ b/arch/sparc/kernel/kernel.h
@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 /* smp_64.c */
 void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs);
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs);
 void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs);
 
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index b3bc0ac757cc..fdf31040a7dc 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -964,37 +964,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
         preempt_enable();
 }
 
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
-{
-        struct mm_struct *mm;
-        unsigned long flags;
-
-        clear_softint(1 << irq);
-
-        /* See if we need to allocate a new TLB context because
-         * the version of the one we are using is now out of date.
-         */
-        mm = current->active_mm;
-        if (unlikely(!mm || (mm == &init_mm)))
-                return;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-
-        if (unlikely(!CTX_VALID(mm->context)))
-                get_new_mmu_context(mm);
-
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context),
-                       SECONDARY_CONTEXT);
-}
-
-void smp_new_mmu_context_version(void)
-{
-        smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0);
-}
-
 #ifdef CONFIG_KGDB
 void kgdb_roundup_cpus(unsigned long flags)
 {
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index ef4520efc813..043544d0cda3 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -120,7 +120,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
 
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -183,7 +183,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index 10689cfd0ad4..07c0df924960 100644
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -455,13 +455,16 @@ __tsb_context_switch:
         .type   copy_tsb,#function
 copy_tsb:               /* %o0=old_tsb_base, %o1=old_tsb_size
                          * %o2=new_tsb_base, %o3=new_tsb_size
+                         * %o4=page_size_shift
                          */
         sethi           %uhi(TSB_PASS_BITS), %g7
         srlx            %o3, 4, %o3
-        add             %o0, %o1, %g1   /* end of old tsb */
+        add             %o0, %o1, %o1   /* end of old tsb */
         sllx            %g7, 32, %g7
         sub             %o3, 1, %o3     /* %o3 == new tsb hash mask */
 
+        mov             %o4, %g1        /* page_size_shift */
+
 661:    prefetcha       [%o0] ASI_N, #one_read
         .section        .tsb_phys_patch, "ax"
         .word           661b
@@ -486,9 +489,9 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         /* This can definitely be computed faster... */
         srlx            %o0, 4, %o5     /* Build index */
         and             %o5, 511, %o5   /* Mask index */
-        sllx            %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */
+        sllx            %o5, %g1, %o5   /* Put into vaddr position */
         or              %o4, %o5, %o4   /* Full VADDR. */
-        srlx            %o4, PAGE_SHIFT, %o4 /* Shift down to create index */
+        srlx            %o4, %g1, %o4   /* Shift down to create index */
         and             %o4, %o3, %o4   /* Mask with new_tsb_nents-1 */
         sllx            %o4, 4, %o4     /* Shift back up into tsb ent offset */
         TSB_STORE(%o2 + %o4, %g2)       /* Store TAG */
@@ -496,7 +499,7 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         TSB_STORE(%o2 + %o4, %g3)       /* Store TTE */
 
 80:     add             %o0, 16, %o0
-        cmp             %o0, %g1
+        cmp             %o0, %o1
         bne,pt          %xcc, 90b
          nop
 
diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S
index 7bd8f6556352..efe93ab4a9c0 100644
--- a/arch/sparc/kernel/ttable_64.S
+++ b/arch/sparc/kernel/ttable_64.S
@@ -50,7 +50,7 @@ tl0_resv03e:	BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40)
 tl0_irq1:       TRAP_IRQ(smp_call_function_client, 1)
 tl0_irq2:       TRAP_IRQ(smp_receive_signal_client, 2)
 tl0_irq3:       TRAP_IRQ(smp_penguin_jailcell, 3)
-tl0_irq4:       TRAP_IRQ(smp_new_mmu_context_version_client, 4)
+tl0_irq4:       BTRAP(0x44)
 #else
 tl0_irq1:       BTRAP(0x41)
 tl0_irq2:       BTRAP(0x42)
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index f6bb857254fc..075d38980dee 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -302,13 +302,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
         if (!id) {
                 dev_set_name(&vdev->dev, "%s", bus_id_name);
                 vdev->dev_no = ~(u64)0;
+                vdev->id = ~(u64)0;
         } else if (!cfg_handle) {
                 dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id);
                 vdev->dev_no = *id;
+                vdev->id = ~(u64)0;
         } else {
                 dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name,
                              *cfg_handle, *id);
                 vdev->dev_no = *cfg_handle;
+                vdev->id = *id;
         }
 
         vdev->dev.parent = parent;
@@ -351,27 +354,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node)
         (void) vio_create_one(hp, node, &root_vdev->dev);
 }
 
+struct vio_md_node_query {
+        const char *type;
+        u64 dev_no;
+        u64 id;
+};
+
 static int vio_md_node_match(struct device *dev, void *arg)
 {
+        struct vio_md_node_query *query = (struct vio_md_node_query *) arg;
         struct vio_dev *vdev = to_vio_dev(dev);
 
-        if (vdev->mp == (u64) arg)
-                return 1;
+        if (vdev->dev_no != query->dev_no)
+                return 0;
+        if (vdev->id != query->id)
+                return 0;
+        if (strcmp(vdev->type, query->type))
+                return 0;
 
-        return 0;
+        return 1;
 }
 
 static void vio_remove(struct mdesc_handle *hp, u64 node)
 {
+        const char *type;
+        const u64 *id, *cfg_handle;
+        u64 a;
+        struct vio_md_node_query query;
         struct device *dev;
 
-        dev = device_find_child(&root_vdev->dev, (void *) node,
+        type = mdesc_get_property(hp, node, "device-type", NULL);
+        if (!type) {
+                type = mdesc_get_property(hp, node, "name", NULL);
+                if (!type)
+                        type = mdesc_node_name(hp, node);
+        }
+
+        query.type = type;
+
+        id = mdesc_get_property(hp, node, "id", NULL);
+        cfg_handle = NULL;
+        mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) {
+                u64 target;
+
+                target = mdesc_arc_target(hp, a);
+                cfg_handle = mdesc_get_property(hp, target,
+                                                "cfg-handle", NULL);
+                if (cfg_handle)
+                        break;
+        }
+
+        if (!id) {
+                query.dev_no = ~(u64)0;
+                query.id = ~(u64)0;
+        } else if (!cfg_handle) {
+                query.dev_no = *id;
+                query.id = ~(u64)0;
+        } else {
+                query.dev_no = *cfg_handle;
+                query.id = *id;
+        }
+
+        dev = device_find_child(&root_vdev->dev, &query,
                                 vio_md_node_match);
         if (dev) {
                 printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev));
 
                 device_unregister(dev);
                 put_device(dev);
+        } else {
+                if (!id)
+                        printk(KERN_ERR "VIO: Removed unknown %s node.\n",
+                               type);
+                else if (!cfg_handle)
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n",
+                               type, *id);
+                else
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n",
+                               type, *cfg_handle, *id);
         }
 }
 
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index 69912d2f8b54..07c03e72d812 100644
--- a/arch/sparc/lib/Makefile
+++ b/arch/sparc/lib/Makefile
@@ -15,6 +15,7 @@ lib-$(CONFIG_SPARC32) += copy_user.o locks.o
 lib-$(CONFIG_SPARC64) += atomic_64.o
 lib-$(CONFIG_SPARC32) += lshrdi3.o ashldi3.o
 lib-$(CONFIG_SPARC32) += muldi3.o bitext.o cmpdi2.o
+lib-$(CONFIG_SPARC64) += multi3.o
 
 lib-$(CONFIG_SPARC64) += copy_page.o clear_page.o bzero.o
 lib-$(CONFIG_SPARC64) += csum_copy.o csum_copy_from_user.o csum_copy_to_user.o
diff --git a/arch/sparc/lib/multi3.S b/arch/sparc/lib/multi3.S
new file mode 100644
index 000000000000..d6b6c97fe3c7
--- /dev/null
+++ b/arch/sparc/lib/multi3.S
@@ -0,0 +1,35 @@
+#include <linux/linkage.h>
+#include <asm/export.h>
+
+        .text
+        .align  4
+ENTRY(__multi3) /* %o0 = u, %o1 = v */
+        mov     %o1, %g1
+        srl     %o3, 0, %g4
+        mulx    %g4, %g1, %o1
+        srlx    %g1, 0x20, %g3
+        mulx    %g3, %g4, %g5
+        sllx    %g5, 0x20, %o5
+        srl     %g1, 0, %g4
+        sub     %o1, %o5, %o5
+        srlx    %o5, 0x20, %o5
+        addcc   %g5, %o5, %g5
+        srlx    %o3, 0x20, %o5
+        mulx    %g4, %o5, %g4
+        mulx    %g3, %o5, %o5
+        sethi   %hi(0x80000000), %g3
+        addcc   %g5, %g4, %g5
+        srlx    %g5, 0x20, %g5
+        add     %g3, %g3, %g3
+        movcc   %xcc, %g0, %g3
+        addcc   %o5, %g5, %o5
+        sllx    %g4, 0x20, %g4
+        add     %o1, %g4, %o1
+        add     %o5, %g3, %g2
+        mulx    %g1, %o2, %g1
+        add     %g1, %g2, %g1
+        mulx    %o0, %o3, %o0
+        retl
+         add    %g1, %o0, %o0
+ENDPROC(__multi3)
+EXPORT_SYMBOL(__multi3)
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index 7c29d38e6b99..88855e383b34 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -120,7 +120,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 0cda653ae007..3c40ebd50f92 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -358,7 +358,8 @@ static int __init setup_hugepagesz(char *string)
         }
 
         if ((hv_pgsz_mask & cpu_pgsz_mask) == 0U) {
-                pr_warn("hugepagesz=%llu not supported by MMU.\n",
+                hugetlb_bad_size();
+                pr_err("hugepagesz=%llu not supported by MMU.\n",
                         hugepage_size);
                 goto out;
         }
@@ -706,10 +707,58 @@ EXPORT_SYMBOL(__flush_dcache_range);
 
 /* get_new_mmu_context() uses "cache + 1".  */
 DEFINE_SPINLOCK(ctx_alloc_lock);
-unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1;
+unsigned long tlb_context_cache = CTX_FIRST_VERSION;
 #define MAX_CTX_NR      (1UL << CTX_NR_BITS)
 #define CTX_BMAP_SLOTS  BITS_TO_LONGS(MAX_CTX_NR)
 DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR);
+DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0};
+
+static void mmu_context_wrap(void)
+{
+        unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK;
+        unsigned long new_ver, new_ctx, old_ctx;
+        struct mm_struct *mm;
+        int cpu;
+
+        bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS);
+
+        /* Reserve kernel context */
+        set_bit(0, mmu_context_bmap);
+
+        new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION;
+        if (unlikely(new_ver == 0))
+                new_ver = CTX_FIRST_VERSION;
+        tlb_context_cache = new_ver;
+
+        /*
+         * Make sure that any new mm that are added into per_cpu_secondary_mm,
+         * are going to go through get_new_mmu_context() path.
+         */
+        mb();
+
+        /*
+         * Updated versions to current on those CPUs that had valid secondary
+         * contexts
+         */
+        for_each_online_cpu(cpu) {
+                /*
+                 * If a new mm is stored after we took this mm from the array,
+                 * it will go into get_new_mmu_context() path, because we
+                 * already bumped the version in tlb_context_cache.
+                 */
+                mm = per_cpu(per_cpu_secondary_mm, cpu);
+
+                if (unlikely(!mm || mm == &init_mm))
+                        continue;
+
+                old_ctx = mm->context.sparc64_ctx_val;
+                if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) {
+                        new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver;
+                        set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap);
+                        mm->context.sparc64_ctx_val = new_ctx;
+                }
+        }
+}
 
 /* Caller does TLB context flushing on local CPU if necessary.
  * The caller also ensures that CTX_VALID(mm->context) is false.
@@ -725,48 +774,30 @@ void get_new_mmu_context(struct mm_struct *mm)
 {
         unsigned long ctx, new_ctx;
         unsigned long orig_pgsz_bits;
-        int new_version;
 
         spin_lock(&ctx_alloc_lock);
+retry:
+        /* wrap might have happened, test again if our context became valid */
+        if (unlikely(CTX_VALID(mm->context)))
+                goto out;
         orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK);
         ctx = (tlb_context_cache + 1) & CTX_NR_MASK;
         new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx);
-        new_version = 0;
         if (new_ctx >= (1 << CTX_NR_BITS)) {
                 new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1);
                 if (new_ctx >= ctx) {
-                        int i;
-                        new_ctx = (tlb_context_cache & CTX_VERSION_MASK) +
-                                CTX_FIRST_VERSION;
-                        if (new_ctx == 1)
-                                new_ctx = CTX_FIRST_VERSION;
-
-                        /* Don't call memset, for 16 entries that's just
-                         * plain silly...
-                         */
-                        mmu_context_bmap[0] = 3;
-                        mmu_context_bmap[1] = 0;
-                        mmu_context_bmap[2] = 0;
-                        mmu_context_bmap[3] = 0;
-                        for (i = 4; i < CTX_BMAP_SLOTS; i += 4) {
-                                mmu_context_bmap[i + 0] = 0;
-                                mmu_context_bmap[i + 1] = 0;
-                                mmu_context_bmap[i + 2] = 0;
-                                mmu_context_bmap[i + 3] = 0;
-                        }
-                        new_version = 1;
-                        goto out;
+                        mmu_context_wrap();
+                        goto retry;
                 }
         }
+        if (mm->context.sparc64_ctx_val)
+                cpumask_clear(mm_cpumask(mm));
         mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63));
         new_ctx |= (tlb_context_cache & CTX_VERSION_MASK);
-out:
         tlb_context_cache = new_ctx;
         mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits;
+out:
         spin_unlock(&ctx_alloc_lock);
-
-        if (unlikely(new_version))
-                smp_new_mmu_context_version();
 }
 
 static int numa_enabled = 1;
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index bedf08b22a47..0d4b998c7d7b 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -496,7 +496,8 @@ retry_tsb_alloc:
                 extern void copy_tsb(unsigned long old_tsb_base,
                                      unsigned long old_tsb_size,
                                      unsigned long new_tsb_base,
-                                     unsigned long new_tsb_size);
+                                     unsigned long new_tsb_size,
+                                     unsigned long page_size_shift);
                 unsigned long old_tsb_base = (unsigned long) old_tsb;
                 unsigned long new_tsb_base = (unsigned long) new_tsb;
 
@@ -504,7 +505,9 @@ retry_tsb_alloc:
                         old_tsb_base = __pa(old_tsb_base);
                         new_tsb_base = __pa(new_tsb_base);
                 }
-                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size);
+                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size,
+                        tsb_index == MM_TSB_BASE ?
+                        PAGE_SHIFT : REAL_HPAGE_SHIFT);
         }
 
         mm->context.tsb_block[tsb_index].tsb = new_tsb;
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index 5d2fd6cd3189..fcf4d27a38fb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -971,11 +971,6 @@ xcall_capture:
         wr              %g0, (1 << PIL_SMP_CAPTURE), %set_softint
         retry
 
-        .globl          xcall_new_mmu_context_version
-xcall_new_mmu_context_version:
-        wr              %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint
-        retry
-
 #ifdef CONFIG_KGDB
         .globl          xcall_kgdb_capture
 xcall_kgdb_capture:
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
index cb10153b5c9f..03e5cc4e76e4 100644
--- a/arch/tile/mm/hugetlbpage.c
+++ b/arch/tile/mm/hugetlbpage.c
@@ -233,7 +233,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (current->mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index cd18994a9555..0efb4c9497bc 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -360,7 +360,7 @@ config SMP
           Management" code will be disabled if you say Y here.
 
           See also <file:Documentation/x86/i386/IO-APIC.txt>,
-          <file:Documentation/nmi_watchdog.txt> and the SMP-HOWTO available at
+          <file:Documentation/lockup-watchdogs.txt> and the SMP-HOWTO available at
           <http://www.tldp.org/docs.html#howto>.
 
           If you don't know what to do here, say N.
@@ -2776,10 +2776,6 @@ config COMPAT_FOR_U64_ALIGNMENT
 config SYSVIPC_COMPAT
         def_bool y
         depends on SYSVIPC
-
-config KEYS_COMPAT
-        def_bool y
-        depends on KEYS
 endif
 
 endmenu
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 5851411e60fb..bf240b920473 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -159,7 +159,7 @@ ifdef CONFIG_FUNCTION_GRAPH_TRACER
         # If '-Os' is enabled, disable it and print a warning.
         ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
           undefine CONFIG_CC_OPTIMIZE_FOR_SIZE
-          $(warning Disabling CONFIG_CC_OPTIMIZE_FOR_SIZE.  Your compiler does not have -mfentry so you cannot optimize for size with CONFIG_FUNCTION_GRAPH_TRACER.)
+          $(warning Disabling CONFIG_CC_OPTIMIZE_FOR_SIZE.  Your compiler does not have -mfentry so you cannot optimize for size with CONFIG_FUNCTION_GRAPH_TRACER.)
         endif
 
     endif
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 44163e8c3868..2c860ad4fe06 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -94,7 +94,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
 quiet_cmd_check_data_rel = DATAREL $@
 define cmd_check_data_rel
         for obj in $(filter %.o,$^); do \
-                readelf -S $$obj | grep -qF .rel.local && { \
+                ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \
                         echo "error: $$obj has data relocations!" >&2; \
                         exit 1; \
                 } || true; \
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 50bc26949e9e..48ef7bb32c42 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -252,6 +252,23 @@ ENTRY(__switch_to_asm)
 END(__switch_to_asm)
 
 /*
+ * The unwinder expects the last frame on the stack to always be at the same
+ * offset from the end of the page, which allows it to validate the stack.
+ * Calling schedule_tail() directly would break that convention because its an
+ * asmlinkage function so its argument has to be pushed on the stack.  This
+ * wrapper creates a proper "end of stack" frame header before the call.
+ */
+ENTRY(schedule_tail_wrapper)
+        FRAME_BEGIN
+
+        pushl   %eax
+        call    schedule_tail
+        popl    %eax
+
+        FRAME_END
+        ret
+ENDPROC(schedule_tail_wrapper)
+/*
  * A newly forked process directly context switches into this address.
  *
  * eax: prev task we switched from
@@ -259,24 +276,15 @@ END(__switch_to_asm)
  * edi: kernel thread arg
  */
 ENTRY(ret_from_fork)
-        FRAME_BEGIN             /* help unwinder find end of stack */
-
-        /*
-         * schedule_tail() is asmlinkage so we have to put its 'prev' argument
-         * on the stack.
-         */
-        pushl   %eax
-        call    schedule_tail
-        popl    %eax
+        call    schedule_tail_wrapper
 
         testl   %ebx, %ebx
         jnz     1f              /* kernel threads are uncommon */
 
 2:
         /* When we fork, we trace the syscall return in the child, too. */
-        leal    FRAME_OFFSET(%esp), %eax
+        movl    %esp, %eax
         call    syscall_return_slowpath
-        FRAME_END
         jmp     restore_all
 
         /* kernel thread */
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 607d72c4a485..4a4c0834f965 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -36,7 +36,6 @@
 #include <asm/smap.h>
 #include <asm/pgtable_types.h>
 #include <asm/export.h>
-#include <asm/frame.h>
 #include <linux/err.h>
 
 .code64
@@ -406,19 +405,17 @@ END(__switch_to_asm)
  * r12: kernel thread arg
  */
 ENTRY(ret_from_fork)
-        FRAME_BEGIN                     /* help unwinder find end of stack */
         movq    %rax, %rdi
-        call    schedule_tail           /* rdi: 'prev' task parameter */
+        call    schedule_tail                   /* rdi: 'prev' task parameter */
 
-        testq   %rbx, %rbx              /* from kernel_thread? */
-        jnz     1f                      /* kernel threads are uncommon */
+        testq   %rbx, %rbx                      /* from kernel_thread? */
+        jnz     1f                              /* kernel threads are uncommon */
 
 2:
-        leaq    FRAME_OFFSET(%rsp),%rdi /* pt_regs pointer */
+        movq    %rsp, %rdi
         call    syscall_return_slowpath /* returns with IRQs disabled */
         TRACE_IRQS_ON                   /* user mode is traced as IRQS on */
         SWAPGS
-        FRAME_END
         jmp     restore_regs_and_iret
 
 1:
diff --git a/arch/x86/include/asm/extable.h b/arch/x86/include/asm/extable.h
index b8ad261d11dc..c66d19e3c23e 100644
--- a/arch/x86/include/asm/extable.h
+++ b/arch/x86/include/asm/extable.h
@@ -29,6 +29,7 @@ struct pt_regs;
         } while (0)
 
 extern int fixup_exception(struct pt_regs *regs, int trapnr);
+extern int fixup_bug(struct pt_regs *regs, int trapnr);
 extern bool ex_has_fault_handler(unsigned long ip);
 extern void early_fixup_exception(struct pt_regs *regs, int trapnr);
 
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 4fd5195deed0..3f9a3d2a5209 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -266,6 +266,7 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s
 #endif
 
 int mce_available(struct cpuinfo_x86 *c);
+bool mce_is_memory_error(struct mce *m);
 
 DECLARE_PER_CPU(unsigned, mce_exception_count);
 DECLARE_PER_CPU(unsigned, mce_poll_count);
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index c5b8f760473c..32e14d137416 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -409,8 +409,13 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
                 memcpy(insnbuf, replacement, a->replacementlen);
                 insnbuf_sz = a->replacementlen;
 
-                /* 0xe8 is a relative jump; fix the offset. */
-                if (*insnbuf == 0xe8 && a->replacementlen == 5) {
+                /*
+                 * 0xe8 is a relative jump; fix the offset.
+                 *
+                 * Instruction length is checked before the opcode to avoid
+                 * accessing uninitialized bytes for zero-length replacements.
+                 */
+                if (a->replacementlen == 5 && *insnbuf == 0xe8) {
                         *(s32 *)(insnbuf + 1) += replacement - instr;
                         DPRINTK("Fix CALL offset: 0x%x, CALL 0x%lx",
                                 *(s32 *)(insnbuf + 1),
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index a70fd61095f8..6f077445647a 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -255,6 +255,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                 break;
 
         case 4: /* MediaGX/GXm or Geode GXM/GXLV/GX1 */
+        case 11: /* GX1 with inverted Device ID */
 #ifdef CONFIG_PCI
         {
                 u32 vendor, device;
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5abd4bf73d6e..5cfbaeb6529a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -499,16 +499,14 @@ static int mce_usable_address(struct mce *m)
         return 1;
 }
 
-static bool memory_error(struct mce *m)
+bool mce_is_memory_error(struct mce *m)
 {
-        struct cpuinfo_x86 *c = &boot_cpu_data;
-
-        if (c->x86_vendor == X86_VENDOR_AMD) {
+        if (m->cpuvendor == X86_VENDOR_AMD) {
                 /* ErrCodeExt[20:16] */
                 u8 xec = (m->status >> 16) & 0x1f;
 
                 return (xec == 0x0 || xec == 0x8);
-        } else if (c->x86_vendor == X86_VENDOR_INTEL) {
+        } else if (m->cpuvendor == X86_VENDOR_INTEL) {
                 /*
                  * Intel SDM Volume 3B - 15.9.2 Compound Error Codes
                  *
@@ -529,6 +527,7 @@ static bool memory_error(struct mce *m)
 
         return false;
 }
+EXPORT_SYMBOL_GPL(mce_is_memory_error);
 
 static bool cec_add_mce(struct mce *m)
 {
@@ -536,7 +535,7 @@ static bool cec_add_mce(struct mce *m)
                 return false;
 
         /* We eat only correctable DRAM errors with usable addresses. */
-        if (memory_error(m) &&
+        if (mce_is_memory_error(m) &&
             !(m->status & MCI_STATUS_UC) &&
             mce_usable_address(m))
                 if (!cec_add_elem(m->addr >> PAGE_SHIFT))
@@ -713,7 +712,7 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
 
                 severity = mce_severity(&m, mca_cfg.tolerant, NULL, false);
 
-                if (severity == MCE_DEFERRED_SEVERITY && memory_error(&m))
+                if (severity == MCE_DEFERRED_SEVERITY && mce_is_memory_error(&m))
                         if (m.status & MCI_STATUS_ADDRV)
                                 m.severity = severity;
 
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 45db4d2ebd01..e9f4d762aa5b 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -320,7 +320,7 @@ void load_ucode_amd_ap(unsigned int cpuid_1_eax)
 }
 
 static enum ucode_state
-load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size);
+load_microcode_amd(bool save, u8 family, const u8 *data, size_t size);
 
 int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
 {
@@ -338,8 +338,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax)
         if (!desc.mc)
                 return -EINVAL;
 
-        ret = load_microcode_amd(smp_processor_id(), x86_family(cpuid_1_eax),
-                                 desc.data, desc.size);
+        ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size);
         if (ret != UCODE_OK)
                 return -EINVAL;
 
@@ -675,7 +674,7 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data,
 }
 
 static enum ucode_state
-load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size)
+load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 {
         enum ucode_state ret;
 
@@ -689,8 +688,8 @@ load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size)
 
 #ifdef CONFIG_X86_32
         /* save BSP's matching patch for early load */
-        if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) {
-                struct ucode_patch *p = find_patch(cpu);
+        if (save) {
+                struct ucode_patch *p = find_patch(0);
                 if (p) {
                         memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
                         memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
@@ -722,11 +721,12 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
 {
         char fw_name[36] = "amd-ucode/microcode_amd.bin";
         struct cpuinfo_x86 *c = &cpu_data(cpu);
+        bool bsp = c->cpu_index == boot_cpu_data.cpu_index;
         enum ucode_state ret = UCODE_NFOUND;
         const struct firmware *fw;
 
         /* reload ucode container only on the boot cpu */
-        if (!refresh_fw || c->cpu_index != boot_cpu_data.cpu_index)
+        if (!refresh_fw || !bsp)
                 return UCODE_OK;
 
         if (c->x86 >= 0x15)
@@ -743,7 +743,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device,
                 goto fw_release;
         }
 
-        ret = load_microcode_amd(cpu, c->x86, fw->data, fw->size);
+        ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size);
 
  fw_release:
         release_firmware(fw);
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index afdfd237b59f..f522415bf9e5 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -619,6 +619,9 @@ int __init save_microcode_in_initrd_intel(void)
 
         show_saved_mc();
 
+        /* initrd is going away, clear patch ptr. */
+        intel_ucode_patch = NULL;
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 0651e974dcb3..9bef1bbeba63 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -689,8 +689,12 @@ static inline void *alloc_tramp(unsigned long size)
 {
         return module_alloc(size);
 }
-static inline void tramp_free(void *tramp)
+static inline void tramp_free(void *tramp, int size)
 {
+        int npages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+
+        set_memory_nx((unsigned long)tramp, npages);
+        set_memory_rw((unsigned long)tramp, npages);
         module_memfree(tramp);
 }
 #else
@@ -699,7 +703,7 @@ static inline void *alloc_tramp(unsigned long size)
 {
         return NULL;
 }
-static inline void tramp_free(void *tramp) { }
+static inline void tramp_free(void *tramp, int size) { }
 #endif
 
 /* Defined as markers to the end of the ftrace default trampolines */
@@ -771,7 +775,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
         /* Copy ftrace_caller onto the trampoline memory */
         ret = probe_kernel_read(trampoline, (void *)start_offset, size);
         if (WARN_ON(ret < 0)) {
-                tramp_free(trampoline);
+                tramp_free(trampoline, *tramp_size);
                 return 0;
         }
 
@@ -797,7 +801,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 
         /* Are we pointing to the reference? */
         if (WARN_ON(memcmp(op_ptr.op, op_ref, 3) != 0)) {
-                tramp_free(trampoline);
+                tramp_free(trampoline, *tramp_size);
                 return 0;
         }
 
@@ -839,7 +843,7 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
         unsigned long offset;
         unsigned long ip;
         unsigned int size;
-        int ret;
+        int ret, npages;
 
         if (ops->trampoline) {
                 /*
@@ -848,11 +852,14 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
                  */
                 if (!(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
                         return;
+                npages = PAGE_ALIGN(ops->trampoline_size) >> PAGE_SHIFT;
+                set_memory_rw(ops->trampoline, npages);
         } else {
                 ops->trampoline = create_trampoline(ops, &size);
                 if (!ops->trampoline)
                         return;
                 ops->trampoline_size = size;
+                npages = PAGE_ALIGN(size) >> PAGE_SHIFT;
         }
 
         offset = calc_trampoline_call_offset(ops->flags & FTRACE_OPS_FL_SAVE_REGS);
@@ -863,6 +870,7 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
         /* Do a safe modify in case the trampoline is executing */
         new = ftrace_call_replace(ip, (unsigned long)func);
         ret = update_ftrace_func(ip, new);
+        set_memory_ro(ops->trampoline, npages);
 
         /* The update should never fail */
         WARN_ON(ret);
@@ -939,7 +947,7 @@ void arch_ftrace_trampoline_free(struct ftrace_ops *ops)
         if (!ops || !(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
                 return;
 
-        tramp_free((void *)ops->trampoline);
+        tramp_free((void *)ops->trampoline, ops->trampoline_size);
         ops->trampoline = 0;
 }
 
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 5b2bbfbb3712..6b877807598b 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -52,6 +52,7 @@
 #include <linux/ftrace.h>
 #include <linux/frame.h>
 #include <linux/kasan.h>
+#include <linux/moduleloader.h>
 
 #include <asm/text-patching.h>
 #include <asm/cacheflush.h>
@@ -417,6 +418,14 @@ static void prepare_boost(struct kprobe *p, struct insn *insn)
         }
 }
 
+/* Recover page to RW mode before releasing it */
+void free_insn_page(void *page)
+{
+        set_memory_nx((unsigned long)page & PAGE_MASK, 1);
+        set_memory_rw((unsigned long)page & PAGE_MASK, 1);
+        module_memfree(page);
+}
+
 static int arch_copy_kprobe(struct kprobe *p)
 {
         struct insn insn;
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index da5c09789984..43e10d6fdbed 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -161,8 +161,8 @@ void kvm_async_pf_task_wait(u32 token)
                          */
                         rcu_irq_exit();
                         native_safe_halt();
-                        rcu_irq_enter();
                         local_irq_disable();
+                        rcu_irq_enter();
                 }
         }
         if (!n.halted)
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index ff40e74c9181..ffeae818aa7a 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -78,7 +78,7 @@ void __show_regs(struct pt_regs *regs, int all)
 
         printk(KERN_DEFAULT "EIP: %pS\n", (void *)regs->ip);
         printk(KERN_DEFAULT "EFLAGS: %08lx CPU: %d\n", regs->flags,
-                smp_processor_id());
+                raw_smp_processor_id());
 
         printk(KERN_DEFAULT "EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
                 regs->ax, regs->bx, regs->cx, regs->dx);
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 0b4d3c686b1e..f81823695014 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -980,8 +980,6 @@ void __init setup_arch(char **cmdline_p)
          */
         x86_configure_nx();
 
-        simple_udelay_calibration();
-
         parse_early_param();
 
 #ifdef CONFIG_MEMORY_HOTPLUG
@@ -1041,6 +1039,8 @@ void __init setup_arch(char **cmdline_p)
          */
         init_hypervisor_platform();
 
+        simple_udelay_calibration();
+
         x86_init.resources.probe_roms();
 
         /* after parse_early_param, so could debug it */
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 207b8f2582c7..213ddf3e937d 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -144,7 +144,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (end - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -187,7 +187,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 3995d3a777d4..bf54309b85da 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -182,7 +182,7 @@ int is_valid_bugaddr(unsigned long addr)
         return ud == INSN_UD0 || ud == INSN_UD2;
 }
 
-static int fixup_bug(struct pt_regs *regs, int trapnr)
+int fixup_bug(struct pt_regs *regs, int trapnr)
 {
         if (trapnr != X86_TRAP_UD)
                 return 0;
diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index 82c6d7f1fd73..b9389d72b2f7 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -104,6 +104,11 @@ static inline unsigned long *last_frame(struct unwind_state *state)
         return (unsigned long *)task_pt_regs(state->task) - 2;
 }
 
+static bool is_last_frame(struct unwind_state *state)
+{
+        return state->bp == last_frame(state);
+}
+
 #ifdef CONFIG_X86_32
 #define GCC_REALIGN_WORDS 3
 #else
@@ -115,16 +120,15 @@ static inline unsigned long *last_aligned_frame(struct unwind_state *state)
         return last_frame(state) - GCC_REALIGN_WORDS;
 }
 
-static bool is_last_task_frame(struct unwind_state *state)
+static bool is_last_aligned_frame(struct unwind_state *state)
 {
         unsigned long *last_bp = last_frame(state);
         unsigned long *aligned_bp = last_aligned_frame(state);
 
         /*
-         * We have to check for the last task frame at two different locations
-         * because gcc can occasionally decide to realign the stack pointer and
-         * change the offset of the stack frame in the prologue of a function
-         * called by head/entry code.  Examples:
+         * GCC can occasionally decide to realign the stack pointer and change
+         * the offset of the stack frame in the prologue of a function called
+         * by head/entry code.  Examples:
          *
          * <start_secondary>:
          *      push   %edi
@@ -141,11 +145,38 @@ static bool is_last_task_frame(struct unwind_state *state)
          *      push   %rbp
          *      mov    %rsp,%rbp
          *
-         * Note that after aligning the stack, it pushes a duplicate copy of
-         * the return address before pushing the frame pointer.
+         * After aligning the stack, it pushes a duplicate copy of the return
+         * address before pushing the frame pointer.
+         */
+        return (state->bp == aligned_bp && *(aligned_bp + 1) == *(last_bp + 1));
+}
+
+static bool is_last_ftrace_frame(struct unwind_state *state)
+{
+        unsigned long *last_bp = last_frame(state);
+        unsigned long *last_ftrace_bp = last_bp - 3;
+
+        /*
+         * When unwinding from an ftrace handler of a function called by entry
+         * code, the stack layout of the last frame is:
+         *
+         *   bp
+         *   parent ret addr
+         *   bp
+         *   function ret addr
+         *   parent ret addr
+         *   pt_regs
+         *   -----------------
          */
-        return (state->bp == last_bp ||
-                (state->bp == aligned_bp && *(aligned_bp+1) == *(last_bp+1)));
+        return (state->bp == last_ftrace_bp &&
+                *state->bp == *(state->bp + 2) &&
+                *(state->bp + 1) == *(state->bp + 4));
+}
+
+static bool is_last_task_frame(struct unwind_state *state)
+{
+        return is_last_frame(state) || is_last_aligned_frame(state) ||
+               is_last_ftrace_frame(state);
 }
 
 /*
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index a181ae76c71c..59ca2eea522c 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -780,18 +780,20 @@ out:
 static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i)
 {
         struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i];
-        int j, nent = vcpu->arch.cpuid_nent;
+        struct kvm_cpuid_entry2 *ej;
+        int j = i;
+        int nent = vcpu->arch.cpuid_nent;
 
         e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT;
         /* when no next entry is found, the current entry[i] is reselected */
-        for (j = i + 1; ; j = (j + 1) % nent) {
-                struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
-                if (ej->function == e->function) {
-                        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
-                        return j;
-                }
-        }
-        return 0; /* silence gcc, even though control never reaches here */
+        do {
+                j = (j + 1) % nent;
+                ej = &vcpu->arch.cpuid_entries[j];
+        } while (ej->function != e->function);
+
+        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
+
+        return j;
 }
 
 /* find an entry with matching function, matching index (if needed), and that
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index c329d2894905..d24c8742d9b0 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1495,8 +1495,10 @@ EXPORT_SYMBOL_GPL(kvm_lapic_hv_timer_in_use);
 
 static void cancel_hv_timer(struct kvm_lapic *apic)
 {
+        preempt_disable();
         kvm_x86_ops->cancel_hv_timer(apic->vcpu);
         apic->lapic_timer.hv_timer_in_use = false;
+        preempt_enable();
 }
 
 static bool start_hv_timer(struct kvm_lapic *apic)
@@ -1934,7 +1936,8 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
         for (i = 0; i < KVM_APIC_LVT_NUM; i++)
                 kvm_lapic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED);
         apic_update_lvtt(apic);
-        if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_LINT0_REENABLED))
+        if (kvm_vcpu_is_reset_bsp(vcpu) &&
+            kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_LINT0_REENABLED))
                 kvm_lapic_set_reg(apic, APIC_LVT0,
                              SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT));
         apic_manage_nmi_watchdog(apic, kvm_lapic_get_reg(apic, APIC_LVT0));
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 5d3376f67794..cb8225969255 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3698,12 +3698,15 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
         return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
 }
 
-static bool can_do_async_pf(struct kvm_vcpu *vcpu)
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
 {
         if (unlikely(!lapic_in_kernel(vcpu) ||
                      kvm_event_needs_reinjection(vcpu)))
                 return false;
 
+        if (is_guest_mode(vcpu))
+                return false;
+
         return kvm_x86_ops->interrupt_allowed(vcpu);
 }
 
@@ -3719,7 +3722,7 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
         if (!async)
                 return false; /* *pfn has correct page already */
 
-        if (!prefault && can_do_async_pf(vcpu)) {
+        if (!prefault && kvm_can_do_async_pf(vcpu)) {
                 trace_kvm_try_async_get_page(gva, gfn);
                 if (kvm_find_async_pf_gfn(vcpu, gfn)) {
                         trace_kvm_async_pf_doublefault(gva, gfn);
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 27975807cc64..330bf3a811fb 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -76,6 +76,7 @@ int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct);
 void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu);
 void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
                              bool accessed_dirty);
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
 
 static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
 {
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 183ddb235fb4..ba9891ac5c56 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1807,7 +1807,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
          * AMD's VMCB does not have an explicit unusable field, so emulate it
          * for cross vendor migration purposes by "not present"
          */
-        var->unusable = !var->present || (var->type == 0);
+        var->unusable = !var->present;
 
         switch (seg) {
         case VCPU_SREG_TR:
@@ -1840,6 +1840,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
                  */
                 if (var->unusable)
                         var->db = 0;
+                /* This is symmetric with svm_set_segment() */
                 var->dpl = to_svm(vcpu)->vmcb->save.cpl;
                 break;
         }
@@ -1980,18 +1981,14 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
         s->base = var->base;
         s->limit = var->limit;
         s->selector = var->selector;
-        if (var->unusable)
-                s->attrib = 0;
-        else {
-                s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
-                s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
-                s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
-                s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
-                s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
-                s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
-                s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
-                s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
-        }
+        s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
+        s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
+        s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
+        s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT;
+        s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
+        s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
+        s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
+        s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
 
         /*
          * This is always accurate, except if SYSRET returned to a segment
@@ -2000,7 +1997,8 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
          * would entail passing the CPL to userspace and back.
          */
         if (seg == VCPU_SREG_SS)
-                svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
+                /* This is symmetric with svm_get_segment() */
+                svm->vmcb->save.cpl = (var->dpl & 3);
 
         mark_dirty(svm->vmcb, VMCB_SEG);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 72f78396bc09..ca5d2b93385c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2425,7 +2425,7 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned nr)
         if (!(vmcs12->exception_bitmap & (1u << nr)))
                 return 0;
 
-        nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason,
+        nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
                           vmcs_read32(VM_EXIT_INTR_INFO),
                           vmcs_readl(EXIT_QUALIFICATION));
         return 1;
@@ -6914,97 +6914,21 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
         return 0;
 }
 
-/*
- * This function performs the various checks including
- * - if it's 4KB aligned
- * - No bits beyond the physical address width are set
- * - Returns 0 on success or else 1
- * (Intel SDM Section 30.3)
- */
-static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason,
-                                  gpa_t *vmpointer)
+static int nested_vmx_get_vmptr(struct kvm_vcpu *vcpu, gpa_t *vmpointer)
 {
         gva_t gva;
-        gpa_t vmptr;
         struct x86_exception e;
-        struct page *page;
-        struct vcpu_vmx *vmx = to_vmx(vcpu);
-        int maxphyaddr = cpuid_maxphyaddr(vcpu);
 
         if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION),
                         vmcs_read32(VMX_INSTRUCTION_INFO), false, &gva))
                 return 1;
 
-        if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, &vmptr,
-                                sizeof(vmptr), &e)) {
+        if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, vmpointer,
+                                sizeof(*vmpointer), &e)) {
                 kvm_inject_page_fault(vcpu, &e);
                 return 1;
         }
 
-        switch (exit_reason) {
-        case EXIT_REASON_VMON:
-                /*
-                 * SDM 3: 24.11.5
-                 * The first 4 bytes of VMXON region contain the supported
-                 * VMCS revision identifier
-                 *
-                 * Note - IA32_VMX_BASIC[48] will never be 1
-                 * for the nested case;
-                 * which replaces physical address width with 32
-                 *
-                 */
-                if (!PAGE_ALIGNED(vmptr) || (vmptr >> maxphyaddr)) {
-                        nested_vmx_failInvalid(vcpu);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-
-                page = nested_get_page(vcpu, vmptr);
-                if (page == NULL) {
-                        nested_vmx_failInvalid(vcpu);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                if (*(u32 *)kmap(page) != VMCS12_REVISION) {
-                        kunmap(page);
-                        nested_release_page_clean(page);
-                        nested_vmx_failInvalid(vcpu);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                kunmap(page);
-                nested_release_page_clean(page);
-                vmx->nested.vmxon_ptr = vmptr;
-                break;
-        case EXIT_REASON_VMCLEAR:
-                if (!PAGE_ALIGNED(vmptr) || (vmptr >> maxphyaddr)) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMCLEAR_INVALID_ADDRESS);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-
-                if (vmptr == vmx->nested.vmxon_ptr) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMCLEAR_VMXON_POINTER);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                break;
-        case EXIT_REASON_VMPTRLD:
-                if (!PAGE_ALIGNED(vmptr) || (vmptr >> maxphyaddr)) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMPTRLD_INVALID_ADDRESS);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-
-                if (vmptr == vmx->nested.vmxon_ptr) {
-                        nested_vmx_failValid(vcpu,
-                                             VMXERR_VMPTRLD_VMXON_POINTER);
-                        return kvm_skip_emulated_instruction(vcpu);
-                }
-                break;
-        default:
-                return 1; /* shouldn't happen */
-        }
-
-        if (vmpointer)
-                *vmpointer = vmptr;
         return 0;
 }
 
@@ -7066,6 +6990,8 @@ out_msr_bitmap:
 static int handle_vmon(struct kvm_vcpu *vcpu)
 {
         int ret;
+        gpa_t vmptr;
+        struct page *page;
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         const u64 VMXON_NEEDED_FEATURES = FEATURE_CONTROL_LOCKED
                 | FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
@@ -7095,9 +7021,37 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
                 return 1;
         }
 
-        if (nested_vmx_check_vmptr(vcpu, EXIT_REASON_VMON, NULL))
+        if (nested_vmx_get_vmptr(vcpu, &vmptr))
                 return 1;
- 
+
+        /*
+         * SDM 3: 24.11.5
+         * The first 4 bytes of VMXON region contain the supported
+         * VMCS revision identifier
+         *
+         * Note - IA32_VMX_BASIC[48] will never be 1 for the nested case;
+         * which replaces physical address width with 32
+         */
+        if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+                nested_vmx_failInvalid(vcpu);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
+        page = nested_get_page(vcpu, vmptr);
+        if (page == NULL) {
+                nested_vmx_failInvalid(vcpu);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+        if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+                kunmap(page);
+                nested_release_page_clean(page);
+                nested_vmx_failInvalid(vcpu);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+        kunmap(page);
+        nested_release_page_clean(page);
+
+        vmx->nested.vmxon_ptr = vmptr;
         ret = enter_vmx_operation(vcpu);
         if (ret)
                 return ret;
@@ -7213,9 +7167,19 @@ static int handle_vmclear(struct kvm_vcpu *vcpu)
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
 
-        if (nested_vmx_check_vmptr(vcpu, EXIT_REASON_VMCLEAR, &vmptr))
+        if (nested_vmx_get_vmptr(vcpu, &vmptr))
                 return 1;
 
+        if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+                nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_INVALID_ADDRESS);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
+        if (vmptr == vmx->nested.vmxon_ptr) {
+                nested_vmx_failValid(vcpu, VMXERR_VMCLEAR_VMXON_POINTER);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
         if (vmptr == vmx->nested.current_vmptr)
                 nested_release_vmcs12(vmx);
 
@@ -7545,9 +7509,19 @@ static int handle_vmptrld(struct kvm_vcpu *vcpu)
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
 
-        if (nested_vmx_check_vmptr(vcpu, EXIT_REASON_VMPTRLD, &vmptr))
+        if (nested_vmx_get_vmptr(vcpu, &vmptr))
                 return 1;
 
+        if (!PAGE_ALIGNED(vmptr) || (vmptr >> cpuid_maxphyaddr(vcpu))) {
+                nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_INVALID_ADDRESS);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
+        if (vmptr == vmx->nested.vmxon_ptr) {
+                nested_vmx_failValid(vcpu, VMXERR_VMPTRLD_VMXON_POINTER);
+                return kvm_skip_emulated_instruction(vcpu);
+        }
+
         if (vmx->nested.current_vmptr != vmptr) {
                 struct vmcs12 *new_vmcs12;
                 struct page *page;
@@ -7913,11 +7887,13 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
 {
         unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
         int cr = exit_qualification & 15;
-        int reg = (exit_qualification >> 8) & 15;
-        unsigned long val = kvm_register_readl(vcpu, reg);
+        int reg;
+        unsigned long val;
 
         switch ((exit_qualification >> 4) & 3) {
         case 0: /* mov to cr */
+                reg = (exit_qualification >> 8) & 15;
+                val = kvm_register_readl(vcpu, reg);
                 switch (cr) {
                 case 0:
                         if (vmcs12->cr0_guest_host_mask &
@@ -7972,6 +7948,7 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
                  * lmsw can change bits 1..3 of cr0, and only set bit 0 of
                  * cr0. Other attempted changes are ignored, with no exit.
                  */
+                val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
                 if (vmcs12->cr0_guest_host_mask & 0xe &
                     (val ^ vmcs12->cr0_read_shadow))
                         return true;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 02363e37d4a6..87d3cb901935 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8394,10 +8394,13 @@ static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu)
         if (vcpu->arch.pv.pv_unhalted)
                 return true;
 
-        if (atomic_read(&vcpu->arch.nmi_queued))
+        if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
+            (vcpu->arch.nmi_pending &&
+             kvm_x86_ops->nmi_allowed(vcpu)))
                 return true;
 
-        if (kvm_test_request(KVM_REQ_SMI, vcpu))
+        if (kvm_test_request(KVM_REQ_SMI, vcpu) ||
+            (vcpu->arch.smi_pending && !is_smm(vcpu)))
                 return true;
 
         if (kvm_arch_interrupt_allowed(vcpu) &&
@@ -8604,8 +8607,7 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
         if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED))
                 return true;
         else
-                return !kvm_event_needs_reinjection(vcpu) &&
-                        kvm_x86_ops->interrupt_allowed(vcpu);
+                return kvm_can_do_async_pf(vcpu);
 }
 
 void kvm_arch_start_assignment(struct kvm *kvm)
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 35ea061010a1..0ea8afcb929c 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -162,6 +162,9 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
         if (fixup_exception(regs, trapnr))
                 return;
 
+        if (fixup_bug(regs, trapnr))
+                return;
+
 fail:
         early_printk("PANIC: early exception 0x%02x IP %lx:%lx error %lx cr2 0x%lx\n",
                      (unsigned)trapnr, (unsigned long)regs->cs, regs->ip,
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 302f43fd9c28..adad702b39cd 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -148,7 +148,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index cbc87ea98751..9b3f9fa5b283 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -161,16 +161,16 @@ static int page_size_mask;
 
 static void __init probe_page_size_mask(void)
 {
-#if !defined(CONFIG_KMEMCHECK)
         /*
          * For CONFIG_KMEMCHECK or pagealloc debugging, identity mapping will
          * use small pages.
          * This will simplify cpa(), which otherwise needs to support splitting
          * large pages into small in interrupt context, etc.
          */
-        if (boot_cpu_has(X86_FEATURE_PSE) && !debug_pagealloc_enabled())
+        if (boot_cpu_has(X86_FEATURE_PSE) && !debug_pagealloc_enabled() && !IS_ENABLED(CONFIG_KMEMCHECK))
                 page_size_mask |= 1 << PG_LEVEL_2M;
-#endif
+        else
+                direct_gbpages = 0;
 
         /* Enable PSE if available */
         if (boot_cpu_has(X86_FEATURE_PSE))
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 1dcd2be4cce4..c8520b2c62d2 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -186,7 +186,7 @@ static void cpa_flush_range(unsigned long start, int numpages, int cache)
         unsigned int i, level;
         unsigned long addr;
 
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
         WARN_ON(PAGE_ALIGN(start) != start);
 
         on_each_cpu(__cpa_flush_range, NULL, 1);
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 7e76a4d8304b..43b96f5f78ba 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -828,9 +828,11 @@ static void __init kexec_enter_virtual_mode(void)
 
         /*
          * We don't do virtual mode, since we don't do runtime services, on
-         * non-native EFI
+         * non-native EFI. With efi=old_map, we don't do runtime services in
+         * kexec kernel because in the initial boot something else might
+         * have been mapped at these virtual addresses.
          */
-        if (!efi_is_native()) {
+        if (!efi_is_native() || efi_enabled(EFI_OLD_MEMMAP)) {
                 efi_memmap_unmap();
                 clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
                 return;
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index c488625c9712..eb8dff15a7f6 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -71,11 +71,13 @@ static void __init early_code_mapping_set_exec(int executable)
 
 pgd_t * __init efi_call_phys_prolog(void)
 {
-        unsigned long vaddress;
-        pgd_t *save_pgd;
+        unsigned long vaddr, addr_pgd, addr_p4d, addr_pud;
+        pgd_t *save_pgd, *pgd_k, *pgd_efi;
+        p4d_t *p4d, *p4d_k, *p4d_efi;
+        pud_t *pud;
 
         int pgd;
-        int n_pgds;
+        int n_pgds, i, j;
 
         if (!efi_enabled(EFI_OLD_MEMMAP)) {
                 save_pgd = (pgd_t *)read_cr3();
@@ -88,10 +90,49 @@ pgd_t * __init efi_call_phys_prolog(void)
         n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
         save_pgd = kmalloc_array(n_pgds, sizeof(*save_pgd), GFP_KERNEL);
 
+        /*
+         * Build 1:1 identity mapping for efi=old_map usage. Note that
+         * PAGE_OFFSET is PGDIR_SIZE aligned when KASLR is disabled, while
+         * it is PUD_SIZE ALIGNED with KASLR enabled. So for a given physical
+         * address X, the pud_index(X) != pud_index(__va(X)), we can only copy
+         * PUD entry of __va(X) to fill in pud entry of X to build 1:1 mapping.
+         * This means here we can only reuse the PMD tables of the direct mapping.
+         */
         for (pgd = 0; pgd < n_pgds; pgd++) {
-                save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE);
-                vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
-                set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
+                addr_pgd = (unsigned long)(pgd * PGDIR_SIZE);
+                vaddr = (unsigned long)__va(pgd * PGDIR_SIZE);
+                pgd_efi = pgd_offset_k(addr_pgd);
+                save_pgd[pgd] = *pgd_efi;
+
+                p4d = p4d_alloc(&init_mm, pgd_efi, addr_pgd);
+                if (!p4d) {
+                        pr_err("Failed to allocate p4d table!\n");
+                        goto out;
+                }
+
+                for (i = 0; i < PTRS_PER_P4D; i++) {
+                        addr_p4d = addr_pgd + i * P4D_SIZE;
+                        p4d_efi = p4d + p4d_index(addr_p4d);
+
+                        pud = pud_alloc(&init_mm, p4d_efi, addr_p4d);
+                        if (!pud) {
+                                pr_err("Failed to allocate pud table!\n");
+                                goto out;
+                        }
+
+                        for (j = 0; j < PTRS_PER_PUD; j++) {
+                                addr_pud = addr_p4d + j * PUD_SIZE;
+
+                                if (addr_pud > (max_pfn << PAGE_SHIFT))
+                                        break;
+
+                                vaddr = (unsigned long)__va(addr_pud);
+
+                                pgd_k = pgd_offset_k(vaddr);
+                                p4d_k = p4d_offset(pgd_k, vaddr);
+                                pud[j] = *pud_offset(p4d_k, vaddr);
+                        }
+                }
         }
 out:
         __flush_tlb_all();
@@ -104,8 +145,11 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
         /*
          * After the lock is released, the original page table is restored.
          */
-        int pgd_idx;
+        int pgd_idx, i;
         int nr_pgds;
+        pgd_t *pgd;
+        p4d_t *p4d;
+        pud_t *pud;
 
         if (!efi_enabled(EFI_OLD_MEMMAP)) {
                 write_cr3((unsigned long)save_pgd);
@@ -115,9 +159,28 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd)
 
         nr_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
 
-        for (pgd_idx = 0; pgd_idx < nr_pgds; pgd_idx++)
+        for (pgd_idx = 0; pgd_idx < nr_pgds; pgd_idx++) {
+                pgd = pgd_offset_k(pgd_idx * PGDIR_SIZE);
                 set_pgd(pgd_offset_k(pgd_idx * PGDIR_SIZE), save_pgd[pgd_idx]);
 
+                if (!(pgd_val(*pgd) & _PAGE_PRESENT))
+                        continue;
+
+                for (i = 0; i < PTRS_PER_P4D; i++) {
+                        p4d = p4d_offset(pgd,
+                                         pgd_idx * PGDIR_SIZE + i * P4D_SIZE);
+
+                        if (!(p4d_val(*p4d) & _PAGE_PRESENT))
+                                continue;
+
+                        pud = (pud_t *)p4d_page_vaddr(*p4d);
+                        pud_free(&init_mm, pud);
+                }
+
+                p4d = (p4d_t *)pgd_page_vaddr(*pgd);
+                p4d_free(&init_mm, p4d);
+        }
+
         kfree(save_pgd);
 
         __flush_tlb_all();
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 26615991d69c..e0cf95a83f3f 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -360,6 +360,9 @@ void __init efi_free_boot_services(void)
                 free_bootmem_late(start, size);
         }
 
+        if (!num_entries)
+                return;
+
         new_size = efi.memmap.desc_size * num_entries;
         new_phys = efi_memmap_alloc(num_entries);
         if (!new_phys) {
diff --git a/arch/xtensa/include/asm/irq.h b/arch/xtensa/include/asm/irq.h
index f71f88ea7646..19707db966f1 100644
--- a/arch/xtensa/include/asm/irq.h
+++ b/arch/xtensa/include/asm/irq.h
@@ -29,7 +29,8 @@ static inline void variant_irq_disable(unsigned int irq) { }
 # define PLATFORM_NR_IRQS 0
 #endif
 #define XTENSA_NR_IRQS XCHAL_NUM_INTERRUPTS
-#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS)
+#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS + 1)
+#define XTENSA_PIC_LINUX_IRQ(hwirq) ((hwirq) + 1)
 
 #if VARIANT_NR_IRQS == 0
 static inline void variant_init_irq(void) { }
diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
index a265edd6ac37..99341028cc77 100644
--- a/arch/xtensa/kernel/irq.c
+++ b/arch/xtensa/kernel/irq.c
@@ -34,11 +34,6 @@ asmlinkage void do_IRQ(int hwirq, struct pt_regs *regs)
 {
         int irq = irq_find_mapping(NULL, hwirq);
 
-        if (hwirq >= NR_IRQS) {
-                printk(KERN_EMERG "%s: cannot handle IRQ %d\n",
-                                __func__, hwirq);
-        }
-
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
         /* Debugging check for stack overflow: is there less than 1KB free? */
         {
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 394ef08300b6..33bfa5270d95 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -593,8 +593,7 @@ c_show(struct seq_file *f, void *slot)
                       (ccount_freq/10000) % 100,
                       loops_per_jiffy/(500000/HZ),
                       (loops_per_jiffy/(5000/HZ)) % 100);
-
-        seq_printf(f,"flags\t\t: "
+        seq_puts(f, "flags\t\t: "
 #if XCHAL_HAVE_NMI
                      "nmi "
 #endif
diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c
index 06937928cb72..74afbf02d07e 100644
--- a/arch/xtensa/kernel/syscall.c
+++ b/arch/xtensa/kernel/syscall.c
@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 /* At this point:  (!vmm || addr < vmm->vm_end). */
                 if (TASK_SIZE - len < addr)
                         return -ENOMEM;
-                if (!vmm || addr + len <= vmm->vm_start)
+                if (!vmm || addr + len <= vm_start_gap(vmm))
                         return addr;
                 addr = vmm->vm_end;
                 if (flags & MAP_SHARED)
diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
index 30d9fc21e076..162c77e53ca8 100644
--- a/arch/xtensa/kernel/vmlinux.lds.S
+++ b/arch/xtensa/kernel/vmlinux.lds.S
@@ -118,7 +118,7 @@ SECTIONS
   SECTION_VECTOR (.KernelExceptionVector.text, KERNEL_VECTOR_VADDR)
   SECTION_VECTOR (.UserExceptionVector.literal, USER_VECTOR_VADDR - 4)
   SECTION_VECTOR (.UserExceptionVector.text, USER_VECTOR_VADDR)
-  SECTION_VECTOR (.DoubleExceptionVector.literal, DOUBLEEXC_VECTOR_VADDR - 48)
+  SECTION_VECTOR (.DoubleExceptionVector.literal, DOUBLEEXC_VECTOR_VADDR - 20)
   SECTION_VECTOR (.DoubleExceptionVector.text, DOUBLEEXC_VECTOR_VADDR)
 #endif
 
@@ -306,13 +306,13 @@ SECTIONS
                   .UserExceptionVector.literal)
   SECTION_VECTOR (_DoubleExceptionVector_literal,
                   .DoubleExceptionVector.literal,
-                  DOUBLEEXC_VECTOR_VADDR - 48,
+                  DOUBLEEXC_VECTOR_VADDR - 20,
                   SIZEOF(.UserExceptionVector.text),
                   .UserExceptionVector.text)
   SECTION_VECTOR (_DoubleExceptionVector_text,
                   .DoubleExceptionVector.text,
                   DOUBLEEXC_VECTOR_VADDR,
-                  48,
+                  20,
                   .DoubleExceptionVector.literal)
 
   . = (LOADADDR( .DoubleExceptionVector.text ) + SIZEOF( .DoubleExceptionVector.text ) + 3) & ~ 3;
diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c
index 02e94bb3ad3e..c45b90bb9339 100644
--- a/arch/xtensa/platforms/iss/simdisk.c
+++ b/arch/xtensa/platforms/iss/simdisk.c
@@ -317,8 +317,7 @@ static int __init simdisk_init(void)
         if (simdisk_count > MAX_SIMDISK_COUNT)
                 simdisk_count = MAX_SIMDISK_COUNT;
 
-        sddev = kmalloc(simdisk_count * sizeof(struct simdisk),
-                        GFP_KERNEL);
+        sddev = kmalloc_array(simdisk_count, sizeof(*sddev), GFP_KERNEL);
         if (sddev == NULL)
                 goto out_unregister;
 
diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
index dbeea2b440a1..1fda7e20dfcb 100644
--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
@@ -24,16 +24,18 @@
 
 /* Interrupt configuration. */
 
-#define PLATFORM_NR_IRQS        10
+#define PLATFORM_NR_IRQS        0
 
 /* Default assignment of LX60 devices to external interrupts. */
 
 #ifdef CONFIG_XTENSA_MX
 #define DUART16552_INTNUM       XCHAL_EXTINT3_NUM
 #define OETH_IRQ                XCHAL_EXTINT4_NUM
+#define C67X00_IRQ              XCHAL_EXTINT8_NUM
 #else
 #define DUART16552_INTNUM       XCHAL_EXTINT0_NUM
 #define OETH_IRQ                XCHAL_EXTINT1_NUM
+#define C67X00_IRQ              XCHAL_EXTINT5_NUM
 #endif
 
 /*
@@ -63,5 +65,5 @@
 
 #define C67X00_PADDR            (XCHAL_KIO_PADDR + 0x0D0D0000)
 #define C67X00_SIZE             0x10
-#define C67X00_IRQ              5
+
 #endif /* __XTENSA_XTAVNET_HARDWARE_H */
diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 779be723eb2b..42285f35d313 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -175,8 +175,8 @@ static struct resource ethoc_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [2] = { /* IRQ number */
-                .start = OETH_IRQ,
-                .end   = OETH_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -213,8 +213,8 @@ static struct resource c67x00_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [1] = { /* IRQ number */
-                .start = C67X00_IRQ,
-                .end   = C67X00_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -247,7 +247,7 @@ static struct resource serial_resource = {
 static struct plat_serial8250_port serial_platform_data[] = {
         [0] = {
                 .mapbase        = DUART16552_PADDR,
-                .irq            = DUART16552_INTNUM,
+                .irq            = XTENSA_PIC_LINUX_IRQ(DUART16552_INTNUM),
                 .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST |
                                   UPF_IOREMAP,
                 .iotype         = XCHAL_HAVE_BE ? UPIO_MEM32BE : UPIO_MEM32,
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index c8a32fb345cf..78b2e0db4fb2 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -52,7 +52,7 @@ BFQG_FLAG_FNS(idling)
 BFQG_FLAG_FNS(empty)
 #undef BFQG_FLAG_FNS
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
 {
         unsigned long long now;
@@ -67,7 +67,7 @@ static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
         bfqg_stats_clear_waiting(stats);
 }
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
                                                  struct bfq_group *curr_bfqg)
 {
@@ -81,7 +81,7 @@ static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
         bfqg_stats_mark_waiting(stats);
 }
 
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_end_empty_time(struct bfqg_stats *stats)
 {
         unsigned long long now;
@@ -203,12 +203,30 @@ struct bfq_group *bfqq_group(struct bfq_queue *bfqq)
 
 static void bfqg_get(struct bfq_group *bfqg)
 {
-        return blkg_get(bfqg_to_blkg(bfqg));
+        bfqg->ref++;
 }
 
 void bfqg_put(struct bfq_group *bfqg)
 {
-        return blkg_put(bfqg_to_blkg(bfqg));
+        bfqg->ref--;
+
+        if (bfqg->ref == 0)
+                kfree(bfqg);
+}
+
+static void bfqg_and_blkg_get(struct bfq_group *bfqg)
+{
+        /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */
+        bfqg_get(bfqg);
+
+        blkg_get(bfqg_to_blkg(bfqg));
+}
+
+void bfqg_and_blkg_put(struct bfq_group *bfqg)
+{
+        bfqg_put(bfqg);
+
+        blkg_put(bfqg_to_blkg(bfqg));
 }
 
 void bfqg_stats_update_io_add(struct bfq_group *bfqg, struct bfq_queue *bfqq,
@@ -312,7 +330,11 @@ void bfq_init_entity(struct bfq_entity *entity, struct bfq_group *bfqg)
         if (bfqq) {
                 bfqq->ioprio = bfqq->new_ioprio;
                 bfqq->ioprio_class = bfqq->new_ioprio_class;
-                bfqg_get(bfqg);
+                /*
+                 * Make sure that bfqg and its associated blkg do not
+                 * disappear before entity.
+                 */
+                bfqg_and_blkg_get(bfqg);
         }
         entity->parent = bfqg->my_entity; /* NULL for root group */
         entity->sched_data = &bfqg->sched_data;
@@ -399,6 +421,8 @@ struct blkg_policy_data *bfq_pd_alloc(gfp_t gfp, int node)
                 return NULL;
         }
 
+        /* see comments in bfq_bic_update_cgroup for why refcounting */
+        bfqg_get(bfqg);
         return &bfqg->pd;
 }
 
@@ -426,7 +450,7 @@ void bfq_pd_free(struct blkg_policy_data *pd)
         struct bfq_group *bfqg = pd_to_bfqg(pd);
 
         bfqg_stats_exit(&bfqg->stats);
-        return kfree(bfqg);
+        bfqg_put(bfqg);
 }
 
 void bfq_pd_reset_stats(struct blkg_policy_data *pd)
@@ -496,9 +520,10 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
  * Move @bfqq to @bfqg, deactivating it from its old group and reactivating
  * it on the new one.  Avoid putting the entity on the old group idle tree.
  *
- * Must be called under the queue lock; the cgroup owning @bfqg must
- * not disappear (by now this just means that we are called under
- * rcu_read_lock()).
+ * Must be called under the scheduler lock, to make sure that the blkg
+ * owning @bfqg does not disappear (see comments in
+ * bfq_bic_update_cgroup on guaranteeing the consistency of blkg
+ * objects).
  */
 void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                    struct bfq_group *bfqg)
@@ -519,16 +544,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                 bfq_deactivate_bfqq(bfqd, bfqq, false, false);
         else if (entity->on_st)
                 bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
-        bfqg_put(bfqq_group(bfqq));
+        bfqg_and_blkg_put(bfqq_group(bfqq));
 
-        /*
-         * Here we use a reference to bfqg.  We don't need a refcounter
-         * as the cgroup reference will not be dropped, so that its
-         * destroy() callback will not be invoked.
-         */
         entity->parent = bfqg->my_entity;
         entity->sched_data = &bfqg->sched_data;
-        bfqg_get(bfqg);
+        /* pin down bfqg and its associated blkg  */
+        bfqg_and_blkg_get(bfqg);
 
         if (bfq_bfqq_busy(bfqq)) {
                 bfq_pos_tree_add_move(bfqd, bfqq);
@@ -545,8 +566,9 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
  * @bic: the bic to move.
  * @blkcg: the blk-cgroup to move to.
  *
- * Move bic to blkcg, assuming that bfqd->queue is locked; the caller
- * has to make sure that the reference to cgroup is valid across the call.
+ * Move bic to blkcg, assuming that bfqd->lock is held; which makes
+ * sure that the reference to cgroup is valid across the call (see
+ * comments in bfq_bic_update_cgroup on this issue)
  *
  * NOTE: an alternative approach might have been to store the current
  * cgroup in bfqq and getting a reference to it, reducing the lookup
@@ -604,6 +626,57 @@ void bfq_bic_update_cgroup(struct bfq_io_cq *bic, struct bio *bio)
                 goto out;
 
         bfqg = __bfq_bic_change_cgroup(bfqd, bic, bio_blkcg(bio));
+        /*
+         * Update blkg_path for bfq_log_* functions. We cache this
+         * path, and update it here, for the following
+         * reasons. Operations on blkg objects in blk-cgroup are
+         * protected with the request_queue lock, and not with the
+         * lock that protects the instances of this scheduler
+         * (bfqd->lock). This exposes BFQ to the following sort of
+         * race.
+         *
+         * The blkg_lookup performed in bfq_get_queue, protected
+         * through rcu, may happen to return the address of a copy of
+         * the original blkg. If this is the case, then the
+         * bfqg_and_blkg_get performed in bfq_get_queue, to pin down
+         * the blkg, is useless: it does not prevent blk-cgroup code
+         * from destroying both the original blkg and all objects
+         * directly or indirectly referred by the copy of the
+         * blkg.
+         *
+         * On the bright side, destroy operations on a blkg invoke, as
+         * a first step, hooks of the scheduler associated with the
+         * blkg. And these hooks are executed with bfqd->lock held for
+         * BFQ. As a consequence, for any blkg associated with the
+         * request queue this instance of the scheduler is attached
+         * to, we are guaranteed that such a blkg is not destroyed, and
+         * that all the pointers it contains are consistent, while we
+         * are holding bfqd->lock. A blkg_lookup performed with
+         * bfqd->lock held then returns a fully consistent blkg, which
+         * remains consistent until this lock is held.
+         *
+         * Thanks to the last fact, and to the fact that: (1) bfqg has
+         * been obtained through a blkg_lookup in the above
+         * assignment, and (2) bfqd->lock is being held, here we can
+         * safely use the policy data for the involved blkg (i.e., the
+         * field bfqg->pd) to get to the blkg associated with bfqg,
+         * and then we can safely use any field of blkg. After we
+         * release bfqd->lock, even just getting blkg through this
+         * bfqg may cause dangling references to be traversed, as
+         * bfqg->pd may not exist any more.
+         *
+         * In view of the above facts, here we cache, in the bfqg, any
+         * blkg data we may need for this bic, and for its associated
+         * bfq_queue. As of now, we need to cache only the path of the
+         * blkg, which is used in the bfq_log_* functions.
+         *
+         * Finally, note that bfqg itself needs to be protected from
+         * destruction on the blkg_free of the original blkg (which
+         * invokes bfq_pd_free). We use an additional private
+         * refcounter for bfqg, to let it disappear only after no
+         * bfq_queue refers to it any longer.
+         */
+        blkg_path(bfqg_to_blkg(bfqg), bfqg->blkg_path, sizeof(bfqg->blkg_path));
         bic->blkcg_serial_nr = serial_nr;
 out:
         rcu_read_unlock();
@@ -640,8 +713,6 @@ static void bfq_reparent_leaf_entity(struct bfq_data *bfqd,
  * @bfqd: the device data structure with the root group.
  * @bfqg: the group to move from.
  * @st: the service tree with the entities.
- *
- * Needs queue_lock to be taken and reference to be valid over the call.
  */
 static void bfq_reparent_active_entities(struct bfq_data *bfqd,
                                          struct bfq_group *bfqg,
@@ -692,8 +763,7 @@ void bfq_pd_offline(struct blkg_policy_data *pd)
                 /*
                  * The idle tree may still contain bfq_queues belonging
                  * to exited task because they never migrated to a different
-                 * cgroup from the one being destroyed now.  No one else
-                 * can access them so it's safe to act without any lock.
+                 * cgroup from the one being destroyed now.
                  */
                 bfq_flush_idle_tree(st);
 
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 08ce45096350..ed93da2462ab 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -3665,7 +3665,7 @@ void bfq_put_queue(struct bfq_queue *bfqq)
 
         kmem_cache_free(bfq_pool, bfqq);
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-        bfqg_put(bfqg);
+        bfqg_and_blkg_put(bfqg);
 #endif
 }
 
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index ae783c06dfd9..5c3bf9861492 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -759,6 +759,12 @@ struct bfq_group {
         /* must be the first member */
         struct blkg_policy_data pd;
 
+        /* cached path for this blkg (see comments in bfq_bic_update_cgroup) */
+        char blkg_path[128];
+
+        /* reference counter (see comments in bfq_bic_update_cgroup) */
+        int ref;
+
         struct bfq_entity entity;
         struct bfq_sched_data sched_data;
 
@@ -838,7 +844,7 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
 struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node);
-void bfqg_put(struct bfq_group *bfqg);
+void bfqg_and_blkg_put(struct bfq_group *bfqg);
 
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
 extern struct cftype bfq_blkcg_legacy_files[];
@@ -910,20 +916,13 @@ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 
 #define bfq_log_bfqq(bfqd, bfqq, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqq_group(bfqq)), __pbuf, sizeof(__pbuf)); \
-        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid, \
+        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid,\
                         bfq_bfqq_sync((bfqq)) ? 'S' : 'A',              \
-                          __pbuf, ##args);                              \
+                        bfqq_group(bfqq)->blkg_path, ##args);           \
 } while (0)
 
-#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqg), __pbuf, sizeof(__pbuf));          \
-        blk_add_trace_msg((bfqd)->queue, "%s " fmt, __pbuf, ##args);    \
-} while (0)
+#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  \
+        blk_add_trace_msg((bfqd)->queue, "%s " fmt, (bfqg)->blkg_path, ##args)
 
 #else /* CONFIG_BFQ_GROUP_IOSCHED */
 
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 5384713d48bc..b5009a896a7f 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *bio)
         if (bio_op(bio) != REQ_OP_READ && bio_op(bio) != REQ_OP_WRITE)
                 return false;
 
+        if (!bio_sectors(bio))
+                return false;
+
         /* Already protected? */
         if (bio_integrity(bio))
                 return false;
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 7c2947128f58..0480892e97e5 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -74,7 +74,7 @@ static void blkg_free(struct blkcg_gq *blkg)
                         blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
 
         if (blkg->blkcg != &blkcg_root)
-                blk_exit_rl(&blkg->rl);
+                blk_exit_rl(blkg->q, &blkg->rl);
 
         blkg_rwstat_exit(&blkg->stat_ios);
         blkg_rwstat_exit(&blkg->stat_bytes);
diff --git a/block/blk-core.c b/block/blk-core.c
index c7068520794b..a7421b772d0e 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -648,13 +648,19 @@ int blk_init_rl(struct request_list *rl, struct request_queue *q,
         if (!rl->rq_pool)
                 return -ENOMEM;
 
+        if (rl != &q->root_rl)
+                WARN_ON_ONCE(!blk_get_queue(q));
+
         return 0;
 }
 
-void blk_exit_rl(struct request_list *rl)
+void blk_exit_rl(struct request_queue *q, struct request_list *rl)
 {
-        if (rl->rq_pool)
+        if (rl->rq_pool) {
                 mempool_destroy(rl->rq_pool);
+                if (rl != &q->root_rl)
+                        blk_put_queue(q);
+        }
 }
 
 struct request_queue *blk_alloc_queue(gfp_t gfp_mask)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a69ad122ed66..121aa1dbb192 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -628,25 +628,6 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q,
 }
 EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
 
-void blk_mq_abort_requeue_list(struct request_queue *q)
-{
-        unsigned long flags;
-        LIST_HEAD(rq_list);
-
-        spin_lock_irqsave(&q->requeue_lock, flags);
-        list_splice_init(&q->requeue_list, &rq_list);
-        spin_unlock_irqrestore(&q->requeue_lock, flags);
-
-        while (!list_empty(&rq_list)) {
-                struct request *rq;
-
-                rq = list_first_entry(&rq_list, struct request, queuelist);
-                list_del_init(&rq->queuelist);
-                blk_mq_end_request(rq, -EIO);
-        }
-}
-EXPORT_SYMBOL(blk_mq_abort_requeue_list);
-
 struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag)
 {
         if (tag < tags->nr_tags) {
@@ -945,14 +926,14 @@ static bool reorder_tags_to_front(struct list_head *list)
         return first != NULL;
 }
 
-static int blk_mq_dispatch_wake(wait_queue_t *wait, unsigned mode, int flags,
+static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode, int flags,
                                 void *key)
 {
         struct blk_mq_hw_ctx *hctx;
 
         hctx = container_of(wait, struct blk_mq_hw_ctx, dispatch_wait);
 
-        list_del(&wait->task_list);
+        list_del(&wait->entry);
         clear_bit_unlock(BLK_MQ_S_TAG_WAITING, &hctx->state);
         blk_mq_run_hw_queue(hctx, true);
         return 1;
@@ -1480,22 +1461,28 @@ static blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx, struct request *rq)
         return blk_tag_to_qc_t(rq->internal_tag, hctx->queue_num, true);
 }
 
-static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
-                                      bool may_sleep)
+static void __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
+                                        struct request *rq,
+                                        blk_qc_t *cookie, bool may_sleep)
 {
         struct request_queue *q = rq->q;
         struct blk_mq_queue_data bd = {
                 .rq = rq,
                 .last = true,
         };
-        struct blk_mq_hw_ctx *hctx;
         blk_qc_t new_cookie;
         int ret;
+        bool run_queue = true;
+
+        if (blk_mq_hctx_stopped(hctx)) {
+                run_queue = false;
+                goto insert;
+        }
 
         if (q->elevator)
                 goto insert;
 
-        if (!blk_mq_get_driver_tag(rq, &hctx, false))
+        if (!blk_mq_get_driver_tag(rq, NULL, false))
                 goto insert;
 
         new_cookie = request_to_qc_t(hctx, rq);
@@ -1519,7 +1506,7 @@ static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
 
         __blk_mq_requeue_request(rq);
 insert:
-        blk_mq_sched_insert_request(rq, false, true, false, may_sleep);
+        blk_mq_sched_insert_request(rq, false, run_queue, false, may_sleep);
 }
 
 static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
@@ -1527,7 +1514,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
 {
         if (!(hctx->flags & BLK_MQ_F_BLOCKING)) {
                 rcu_read_lock();
-                __blk_mq_try_issue_directly(rq, cookie, false);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, false);
                 rcu_read_unlock();
         } else {
                 unsigned int srcu_idx;
@@ -1535,7 +1522,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                 might_sleep();
 
                 srcu_idx = srcu_read_lock(&hctx->queue_rq_srcu);
-                __blk_mq_try_issue_directly(rq, cookie, true);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, true);
                 srcu_read_unlock(&hctx->queue_rq_srcu, srcu_idx);
         }
 }
@@ -1638,9 +1625,12 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
                 blk_mq_put_ctx(data.ctx);
 
-                if (same_queue_rq)
+                if (same_queue_rq) {
+                        data.hctx = blk_mq_map_queue(q,
+                                        same_queue_rq->mq_ctx->cpu);
                         blk_mq_try_issue_directly(data.hctx, same_queue_rq,
                                         &cookie);
+                }
         } else if (q->nr_hw_queues > 1 && is_sync) {
                 blk_mq_put_ctx(data.ctx);
                 blk_mq_bio_to_request(rq, bio);
@@ -2660,7 +2650,8 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
         return ret;
 }
 
-void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
+static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
+                                                        int nr_hw_queues)
 {
         struct request_queue *q;
 
@@ -2684,6 +2675,13 @@ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
         list_for_each_entry(q, &set->tag_list, tag_set_list)
                 blk_mq_unfreeze_queue(q);
 }
+
+void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
+{
+        mutex_lock(&set->tag_list_lock);
+        __blk_mq_update_nr_hw_queues(set, nr_hw_queues);
+        mutex_unlock(&set->tag_list_lock);
+}
 EXPORT_SYMBOL_GPL(blk_mq_update_nr_hw_queues);
 
 /* Enable polling stats and return whether they were already enabled. */
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 504fee940052..27aceab1cc31 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -777,24 +777,25 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head)
 }
 
 /**
- * blk_release_queue: - release a &struct request_queue when it is no longer needed
- * @kobj:    the kobj belonging to the request queue to be released
+ * __blk_release_queue - release a request queue when it is no longer needed
+ * @work: pointer to the release_work member of the request queue to be released
  *
  * Description:
- *     blk_release_queue is the pair to blk_init_queue() or
- *     blk_queue_make_request().  It should be called when a request queue is
- *     being released; typically when a block device is being de-registered.
- *     Currently, its primary task it to free all the &struct request
- *     structures that were allocated to the queue and the queue itself.
+ *     blk_release_queue is the counterpart of blk_init_queue(). It should be
+ *     called when a request queue is being released; typically when a block
+ *     device is being de-registered. Its primary task it to free the queue
+ *     itself.
  *
- * Note:
+ * Notes:
  *     The low level driver must have finished any outstanding requests first
  *     via blk_cleanup_queue().
- **/
-static void blk_release_queue(struct kobject *kobj)
+ *
+ *     Although blk_release_queue() may be called with preemption disabled,
+ *     __blk_release_queue() may sleep.
+ */
+static void __blk_release_queue(struct work_struct *work)
 {
-        struct request_queue *q =
-                container_of(kobj, struct request_queue, kobj);
+        struct request_queue *q = container_of(work, typeof(*q), release_work);
 
         if (test_bit(QUEUE_FLAG_POLL_STATS, &q->queue_flags))
                 blk_stat_remove_callback(q, q->poll_cb);
@@ -809,7 +810,7 @@ static void blk_release_queue(struct kobject *kobj)
 
         blk_free_queue_stats(q->stats);
 
-        blk_exit_rl(&q->root_rl);
+        blk_exit_rl(q, &q->root_rl);
 
         if (q->queue_tags)
                 __blk_queue_free_tags(q);
@@ -834,6 +835,15 @@ static void blk_release_queue(struct kobject *kobj)
         call_rcu(&q->rcu_head, blk_free_queue_rcu);
 }
 
+static void blk_release_queue(struct kobject *kobj)
+{
+        struct request_queue *q =
+                container_of(kobj, struct request_queue, kobj);
+
+        INIT_WORK(&q->release_work, __blk_release_queue);
+        schedule_work(&q->release_work);
+}
+
 static const struct sysfs_ops queue_sysfs_ops = {
         .show   = queue_attr_show,
         .store  = queue_attr_store,
@@ -887,10 +897,10 @@ int blk_register_queue(struct gendisk *disk)
                 goto unlock;
         }
 
-        if (q->mq_ops)
+        if (q->mq_ops) {
                 __blk_mq_register_dev(dev, q);
-
-        blk_mq_debugfs_register(q);
+                blk_mq_debugfs_register(q);
+        }
 
         kobject_uevent(&q->kobj, KOBJ_ADD);
 
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index b78db2e5fdff..a7285bf2831c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -22,11 +22,18 @@ static int throtl_quantum = 32;
 #define DFL_THROTL_SLICE_HD (HZ / 10)
 #define DFL_THROTL_SLICE_SSD (HZ / 50)
 #define MAX_THROTL_SLICE (HZ)
-#define DFL_IDLE_THRESHOLD_SSD (1000L) /* 1 ms */
-#define DFL_IDLE_THRESHOLD_HD (100L * 1000) /* 100 ms */
 #define MAX_IDLE_TIME (5L * 1000 * 1000) /* 5 s */
-/* default latency target is 0, eg, guarantee IO latency by default */
-#define DFL_LATENCY_TARGET (0)
+#define MIN_THROTL_BPS (320 * 1024)
+#define MIN_THROTL_IOPS (10)
+#define DFL_LATENCY_TARGET (-1L)
+#define DFL_IDLE_THRESHOLD (0)
+#define DFL_HD_BASELINE_LATENCY (4000L) /* 4ms */
+#define LATENCY_FILTERED_SSD (0)
+/*
+ * For HD, very small latency comes from sequential IO. Such IO is helpless to
+ * help determine if its IO is impacted by others, hence we ignore the IO
+ */
+#define LATENCY_FILTERED_HD (1000L) /* 1ms */
 
 #define SKIP_LATENCY (((u64)1) << BLK_STAT_RES_SHIFT)
 
@@ -157,6 +164,7 @@ struct throtl_grp {
         unsigned long last_check_time;
 
         unsigned long latency_target; /* us */
+        unsigned long latency_target_conf; /* us */
         /* When did we start a new slice */
         unsigned long slice_start[2];
         unsigned long slice_end[2];
@@ -165,6 +173,7 @@ struct throtl_grp {
         unsigned long checked_last_finish_time; /* ns / 1024 */
         unsigned long avg_idletime; /* ns / 1024 */
         unsigned long idletime_threshold; /* us */
+        unsigned long idletime_threshold_conf; /* us */
 
         unsigned int bio_cnt; /* total bios */
         unsigned int bad_bio_cnt; /* bios exceeding latency threshold */
@@ -201,8 +210,6 @@ struct throtl_data
         unsigned int limit_index;
         bool limit_valid[LIMIT_CNT];
 
-        unsigned long dft_idletime_threshold; /* us */
-
         unsigned long low_upgrade_time;
         unsigned long low_downgrade_time;
 
@@ -212,6 +219,7 @@ struct throtl_data
         struct avg_latency_bucket avg_buckets[LATENCY_BUCKET_SIZE];
         struct latency_bucket __percpu *latency_buckets;
         unsigned long last_calculate_time;
+        unsigned long filtered_latency;
 
         bool track_bio_latency;
 };
@@ -294,8 +302,14 @@ static uint64_t tg_bps_limit(struct throtl_grp *tg, int rw)
 
         td = tg->td;
         ret = tg->bps[rw][td->limit_index];
-        if (ret == 0 && td->limit_index == LIMIT_LOW)
-                return tg->bps[rw][LIMIT_MAX];
+        if (ret == 0 && td->limit_index == LIMIT_LOW) {
+                /* intermediate node or iops isn't 0 */
+                if (!list_empty(&blkg->blkcg->css.children) ||
+                    tg->iops[rw][td->limit_index])
+                        return U64_MAX;
+                else
+                        return MIN_THROTL_BPS;
+        }
 
         if (td->limit_index == LIMIT_MAX && tg->bps[rw][LIMIT_LOW] &&
             tg->bps[rw][LIMIT_LOW] != tg->bps[rw][LIMIT_MAX]) {
@@ -315,10 +329,17 @@ static unsigned int tg_iops_limit(struct throtl_grp *tg, int rw)
 
         if (cgroup_subsys_on_dfl(io_cgrp_subsys) && !blkg->parent)
                 return UINT_MAX;
+
         td = tg->td;
         ret = tg->iops[rw][td->limit_index];
-        if (ret == 0 && tg->td->limit_index == LIMIT_LOW)
-                return tg->iops[rw][LIMIT_MAX];
+        if (ret == 0 && tg->td->limit_index == LIMIT_LOW) {
+                /* intermediate node or bps isn't 0 */
+                if (!list_empty(&blkg->blkcg->css.children) ||
+                    tg->bps[rw][td->limit_index])
+                        return UINT_MAX;
+                else
+                        return MIN_THROTL_IOPS;
+        }
 
         if (td->limit_index == LIMIT_MAX && tg->iops[rw][LIMIT_LOW] &&
             tg->iops[rw][LIMIT_LOW] != tg->iops[rw][LIMIT_MAX]) {
@@ -482,6 +503,9 @@ static struct blkg_policy_data *throtl_pd_alloc(gfp_t gfp, int node)
         /* LIMIT_LOW will have default value 0 */
 
         tg->latency_target = DFL_LATENCY_TARGET;
+        tg->latency_target_conf = DFL_LATENCY_TARGET;
+        tg->idletime_threshold = DFL_IDLE_THRESHOLD;
+        tg->idletime_threshold_conf = DFL_IDLE_THRESHOLD;
 
         return &tg->pd;
 }
@@ -510,8 +534,6 @@ static void throtl_pd_init(struct blkg_policy_data *pd)
         if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent)
                 sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue;
         tg->td = td;
-
-        tg->idletime_threshold = td->dft_idletime_threshold;
 }
 
 /*
@@ -684,7 +706,7 @@ static void throtl_dequeue_tg(struct throtl_grp *tg)
 static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
                                           unsigned long expires)
 {
-        unsigned long max_expire = jiffies + 8 * sq_to_tg(sq)->td->throtl_slice;
+        unsigned long max_expire = jiffies + 8 * sq_to_td(sq)->throtl_slice;
 
         /*
          * Since we are adjusting the throttle limit dynamically, the sleep
@@ -1349,7 +1371,7 @@ static int tg_print_conf_uint(struct seq_file *sf, void *v)
         return 0;
 }
 
-static void tg_conf_updated(struct throtl_grp *tg)
+static void tg_conf_updated(struct throtl_grp *tg, bool global)
 {
         struct throtl_service_queue *sq = &tg->service_queue;
         struct cgroup_subsys_state *pos_css;
@@ -1367,8 +1389,26 @@ static void tg_conf_updated(struct throtl_grp *tg)
          * restrictions in the whole hierarchy and allows them to bypass
          * blk-throttle.
          */
-        blkg_for_each_descendant_pre(blkg, pos_css, tg_to_blkg(tg))
-                tg_update_has_rules(blkg_to_tg(blkg));
+        blkg_for_each_descendant_pre(blkg, pos_css,
+                        global ? tg->td->queue->root_blkg : tg_to_blkg(tg)) {
+                struct throtl_grp *this_tg = blkg_to_tg(blkg);
+                struct throtl_grp *parent_tg;
+
+                tg_update_has_rules(this_tg);
+                /* ignore root/second level */
+                if (!cgroup_subsys_on_dfl(io_cgrp_subsys) || !blkg->parent ||
+                    !blkg->parent->parent)
+                        continue;
+                parent_tg = blkg_to_tg(blkg->parent);
+                /*
+                 * make sure all children has lower idle time threshold and
+                 * higher latency target
+                 */
+                this_tg->idletime_threshold = min(this_tg->idletime_threshold,
+                                parent_tg->idletime_threshold);
+                this_tg->latency_target = max(this_tg->latency_target,
+                                parent_tg->latency_target);
+        }
 
         /*
          * We're already holding queue_lock and know @tg is valid.  Let's
@@ -1413,7 +1453,7 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of,
         else
                 *(unsigned int *)((void *)tg + of_cft(of)->private) = v;
 
-        tg_conf_updated(tg);
+        tg_conf_updated(tg, false);
         ret = 0;
 out_finish:
         blkg_conf_finish(&ctx);
@@ -1497,34 +1537,34 @@ static u64 tg_prfill_limit(struct seq_file *sf, struct blkg_policy_data *pd,
             tg->iops_conf[READ][off] == iops_dft &&
             tg->iops_conf[WRITE][off] == iops_dft &&
             (off != LIMIT_LOW ||
-             (tg->idletime_threshold == tg->td->dft_idletime_threshold &&
-              tg->latency_target == DFL_LATENCY_TARGET)))
+             (tg->idletime_threshold_conf == DFL_IDLE_THRESHOLD &&
+              tg->latency_target_conf == DFL_LATENCY_TARGET)))
                 return 0;
 
-        if (tg->bps_conf[READ][off] != bps_dft)
+        if (tg->bps_conf[READ][off] != U64_MAX)
                 snprintf(bufs[0], sizeof(bufs[0]), "%llu",
                         tg->bps_conf[READ][off]);
-        if (tg->bps_conf[WRITE][off] != bps_dft)
+        if (tg->bps_conf[WRITE][off] != U64_MAX)
                 snprintf(bufs[1], sizeof(bufs[1]), "%llu",
                         tg->bps_conf[WRITE][off]);
-        if (tg->iops_conf[READ][off] != iops_dft)
+        if (tg->iops_conf[READ][off] != UINT_MAX)
                 snprintf(bufs[2], sizeof(bufs[2]), "%u",
                         tg->iops_conf[READ][off]);
-        if (tg->iops_conf[WRITE][off] != iops_dft)
+        if (tg->iops_conf[WRITE][off] != UINT_MAX)
                 snprintf(bufs[3], sizeof(bufs[3]), "%u",
                         tg->iops_conf[WRITE][off]);
         if (off == LIMIT_LOW) {
-                if (tg->idletime_threshold == ULONG_MAX)
+                if (tg->idletime_threshold_conf == ULONG_MAX)
                         strcpy(idle_time, " idle=max");
                 else
                         snprintf(idle_time, sizeof(idle_time), " idle=%lu",
-                                tg->idletime_threshold);
+                                tg->idletime_threshold_conf);
 
-                if (tg->latency_target == ULONG_MAX)
+                if (tg->latency_target_conf == ULONG_MAX)
                         strcpy(latency_time, " latency=max");
                 else
                         snprintf(latency_time, sizeof(latency_time),
-                                " latency=%lu", tg->latency_target);
+                                " latency=%lu", tg->latency_target_conf);
         }
 
         seq_printf(sf, "%s rbps=%s wbps=%s riops=%s wiops=%s%s%s\n",
@@ -1563,8 +1603,8 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of,
         v[2] = tg->iops_conf[READ][index];
         v[3] = tg->iops_conf[WRITE][index];
 
-        idle_time = tg->idletime_threshold;
-        latency_time = tg->latency_target;
+        idle_time = tg->idletime_threshold_conf;
+        latency_time = tg->latency_target_conf;
         while (true) {
                 char tok[27];   /* wiops=18446744073709551616 */
                 char *p;
@@ -1623,17 +1663,33 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of,
                 tg->iops_conf[READ][LIMIT_MAX]);
         tg->iops[WRITE][LIMIT_LOW] = min(tg->iops_conf[WRITE][LIMIT_LOW],
                 tg->iops_conf[WRITE][LIMIT_MAX]);
+        tg->idletime_threshold_conf = idle_time;
+        tg->latency_target_conf = latency_time;
+
+        /* force user to configure all settings for low limit  */
+        if (!(tg->bps[READ][LIMIT_LOW] || tg->iops[READ][LIMIT_LOW] ||
+              tg->bps[WRITE][LIMIT_LOW] || tg->iops[WRITE][LIMIT_LOW]) ||
+            tg->idletime_threshold_conf == DFL_IDLE_THRESHOLD ||
+            tg->latency_target_conf == DFL_LATENCY_TARGET) {
+                tg->bps[READ][LIMIT_LOW] = 0;
+                tg->bps[WRITE][LIMIT_LOW] = 0;
+                tg->iops[READ][LIMIT_LOW] = 0;
+                tg->iops[WRITE][LIMIT_LOW] = 0;
+                tg->idletime_threshold = DFL_IDLE_THRESHOLD;
+                tg->latency_target = DFL_LATENCY_TARGET;
+        } else if (index == LIMIT_LOW) {
+                tg->idletime_threshold = tg->idletime_threshold_conf;
+                tg->latency_target = tg->latency_target_conf;
+        }
 
-        if (index == LIMIT_LOW) {
-                blk_throtl_update_limit_valid(tg->td);
-                if (tg->td->limit_valid[LIMIT_LOW])
+        blk_throtl_update_limit_valid(tg->td);
+        if (tg->td->limit_valid[LIMIT_LOW]) {
+                if (index == LIMIT_LOW)
                         tg->td->limit_index = LIMIT_LOW;
-                tg->idletime_threshold = (idle_time == ULONG_MAX) ?
-                        ULONG_MAX : idle_time;
-                tg->latency_target = (latency_time == ULONG_MAX) ?
-                        ULONG_MAX : latency_time;
-        }
-        tg_conf_updated(tg);
+        } else
+                tg->td->limit_index = LIMIT_MAX;
+        tg_conf_updated(tg, index == LIMIT_LOW &&
+                tg->td->limit_valid[LIMIT_LOW]);
         ret = 0;
 out_finish:
         blkg_conf_finish(&ctx);
@@ -1722,17 +1778,25 @@ static bool throtl_tg_is_idle(struct throtl_grp *tg)
         /*
          * cgroup is idle if:
          * - single idle is too long, longer than a fixed value (in case user
-         *   configure a too big threshold) or 4 times of slice
+         *   configure a too big threshold) or 4 times of idletime threshold
          * - average think time is more than threshold
          * - IO latency is largely below threshold
          */
-        unsigned long time = jiffies_to_usecs(4 * tg->td->throtl_slice);
-
-        time = min_t(unsigned long, MAX_IDLE_TIME, time);
-        return (ktime_get_ns() >> 10) - tg->last_finish_time > time ||
-               tg->avg_idletime > tg->idletime_threshold ||
-               (tg->latency_target && tg->bio_cnt &&
+        unsigned long time;
+        bool ret;
+
+        time = min_t(unsigned long, MAX_IDLE_TIME, 4 * tg->idletime_threshold);
+        ret = tg->latency_target == DFL_LATENCY_TARGET ||
+              tg->idletime_threshold == DFL_IDLE_THRESHOLD ||
+              (ktime_get_ns() >> 10) - tg->last_finish_time > time ||
+              tg->avg_idletime > tg->idletime_threshold ||
+              (tg->latency_target && tg->bio_cnt &&
                 tg->bad_bio_cnt * 5 < tg->bio_cnt);
+        throtl_log(&tg->service_queue,
+                "avg_idle=%ld, idle_threshold=%ld, bad_bio=%d, total_bio=%d, is_idle=%d, scale=%d",
+                tg->avg_idletime, tg->idletime_threshold, tg->bad_bio_cnt,
+                tg->bio_cnt, ret, tg->td->scale);
+        return ret;
 }
 
 static bool throtl_tg_can_upgrade(struct throtl_grp *tg)
@@ -1828,6 +1892,7 @@ static void throtl_upgrade_state(struct throtl_data *td)
         struct cgroup_subsys_state *pos_css;
         struct blkcg_gq *blkg;
 
+        throtl_log(&td->service_queue, "upgrade to max");
         td->limit_index = LIMIT_MAX;
         td->low_upgrade_time = jiffies;
         td->scale = 0;
@@ -1850,6 +1915,7 @@ static void throtl_downgrade_state(struct throtl_data *td, int new)
 {
         td->scale /= 2;
 
+        throtl_log(&td->service_queue, "downgrade, scale %d", td->scale);
         if (td->scale) {
                 td->low_upgrade_time = jiffies - td->scale * td->throtl_slice;
                 return;
@@ -2023,6 +2089,11 @@ static void throtl_update_latency_buckets(struct throtl_data *td)
                 td->avg_buckets[i].valid = true;
                 last_latency = td->avg_buckets[i].latency;
         }
+
+        for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                throtl_log(&td->service_queue,
+                        "Latency bucket %d: latency=%ld, valid=%d", i,
+                        td->avg_buckets[i].latency, td->avg_buckets[i].valid);
 }
 #else
 static inline void throtl_update_latency_buckets(struct throtl_data *td)
@@ -2218,7 +2289,7 @@ void blk_throtl_bio_endio(struct bio *bio)
                 throtl_track_latency(tg->td, blk_stat_size(&bio->bi_issue_stat),
                         bio_op(bio), lat);
 
-        if (tg->latency_target) {
+        if (tg->latency_target && lat >= tg->td->filtered_latency) {
                 int bucket;
                 unsigned int threshold;
 
@@ -2354,18 +2425,19 @@ void blk_throtl_exit(struct request_queue *q)
 void blk_throtl_register_queue(struct request_queue *q)
 {
         struct throtl_data *td;
-        struct cgroup_subsys_state *pos_css;
-        struct blkcg_gq *blkg;
+        int i;
 
         td = q->td;
         BUG_ON(!td);
 
         if (blk_queue_nonrot(q)) {
                 td->throtl_slice = DFL_THROTL_SLICE_SSD;
-                td->dft_idletime_threshold = DFL_IDLE_THRESHOLD_SSD;
+                td->filtered_latency = LATENCY_FILTERED_SSD;
         } else {
                 td->throtl_slice = DFL_THROTL_SLICE_HD;
-                td->dft_idletime_threshold = DFL_IDLE_THRESHOLD_HD;
+                td->filtered_latency = LATENCY_FILTERED_HD;
+                for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                        td->avg_buckets[i].latency = DFL_HD_BASELINE_LATENCY;
         }
 #ifndef CONFIG_BLK_DEV_THROTTLING_LOW
         /* if no low limit, use previous default */
@@ -2375,18 +2447,6 @@ void blk_throtl_register_queue(struct request_queue *q)
         td->track_bio_latency = !q->mq_ops && !q->request_fn;
         if (!td->track_bio_latency)
                 blk_stat_enable_accounting(q);
-
-        /*
-         * some tg are created before queue is fully initialized, eg, nonrot
-         * isn't initialized yet
-         */
-        rcu_read_lock();
-        blkg_for_each_descendant_post(blkg, pos_css, q->root_blkg) {
-                struct throtl_grp *tg = blkg_to_tg(blkg);
-
-                tg->idletime_threshold = td->dft_idletime_threshold;
-        }
-        rcu_read_unlock();
 }
 
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
diff --git a/block/blk-wbt.c b/block/blk-wbt.c
index 17676f4d7fd1..6a9a0f03a67b 100644
--- a/block/blk-wbt.c
+++ b/block/blk-wbt.c
@@ -503,7 +503,7 @@ static inline unsigned int get_limit(struct rq_wb *rwb, unsigned long rw)
 }
 
 static inline bool may_queue(struct rq_wb *rwb, struct rq_wait *rqw,
-                             wait_queue_t *wait, unsigned long rw)
+                             wait_queue_entry_t *wait, unsigned long rw)
 {
         /*
          * inc it here even if disabled, since we'll dec it at completion.
@@ -520,7 +520,7 @@ static inline bool may_queue(struct rq_wb *rwb, struct rq_wait *rqw,
          * in line to be woken up, wait for our turn.
          */
         if (waitqueue_active(&rqw->wait) &&
-            rqw->wait.task_list.next != &wait->task_list)
+            rqw->wait.head.next != &wait->entry)
                 return false;
 
         return atomic_inc_below(&rqw->inflight, get_limit(rwb, rw));
diff --git a/block/blk.h b/block/blk.h
index 2ed70228e44f..83c8e1100525 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -59,7 +59,7 @@ void blk_free_flush_queue(struct blk_flush_queue *q);
 
 int blk_init_rl(struct request_list *rl, struct request_queue *q,
                 gfp_t gfp_mask);
-void blk_exit_rl(struct request_list *rl);
+void blk_exit_rl(struct request_queue *q, struct request_list *rl);
 void blk_rq_bio_prep(struct request_queue *q, struct request *rq,
                         struct bio *bio);
 void blk_queue_bypass_start(struct request_queue *q);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index da69b079725f..b7e9c7feeab2 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -38,9 +38,13 @@ static const u64 cfq_target_latency = (u64)NSEC_PER_SEC * 3/10; /* 300 ms */
 static const int cfq_hist_divisor = 4;
 
 /*
- * offset from end of service tree
+ * offset from end of queue service tree for idle class
  */
 #define CFQ_IDLE_DELAY          (NSEC_PER_SEC / 5)
+/* offset from end of group service tree under time slice mode */
+#define CFQ_SLICE_MODE_GROUP_DELAY (NSEC_PER_SEC / 5)
+/* offset from end of group service under IOPS mode */
+#define CFQ_IOPS_MODE_GROUP_DELAY (HZ / 5)
 
 /*
  * below this threshold, we consider thinktime immediate
@@ -1362,6 +1366,14 @@ cfq_group_service_tree_add(struct cfq_rb_root *st, struct cfq_group *cfqg)
         cfqg->vfraction = max_t(unsigned, vfr, 1);
 }
 
+static inline u64 cfq_get_cfqg_vdisktime_delay(struct cfq_data *cfqd)
+{
+        if (!iops_mode(cfqd))
+                return CFQ_SLICE_MODE_GROUP_DELAY;
+        else
+                return CFQ_IOPS_MODE_GROUP_DELAY;
+}
+
 static void
 cfq_group_notify_queue_add(struct cfq_data *cfqd, struct cfq_group *cfqg)
 {
@@ -1381,7 +1393,8 @@ cfq_group_notify_queue_add(struct cfq_data *cfqd, struct cfq_group *cfqg)
         n = rb_last(&st->rb);
         if (n) {
                 __cfqg = rb_entry_cfqg(n);
-                cfqg->vdisktime = __cfqg->vdisktime + CFQ_IDLE_DELAY;
+                cfqg->vdisktime = __cfqg->vdisktime +
+                        cfq_get_cfqg_vdisktime_delay(cfqd);
         } else
                 cfqg->vdisktime = st->min_vdisktime;
         cfq_group_service_tree_add(st, cfqg);
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index b9faabc75fdb..9bf1484365b2 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -99,7 +99,7 @@ struct kyber_hctx_data {
         struct list_head rqs[KYBER_NUM_DOMAINS];
         unsigned int cur_domain;
         unsigned int batching;
-        wait_queue_t domain_wait[KYBER_NUM_DOMAINS];
+        wait_queue_entry_t domain_wait[KYBER_NUM_DOMAINS];
         atomic_t wait_index[KYBER_NUM_DOMAINS];
 };
 
@@ -385,7 +385,7 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
 
         for (i = 0; i < KYBER_NUM_DOMAINS; i++) {
                 INIT_LIST_HEAD(&khd->rqs[i]);
-                INIT_LIST_HEAD(&khd->domain_wait[i].task_list);
+                INIT_LIST_HEAD(&khd->domain_wait[i].entry);
                 atomic_set(&khd->wait_index[i], 0);
         }
 
@@ -507,12 +507,12 @@ static void kyber_flush_busy_ctxs(struct kyber_hctx_data *khd,
         }
 }
 
-static int kyber_domain_wake(wait_queue_t *wait, unsigned mode, int flags,
+static int kyber_domain_wake(wait_queue_entry_t *wait, unsigned mode, int flags,
                              void *key)
 {
         struct blk_mq_hw_ctx *hctx = READ_ONCE(wait->private);
 
-        list_del_init(&wait->task_list);
+        list_del_init(&wait->entry);
         blk_mq_run_hw_queue(hctx, true);
         return 1;
 }
@@ -523,7 +523,7 @@ static int kyber_get_domain_token(struct kyber_queue_data *kqd,
 {
         unsigned int sched_domain = khd->cur_domain;
         struct sbitmap_queue *domain_tokens = &kqd->domain_tokens[sched_domain];
-        wait_queue_t *wait = &khd->domain_wait[sched_domain];
+        wait_queue_entry_t *wait = &khd->domain_wait[sched_domain];
         struct sbq_wait_state *ws;
         int nr;
 
@@ -536,7 +536,7 @@ static int kyber_get_domain_token(struct kyber_queue_data *kqd,
          * run when one becomes available. Note that this is serialized on
          * khd->lock, but we still need to be careful about the waker.
          */
-        if (list_empty_careful(&wait->task_list)) {
+        if (list_empty_careful(&wait->entry)) {
                 init_waitqueue_func_entry(wait, kyber_domain_wake);
                 wait->private = hctx;
                 ws = sbq_wait_ptr(domain_tokens,
@@ -734,9 +734,9 @@ static int kyber_##name##_waiting_show(void *data, struct seq_file *m)	\
 {                                                                       \
         struct blk_mq_hw_ctx *hctx = data;                              \
         struct kyber_hctx_data *khd = hctx->sched_data;                 \
-        wait_queue_t *wait = &khd->domain_wait[domain];                 \
+        wait_queue_entry_t *wait = &khd->domain_wait[domain];           \
                                                                         \
-        seq_printf(m, "%d\n", !list_empty_careful(&wait->task_list));   \
+        seq_printf(m, "%d\n", !list_empty_careful(&wait->entry));       \
         return 0;                                                       \
 }
 KYBER_DEBUGFS_DOMAIN_ATTRS(KYBER_READ, read)
diff --git a/block/partition-generic.c b/block/partition-generic.c
index ff07b9143ca4..c5ec8246e25e 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -320,8 +320,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
 
         if (info) {
                 struct partition_meta_info *pinfo = alloc_part_info(disk);
-                if (!pinfo)
+                if (!pinfo) {
+                        err = -ENOMEM;
                         goto out_free_stats;
+                }
                 memcpy(pinfo, info, sizeof(*info));
                 p->info = pinfo;
         }
diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c
index 93e7c1b32edd..5610cd537da7 100644
--- a/block/partitions/msdos.c
+++ b/block/partitions/msdos.c
@@ -300,6 +300,8 @@ static void parse_bsd(struct parsed_partitions *state,
                         continue;
                 bsd_start = le32_to_cpu(p->p_offset);
                 bsd_size = le32_to_cpu(p->p_size);
+                if (memcmp(flavour, "bsd\0", 4) == 0)
+                        bsd_start += offset;
                 if (offset == bsd_start && size == bsd_size)
                         /* full parent partition, we have it already */
                         continue;
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index d3a989e718f5..3cd6e12cfc46 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -141,7 +141,7 @@ int public_key_verify_signature(const struct public_key *pkey,
          * signature and returns that to us.
          */
         ret = crypto_akcipher_verify(req);
-        if (ret == -EINPROGRESS) {
+        if ((ret == -EINPROGRESS) || (ret == -EBUSY)) {
                 wait_for_completion(&compl.completion);
                 ret = compl.err;
         }
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 672a94c2c3ff..d178650fd524 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -381,7 +381,7 @@ static int pefile_digest_pe(const void *pebuf, unsigned int pelen,
         }
 
 error:
-        kfree(desc);
+        kzfree(desc);
 error_no_desc:
         crypto_free_shash(tfm);
         kleave(" = %d", ret);
@@ -450,6 +450,6 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
         ret = pefile_digest_pe(pebuf, pelen, &ctx);
 
 error:
-        kfree(ctx.digest);
+        kzfree(ctx.digest);
         return ret;
 }
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index c80765b211cf..dd03fead1ca3 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -102,6 +102,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
                 }
         }
 
+        ret = -ENOMEM;
         cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
         if (!cert->pub->key)
                 goto error_decode;
diff --git a/crypto/drbg.c b/crypto/drbg.c
index fa749f470135..cdb27ac4b226 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1767,9 +1767,8 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                         break;
                 case -EINPROGRESS:
                 case -EBUSY:
-                        ret = wait_for_completion_interruptible(
-                                &drbg->ctr_completion);
-                        if (!ret && !drbg->ctr_async_err) {
+                        wait_for_completion(&drbg->ctr_completion);
+                        if (!drbg->ctr_async_err) {
                                 reinit_completion(&drbg->ctr_completion);
                                 break;
                         }
diff --git a/crypto/gcm.c b/crypto/gcm.c
index b7ad808be3d4..3841b5eafa7e 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -152,10 +152,8 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
 
         err = crypto_skcipher_encrypt(&data->req);
         if (err == -EINPROGRESS || err == -EBUSY) {
-                err = wait_for_completion_interruptible(
-                        &data->result.completion);
-                if (!err)
-                        err = data->result.err;
+                wait_for_completion(&data->result.completion);
+                err = data->result.err;
         }
 
         if (err)
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 5a968a78652b..0d2e98920069 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -416,13 +416,18 @@ acpi_tb_get_table(struct acpi_table_desc *table_desc,
                 }
         }
 
-        table_desc->validation_count++;
-        if (table_desc->validation_count == 0) {
-                ACPI_ERROR((AE_INFO,
-                            "Table %p, Validation count is zero after increment\n",
-                            table_desc));
-                table_desc->validation_count--;
-                return_ACPI_STATUS(AE_LIMIT);
+        if (table_desc->validation_count < ACPI_MAX_TABLE_VALIDATIONS) {
+                table_desc->validation_count++;
+
+                /*
+                 * Detect validation_count overflows to ensure that the warning
+                 * message will only be printed once.
+                 */
+                if (table_desc->validation_count >= ACPI_MAX_TABLE_VALIDATIONS) {
+                        ACPI_WARNING((AE_INFO,
+                                      "Table %p, Validation count overflows\n",
+                                      table_desc));
+                }
         }
 
         *out_table = table_desc->pointer;
@@ -449,13 +454,20 @@ void acpi_tb_put_table(struct acpi_table_desc *table_desc)
 
         ACPI_FUNCTION_TRACE(acpi_tb_put_table);
 
-        if (table_desc->validation_count == 0) {
-                ACPI_WARNING((AE_INFO,
-                              "Table %p, Validation count is zero before decrement\n",
-                              table_desc));
-                return_VOID;
+        if (table_desc->validation_count < ACPI_MAX_TABLE_VALIDATIONS) {
+                table_desc->validation_count--;
+
+                /*
+                 * Detect validation_count underflows to ensure that the warning
+                 * message will only be printed once.
+                 */
+                if (table_desc->validation_count >= ACPI_MAX_TABLE_VALIDATIONS) {
+                        ACPI_WARNING((AE_INFO,
+                                      "Table %p, Validation count underflows\n",
+                                      table_desc));
+                        return_VOID;
+                }
         }
-        table_desc->validation_count--;
 
         if (table_desc->validation_count == 0) {
 
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index e0587c85bafd..ff096d9755b9 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -474,15 +474,6 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                                 return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
                         }
 
-                        /*
-                         * The end_tag opcode must be followed by a zero byte.
-                         * Although this byte is technically defined to be a checksum,
-                         * in practice, all ASL compilers set this byte to zero.
-                         */
-                        if (*(aml + 1) != 0) {
-                                return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
-                        }
-
                         /* Return the pointer to the end_tag if requested */
 
                         if (!user_function) {
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index c5fecf97ee2f..797b28dc7b34 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -666,14 +666,6 @@ static const struct iommu_ops *iort_iommu_xlate(struct device *dev,
         int ret = -ENODEV;
         struct fwnode_handle *iort_fwnode;
 
-        /*
-         * If we already translated the fwspec there
-         * is nothing left to do, return the iommu_ops.
-         */
-        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
-        if (ops)
-                return ops;
-
         if (node) {
                 iort_fwnode = iort_get_fwnode(node);
                 if (!iort_fwnode)
@@ -735,6 +727,14 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         u32 streamid = 0;
         int err;
 
+        /*
+         * If we already translated the fwspec there
+         * is nothing left to do, return the iommu_ops.
+         */
+        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
+        if (ops)
+                return ops;
+
         if (dev_is_pci(dev)) {
                 struct pci_bus *bus = to_pci_dev(dev)->bus;
                 u32 rid;
@@ -782,6 +782,12 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
         if (err)
                 ops = ERR_PTR(err);
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index a9a9ab3399d4..d42eeef9d928 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -782,7 +782,7 @@ static int acpi_battery_update(struct acpi_battery *battery, bool resume)
         if ((battery->state & ACPI_BATTERY_STATE_CRITICAL) ||
             (test_bit(ACPI_BATTERY_ALARM_PRESENT, &battery->flags) &&
             (battery->capacity_now <= battery->alarm)))
-                pm_wakeup_hard_event(&battery->device->dev);
+                pm_wakeup_event(&battery->device->dev, 0);
 
         return result;
 }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 25aba9b107dd..e19f530f1083 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -113,7 +113,7 @@ struct acpi_button {
 
 static BLOCKING_NOTIFIER_HEAD(acpi_lid_notifier);
 static struct acpi_device *lid_device;
-static u8 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
+static u8 lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
 
 static unsigned long lid_report_interval __read_mostly = 500;
 module_param(lid_report_interval, ulong, 0644);
@@ -217,7 +217,7 @@ static int acpi_lid_notify_state(struct acpi_device *device, int state)
         }
 
         if (state)
-                pm_wakeup_hard_event(&device->dev);
+                pm_wakeup_event(&device->dev, 0);
 
         ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, device);
         if (ret == NOTIFY_DONE)
@@ -402,7 +402,7 @@ static void acpi_button_notify(struct acpi_device *device, u32 event)
                 } else {
                         int keycode;
 
-                        pm_wakeup_hard_event(&device->dev);
+                        pm_wakeup_event(&device->dev, 0);
                         if (button->suspended)
                                 break;
 
@@ -534,7 +534,6 @@ static int acpi_button_add(struct acpi_device *device)
                 lid_device = device;
         }
 
-        device_init_wakeup(&device->dev, true);
         printk(KERN_INFO PREFIX "%s [%s]\n", name, acpi_device_bid(device));
         return 0;
 
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 798d5003a039..993fd31394c8 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -24,7 +24,6 @@
 #include <linux/pm_qos.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
-#include <linux/suspend.h>
 
 #include "internal.h"
 
@@ -400,7 +399,7 @@ static void acpi_pm_notify_handler(acpi_handle handle, u32 val, void *not_used)
         mutex_lock(&acpi_pm_notifier_lock);
 
         if (adev->wakeup.flags.notifier_present) {
-                pm_wakeup_ws_event(adev->wakeup.ws, 0, true);
+                __pm_wakeup_event(adev->wakeup.ws, 0);
                 if (adev->wakeup.context.work.func)
                         queue_pm_work(&adev->wakeup.context.work);
         }
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 3ba1c3472cf9..fd86bec98dea 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -26,7 +26,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
         struct nfit_spa *nfit_spa;
 
         /* We only care about memory errors */
-        if (!(mce->status & MCACOD))
+        if (!mce_is_memory_error(mce))
                 return NOTIFY_DONE;
 
         /*
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index e39ec7b7cb67..3a10d7573477 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1371,8 +1371,8 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr)
         iort_set_dma_mask(dev);
 
         iommu = iort_iommu_configure(dev);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
         /*
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index a6574d626340..097d630ab886 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -663,40 +663,14 @@ static int acpi_freeze_prepare(void)
         acpi_os_wait_events_complete();
         if (acpi_sci_irq_valid())
                 enable_irq_wake(acpi_sci_irq);
-
         return 0;
 }
 
-static void acpi_freeze_wake(void)
-{
-        /*
-         * If IRQD_WAKEUP_ARMED is not set for the SCI at this point, it means
-         * that the SCI has triggered while suspended, so cancel the wakeup in
-         * case it has not been a wakeup event (the GPEs will be checked later).
-         */
-        if (acpi_sci_irq_valid() &&
-            !irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
-                pm_system_cancel_wakeup();
-}
-
-static void acpi_freeze_sync(void)
-{
-        /*
-         * Process all pending events in case there are any wakeup ones.
-         *
-         * The EC driver uses the system workqueue, so that one needs to be
-         * flushed too.
-         */
-        acpi_os_wait_events_complete();
-        flush_scheduled_work();
-}
-
 static void acpi_freeze_restore(void)
 {
         acpi_disable_wakeup_devices(ACPI_STATE_S0);
         if (acpi_sci_irq_valid())
                 disable_irq_wake(acpi_sci_irq);
-
         acpi_enable_all_runtime_gpes();
 }
 
@@ -708,8 +682,6 @@ static void acpi_freeze_end(void)
 static const struct platform_freeze_ops acpi_freeze_ops = {
         .begin = acpi_freeze_begin,
         .prepare = acpi_freeze_prepare,
-        .wake = acpi_freeze_wake,
-        .sync = acpi_freeze_sync,
         .restore = acpi_freeze_restore,
         .end = acpi_freeze_end,
 };
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 1b5ee1e0e5a3..e414fabf7315 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -333,14 +333,17 @@ static ssize_t acpi_table_show(struct file *filp, struct kobject *kobj,
             container_of(bin_attr, struct acpi_table_attr, attr);
         struct acpi_table_header *table_header = NULL;
         acpi_status status;
+        ssize_t rc;
 
         status = acpi_get_table(table_attr->name, table_attr->instance,
                                 &table_header);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        return memory_read_from_buffer(buf, count, &offset,
-                                       table_header, table_header->length);
+        rc = memory_read_from_buffer(buf, count, &offset, table_header,
+                        table_header->length);
+        acpi_put_table(table_header);
+        return rc;
 }
 
 static int acpi_table_attr_init(struct kobject *tables_obj,
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 2fc52407306c..c69954023c2e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1364,6 +1364,40 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 {}
 #endif
 
+/*
+ * On the Acer Aspire Switch Alpha 12, sometimes all SATA ports are detected
+ * as DUMMY, or detected but eventually get a "link down" and never get up
+ * again. When this happens, CAP.NP may hold a value of 0x00 or 0x01, and the
+ * port_map may hold a value of 0x00.
+ *
+ * Overriding CAP.NP to 0x02 and the port_map to 0x7 will reveal all 3 ports
+ * and can significantly reduce the occurrence of the problem.
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=189471
+ */
+static void acer_sa5_271_workaround(struct ahci_host_priv *hpriv,
+                                    struct pci_dev *pdev)
+{
+        static const struct dmi_system_id sysids[] = {
+                {
+                        .ident = "Acer Switch Alpha 12",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271")
+                        },
+                },
+                { }
+        };
+
+        if (dmi_check_system(sysids)) {
+                dev_info(&pdev->dev, "enabling Acer Switch Alpha 12 workaround\n");
+                if ((hpriv->saved_cap & 0xC734FF00) == 0xC734FF00) {
+                        hpriv->port_map = 0x7;
+                        hpriv->cap = 0xC734FF02;
+                }
+        }
+}
+
 #ifdef CONFIG_ARM64
 /*
  * Due to ERRATA#22536, ThunderX needs to handle HOST_IRQ_STAT differently.
@@ -1636,6 +1670,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                          "online status unreliable, applying workaround\n");
         }
 
+
+        /* Acer SA5-271 workaround modifies private_data */
+        acer_sa5_271_workaround(hpriv, pdev);
+
         /* CAP.NP sometimes indicate the index of the last enabled
          * port, at other times, that of the last possible port, so
          * determining the maximum port number requires looking at
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index aaa761b9081c..cd2eab6aa92e 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platform_device *pdev,
 
         irq = platform_get_irq(pdev, 0);
         if (irq <= 0) {
-                dev_err(dev, "no irq\n");
-                return -EINVAL;
+                if (irq != -EPROBE_DEFER)
+                        dev_err(dev, "no irq\n");
+                return irq;
         }
 
         hpriv->irq = irq;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2d83b8c75965..e157a0e44419 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6800,7 +6800,7 @@ static int __init ata_parse_force_one(char **cur,
         }
 
         force_ent->port = simple_strtoul(id, &endp, 10);
-        if (p == endp || *endp != '\0') {
+        if (id == endp || *endp != '\0') {
                 *reason = "invalid port/link";
                 return -EINVAL;
         }
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index b66bcda88320..3b2246dded74 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4067,7 +4067,6 @@ static int mv_platform_probe(struct platform_device *pdev)
         struct ata_host *host;
         struct mv_host_priv *hpriv;
         struct resource *res;
-        void __iomem *mmio;
         int n_ports = 0, irq = 0;
         int rc;
         int port;
@@ -4086,9 +4085,8 @@ static int mv_platform_probe(struct platform_device *pdev)
          * Get the register base first
          */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mmio = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(mmio))
-                return PTR_ERR(mmio);
+        if (res == NULL)
+                return -EINVAL;
 
         /* allocate host */
         if (pdev->dev.of_node) {
@@ -4132,7 +4130,12 @@ static int mv_platform_probe(struct platform_device *pdev)
         hpriv->board_idx = chip_soc;
 
         host->iomap = NULL;
-        hpriv->base = mmio - SATAHC0_REG_BASE;
+        hpriv->base = devm_ioremap(&pdev->dev, res->start,
+                                   resource_size(res));
+        if (!hpriv->base)
+                return -ENOMEM;
+
+        hpriv->base -= SATAHC0_REG_BASE;
 
         hpriv->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(hpriv->clk))
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 5d38245a7a73..b7939a2c1fab 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -890,7 +890,10 @@ static int sata_rcar_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "failed to get access to sata clock\n");
                 return PTR_ERR(priv->clk);
         }
-        clk_prepare_enable(priv->clk);
+
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         host = ata_host_alloc(&pdev->dev, 1);
         if (!host) {
@@ -970,8 +973,11 @@ static int sata_rcar_resume(struct device *dev)
         struct ata_host *host = dev_get_drvdata(dev);
         struct sata_rcar_priv *priv = host->private_data;
         void __iomem *base = priv->base;
+        int ret;
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         /* ack and mask */
         iowrite32(0, base + SATAINTSTAT_REG);
@@ -988,8 +994,11 @@ static int sata_rcar_restore(struct device *dev)
 {
         struct ata_host *host = dev_get_drvdata(dev);
         struct sata_rcar_priv *priv = host->private_data;
+        int ret;
 
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
 
         sata_rcar_setup_port(host);
 
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e987a6f55d36..9faee1c893e5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1091,6 +1091,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
         if (async_error)
                 goto Complete;
 
+        if (pm_wakeup_pending()) {
+                async_error = -EBUSY;
+                goto Complete;
+        }
+
         if (dev->power.syscore || dev->power.direct_complete)
                 goto Complete;
 
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 9c36b27996fc..c313b600d356 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -28,8 +28,8 @@ bool events_check_enabled __read_mostly;
 /* First wakeup IRQ seen by the kernel in the last cycle. */
 unsigned int pm_wakeup_irq __read_mostly;
 
-/* If greater than 0 and the system is suspending, terminate the suspend. */
-static atomic_t pm_abort_suspend __read_mostly;
+/* If set and the system is suspending, terminate the suspend. */
+static bool pm_abort_suspend __read_mostly;
 
 /*
  * Combined counters of registered wakeup events and wakeup events in progress.
@@ -855,26 +855,20 @@ bool pm_wakeup_pending(void)
                 pm_print_active_wakeup_sources();
         }
 
-        return ret || atomic_read(&pm_abort_suspend) > 0;
+        return ret || pm_abort_suspend;
 }
 
 void pm_system_wakeup(void)
 {
-        atomic_inc(&pm_abort_suspend);
+        pm_abort_suspend = true;
         freeze_wake();
 }
 EXPORT_SYMBOL_GPL(pm_system_wakeup);
 
-void pm_system_cancel_wakeup(void)
-{
-        atomic_dec(&pm_abort_suspend);
-}
-
-void pm_wakeup_clear(bool reset)
+void pm_wakeup_clear(void)
 {
+        pm_abort_suspend = false;
         pm_wakeup_irq = 0;
-        if (reset)
-                atomic_set(&pm_abort_suspend, 0);
 }
 
 void pm_system_irq_wakeup(unsigned int irq_number)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 28d932906f24..ebbd0c3fe0ed 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -608,6 +608,9 @@ static int loop_switch(struct loop_device *lo, struct file *file)
  */
 static int loop_flush(struct loop_device *lo)
 {
+        /* loop not yet configured, no running thread, nothing to flush */
+        if (lo->lo_state != Lo_bound)
+                return 0;
         return loop_switch(lo, NULL);
 }
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9a7bb2c29447..f3f191ba8ca4 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -937,14 +937,6 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
         return -ENOSPC;
 }
 
-/* Reset all properties of an NBD device */
-static void nbd_reset(struct nbd_device *nbd)
-{
-        nbd->config = NULL;
-        nbd->tag_set.timeout = 0;
-        queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
-}
-
 static void nbd_bdev_reset(struct block_device *bdev)
 {
         if (bdev->bd_openers > 1)
@@ -1029,7 +1021,11 @@ static void nbd_config_put(struct nbd_device *nbd)
                         }
                         kfree(config->socks);
                 }
-                nbd_reset(nbd);
+                kfree(nbd->config);
+                nbd->config = NULL;
+
+                nbd->tag_set.timeout = 0;
+                queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, nbd->disk->queue);
 
                 mutex_unlock(&nbd->config_lock);
                 nbd_put(nbd);
@@ -1483,7 +1479,6 @@ static int nbd_dev_add(int index)
         disk->fops = &nbd_fops;
         disk->private_data = nbd;
         sprintf(disk->disk_name, "nbd%d", index);
-        nbd_reset(nbd);
         add_disk(disk);
         nbd_total_devices++;
         return index;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 454bf9c34882..c16f74547804 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4023,6 +4023,7 @@ static void rbd_queue_workfn(struct work_struct *work)
 
         switch (req_op(rq)) {
         case REQ_OP_DISCARD:
+        case REQ_OP_WRITE_ZEROES:
                 op_type = OBJ_OP_DISCARD;
                 break;
         case REQ_OP_WRITE:
@@ -4420,6 +4421,7 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
         q->limits.discard_granularity = segment_size;
         q->limits.discard_alignment = segment_size;
         blk_queue_max_discard_sectors(q, segment_size / SECTOR_SIZE);
+        blk_queue_max_write_zeroes_sectors(q, segment_size / SECTOR_SIZE);
 
         if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
                 q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index c38cb5b91291..fe850f0567cb 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -602,7 +602,7 @@ static int btmrvl_service_main_thread(void *data)
         struct btmrvl_thread *thread = data;
         struct btmrvl_private *priv = thread->priv;
         struct btmrvl_adapter *adapter = priv->adapter;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct sk_buff *skb;
         ulong flags;
 
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index d165af8abe36..a5c6cfe71a8e 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -821,7 +821,7 @@ static ssize_t ipmi_read(struct file *file,
                          loff_t      *ppos)
 {
         int          rv = 0;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if (count <= 0)
                 return 0;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6e0cbe092220..593a8818aca9 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -343,7 +343,7 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma)
         phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
 
         /* It's illegal to wrap around the end of the physical address space. */
-        if (offset + (phys_addr_t)size < offset)
+        if (offset + (phys_addr_t)size - 1 < offset)
                 return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index d4dbd8d8e524..382c864814d9 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -374,7 +374,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
 
         rc = write_sync_reg(SCR_HOST_TO_READER_START, dev);
         if (rc <= 0) {
-                DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
+                DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                 if (rc == -ERESTARTSYS)
                         return rc;
@@ -387,7 +387,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
         for (i = 0; i < bytes_to_write; i++) {
                 rc = wait_for_bulk_out_ready(dev);
                 if (rc <= 0) {
-                        DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n",
+                        DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2zx\n",
                                rc);
                         DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                         if (rc == -ERESTARTSYS)
@@ -403,7 +403,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
         rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev);
 
         if (rc <= 0) {
-                DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc);
+                DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc);
                 DEBUGP(2, dev, "<- cm4040_write (failed)\n");
                 if (rc == -ERESTARTSYS)
                         return rc;
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0ab024918907..e870f329db88 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1,6 +1,9 @@
 /*
  * random.c -- A strong random number generator
  *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All
+ * Rights Reserved.
+ *
  * Copyright Matt Mackall <mpm@selenic.com>, 2003, 2004, 2005
  *
  * Copyright Theodore Ts'o, 1994, 1995, 1996, 1997, 1998, 1999.  All
@@ -762,6 +765,8 @@ static DECLARE_WAIT_QUEUE_HEAD(crng_init_wait);
 static struct crng_state **crng_node_pool __read_mostly;
 #endif
 
+static void invalidate_batched_entropy(void);
+
 static void crng_initialize(struct crng_state *crng)
 {
         int             i;
@@ -799,6 +804,7 @@ static int crng_fast_load(const char *cp, size_t len)
                 cp++; crng_init_cnt++; len--;
         }
         if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) {
+                invalidate_batched_entropy();
                 crng_init = 1;
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: fast init done\n");
@@ -836,6 +842,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         memzero_explicit(&buf, sizeof(buf));
         crng->init_time = jiffies;
         if (crng == &primary_crng && crng_init < 2) {
+                invalidate_batched_entropy();
                 crng_init = 2;
                 process_random_ready_list();
                 wake_up_interruptible(&crng_init_wait);
@@ -1097,12 +1104,16 @@ static void add_interrupt_bench(cycles_t start)
 static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
 {
         __u32 *ptr = (__u32 *) regs;
+        unsigned int idx;
 
         if (regs == NULL)
                 return 0;
-        if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
-                f->reg_idx = 0;
-        return *(ptr + f->reg_idx++);
+        idx = READ_ONCE(f->reg_idx);
+        if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
+                idx = 0;
+        ptr += idx++;
+        WRITE_ONCE(f->reg_idx, idx);
+        return *ptr;
 }
 
 void add_interrupt_randomness(int irq, int irq_flags)
@@ -2019,6 +2030,7 @@ struct batched_entropy {
         };
         unsigned int position;
 };
+static rwlock_t batched_entropy_reset_lock = __RW_LOCK_UNLOCKED(batched_entropy_reset_lock);
 
 /*
  * Get a random word for internal kernel use only. The quality of the random
@@ -2029,6 +2041,8 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
 u64 get_random_u64(void)
 {
         u64 ret;
+        bool use_lock = crng_init < 2;
+        unsigned long flags;
         struct batched_entropy *batch;
 
 #if BITS_PER_LONG == 64
@@ -2041,11 +2055,15 @@ u64 get_random_u64(void)
 #endif
 
         batch = &get_cpu_var(batched_entropy_u64);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
                 extract_crng((u8 *)batch->entropy_u64);
                 batch->position = 0;
         }
         ret = batch->entropy_u64[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u64);
         return ret;
 }
@@ -2055,22 +2073,45 @@ static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
 u32 get_random_u32(void)
 {
         u32 ret;
+        bool use_lock = crng_init < 2;
+        unsigned long flags;
         struct batched_entropy *batch;
 
         if (arch_get_random_int(&ret))
                 return ret;
 
         batch = &get_cpu_var(batched_entropy_u32);
+        if (use_lock)
+                read_lock_irqsave(&batched_entropy_reset_lock, flags);
         if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
                 extract_crng((u8 *)batch->entropy_u32);
                 batch->position = 0;
         }
         ret = batch->entropy_u32[batch->position++];
+        if (use_lock)
+                read_unlock_irqrestore(&batched_entropy_reset_lock, flags);
         put_cpu_var(batched_entropy_u32);
         return ret;
 }
 EXPORT_SYMBOL(get_random_u32);
 
+/* It's important to invalidate all potential batched entropy that might
+ * be stored before the crng is initialized, which we can do lazily by
+ * simply resetting the counter to zero so that it's re-extracted on the
+ * next usage. */
+static void invalidate_batched_entropy(void)
+{
+        int cpu;
+        unsigned long flags;
+
+        write_lock_irqsave(&batched_entropy_reset_lock, flags);
+        for_each_possible_cpu (cpu) {
+                per_cpu_ptr(&batched_entropy_u32, cpu)->position = 0;
+                per_cpu_ptr(&batched_entropy_u64, cpu)->position = 0;
+        }
+        write_unlock_irqrestore(&batched_entropy_reset_lock, flags);
+}
+
 /**
  * randomize_page - Generate a random, page aligned address
  * @start:      The smallest acceptable address the caller will take.
diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
index 19480bcc7046..2f29ee1a4d00 100644
--- a/drivers/clk/meson/Kconfig
+++ b/drivers/clk/meson/Kconfig
@@ -14,6 +14,7 @@ config COMMON_CLK_MESON8B
 config COMMON_CLK_GXBB
         bool
         depends on COMMON_CLK_AMLOGIC
+        select RESET_CONTROLLER
         help
           Support for the clock controller on AmLogic S905 devices, aka gxbb.
           Say Y if you want peripherals and CPU frequency scaling to work.
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index b0d551a8efe4..eb89c7801f00 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -156,6 +156,7 @@ config SUN8I_R_CCU
         bool "Support for Allwinner SoCs' PRCM CCUs"
         select SUNXI_CCU_DIV
         select SUNXI_CCU_GATE
+        select SUNXI_CCU_MP
         default MACH_SUN8I || (ARCH_SUNXI && ARM64)
 
 endif
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
index 9b3cd24b78d2..061b6fbb4f95 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.h
@@ -31,7 +31,9 @@
 #define CLK_PLL_VIDEO0_2X               8
 #define CLK_PLL_VE                      9
 #define CLK_PLL_DDR0                    10
-#define CLK_PLL_PERIPH0                 11
+
+/* PLL_PERIPH0 exported for PRCM */
+
 #define CLK_PLL_PERIPH0_2X              12
 #define CLK_PLL_PERIPH1                 13
 #define CLK_PLL_PERIPH1_2X              14
diff --git a/drivers/clk/sunxi-ng/ccu-sun5i.c b/drivers/clk/sunxi-ng/ccu-sun5i.c
index 5c476f966a72..5372bf8be5e6 100644
--- a/drivers/clk/sunxi-ng/ccu-sun5i.c
+++ b/drivers/clk/sunxi-ng/ccu-sun5i.c
@@ -243,7 +243,7 @@ static SUNXI_CCU_GATE(ahb_ss_clk,	"ahb-ss",	"ahb",
 static SUNXI_CCU_GATE(ahb_dma_clk,      "ahb-dma",      "ahb",
                       0x060, BIT(6), 0);
 static SUNXI_CCU_GATE(ahb_bist_clk,     "ahb-bist",     "ahb",
-                      0x060, BIT(6), 0);
+                      0x060, BIT(7), 0);
 static SUNXI_CCU_GATE(ahb_mmc0_clk,     "ahb-mmc0",     "ahb",
                       0x060, BIT(8), 0);
 static SUNXI_CCU_GATE(ahb_mmc1_clk,     "ahb-mmc1",     "ahb",
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 89e68d29bf45..df97e25aec76 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -556,7 +556,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(lcd0_ch1_clk, "lcd0-ch1", lcd_ch1_parents,
                                  0x12c, 0, 4, 24, 3, BIT(31),
                                  CLK_SET_RATE_PARENT);
 static SUNXI_CCU_M_WITH_MUX_GATE(lcd1_ch1_clk, "lcd1-ch1", lcd_ch1_parents,
-                                 0x12c, 0, 4, 24, 3, BIT(31),
+                                 0x130, 0, 4, 24, 3, BIT(31),
                                  CLK_SET_RATE_PARENT);
 
 static const char * const csi_sclk_parents[] = { "pll-video0", "pll-video1",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.h b/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
index 85973d1e8165..1b4baea37d81 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.h
@@ -29,7 +29,9 @@
 #define CLK_PLL_VIDEO           6
 #define CLK_PLL_VE              7
 #define CLK_PLL_DDR             8
-#define CLK_PLL_PERIPH0         9
+
+/* PLL_PERIPH0 exported for PRCM */
+
 #define CLK_PLL_PERIPH0_2X      10
 #define CLK_PLL_GPU             11
 #define CLK_PLL_PERIPH1         12
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
index e58706b40ae9..6297add857b5 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@@ -537,7 +537,7 @@ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
         [RST_BUS_EMAC]          =  { 0x2c0, BIT(17) },
         [RST_BUS_HSTIMER]       =  { 0x2c0, BIT(19) },
         [RST_BUS_SPI0]          =  { 0x2c0, BIT(20) },
-        [RST_BUS_OTG]           =  { 0x2c0, BIT(23) },
+        [RST_BUS_OTG]           =  { 0x2c0, BIT(24) },
         [RST_BUS_EHCI0]         =  { 0x2c0, BIT(26) },
         [RST_BUS_OHCI0]         =  { 0x2c0, BIT(29) },
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 0e3f6496524d..26b643d57847 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2468,6 +2468,7 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
         if (!(cpufreq_driver->flags & CPUFREQ_STICKY) &&
             list_empty(&cpufreq_policy_list)) {
                 /* if all ->init() calls failed, unregister */
+                ret = -ENODEV;
                 pr_debug("%s: No CPU initialized for driver %s\n", __func__,
                          driver_data->name);
                 goto err_if_unreg;
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 992f7c20760f..88220ff3e1c2 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -185,8 +185,8 @@ static ssize_t store_down_threshold(struct gov_attr_set *attr_set,
         int ret;
         ret = sscanf(buf, "%u", &input);
 
-        /* cannot be lower than 11 otherwise freq will not fall */
-        if (ret != 1 || input < 11 || input > 100 ||
+        /* cannot be lower than 1 otherwise freq will not fall */
+        if (ret != 1 || input < 1 || input > 100 ||
                         input >= dbs_data->up_threshold)
                 return -EINVAL;
 
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b7de5bd76a31..eb1158532de3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -571,9 +571,10 @@ static inline void update_turbo_state(void)
 static int min_perf_pct_min(void)
 {
         struct cpudata *cpu = all_cpu_data[0];
+        int turbo_pstate = cpu->pstate.turbo_pstate;
 
-        return DIV_ROUND_UP(cpu->pstate.min_pstate * 100,
-                            cpu->pstate.turbo_pstate);
+        return turbo_pstate ?
+                DIV_ROUND_UP(cpu->pstate.min_pstate * 100, turbo_pstate) : 0;
 }
 
 static s16 intel_pstate_get_epb(struct cpudata *cpu_data)
diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
index 1b9bcd76c60e..c2dd43f3f5d8 100644
--- a/drivers/cpufreq/kirkwood-cpufreq.c
+++ b/drivers/cpufreq/kirkwood-cpufreq.c
@@ -127,7 +127,12 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 return PTR_ERR(priv.cpu_clk);
         }
 
-        clk_prepare_enable(priv.cpu_clk);
+        err = clk_prepare_enable(priv.cpu_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare cpuclk\n");
+                return err;
+        }
+
         kirkwood_freq_table[0].frequency = clk_get_rate(priv.cpu_clk) / 1000;
 
         priv.ddr_clk = of_clk_get_by_name(np, "ddrclk");
@@ -137,7 +142,11 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 goto out_cpu;
         }
 
-        clk_prepare_enable(priv.ddr_clk);
+        err = clk_prepare_enable(priv.ddr_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare ddrclk\n");
+                goto out_cpu;
+        }
         kirkwood_freq_table[1].frequency = clk_get_rate(priv.ddr_clk) / 1000;
 
         priv.powersave_clk = of_clk_get_by_name(np, "powersave");
@@ -146,7 +155,11 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
                 err = PTR_ERR(priv.powersave_clk);
                 goto out_ddr;
         }
-        clk_prepare_enable(priv.powersave_clk);
+        err = clk_prepare_enable(priv.powersave_clk);
+        if (err) {
+                dev_err(priv.dev, "Unable to prepare powersave clk\n");
+                goto out_ddr;
+        }
 
         of_node_put(np);
         np = NULL;
diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c
index ffca4fc0061d..ae8eb0359889 100644
--- a/drivers/cpuidle/dt_idle_states.c
+++ b/drivers/cpuidle/dt_idle_states.c
@@ -180,8 +180,10 @@ int dt_init_idle_driver(struct cpuidle_driver *drv,
                 if (!state_node)
                         break;
 
-                if (!of_device_is_available(state_node))
+                if (!of_device_is_available(state_node)) {
+                        of_node_put(state_node);
                         continue;
+                }
 
                 if (!idle_state_valid(state_node, i, cpumask)) {
                         pr_warn("%s idle state not valid, bailing out\n",
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index 6ed32aac8bbe..922d0823f8ec 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -210,9 +210,12 @@ EXPORT_SYMBOL_GPL(kill_dax);
 static struct inode *dax_alloc_inode(struct super_block *sb)
 {
         struct dax_device *dax_dev;
+        struct inode *inode;
 
         dax_dev = kmem_cache_alloc(dax_cache, GFP_KERNEL);
-        return &dax_dev->inode;
+        inode = &dax_dev->inode;
+        inode->i_rdev = 0;
+        return inode;
 }
 
 static struct dax_device *to_dax_dev(struct inode *inode)
@@ -227,7 +230,8 @@ static void dax_i_callback(struct rcu_head *head)
 
         kfree(dax_dev->host);
         dax_dev->host = NULL;
-        ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
+        if (inode->i_rdev)
+                ida_simple_remove(&dax_minor_ida, MINOR(inode->i_rdev));
         kmem_cache_free(dax_cache, dax_dev);
 }
 
@@ -423,6 +427,7 @@ static void init_once(void *_dax_dev)
         struct dax_device *dax_dev = _dax_dev;
         struct inode *inode = &dax_dev->inode;
 
+        memset(dax_dev, 0, sizeof(*dax_dev));
         inode_init_once(inode);
 }
 
diff --git a/drivers/devfreq/event/exynos-nocp.c b/drivers/devfreq/event/exynos-nocp.c
index 5c3e7b11e8a6..f6e7956fc91a 100644
--- a/drivers/devfreq/event/exynos-nocp.c
+++ b/drivers/devfreq/event/exynos-nocp.c
@@ -267,7 +267,11 @@ static int exynos_nocp_probe(struct platform_device *pdev)
         }
         platform_set_drvdata(pdev, nocp);
 
-        clk_prepare_enable(nocp->clk);
+        ret = clk_prepare_enable(nocp->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to prepare ppmu clock\n");
+                return ret;
+        }
 
         pr_info("exynos-nocp: new NoC Probe device registered: %s\n",
                         dev_name(dev));
diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
index 9b7350935b73..d96e3dc71cf8 100644
--- a/drivers/devfreq/event/exynos-ppmu.c
+++ b/drivers/devfreq/event/exynos-ppmu.c
@@ -44,7 +44,7 @@ struct exynos_ppmu {
         { "ppmu-event2-"#name, PPMU_PMNCNT2 },  \
         { "ppmu-event3-"#name, PPMU_PMNCNT3 }
 
-struct __exynos_ppmu_events {
+static struct __exynos_ppmu_events {
         char *name;
         int id;
 } ppmu_events[] = {
@@ -648,7 +648,11 @@ static int exynos_ppmu_probe(struct platform_device *pdev)
                         dev_name(&pdev->dev), desc[i].name);
         }
 
-        clk_prepare_enable(info->ppmu.clk);
+        ret = clk_prepare_enable(info->ppmu.clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to prepare ppmu clock\n");
+                return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index d37e8dda8079..ec240592f5c8 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -201,6 +201,7 @@ struct ep93xx_dma_engine {
         struct dma_device       dma_dev;
         bool                    m2m;
         int                     (*hw_setup)(struct ep93xx_dma_chan *);
+        void                    (*hw_synchronize)(struct ep93xx_dma_chan *);
         void                    (*hw_shutdown)(struct ep93xx_dma_chan *);
         void                    (*hw_submit)(struct ep93xx_dma_chan *);
         int                     (*hw_interrupt)(struct ep93xx_dma_chan *);
@@ -323,6 +324,8 @@ static int m2p_hw_setup(struct ep93xx_dma_chan *edmac)
                 | M2P_CONTROL_ENABLE;
         m2p_set_control(edmac, control);
 
+        edmac->buffer = 0;
+
         return 0;
 }
 
@@ -331,21 +334,27 @@ static inline u32 m2p_channel_state(struct ep93xx_dma_chan *edmac)
         return (readl(edmac->regs + M2P_STATUS) >> 4) & 0x3;
 }
 
-static void m2p_hw_shutdown(struct ep93xx_dma_chan *edmac)
+static void m2p_hw_synchronize(struct ep93xx_dma_chan *edmac)
 {
+        unsigned long flags;
         u32 control;
 
+        spin_lock_irqsave(&edmac->lock, flags);
         control = readl(edmac->regs + M2P_CONTROL);
         control &= ~(M2P_CONTROL_STALLINT | M2P_CONTROL_NFBINT);
         m2p_set_control(edmac, control);
+        spin_unlock_irqrestore(&edmac->lock, flags);
 
         while (m2p_channel_state(edmac) >= M2P_STATE_ON)
-                cpu_relax();
+                schedule();
+}
 
+static void m2p_hw_shutdown(struct ep93xx_dma_chan *edmac)
+{
         m2p_set_control(edmac, 0);
 
-        while (m2p_channel_state(edmac) == M2P_STATE_STALL)
-                cpu_relax();
+        while (m2p_channel_state(edmac) != M2P_STATE_IDLE)
+                dev_warn(chan2dev(edmac), "M2P: Not yet IDLE\n");
 }
 
 static void m2p_fill_desc(struct ep93xx_dma_chan *edmac)
@@ -1161,6 +1170,26 @@ fail:
 }
 
 /**
+ * ep93xx_dma_synchronize - Synchronizes the termination of transfers to the
+ * current context.
+ * @chan: channel
+ *
+ * Synchronizes the DMA channel termination to the current context. When this
+ * function returns it is guaranteed that all transfers for previously issued
+ * descriptors have stopped and and it is safe to free the memory associated
+ * with them. Furthermore it is guaranteed that all complete callback functions
+ * for a previously submitted descriptor have finished running and it is safe to
+ * free resources accessed from within the complete callbacks.
+ */
+static void ep93xx_dma_synchronize(struct dma_chan *chan)
+{
+        struct ep93xx_dma_chan *edmac = to_ep93xx_dma_chan(chan);
+
+        if (edmac->edma->hw_synchronize)
+                edmac->edma->hw_synchronize(edmac);
+}
+
+/**
  * ep93xx_dma_terminate_all - terminate all transactions
  * @chan: channel
  *
@@ -1323,6 +1352,7 @@ static int __init ep93xx_dma_probe(struct platform_device *pdev)
         dma_dev->device_prep_slave_sg = ep93xx_dma_prep_slave_sg;
         dma_dev->device_prep_dma_cyclic = ep93xx_dma_prep_dma_cyclic;
         dma_dev->device_config = ep93xx_dma_slave_config;
+        dma_dev->device_synchronize = ep93xx_dma_synchronize;
         dma_dev->device_terminate_all = ep93xx_dma_terminate_all;
         dma_dev->device_issue_pending = ep93xx_dma_issue_pending;
         dma_dev->device_tx_status = ep93xx_dma_tx_status;
@@ -1340,6 +1370,7 @@ static int __init ep93xx_dma_probe(struct platform_device *pdev)
         } else {
                 dma_cap_set(DMA_PRIVATE, dma_dev->cap_mask);
 
+                edma->hw_synchronize = m2p_hw_synchronize;
                 edma->hw_setup = m2p_hw_setup;
                 edma->hw_shutdown = m2p_hw_shutdown;
                 edma->hw_submit = m2p_hw_submit;
diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
index a28a01fcba67..f3e211f8f6c5 100644
--- a/drivers/dma/mv_xor_v2.c
+++ b/drivers/dma/mv_xor_v2.c
@@ -161,6 +161,7 @@ struct mv_xor_v2_device {
         struct mv_xor_v2_sw_desc *sw_desq;
         int desc_size;
         unsigned int npendings;
+        unsigned int hw_queue_idx;
 };
 
 /**
@@ -214,18 +215,6 @@ static void mv_xor_v2_set_data_buffers(struct mv_xor_v2_device *xor_dev,
 }
 
 /*
- * Return the next available index in the DESQ.
- */
-static int mv_xor_v2_get_desq_write_ptr(struct mv_xor_v2_device *xor_dev)
-{
-        /* read the index for the next available descriptor in the DESQ */
-        u32 reg = readl(xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_ALLOC_OFF);
-
-        return ((reg >> MV_XOR_V2_DMA_DESQ_ALLOC_WRPTR_SHIFT)
-                & MV_XOR_V2_DMA_DESQ_ALLOC_WRPTR_MASK);
-}
-
-/*
  * notify the engine of new descriptors, and update the available index.
  */
 static void mv_xor_v2_add_desc_to_desq(struct mv_xor_v2_device *xor_dev,
@@ -257,22 +246,6 @@ static int mv_xor_v2_set_desc_size(struct mv_xor_v2_device *xor_dev)
         return MV_XOR_V2_EXT_DESC_SIZE;
 }
 
-/*
- * Set the IMSG threshold
- */
-static inline
-void mv_xor_v2_set_imsg_thrd(struct mv_xor_v2_device *xor_dev, int thrd_val)
-{
-        u32 reg;
-
-        reg = readl(xor_dev->dma_base + MV_XOR_V2_DMA_IMSG_THRD_OFF);
-
-        reg &= (~MV_XOR_V2_DMA_IMSG_THRD_MASK << MV_XOR_V2_DMA_IMSG_THRD_SHIFT);
-        reg |= (thrd_val << MV_XOR_V2_DMA_IMSG_THRD_SHIFT);
-
-        writel(reg, xor_dev->dma_base + MV_XOR_V2_DMA_IMSG_THRD_OFF);
-}
-
 static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
 {
         struct mv_xor_v2_device *xor_dev = data;
@@ -288,12 +261,6 @@ static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
         if (!ndescs)
                 return IRQ_NONE;
 
-        /*
-         * Update IMSG threshold, to disable new IMSG interrupts until
-         * end of the tasklet
-         */
-        mv_xor_v2_set_imsg_thrd(xor_dev, MV_XOR_V2_DESC_NUM);
-
         /* schedule a tasklet to handle descriptors callbacks */
         tasklet_schedule(&xor_dev->irq_tasklet);
 
@@ -306,7 +273,6 @@ static irqreturn_t mv_xor_v2_interrupt_handler(int irq, void *data)
 static dma_cookie_t
 mv_xor_v2_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-        int desq_ptr;
         void *dest_hw_desc;
         dma_cookie_t cookie;
         struct mv_xor_v2_sw_desc *sw_desc =
@@ -322,15 +288,15 @@ mv_xor_v2_tx_submit(struct dma_async_tx_descriptor *tx)
         spin_lock_bh(&xor_dev->lock);
         cookie = dma_cookie_assign(tx);
 
-        /* get the next available slot in the DESQ */
-        desq_ptr = mv_xor_v2_get_desq_write_ptr(xor_dev);
-
         /* copy the HW descriptor from the SW descriptor to the DESQ */
-        dest_hw_desc = xor_dev->hw_desq_virt + desq_ptr;
+        dest_hw_desc = xor_dev->hw_desq_virt + xor_dev->hw_queue_idx;
 
         memcpy(dest_hw_desc, &sw_desc->hw_desc, xor_dev->desc_size);
 
         xor_dev->npendings++;
+        xor_dev->hw_queue_idx++;
+        if (xor_dev->hw_queue_idx >= MV_XOR_V2_DESC_NUM)
+                xor_dev->hw_queue_idx = 0;
 
         spin_unlock_bh(&xor_dev->lock);
 
@@ -344,6 +310,7 @@ static struct mv_xor_v2_sw_desc	*
 mv_xor_v2_prep_sw_desc(struct mv_xor_v2_device *xor_dev)
 {
         struct mv_xor_v2_sw_desc *sw_desc;
+        bool found = false;
 
         /* Lock the channel */
         spin_lock_bh(&xor_dev->lock);
@@ -355,19 +322,23 @@ mv_xor_v2_prep_sw_desc(struct mv_xor_v2_device *xor_dev)
                 return NULL;
         }
 
-        /* get a free SW descriptor from the SW DESQ */
-        sw_desc = list_first_entry(&xor_dev->free_sw_desc,
-                                   struct mv_xor_v2_sw_desc, free_list);
+        list_for_each_entry(sw_desc, &xor_dev->free_sw_desc, free_list) {
+                if (async_tx_test_ack(&sw_desc->async_tx)) {
+                        found = true;
+                        break;
+                }
+        }
+
+        if (!found) {
+                spin_unlock_bh(&xor_dev->lock);
+                return NULL;
+        }
+
         list_del(&sw_desc->free_list);
 
         /* Release the channel */
         spin_unlock_bh(&xor_dev->lock);
 
-        /* set the async tx descriptor */
-        dma_async_tx_descriptor_init(&sw_desc->async_tx, &xor_dev->dmachan);
-        sw_desc->async_tx.tx_submit = mv_xor_v2_tx_submit;
-        async_tx_ack(&sw_desc->async_tx);
-
         return sw_desc;
 }
 
@@ -389,6 +360,8 @@ mv_xor_v2_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest,
                 __func__, len, &src, &dest, flags);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         sw_desc->async_tx.flags = flags;
 
@@ -443,6 +416,8 @@ mv_xor_v2_prep_dma_xor(struct dma_chan *chan, dma_addr_t dest, dma_addr_t *src,
                 __func__, src_cnt, len, &dest, flags);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         sw_desc->async_tx.flags = flags;
 
@@ -491,6 +466,8 @@ mv_xor_v2_prep_dma_interrupt(struct dma_chan *chan, unsigned long flags)
                 container_of(chan, struct mv_xor_v2_device, dmachan);
 
         sw_desc = mv_xor_v2_prep_sw_desc(xor_dev);
+        if (!sw_desc)
+                return NULL;
 
         /* set the HW descriptor */
         hw_descriptor = &sw_desc->hw_desc;
@@ -554,7 +531,6 @@ static void mv_xor_v2_tasklet(unsigned long data)
 {
         struct mv_xor_v2_device *xor_dev = (struct mv_xor_v2_device *) data;
         int pending_ptr, num_of_pending, i;
-        struct mv_xor_v2_descriptor *next_pending_hw_desc = NULL;
         struct mv_xor_v2_sw_desc *next_pending_sw_desc = NULL;
 
         dev_dbg(xor_dev->dmadev.dev, "%s %d\n", __func__, __LINE__);
@@ -562,17 +538,10 @@ static void mv_xor_v2_tasklet(unsigned long data)
         /* get the pending descriptors parameters */
         num_of_pending = mv_xor_v2_get_pending_params(xor_dev, &pending_ptr);
 
-        /* next HW descriptor */
-        next_pending_hw_desc = xor_dev->hw_desq_virt + pending_ptr;
-
         /* loop over free descriptors */
         for (i = 0; i < num_of_pending; i++) {
-
-                if (pending_ptr > MV_XOR_V2_DESC_NUM)
-                        pending_ptr = 0;
-
-                if (next_pending_sw_desc != NULL)
-                        next_pending_hw_desc++;
+                struct mv_xor_v2_descriptor *next_pending_hw_desc =
+                        xor_dev->hw_desq_virt + pending_ptr;
 
                 /* get the SW descriptor related to the HW descriptor */
                 next_pending_sw_desc =
@@ -608,15 +577,14 @@ static void mv_xor_v2_tasklet(unsigned long data)
 
                 /* increment the next descriptor */
                 pending_ptr++;
+                if (pending_ptr >= MV_XOR_V2_DESC_NUM)
+                        pending_ptr = 0;
         }
 
         if (num_of_pending != 0) {
                 /* free the descriptores */
                 mv_xor_v2_free_desc_from_desq(xor_dev, num_of_pending);
         }
-
-        /* Update IMSG threshold, to enable new IMSG interrupts */
-        mv_xor_v2_set_imsg_thrd(xor_dev, 0);
 }
 
 /*
@@ -648,9 +616,6 @@ static int mv_xor_v2_descq_init(struct mv_xor_v2_device *xor_dev)
         writel((xor_dev->hw_desq & 0xFFFF00000000) >> 32,
                xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_BAHR_OFF);
 
-        /* enable the DMA engine */
-        writel(0, xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_STOP_OFF);
-
         /*
          * This is a temporary solution, until we activate the
          * SMMU. Set the attributes for reading & writing data buffers
@@ -694,6 +659,9 @@ static int mv_xor_v2_descq_init(struct mv_xor_v2_device *xor_dev)
         reg |= MV_XOR_V2_GLOB_PAUSE_AXI_TIME_DIS_VAL;
         writel(reg, xor_dev->glob_base + MV_XOR_V2_GLOB_PAUSE);
 
+        /* enable the DMA engine */
+        writel(0, xor_dev->dma_base + MV_XOR_V2_DMA_DESQ_STOP_OFF);
+
         return 0;
 }
 
@@ -725,6 +693,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, xor_dev);
 
+        ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40));
+        if (ret)
+                return ret;
+
         xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER)
                 return -EPROBE_DEFER;
@@ -785,8 +757,15 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
 
         /* add all SW descriptors to the free list */
         for (i = 0; i < MV_XOR_V2_DESC_NUM; i++) {
-                xor_dev->sw_desq[i].idx = i;
-                list_add(&xor_dev->sw_desq[i].free_list,
+                struct mv_xor_v2_sw_desc *sw_desc =
+                        xor_dev->sw_desq + i;
+                sw_desc->idx = i;
+                dma_async_tx_descriptor_init(&sw_desc->async_tx,
+                                             &xor_dev->dmachan);
+                sw_desc->async_tx.tx_submit = mv_xor_v2_tx_submit;
+                async_tx_ack(&sw_desc->async_tx);
+
+                list_add(&sw_desc->free_list,
                          &xor_dev->free_sw_desc);
         }
 
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 8b0da7fa520d..e90a7a0d760a 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -3008,7 +3008,8 @@ static int pl330_remove(struct amba_device *adev)
 
         for (i = 0; i < AMBA_NR_IRQS; i++) {
                 irq = adev->irq[i];
-                devm_free_irq(&adev->dev, irq, pl330);
+                if (irq)
+                        devm_free_irq(&adev->dev, irq, pl330);
         }
 
         dma_async_device_unregister(&pl330->ddma);
diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index db41795fe42a..bd261c9e9664 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1287,6 +1287,9 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
         if (desc->hwdescs.use) {
                 dptr = (rcar_dmac_chan_read(chan, RCAR_DMACHCRB) &
                         RCAR_DMACHCRB_DPTR_MASK) >> RCAR_DMACHCRB_DPTR_SHIFT;
+                if (dptr == 0)
+                        dptr = desc->nchunks;
+                dptr--;
                 WARN_ON(dptr >= desc->nchunks);
         } else {
                 running = desc->running;
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 72c649713ace..31a145154e9f 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -117,7 +117,7 @@ struct usb_dmac {
 #define USB_DMASWR                      0x0008
 #define USB_DMASWR_SWR                  (1 << 0)
 #define USB_DMAOR                       0x0060
-#define USB_DMAOR_AE                    (1 << 2)
+#define USB_DMAOR_AE                    (1 << 1)
 #define USB_DMAOR_DME                   (1 << 0)
 
 #define USB_DMASAR                      0x0000
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 44c01390d035..951b6c79f166 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -47,6 +47,7 @@ DEFINE_DMI_ATTR_WITH_SHOW(product_name,		0444, DMI_PRODUCT_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(product_version,      0444, DMI_PRODUCT_VERSION);
 DEFINE_DMI_ATTR_WITH_SHOW(product_serial,       0400, DMI_PRODUCT_SERIAL);
 DEFINE_DMI_ATTR_WITH_SHOW(product_uuid,         0400, DMI_PRODUCT_UUID);
+DEFINE_DMI_ATTR_WITH_SHOW(product_family,       0444, DMI_PRODUCT_FAMILY);
 DEFINE_DMI_ATTR_WITH_SHOW(board_vendor,         0444, DMI_BOARD_VENDOR);
 DEFINE_DMI_ATTR_WITH_SHOW(board_name,           0444, DMI_BOARD_NAME);
 DEFINE_DMI_ATTR_WITH_SHOW(board_version,        0444, DMI_BOARD_VERSION);
@@ -191,6 +192,7 @@ static void __init dmi_id_init_attr_table(void)
         ADD_DMI_ATTR(product_version,   DMI_PRODUCT_VERSION);
         ADD_DMI_ATTR(product_serial,    DMI_PRODUCT_SERIAL);
         ADD_DMI_ATTR(product_uuid,      DMI_PRODUCT_UUID);
+        ADD_DMI_ATTR(product_family,    DMI_PRODUCT_FAMILY);
         ADD_DMI_ATTR(board_vendor,      DMI_BOARD_VENDOR);
         ADD_DMI_ATTR(board_name,        DMI_BOARD_NAME);
         ADD_DMI_ATTR(board_version,     DMI_BOARD_VERSION);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 54be60ead08f..783041964439 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -144,7 +144,7 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
 
         buf = dmi_early_remap(dmi_base, orig_dmi_len);
         if (buf == NULL)
-                return -1;
+                return -ENOMEM;
 
         dmi_decode_table(buf, decode, NULL);
 
@@ -178,7 +178,7 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
         const char *d = (const char *) dm;
         const char *p;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= string)
                 return;
 
         p = dmi_string(dm, d[string]);
@@ -191,13 +191,14 @@ static void __init dmi_save_ident(const struct dmi_header *dm, int slot,
 static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
                 int index)
 {
-        const u8 *d = (u8 *) dm + index;
+        const u8 *d;
         char *s;
         int is_ff = 1, is_00 = 1, i;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= index + 16)
                 return;
 
+        d = (u8 *) dm + index;
         for (i = 0; i < 16 && (is_ff || is_00); i++) {
                 if (d[i] != 0x00)
                         is_00 = 0;
@@ -228,16 +229,17 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot,
 static void __init dmi_save_type(const struct dmi_header *dm, int slot,
                 int index)
 {
-        const u8 *d = (u8 *) dm + index;
+        const u8 *d;
         char *s;
 
-        if (dmi_ident[slot])
+        if (dmi_ident[slot] || dm->length <= index)
                 return;
 
         s = dmi_alloc(4);
         if (!s)
                 return;
 
+        d = (u8 *) dm + index;
         sprintf(s, "%u", *d & 0x7F);
         dmi_ident[slot] = s;
 }
@@ -278,9 +280,13 @@ static void __init dmi_save_devices(const struct dmi_header *dm)
 
 static void __init dmi_save_oem_strings_devices(const struct dmi_header *dm)
 {
-        int i, count = *(u8 *)(dm + 1);
+        int i, count;
         struct dmi_device *dev;
 
+        if (dm->length < 0x05)
+                return;
+
+        count = *(u8 *)(dm + 1);
         for (i = 1; i <= count; i++) {
                 const char *devname = dmi_string(dm, i);
 
@@ -353,6 +359,9 @@ static void __init dmi_save_extended_devices(const struct dmi_header *dm)
         const char *name;
         const u8 *d = (u8 *)dm;
 
+        if (dm->length < 0x0B)
+                return;
+
         /* Skip disabled device */
         if ((d[0x5] & 0x80) == 0)
                 return;
@@ -387,7 +396,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
         const char *d = (const char *)dm;
         static int nr;
 
-        if (dm->type != DMI_ENTRY_MEM_DEVICE)
+        if (dm->type != DMI_ENTRY_MEM_DEVICE || dm->length < 0x12)
                 return;
         if (nr >= dmi_memdev_nr) {
                 pr_warn(FW_BUG "Too many DIMM entries in SMBIOS table\n");
@@ -430,6 +439,7 @@ static void __init dmi_decode(const struct dmi_header *dm, void *dummy)
                 dmi_save_ident(dm, DMI_PRODUCT_VERSION, 6);
                 dmi_save_ident(dm, DMI_PRODUCT_SERIAL, 7);
                 dmi_save_uuid(dm, DMI_PRODUCT_UUID, 8);
+                dmi_save_ident(dm, DMI_PRODUCT_FAMILY, 26);
                 break;
         case 2:         /* Base Board Information */
                 dmi_save_ident(dm, DMI_BOARD_VENDOR, 4);
@@ -649,6 +659,21 @@ void __init dmi_scan_machine(void)
                         goto error;
 
                 /*
+                 * Same logic as above, look for a 64-bit entry point
+                 * first, and if not found, fall back to 32-bit entry point.
+                 */
+                memcpy_fromio(buf, p, 16);
+                for (q = p + 16; q < p + 0x10000; q += 16) {
+                        memcpy_fromio(buf + 16, q, 16);
+                        if (!dmi_smbios3_present(buf)) {
+                                dmi_available = 1;
+                                dmi_early_unmap(p, 0x10000);
+                                goto out;
+                        }
+                        memcpy(buf, buf + 16, 16);
+                }
+
+                /*
                  * Iterate over all possible DMI header addresses q.
                  * Maintain the 32 bytes around q in buf.  On the
                  * first iteration, substitute zero for the
@@ -658,7 +683,7 @@ void __init dmi_scan_machine(void)
                 memset(buf, 0, 16);
                 for (q = p; q < p + 0x10000; q += 16) {
                         memcpy_fromio(buf + 16, q, 16);
-                        if (!dmi_smbios3_present(buf) || !dmi_present(buf)) {
+                        if (!dmi_present(buf)) {
                                 dmi_available = 1;
                                 dmi_early_unmap(p, 0x10000);
                                 goto out;
@@ -992,7 +1017,8 @@ EXPORT_SYMBOL(dmi_get_date);
  *      @decode: Callback function
  *      @private_data: Private data to be passed to the callback function
  *
- *      Returns -1 when the DMI table can't be reached, 0 on success.
+ *      Returns 0 on success, -ENXIO if DMI is not selected or not present,
+ *      or a different negative error code if DMI walking fails.
  */
 int dmi_walk(void (*decode)(const struct dmi_header *, void *),
              void *private_data)
@@ -1000,11 +1026,11 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
         u8 *buf;
 
         if (!dmi_available)
-                return -1;
+                return -ENXIO;
 
         buf = dmi_remap(dmi_base, dmi_len);
         if (buf == NULL)
-                return -1;
+                return -ENOMEM;
 
         dmi_decode_table(buf, decode, private_data);
 
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index 04ca8764f0c0..b58233e4ed71 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -27,6 +27,26 @@ struct bmp_header {
         u32 size;
 } __packed;
 
+static bool efi_bgrt_addr_valid(u64 addr)
+{
+        efi_memory_desc_t *md;
+
+        for_each_efi_memory_desc(md) {
+                u64 size;
+                u64 end;
+
+                if (md->type != EFI_BOOT_SERVICES_DATA)
+                        continue;
+
+                size = md->num_pages << EFI_PAGE_SHIFT;
+                end = md->phys_addr + size;
+                if (addr >= md->phys_addr && addr < end)
+                        return true;
+        }
+
+        return false;
+}
+
 void __init efi_bgrt_init(struct acpi_table_header *table)
 {
         void *image;
@@ -36,6 +56,9 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
         if (acpi_disabled)
                 return;
 
+        if (!efi_enabled(EFI_MEMMAP))
+                return;
+
         if (table->length < sizeof(bgrt_tab)) {
                 pr_notice("Ignoring BGRT: invalid length %u (expected %zu)\n",
                        table->length, sizeof(bgrt_tab));
@@ -62,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                 goto out;
         }
 
+        if (!efi_bgrt_addr_valid(bgrt->image_address)) {
+                pr_notice("Ignoring BGRT: invalid image address\n");
+                goto out;
+        }
         image = early_memremap(bgrt->image_address, sizeof(bmp_header));
         if (!image) {
                 pr_notice("Ignoring BGRT: failed to map image header memory\n");
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 8c34d50a4d80..959777ec8a77 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -16,10 +16,10 @@
 
 /* BIOS variables */
 static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
-static const efi_char16_t const efi_SecureBoot_name[] = {
+static const efi_char16_t efi_SecureBoot_name[] = {
         'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0
 };
-static const efi_char16_t const efi_SetupMode_name[] = {
+static const efi_char16_t efi_SetupMode_name[] = {
         'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0
 };
 
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 1e7860f02f4f..31058d400bda 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -136,12 +136,12 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         info->value = value;
 
         INIT_LIST_HEAD(&info->list);
-        list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
         if (ret)
                 goto free_info_key;
 
+        list_add_tail(&info->list, &sec->attribs);
         return 0;
 
 free_info_key:
@@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec)
         struct vpd_attrib_info *temp;
 
         list_for_each_entry_safe(info, temp, &sec->attribs, list) {
-                kfree(info->key);
                 sysfs_remove_bin_file(sec->kobj, &info->bin_attr);
+                kfree(info->key);
                 kfree(info);
         }
 }
@@ -244,7 +244,7 @@ static int vpd_section_destroy(struct vpd_section *sec)
 {
         if (sec->enabled) {
                 vpd_section_attrib_destroy(sec);
-                kobject_del(sec->kobj);
+                kobject_put(sec->kobj);
                 sysfs_remove_bin_file(vpd_kobj, &sec->bin_attr);
                 kfree(sec->raw_name);
                 iounmap(sec->baseaddr);
@@ -331,7 +331,7 @@ static void __exit vpd_platform_exit(void)
 {
         vpd_section_destroy(&ro_vpd);
         vpd_section_destroy(&rw_vpd);
-        kobject_del(vpd_kobj);
+        kobject_put(vpd_kobj);
 }
 
 module_init(vpd_platform_init);
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index ccea609676ee..4ca436e66bdb 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -646,6 +646,9 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset,
         int rc;
         int i;
 
+        if (!gpio->clk)
+                return -EINVAL;
+
         rc = usecs_to_cycles(gpio, usecs, &requested_cycles);
         if (rc < 0) {
                 dev_warn(chip->parent, "Failed to convert %luus to cycles at %luHz: %d\n",
diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
index 2197368cc899..e60156ec0c18 100644
--- a/drivers/gpio/gpio-crystalcove.c
+++ b/drivers/gpio/gpio-crystalcove.c
@@ -90,8 +90,18 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)
 {
         int reg;
 
-        if (gpio == 94)
-                return GPIOPANELCTL;
+        if (gpio >= CRYSTALCOVE_GPIO_NUM) {
+                /*
+                 * Virtual GPIO called from ACPI, for now we only support
+                 * the panel ctl.
+                 */
+                switch (gpio) {
+                case 0x5e:
+                        return GPIOPANELCTL;
+                default:
+                        return -EOPNOTSUPP;
+                }
+        }
 
         if (reg_type == CTRL_IN) {
                 if (gpio < 8)
@@ -130,36 +140,36 @@ static void crystalcove_update_irq_ctrl(struct crystalcove_gpio *cg, int gpio)
 static int crystalcove_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_INPUT_SET);
+        return regmap_write(cg->regmap, reg, CTLO_INPUT_SET);
 }
 
 static int crystalcove_gpio_dir_out(struct gpio_chip *chip, unsigned gpio,
                                     int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
-                            CTLO_OUTPUT_SET | value);
+        return regmap_write(cg->regmap, reg, CTLO_OUTPUT_SET | value);
 }
 
 static int crystalcove_gpio_get(struct gpio_chip *chip, unsigned gpio)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
-        int ret;
         unsigned int val;
+        int ret, reg = to_reg(gpio, CTRL_IN);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return 0;
 
-        ret = regmap_read(cg->regmap, to_reg(gpio, CTRL_IN), &val);
+        ret = regmap_read(cg->regmap, reg, &val);
         if (ret)
                 return ret;
 
@@ -170,14 +180,15 @@ static void crystalcove_gpio_set(struct gpio_chip *chip,
                                  unsigned gpio, int value)
 {
         struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+        int reg = to_reg(gpio, CTRL_OUT);
 
-        if (gpio > CRYSTALCOVE_VGPIO_NUM)
+        if (reg < 0)
                 return;
 
         if (value)
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 1);
+                regmap_update_bits(cg->regmap, reg, 1, 1);
         else
-                regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 0);
+                regmap_update_bits(cg->regmap, reg, 1, 0);
 }
 
 static int crystalcove_irq_type(struct irq_data *data, unsigned type)
@@ -185,6 +196,9 @@ static int crystalcove_irq_type(struct irq_data *data, unsigned type)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
+        if (data->hwirq >= CRYSTALCOVE_GPIO_NUM)
+                return 0;
+
         switch (type) {
         case IRQ_TYPE_NONE:
                 cg->intcnt_value = CTLI_INTCNT_DIS;
@@ -235,8 +249,10 @@ static void crystalcove_irq_unmask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = false;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = false;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static void crystalcove_irq_mask(struct irq_data *data)
@@ -244,8 +260,10 @@ static void crystalcove_irq_mask(struct irq_data *data)
         struct crystalcove_gpio *cg =
                 gpiochip_get_data(irq_data_get_irq_chip_data(data));
 
-        cg->set_irq_mask = true;
-        cg->update |= UPDATE_IRQ_MASK;
+        if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
+                cg->set_irq_mask = true;
+                cg->update |= UPDATE_IRQ_MASK;
+        }
 }
 
 static struct irq_chip crystalcove_irqchip = {
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 19a92efabbef..5104b6398139 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -747,7 +747,7 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
                 set = U32_MAX;
         else
                 return -EINVAL;
-        writel_relaxed(0, mvebu_gpioreg_blink_counter_select(mvchip));
+        writel_relaxed(set, mvebu_gpioreg_blink_counter_select(mvchip));
 
         mvpwm = devm_kzalloc(dev, sizeof(struct mvebu_pwm), GFP_KERNEL);
         if (!mvpwm)
@@ -768,6 +768,13 @@ static int mvebu_pwm_probe(struct platform_device *pdev,
         mvpwm->chip.dev = dev;
         mvpwm->chip.ops = &mvebu_pwm_ops;
         mvpwm->chip.npwm = mvchip->chip.ngpio;
+        /*
+         * There may already be some PWM allocated, so we can't force
+         * mvpwm->chip.base to a fixed point like mvchip->chip.base.
+         * So, we let pwmchip_add() do the numbering and take the next free
+         * region.
+         */
+        mvpwm->chip.base = -1;
 
         spin_lock_init(&mvpwm->lock);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
index 236d9950221b..c0d8c6ff6380 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
@@ -425,10 +425,15 @@ bool amdgpu_fbdev_robj_is_fb(struct amdgpu_device *adev, struct amdgpu_bo *robj)
 
 void amdgpu_fbdev_restore_mode(struct amdgpu_device *adev)
 {
-        struct amdgpu_fbdev *afbdev = adev->mode_info.rfbdev;
+        struct amdgpu_fbdev *afbdev;
         struct drm_fb_helper *fb_helper;
         int ret;
 
+        if (!adev)
+                return;
+
+        afbdev = adev->mode_info.rfbdev;
+
         if (!afbdev)
                 return;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 07ff3b1514f1..8ecf82c5fe74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -634,7 +634,7 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job)
                 mutex_unlock(&id_mgr->lock);
         }
 
-        if (gds_switch_needed) {
+        if (ring->funcs->emit_gds_switch && gds_switch_needed) {
                 id->gds_base = job->gds_base;
                 id->gds_size = job->gds_size;
                 id->gws_base = job->gws_base;
@@ -672,6 +672,7 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
         struct amdgpu_vm_id_manager *id_mgr = &adev->vm_manager.id_mgr[vmhub];
         struct amdgpu_vm_id *id = &id_mgr->ids[vmid];
 
+        atomic64_set(&id->owner, 0);
         id->gds_base = 0;
         id->gds_size = 0;
         id->gws_base = 0;
@@ -681,6 +682,26 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
 }
 
 /**
+ * amdgpu_vm_reset_all_id - reset VMID to zero
+ *
+ * @adev: amdgpu device structure
+ *
+ * Reset VMID to force flush on next use
+ */
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev)
+{
+        unsigned i, j;
+
+        for (i = 0; i < AMDGPU_MAX_VMHUBS; ++i) {
+                struct amdgpu_vm_id_manager *id_mgr =
+                        &adev->vm_manager.id_mgr[i];
+
+                for (j = 1; j < id_mgr->num_ids; ++j)
+                        amdgpu_vm_reset_id(adev, i, j);
+        }
+}
+
+/**
  * amdgpu_vm_bo_find - find the bo_va for a specific vm & bo
  *
  * @vm: requested vm
@@ -2270,7 +2291,6 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev)
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i)
                 adev->vm_manager.seqno[i] = 0;
 
-
         atomic_set(&adev->vm_manager.vm_pte_next_ring, 0);
         atomic64_set(&adev->vm_manager.client_counter, 0);
         spin_lock_init(&adev->vm_manager.prt_lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index d97e28b4bdc4..e1d951ece433 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -204,6 +204,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
 int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job);
 void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
                         unsigned vmid);
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev);
 int amdgpu_vm_update_directories(struct amdgpu_device *adev,
                                  struct amdgpu_vm *vm);
 int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
index a4831fe0223b..a2c59a08b2bd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
@@ -220,9 +220,9 @@ static void amdgpu_vram_mgr_debug(struct ttm_mem_type_manager *man,
 }
 
 const struct ttm_mem_type_manager_func amdgpu_vram_mgr_func = {
-        amdgpu_vram_mgr_init,
-        amdgpu_vram_mgr_fini,
-        amdgpu_vram_mgr_new,
-        amdgpu_vram_mgr_del,
-        amdgpu_vram_mgr_debug
+        .init           = amdgpu_vram_mgr_init,
+        .takedown       = amdgpu_vram_mgr_fini,
+        .get_node       = amdgpu_vram_mgr_new,
+        .put_node       = amdgpu_vram_mgr_del,
+        .debug          = amdgpu_vram_mgr_debug
 };
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 6dc1410b380f..ec93714e4524 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -906,6 +906,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev)
         u32 vblank_time = amdgpu_dpm_get_vblank_time(adev);
         u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+         * blanking period would allow it
+         */
+        if (amdgpu_dpm_get_vrefresh(adev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 0cdeb6a2e4a0..5dffa27afa45 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1207,8 +1207,11 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 773654a19749..47bbc87f96d2 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1176,8 +1176,11 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
index 1f3552967ba3..d8c9a959493e 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@@ -983,8 +983,11 @@ static void dce_v6_0_program_watermarks(struct amdgpu_device *adev,
         fixed20_12 a, b, c;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index 3c558c170e5e..db30c6ba563a 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1091,8 +1091,11 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev,
         u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
 
         if (amdgpu_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if (adev->pm.dpm_enabled) {
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index a572979f186c..d860939152df 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -950,10 +950,6 @@ static int gmc_v6_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v6_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v6_0_hw_fini(adev);
 
         return 0;
@@ -968,16 +964,9 @@ static int gmc_v6_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v6_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v6_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index a9083a16a250..2750e5c23813 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1117,10 +1117,6 @@ static int gmc_v7_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v7_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v7_0_hw_fini(adev);
 
         return 0;
@@ -1135,16 +1131,9 @@ static int gmc_v7_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v7_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v7_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 4ac99784160a..f56b4089ee9f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1209,10 +1209,6 @@ static int gmc_v8_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v8_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v8_0_hw_fini(adev);
 
         return 0;
@@ -1227,16 +1223,9 @@ static int gmc_v8_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v8_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v8_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index dc1e1c1d6b24..f936332a069d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -791,10 +791,6 @@ static int gmc_v9_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v9_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v9_0_hw_fini(adev);
 
         return 0;
@@ -809,17 +805,9 @@ static int gmc_v9_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v9_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev,
-                                "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v9_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index fb0819359909..90332f55cfba 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -77,13 +77,26 @@ static int vce_v3_0_set_clockgating_state(void *handle,
 static uint64_t vce_v3_0_ring_get_rptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
+        u32 v;
+
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
 
         if (ring == &adev->vce.ring[0])
-                return RREG32(mmVCE_RB_RPTR);
+                v = RREG32(mmVCE_RB_RPTR);
         else if (ring == &adev->vce.ring[1])
-                return RREG32(mmVCE_RB_RPTR2);
+                v = RREG32(mmVCE_RB_RPTR2);
         else
-                return RREG32(mmVCE_RB_RPTR3);
+                v = RREG32(mmVCE_RB_RPTR3);
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
+
+        return v;
 }
 
 /**
@@ -96,13 +109,26 @@ static uint64_t vce_v3_0_ring_get_rptr(struct amdgpu_ring *ring)
 static uint64_t vce_v3_0_ring_get_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
+        u32 v;
+
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
 
         if (ring == &adev->vce.ring[0])
-                return RREG32(mmVCE_RB_WPTR);
+                v = RREG32(mmVCE_RB_WPTR);
         else if (ring == &adev->vce.ring[1])
-                return RREG32(mmVCE_RB_WPTR2);
+                v = RREG32(mmVCE_RB_WPTR2);
         else
-                return RREG32(mmVCE_RB_WPTR3);
+                v = RREG32(mmVCE_RB_WPTR3);
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
+
+        return v;
 }
 
 /**
@@ -116,12 +142,22 @@ static void vce_v3_0_ring_set_wptr(struct amdgpu_ring *ring)
 {
         struct amdgpu_device *adev = ring->adev;
 
+        mutex_lock(&adev->grbm_idx_mutex);
+        if (adev->vce.harvest_config == 0 ||
+                adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE1)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(0));
+        else if (adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0)
+                WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(1));
+
         if (ring == &adev->vce.ring[0])
                 WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
         else if (ring == &adev->vce.ring[1])
                 WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
         else
                 WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
+
+        WREG32(mmGRBM_GFX_INDEX, mmGRBM_GFX_INDEX_DEFAULT);
+        mutex_unlock(&adev->grbm_idx_mutex);
 }
 
 static void vce_v3_0_override_vce_clock_gating(struct amdgpu_device *adev, bool override)
@@ -231,33 +267,38 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
         struct amdgpu_ring *ring;
         int idx, r;
 
-        ring = &adev->vce.ring[0];
-        WREG32(mmVCE_RB_RPTR, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE, ring->ring_size / 4);
-
-        ring = &adev->vce.ring[1];
-        WREG32(mmVCE_RB_RPTR2, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO2, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE2, ring->ring_size / 4);
-
-        ring = &adev->vce.ring[2];
-        WREG32(mmVCE_RB_RPTR3, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
-        WREG32(mmVCE_RB_BASE_LO3, ring->gpu_addr);
-        WREG32(mmVCE_RB_BASE_HI3, upper_32_bits(ring->gpu_addr));
-        WREG32(mmVCE_RB_SIZE3, ring->ring_size / 4);
-
         mutex_lock(&adev->grbm_idx_mutex);
         for (idx = 0; idx < 2; ++idx) {
                 if (adev->vce.harvest_config & (1 << idx))
                         continue;
 
                 WREG32(mmGRBM_GFX_INDEX, GET_VCE_INSTANCE(idx));
+
+                /* Program instance 0 reg space for two instances or instance 0 case
+                program instance 1 reg space for only instance 1 available case */
+                if (idx != 1 || adev->vce.harvest_config == AMDGPU_VCE_HARVEST_VCE0) {
+                        ring = &adev->vce.ring[0];
+                        WREG32(mmVCE_RB_RPTR, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE, ring->ring_size / 4);
+
+                        ring = &adev->vce.ring[1];
+                        WREG32(mmVCE_RB_RPTR2, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR2, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO2, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI2, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE2, ring->ring_size / 4);
+
+                        ring = &adev->vce.ring[2];
+                        WREG32(mmVCE_RB_RPTR3, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_WPTR3, lower_32_bits(ring->wptr));
+                        WREG32(mmVCE_RB_BASE_LO3, ring->gpu_addr);
+                        WREG32(mmVCE_RB_BASE_HI3, upper_32_bits(ring->gpu_addr));
+                        WREG32(mmVCE_RB_SIZE3, ring->ring_size / 4);
+                }
+
                 vce_v3_0_mc_resume(adev, idx);
                 WREG32_FIELD(VCE_STATUS, JOB_BUSY, 1);
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index a74a3db3056c..102eb6d029fa 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2655,6 +2655,28 @@ static int smu7_get_power_state_size(struct pp_hwmgr *hwmgr)
         return sizeof(struct smu7_power_state);
 }
 
+static int smu7_vblank_too_short(struct pp_hwmgr *hwmgr,
+                                 uint32_t vblank_time_us)
+{
+        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+        uint32_t switch_limit_us;
+
+        switch (hwmgr->chip_id) {
+        case CHIP_POLARIS10:
+        case CHIP_POLARIS11:
+        case CHIP_POLARIS12:
+                switch_limit_us = data->is_memory_gddr5 ? 190 : 150;
+                break;
+        default:
+                switch_limit_us = data->is_memory_gddr5 ? 450 : 150;
+                break;
+        }
+
+        if (vblank_time_us < switch_limit_us)
+                return true;
+        else
+                return false;
+}
 
 static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                 struct pp_power_state *request_ps,
@@ -2669,6 +2691,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         bool disable_mclk_switching;
         bool disable_mclk_switching_for_frame_lock;
         struct cgs_display_info info = {0};
+        struct cgs_mode_info mode_info = {0};
         const struct phm_clock_and_voltage_limits *max_limits;
         uint32_t i;
         struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
@@ -2677,6 +2700,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         int32_t count;
         int32_t stable_pstate_sclk = 0, stable_pstate_mclk = 0;
 
+        info.mode_info = &mode_info;
         data->battery_state = (PP_StateUILabel_Battery ==
                         request_ps->classification.ui_label);
 
@@ -2703,8 +2727,6 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
 
         cgs_get_active_displays_info(hwmgr->device, &info);
 
-        /*TO DO result = PHM_CheckVBlankTime(hwmgr, &vblankTooShort);*/
-
         minimum_clocks.engineClock = hwmgr->display_config.min_core_set_clock;
         minimum_clocks.memoryClock = hwmgr->display_config.min_mem_set_clock;
 
@@ -2769,8 +2791,10 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                     PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
 
 
-        disable_mclk_switching = (1 < info.display_count) ||
-                                    disable_mclk_switching_for_frame_lock;
+        disable_mclk_switching = ((1 < info.display_count) ||
+                                  disable_mclk_switching_for_frame_lock ||
+                                  smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+                                  (mode_info.refresh_rate > 120));
 
         sclk = smu7_ps->performance_levels[0].engine_clock;
         mclk = smu7_ps->performance_levels[0].memory_clock;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index ad30f5d3a10d..2614af2f553f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4186,7 +4186,7 @@ static int vega10_force_clock_level(struct pp_hwmgr *hwmgr,
                 enum pp_clock_type type, uint32_t mask)
 {
         struct vega10_hwmgr *data = (struct vega10_hwmgr *)(hwmgr->backend);
-        uint32_t i;
+        int i;
 
         if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL)
                 return -EINVAL;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
index d5f53d04fa08..83e40fe51b62 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c
@@ -709,17 +709,17 @@ static int tf_vega10_thermal_disable_alert(struct pp_hwmgr *hwmgr,
 
 static struct phm_master_table_item
 vega10_thermal_start_thermal_controller_master_list[] = {
-        {NULL, tf_vega10_thermal_initialize},
-        {NULL, tf_vega10_thermal_set_temperature_range},
-        {NULL, tf_vega10_thermal_enable_alert},
+        { .tableFunction = tf_vega10_thermal_initialize },
+        { .tableFunction = tf_vega10_thermal_set_temperature_range },
+        { .tableFunction = tf_vega10_thermal_enable_alert },
 /* We should restrict performance levels to low before we halt the SMC.
  * On the other hand we are still in boot state when we do this
  * so it would be pointless.
  * If this assumption changes we have to revisit this table.
  */
-        {NULL, tf_vega10_thermal_setup_fan_table},
-        {NULL, tf_vega10_thermal_start_smc_fan_control},
-        {NULL, NULL}
+        { .tableFunction = tf_vega10_thermal_setup_fan_table },
+        { .tableFunction = tf_vega10_thermal_start_smc_fan_control },
+        { }
 };
 
 static struct phm_master_table_header
@@ -731,10 +731,10 @@ vega10_thermal_start_thermal_controller_master = {
 
 static struct phm_master_table_item
 vega10_thermal_set_temperature_range_master_list[] = {
-        {NULL, tf_vega10_thermal_disable_alert},
-        {NULL, tf_vega10_thermal_set_temperature_range},
-        {NULL, tf_vega10_thermal_enable_alert},
-        {NULL, NULL}
+        { .tableFunction = tf_vega10_thermal_disable_alert },
+        { .tableFunction = tf_vega10_thermal_set_temperature_range },
+        { .tableFunction = tf_vega10_thermal_enable_alert },
+        { }
 };
 
 struct phm_master_table_header
diff --git a/drivers/gpu/drm/bridge/synopsys/Kconfig b/drivers/gpu/drm/bridge/synopsys/Kconfig
index 40d2827a6d19..53e78d092d18 100644
--- a/drivers/gpu/drm/bridge/synopsys/Kconfig
+++ b/drivers/gpu/drm/bridge/synopsys/Kconfig
@@ -1,6 +1,7 @@
 config DRM_DW_HDMI
         tristate
         select DRM_KMS_HELPER
+        select REGMAP_MMIO
 
 config DRM_DW_HDMI_AHB_AUDIO
         tristate "Synopsys Designware AHB Audio interface"
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 8be9719284b0..aa885a614e27 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -508,6 +508,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
                 bool has_connectors =
                         !!new_crtc_state->connector_mask;
 
+                WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
+
                 if (!drm_mode_equal(&old_crtc_state->mode, &new_crtc_state->mode)) {
                         DRM_DEBUG_ATOMIC("[CRTC:%d:%s] mode changed\n",
                                          crtc->base.id, crtc->name);
@@ -551,6 +553,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
         for_each_oldnew_connector_in_state(state, connector, old_connector_state, new_connector_state, i) {
                 const struct drm_connector_helper_funcs *funcs = connector->helper_private;
 
+                WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
+
                 /*
                  * This only sets crtc->connectors_changed for routing changes,
                  * drivers must set crtc->connectors_changed themselves when
@@ -650,6 +654,8 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
         for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
                 const struct drm_plane_helper_funcs *funcs;
 
+                WARN_ON(!drm_modeset_is_locked(&plane->mutex));
+
                 funcs = plane->helper_private;
 
                 drm_atomic_helper_plane_changed(state, old_plane_state, new_plane_state, plane);
@@ -2663,7 +2669,12 @@ int drm_atomic_helper_resume(struct drm_device *dev,
 
         drm_modeset_acquire_init(&ctx, 0);
         while (1) {
+                err = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (err)
+                        goto out;
+
                 err = drm_atomic_helper_commit_duplicated_state(state, &ctx);
+out:
                 if (err != -EDEADLK)
                         break;
 
diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
index 3e5f52110ea1..213fb837e1c4 100644
--- a/drivers/gpu/drm/drm_dp_helper.c
+++ b/drivers/gpu/drm/drm_dp_helper.c
@@ -1208,3 +1208,86 @@ int drm_dp_stop_crc(struct drm_dp_aux *aux)
         return 0;
 }
 EXPORT_SYMBOL(drm_dp_stop_crc);
+
+struct dpcd_quirk {
+        u8 oui[3];
+        bool is_branch;
+        u32 quirks;
+};
+
+#define OUI(first, second, third) { (first), (second), (third) }
+
+static const struct dpcd_quirk dpcd_quirk_list[] = {
+        /* Analogix 7737 needs reduced M and N at HBR2 link rates */
+        { OUI(0x00, 0x22, 0xb9), true, BIT(DP_DPCD_QUIRK_LIMITED_M_N) },
+};
+
+#undef OUI
+
+/*
+ * Get a bit mask of DPCD quirks for the sink/branch device identified by
+ * ident. The quirk data is shared but it's up to the drivers to act on the
+ * data.
+ *
+ * For now, only the OUI (first three bytes) is used, but this may be extended
+ * to device identification string and hardware/firmware revisions later.
+ */
+static u32
+drm_dp_get_quirks(const struct drm_dp_dpcd_ident *ident, bool is_branch)
+{
+        const struct dpcd_quirk *quirk;
+        u32 quirks = 0;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(dpcd_quirk_list); i++) {
+                quirk = &dpcd_quirk_list[i];
+
+                if (quirk->is_branch != is_branch)
+                        continue;
+
+                if (memcmp(quirk->oui, ident->oui, sizeof(ident->oui)) != 0)
+                        continue;
+
+                quirks |= quirk->quirks;
+        }
+
+        return quirks;
+}
+
+/**
+ * drm_dp_read_desc - read sink/branch descriptor from DPCD
+ * @aux: DisplayPort AUX channel
+ * @desc: Device decriptor to fill from DPCD
+ * @is_branch: true for branch devices, false for sink devices
+ *
+ * Read DPCD 0x400 (sink) or 0x500 (branch) into @desc. Also debug log the
+ * identification.
+ *
+ * Returns 0 on success or a negative error code on failure.
+ */
+int drm_dp_read_desc(struct drm_dp_aux *aux, struct drm_dp_desc *desc,
+                     bool is_branch)
+{
+        struct drm_dp_dpcd_ident *ident = &desc->ident;
+        unsigned int offset = is_branch ? DP_BRANCH_OUI : DP_SINK_OUI;
+        int ret, dev_id_len;
+
+        ret = drm_dp_dpcd_read(aux, offset, ident, sizeof(*ident));
+        if (ret < 0)
+                return ret;
+
+        desc->quirks = drm_dp_get_quirks(ident, is_branch);
+
+        dev_id_len = strnlen(ident->device_id, sizeof(ident->device_id));
+
+        DRM_DEBUG_KMS("DP %s: OUI %*phD dev-ID %*pE HW-rev %d.%d SW-rev %d.%d quirks 0x%04x\n",
+                      is_branch ? "branch" : "sink",
+                      (int)sizeof(ident->oui), ident->oui,
+                      dev_id_len, ident->device_id,
+                      ident->hw_rev >> 4, ident->hw_rev & 0xf,
+                      ident->sw_major_rev, ident->sw_minor_rev,
+                      desc->quirks);
+
+        return 0;
+}
+EXPORT_SYMBOL(drm_dp_read_desc);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index b5c6bb46a425..37b8ad3e30d8 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -358,7 +358,12 @@ EXPORT_SYMBOL(drm_put_dev);
 void drm_unplug_dev(struct drm_device *dev)
 {
         /* for a USB device */
-        drm_dev_unregister(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_modeset_unregister_all(dev);
+
+        drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
 
         mutex_lock(&drm_global_mutex);
 
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index fedd4d60d9cd..5dc8c4350602 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -948,8 +948,6 @@ retry:
         }
 
 out:
-        if (ret && crtc->funcs->page_flip_target)
-                drm_crtc_vblank_put(crtc);
         if (fb)
                 drm_framebuffer_put(fb);
         if (crtc->primary->old_fb)
@@ -964,5 +962,8 @@ out:
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
 
+        if (ret && crtc->funcs->page_flip_target)
+                drm_crtc_vblank_put(crtc);
+
         return ret;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 09d3c4c3c858..50294a7bd29d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -82,14 +82,9 @@ err_file_priv_free:
         return ret;
 }
 
-static void exynos_drm_preclose(struct drm_device *dev,
-                                        struct drm_file *file)
-{
-        exynos_drm_subdrv_close(dev, file);
-}
-
 static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
 {
+        exynos_drm_subdrv_close(dev, file);
         kfree(file->driver_priv);
         file->driver_priv = NULL;
 }
@@ -145,7 +140,6 @@ static struct drm_driver exynos_drm_driver = {
         .driver_features        = DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME
                                   | DRIVER_ATOMIC | DRIVER_RENDER,
         .open                   = exynos_drm_open,
-        .preclose               = exynos_drm_preclose,
         .lastclose              = exynos_drm_lastclose,
         .postclose              = exynos_drm_postclose,
         .gem_free_object_unlocked = exynos_drm_gem_free_object,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index cb3176930596..39c740572034 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -160,12 +160,9 @@ struct exynos_drm_clk {
  *      drm framework doesn't support multiple irq yet.
  *      we can refer to the crtc to current hardware interrupt occurred through
  *      this pipe value.
- * @enabled: if the crtc is enabled or not
- * @event: vblank event that is currently queued for flip
- * @wait_update: wait all pending planes updates to finish
- * @pending_update: number of pending plane updates in this crtc
  * @ops: pointer to callbacks for exynos drm specific functionality
  * @ctx: A pointer to the crtc's implementation specific context
+ * @pipe_clk: A pointer to the crtc's pipeline clock.
  */
 struct exynos_drm_crtc {
         struct drm_crtc                 base;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index fc4fda738906..d404de86d5f9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1633,7 +1633,6 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
 {
         struct device *dev = dsi->dev;
         struct device_node *node = dev->of_node;
-        struct device_node *ep;
         int ret;
 
         ret = exynos_dsi_of_read_u32(node, "samsung,pll-clock-frequency",
@@ -1641,32 +1640,21 @@ static int exynos_dsi_parse_dt(struct exynos_dsi *dsi)
         if (ret < 0)
                 return ret;
 
-        ep = of_graph_get_endpoint_by_regs(node, DSI_PORT_OUT, 0);
-        if (!ep) {
-                dev_err(dev, "no output port with endpoint specified\n");
-                return -EINVAL;
-        }
-
-        ret = exynos_dsi_of_read_u32(ep, "samsung,burst-clock-frequency",
+        ret = exynos_dsi_of_read_u32(node, "samsung,burst-clock-frequency",
                                      &dsi->burst_clk_rate);
         if (ret < 0)
-                goto end;
+                return ret;
 
-        ret = exynos_dsi_of_read_u32(ep, "samsung,esc-clock-frequency",
+        ret = exynos_dsi_of_read_u32(node, "samsung,esc-clock-frequency",
                                      &dsi->esc_clk_rate);
         if (ret < 0)
-                goto end;
-
-        of_node_put(ep);
+                return ret;
 
         dsi->bridge_node = of_graph_get_remote_node(node, DSI_PORT_OUT, 0);
         if (!dsi->bridge_node)
                 return -EINVAL;
 
-end:
-        of_node_put(ep);
-
-        return ret;
+        return 0;
 }
 
 static int exynos_dsi_bind(struct device *dev, struct device *master,
@@ -1817,6 +1805,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
 
 static int exynos_dsi_remove(struct platform_device *pdev)
 {
+        struct exynos_dsi *dsi = platform_get_drvdata(pdev);
+
+        of_node_put(dsi->bridge_node);
+
         pm_runtime_disable(&pdev->dev);
 
         component_del(&pdev->dev, &exynos_dsi_component_ops);
diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c
index 0066fe7e622e..be3eefec5152 100644
--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -759,20 +759,23 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (scan->type & DRM_MODE_TYPE_PREFERRED) {
                         mode_dev->panel_fixed_mode =
                             drm_mode_duplicate(dev, scan);
+                        DRM_DEBUG_KMS("Using mode from DDC\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
 
         /* Failed to get EDID, what about VBT? do we need this? */
-        if (mode_dev->vbt_mode)
+        if (dev_priv->lfp_lvds_vbt_mode) {
                 mode_dev->panel_fixed_mode =
-                    drm_mode_duplicate(dev, mode_dev->vbt_mode);
+                        drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
 
-        if (!mode_dev->panel_fixed_mode)
-                if (dev_priv->lfp_lvds_vbt_mode)
-                        mode_dev->panel_fixed_mode =
-                                drm_mode_duplicate(dev,
-                                        dev_priv->lfp_lvds_vbt_mode);
+                if (mode_dev->panel_fixed_mode) {
+                        mode_dev->panel_fixed_mode->type |=
+                                DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using mode from VBT\n");
+                        goto out;
+                }
+        }
 
         /*
          * If we didn't get EDID, try checking if the panel is already turned
@@ -789,6 +792,7 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (mode_dev->panel_fixed_mode) {
                         mode_dev->panel_fixed_mode->type |=
                             DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using pre-programmed mode\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
diff --git a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
index 5abc69c9630f..f77dcfaade6c 100644
--- a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
+++ b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
@@ -760,7 +760,7 @@ static int dsi_parse_dt(struct platform_device *pdev, struct dw_dsi *dsi)
          * Get the endpoint node. In our case, dsi has one output port1
          * to which the external HDMI bridge is connected.
          */
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, NULL, &dsi->bridge);
+        ret = drm_of_find_panel_or_bridge(np, 1, 0, NULL, &dsi->bridge);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index dca989eb2d42..24fe04d6307b 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -779,8 +779,26 @@ static void init_vgpu_execlist(struct intel_vgpu *vgpu, int ring_id)
         vgpu_vreg(vgpu, ctx_status_ptr_reg) = ctx_status_ptr.dw;
 }
 
+static void clean_workloads(struct intel_vgpu *vgpu, unsigned long engine_mask)
+{
+        struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+        struct intel_engine_cs *engine;
+        struct intel_vgpu_workload *pos, *n;
+        unsigned int tmp;
+
+        /* free the unsubmited workloads in the queues. */
+        for_each_engine_masked(engine, dev_priv, engine_mask, tmp) {
+                list_for_each_entry_safe(pos, n,
+                        &vgpu->workload_q_head[engine->id], list) {
+                        list_del_init(&pos->list);
+                        free_workload(pos);
+                }
+        }
+}
+
 void intel_vgpu_clean_execlist(struct intel_vgpu *vgpu)
 {
+        clean_workloads(vgpu, ALL_ENGINES);
         kmem_cache_destroy(vgpu->workloads);
 }
 
@@ -811,17 +829,9 @@ void intel_vgpu_reset_execlist(struct intel_vgpu *vgpu,
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
         struct intel_engine_cs *engine;
-        struct intel_vgpu_workload *pos, *n;
         unsigned int tmp;
 
-        for_each_engine_masked(engine, dev_priv, engine_mask, tmp) {
-                /* free the unsubmited workload in the queue */
-                list_for_each_entry_safe(pos, n,
-                        &vgpu->workload_q_head[engine->id], list) {
-                        list_del_init(&pos->list);
-                        free_workload(pos);
-                }
-
+        clean_workloads(vgpu, engine_mask);
+        for_each_engine_masked(engine, dev_priv, engine_mask, tmp)
                 init_vgpu_execlist(vgpu, engine->id);
-        }
 }
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index c995e540ff96..0ffd69654592 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1366,18 +1366,28 @@ static int skl_misc_ctl_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
-        i915_reg_t reg = {.reg = offset};
+        u32 v = *(u32 *)p_data;
+
+        if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
+                return intel_vgpu_default_mmio_write(vgpu,
+                                offset, p_data, bytes);
 
         switch (offset) {
         case 0x4ddc:
-                vgpu_vreg(vgpu, offset) = 0x8000003c;
-                /* WaCompressedResourceSamplerPbeMediaNewHashMode:skl */
-                I915_WRITE(reg, vgpu_vreg(vgpu, offset));
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 31);
                 break;
         case 0x42080:
-                vgpu_vreg(vgpu, offset) = 0x8000;
-                /* WaCompressedResourceDisplayNewHashMode:skl */
-                I915_WRITE(reg, vgpu_vreg(vgpu, offset));
+                /* bypass WaCompressedResourceDisplayNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 15);
+                break;
+        case 0xe194:
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 8);
+                break;
+        case 0x7014:
+                /* bypass WaCompressedResourceSamplerPbeMediaNewHashMode */
+                vgpu_vreg(vgpu, offset) = v & ~(1 << 13);
                 break;
         default:
                 return -EINVAL;
@@ -1634,7 +1644,8 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(GAM_ECOCHK, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
                 NULL, NULL);
-        MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                 skl_misc_ctl_write);
         MMIO_DFH(0x9030, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x20a0, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2420, D_ALL, F_CMD_ACCESS, NULL, NULL);
@@ -2568,7 +2579,8 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x6e570, D_BDW_PLUS);
         MMIO_D(0x65f10, D_BDW_PLUS);
 
-        MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                 skl_misc_ctl_write);
         MMIO_DFH(0xe188, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 3036d4835b0f..48428672fc6e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1235,6 +1235,15 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_fini;
 
         pci_set_drvdata(pdev, &dev_priv->drm);
+        /*
+         * Disable the system suspend direct complete optimization, which can
+         * leave the device suspended skipping the driver's suspend handlers
+         * if the device was already runtime suspended. This is needed due to
+         * the difference in our runtime and system suspend sequence and
+         * becaue the HDA driver may require us to enable the audio power
+         * domain during system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
 
         ret = i915_driver_init_early(dev_priv, ent);
         if (ret < 0)
@@ -1272,10 +1281,6 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         dev_priv->ipc_enabled = false;
 
-        /* Everything is in place, we can now relax! */
-        DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
-                 driver.name, driver.major, driver.minor, driver.patchlevel,
-                 driver.date, pci_name(pdev), dev_priv->drm.primary->index);
         if (IS_ENABLED(CONFIG_DRM_I915_DEBUG))
                 DRM_INFO("DRM_I915_DEBUG enabled\n");
         if (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c9b0949f6c1a..2c453a4e97d5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -562,7 +562,8 @@ struct intel_link_m_n {
 
 void intel_link_compute_m_n(int bpp, int nlanes,
                             int pixel_clock, int link_clock,
-                            struct intel_link_m_n *m_n);
+                            struct intel_link_m_n *m_n,
+                            bool reduce_m_n);
 
 /* Interface history:
  *
@@ -2990,6 +2991,16 @@ static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv)
         return false;
 }
 
+static inline bool
+intel_ggtt_update_needs_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        if (IS_BROXTON(dev_priv) && intel_iommu_gfx_mapped)
+                return true;
+#endif
+        return false;
+}
+
 int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                                 int enable_ppgtt);
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b6ac3df18b58..462031cbd77f 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3298,6 +3298,10 @@ int i915_gem_wait_for_idle(struct drm_i915_private *i915, unsigned int flags)
 {
         int ret;
 
+        /* If the device is asleep, we have no requests outstanding */
+        if (!READ_ONCE(i915->gt.awake))
+                return 0;
+
         if (flags & I915_WAIT_LOCKED) {
                 struct i915_gem_timeline *tl;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index a0563e18d753..f1989b8792dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2191,6 +2191,101 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm,
                 gen8_set_pte(&gtt_base[i], scratch_pte);
 }
 
+static void bxt_vtd_ggtt_wa(struct i915_address_space *vm)
+{
+        struct drm_i915_private *dev_priv = vm->i915;
+
+        /*
+         * Make sure the internal GAM fifo has been cleared of all GTT
+         * writes before exiting stop_machine(). This guarantees that
+         * any aperture accesses waiting to start in another process
+         * cannot back up behind the GTT writes causing a hang.
+         * The register can be any arbitrary GAM register.
+         */
+        POSTING_READ(GFX_FLSH_CNTL_GEN6);
+}
+
+struct insert_page {
+        struct i915_address_space *vm;
+        dma_addr_t addr;
+        u64 offset;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_page__cb(void *_arg)
+{
+        struct insert_page *arg = _arg;
+
+        gen8_ggtt_insert_page(arg->vm, arg->addr, arg->offset, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_page__BKL(struct i915_address_space *vm,
+                                          dma_addr_t addr,
+                                          u64 offset,
+                                          enum i915_cache_level level,
+                                          u32 unused)
+{
+        struct insert_page arg = { vm, addr, offset, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_page__cb, &arg, NULL);
+}
+
+struct insert_entries {
+        struct i915_address_space *vm;
+        struct sg_table *st;
+        u64 start;
+        enum i915_cache_level level;
+};
+
+static int bxt_vtd_ggtt_insert_entries__cb(void *_arg)
+{
+        struct insert_entries *arg = _arg;
+
+        gen8_ggtt_insert_entries(arg->vm, arg->st, arg->start, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_insert_entries__BKL(struct i915_address_space *vm,
+                                             struct sg_table *st,
+                                             u64 start,
+                                             enum i915_cache_level level,
+                                             u32 unused)
+{
+        struct insert_entries arg = { vm, st, start, level };
+
+        stop_machine(bxt_vtd_ggtt_insert_entries__cb, &arg, NULL);
+}
+
+struct clear_range {
+        struct i915_address_space *vm;
+        u64 start;
+        u64 length;
+};
+
+static int bxt_vtd_ggtt_clear_range__cb(void *_arg)
+{
+        struct clear_range *arg = _arg;
+
+        gen8_ggtt_clear_range(arg->vm, arg->start, arg->length);
+        bxt_vtd_ggtt_wa(arg->vm);
+
+        return 0;
+}
+
+static void bxt_vtd_ggtt_clear_range__BKL(struct i915_address_space *vm,
+                                          u64 start,
+                                          u64 length)
+{
+        struct clear_range arg = { vm, start, length };
+
+        stop_machine(bxt_vtd_ggtt_clear_range__cb, &arg, NULL);
+}
+
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                   u64 start, u64 length)
 {
@@ -2313,7 +2408,7 @@ static int aliasing_gtt_bind_vma(struct i915_vma *vma,
                     appgtt->base.allocate_va_range) {
                         ret = appgtt->base.allocate_va_range(&appgtt->base,
                                                              vma->node.start,
-                                                             vma->node.size);
+                                                             vma->size);
                         if (ret)
                                 goto err_pages;
                 }
@@ -2785,6 +2880,14 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
 
         ggtt->base.insert_entries = gen8_ggtt_insert_entries;
 
+        /* Serialize GTT updates with aperture access on BXT if VT-d is on. */
+        if (intel_ggtt_update_needs_vtd_wa(dev_priv)) {
+                ggtt->base.insert_entries = bxt_vtd_ggtt_insert_entries__BKL;
+                ggtt->base.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
+                if (ggtt->base.clear_range != nop_clear_range)
+                        ggtt->base.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+        }
+
         ggtt->invalidate = gen6_ggtt_invalidate;
 
         return ggtt_probe_common(ggtt, size);
@@ -2997,7 +3100,8 @@ void i915_ggtt_enable_guc(struct drm_i915_private *i915)
 
 void i915_ggtt_disable_guc(struct drm_i915_private *i915)
 {
-        i915->ggtt.invalidate = gen6_ggtt_invalidate;
+        if (i915->ggtt.invalidate == guc_ggtt_invalidate)
+                i915->ggtt.invalidate = gen6_ggtt_invalidate;
 }
 
 void i915_gem_restore_gtt_mappings(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/i915_gem_request.h b/drivers/gpu/drm/i915/i915_gem_request.h
index 129c58bb4805..a4a920c4c454 100644
--- a/drivers/gpu/drm/i915/i915_gem_request.h
+++ b/drivers/gpu/drm/i915/i915_gem_request.h
@@ -123,7 +123,7 @@ struct drm_i915_gem_request {
          * It is used by the driver to then queue the request for execution.
          */
         struct i915_sw_fence submit;
-        wait_queue_t submitq;
+        wait_queue_entry_t submitq;
         wait_queue_head_t execute;
 
         /* A list of everyone we wait upon, and everyone who waits upon us.
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 129ed303a6c4..57d9f7f4ef15 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -59,9 +59,6 @@ static void i915_gem_shrinker_unlock(struct drm_device *dev, bool unlock)
                 return;
 
         mutex_unlock(&dev->struct_mutex);
-
-        /* expedite the RCU grace period to free some request slabs */
-        synchronize_rcu_expedited();
 }
 
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)
@@ -274,8 +271,6 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
                                 I915_SHRINK_ACTIVE);
         intel_runtime_pm_put(dev_priv);
 
-        synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
-
         return freed;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index a0d6d4317a49..fb5231f98c0d 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -278,7 +278,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
                         obj->mm.quirked = false;
                 }
                 if (!i915_gem_object_is_tiled(obj)) {
-                        GEM_BUG_ON(!obj->mm.quirked);
+                        GEM_BUG_ON(obj->mm.quirked);
                         __i915_gem_object_pin_pages(obj);
                         obj->mm.quirked = true;
                 }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index fd97fe00cd0d..190f6aa5d15e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2953,7 +2953,6 @@ static void vlv_display_irq_postinstall(struct drm_i915_private *dev_priv)
         u32 pipestat_mask;
         u32 enable_mask;
         enum pipe pipe;
-        u32 val;
 
         pipestat_mask = PLANE_FLIP_DONE_INT_STATUS_VLV |
                         PIPE_CRC_DONE_INTERRUPT_STATUS;
@@ -2964,18 +2963,16 @@ static void vlv_display_irq_postinstall(struct drm_i915_private *dev_priv)
 
         enable_mask = I915_DISPLAY_PORT_INTERRUPT |
                 I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |
-                I915_DISPLAY_PIPE_B_EVENT_INTERRUPT;
+                I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |
+                I915_LPE_PIPE_A_INTERRUPT |
+                I915_LPE_PIPE_B_INTERRUPT;
+
         if (IS_CHERRYVIEW(dev_priv))
-                enable_mask |= I915_DISPLAY_PIPE_C_EVENT_INTERRUPT;
+                enable_mask |= I915_DISPLAY_PIPE_C_EVENT_INTERRUPT |
+                        I915_LPE_PIPE_C_INTERRUPT;
 
         WARN_ON(dev_priv->irq_mask != ~0);
 
-        val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT |
-                I915_LPE_PIPE_C_INTERRUPT);
-
-        enable_mask |= val;
-
         dev_priv->irq_mask = ~enable_mask;
 
         GEN5_IRQ_INIT(VLV_, dev_priv->irq_mask, enable_mask);
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index f87b0c4e564d..1a78363c7f4a 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -208,7 +208,7 @@ static const struct intel_device_info intel_ironlake_d_info = {
 static const struct intel_device_info intel_ironlake_m_info = {
         GEN5_FEATURES,
         .platform = INTEL_IRONLAKE,
-        .is_mobile = 1,
+        .is_mobile = 1, .has_fbc = 1,
 };
 
 #define GEN6_FEATURES \
@@ -390,7 +390,6 @@ static const struct intel_device_info intel_skylake_gt3_info = {
         .has_hw_contexts = 1, \
         .has_logical_ring_contexts = 1, \
         .has_guc = 1, \
-        .has_decoupled_mmio = 1, \
         .has_aliasing_ppgtt = 1, \
         .has_full_ppgtt = 1, \
         .has_full_48bit_ppgtt = 1, \
diff --git a/drivers/gpu/drm/i915/i915_pvinfo.h b/drivers/gpu/drm/i915/i915_pvinfo.h
index c0cb2974caac..2cfe96d3e5d1 100644
--- a/drivers/gpu/drm/i915/i915_pvinfo.h
+++ b/drivers/gpu/drm/i915/i915_pvinfo.h
@@ -36,10 +36,6 @@
 #define VGT_VERSION_MAJOR 1
 #define VGT_VERSION_MINOR 0
 
-#define INTEL_VGT_IF_VERSION_ENCODE(major, minor) ((major) << 16 | (minor))
-#define INTEL_VGT_IF_VERSION \
-        INTEL_VGT_IF_VERSION_ENCODE(VGT_VERSION_MAJOR, VGT_VERSION_MINOR)
-
 /*
  * notifications from guest to vgpu device model
  */
@@ -55,8 +51,8 @@ enum vgt_g2v_type {
 
 struct vgt_if {
         u64 magic;              /* VGT_MAGIC */
-        uint16_t version_major;
-        uint16_t version_minor;
+        u16 version_major;
+        u16 version_minor;
         u32 vgt_id;             /* ID of vGT instance */
         u32 rsv1[12];           /* pad to offset 0x40 */
         /*
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 5a7c63e64381..65b837e96fe6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -8280,7 +8280,7 @@ enum {
 
 /* MIPI DSI registers */
 
-#define _MIPI_PORT(port, a, c)  ((port) ? c : a)        /* ports A and C only */
+#define _MIPI_PORT(port, a, c)  (((port) == PORT_A) ? a : c)    /* ports A and C only */
 #define _MMIO_MIPI(port, a, c)  _MMIO(_MIPI_PORT(port, a, c))
 
 #define MIPIO_TXESC_CLK_DIV1                    _MMIO(0x160004)
diff --git a/drivers/gpu/drm/i915/i915_sw_fence.c b/drivers/gpu/drm/i915/i915_sw_fence.c
index a277f8eb7beb..380de4360b8a 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence.c
+++ b/drivers/gpu/drm/i915/i915_sw_fence.c
@@ -152,7 +152,7 @@ static void __i915_sw_fence_wake_up_all(struct i915_sw_fence *fence,
                                         struct list_head *continuation)
 {
         wait_queue_head_t *x = &fence->wait;
-        wait_queue_t *pos, *next;
+        wait_queue_entry_t *pos, *next;
         unsigned long flags;
 
         debug_fence_deactivate(fence);
@@ -160,31 +160,30 @@ static void __i915_sw_fence_wake_up_all(struct i915_sw_fence *fence,
 
         /*
          * To prevent unbounded recursion as we traverse the graph of
-         * i915_sw_fences, we move the task_list from this, the next ready
-         * fence, to the tail of the original fence's task_list
+         * i915_sw_fences, we move the entry list from this, the next ready
+         * fence, to the tail of the original fence's entry list
          * (and so added to the list to be woken).
          */
 
         spin_lock_irqsave_nested(&x->lock, flags, 1 + !!continuation);
         if (continuation) {
-                list_for_each_entry_safe(pos, next, &x->task_list, task_list) {
+                list_for_each_entry_safe(pos, next, &x->head, entry) {
                         if (pos->func == autoremove_wake_function)
                                 pos->func(pos, TASK_NORMAL, 0, continuation);
                         else
-                                list_move_tail(&pos->task_list, continuation);
+                                list_move_tail(&pos->entry, continuation);
                 }
         } else {
                 LIST_HEAD(extra);
 
                 do {
-                        list_for_each_entry_safe(pos, next,
-                                                 &x->task_list, task_list)
+                        list_for_each_entry_safe(pos, next, &x->head, entry)
                                 pos->func(pos, TASK_NORMAL, 0, &extra);
 
                         if (list_empty(&extra))
                                 break;
 
-                        list_splice_tail_init(&extra, &x->task_list);
+                        list_splice_tail_init(&extra, &x->head);
                 } while (1);
         }
         spin_unlock_irqrestore(&x->lock, flags);
@@ -254,9 +253,9 @@ void i915_sw_fence_commit(struct i915_sw_fence *fence)
         __i915_sw_fence_commit(fence);
 }
 
-static int i915_sw_fence_wake(wait_queue_t *wq, unsigned mode, int flags, void *key)
+static int i915_sw_fence_wake(wait_queue_entry_t *wq, unsigned mode, int flags, void *key)
 {
-        list_del(&wq->task_list);
+        list_del(&wq->entry);
         __i915_sw_fence_complete(wq->private, key);
         i915_sw_fence_put(wq->private);
         if (wq->flags & I915_SW_FENCE_FLAG_ALLOC)
@@ -267,7 +266,7 @@ static int i915_sw_fence_wake(wait_queue_t *wq, unsigned mode, int flags, void *
 static bool __i915_sw_fence_check_if_after(struct i915_sw_fence *fence,
                                     const struct i915_sw_fence * const signaler)
 {
-        wait_queue_t *wq;
+        wait_queue_entry_t *wq;
 
         if (__test_and_set_bit(I915_SW_FENCE_CHECKED_BIT, &fence->flags))
                 return false;
@@ -275,7 +274,7 @@ static bool __i915_sw_fence_check_if_after(struct i915_sw_fence *fence,
         if (fence == signaler)
                 return true;
 
-        list_for_each_entry(wq, &fence->wait.task_list, task_list) {
+        list_for_each_entry(wq, &fence->wait.head, entry) {
                 if (wq->func != i915_sw_fence_wake)
                         continue;
 
@@ -288,12 +287,12 @@ static bool __i915_sw_fence_check_if_after(struct i915_sw_fence *fence,
 
 static void __i915_sw_fence_clear_checked_bit(struct i915_sw_fence *fence)
 {
-        wait_queue_t *wq;
+        wait_queue_entry_t *wq;
 
         if (!__test_and_clear_bit(I915_SW_FENCE_CHECKED_BIT, &fence->flags))
                 return;
 
-        list_for_each_entry(wq, &fence->wait.task_list, task_list) {
+        list_for_each_entry(wq, &fence->wait.head, entry) {
                 if (wq->func != i915_sw_fence_wake)
                         continue;
 
@@ -320,7 +319,7 @@ static bool i915_sw_fence_check_if_after(struct i915_sw_fence *fence,
 
 static int __i915_sw_fence_await_sw_fence(struct i915_sw_fence *fence,
                                           struct i915_sw_fence *signaler,
-                                          wait_queue_t *wq, gfp_t gfp)
+                                          wait_queue_entry_t *wq, gfp_t gfp)
 {
         unsigned long flags;
         int pending;
@@ -350,7 +349,7 @@ static int __i915_sw_fence_await_sw_fence(struct i915_sw_fence *fence,
                 pending |= I915_SW_FENCE_FLAG_ALLOC;
         }
 
-        INIT_LIST_HEAD(&wq->task_list);
+        INIT_LIST_HEAD(&wq->entry);
         wq->flags = pending;
         wq->func = i915_sw_fence_wake;
         wq->private = i915_sw_fence_get(fence);
@@ -359,7 +358,7 @@ static int __i915_sw_fence_await_sw_fence(struct i915_sw_fence *fence,
 
         spin_lock_irqsave(&signaler->wait.lock, flags);
         if (likely(!i915_sw_fence_done(signaler))) {
-                __add_wait_queue_tail(&signaler->wait, wq);
+                __add_wait_queue_entry_tail(&signaler->wait, wq);
                 pending = 1;
         } else {
                 i915_sw_fence_wake(wq, 0, 0, NULL);
@@ -372,7 +371,7 @@ static int __i915_sw_fence_await_sw_fence(struct i915_sw_fence *fence,
 
 int i915_sw_fence_await_sw_fence(struct i915_sw_fence *fence,
                                  struct i915_sw_fence *signaler,
-                                 wait_queue_t *wq)
+                                 wait_queue_entry_t *wq)
 {
         return __i915_sw_fence_await_sw_fence(fence, signaler, wq, 0);
 }
diff --git a/drivers/gpu/drm/i915/i915_sw_fence.h b/drivers/gpu/drm/i915/i915_sw_fence.h
index d31cefbbcc04..fd3c3bf6c8b7 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence.h
+++ b/drivers/gpu/drm/i915/i915_sw_fence.h
@@ -66,7 +66,7 @@ void i915_sw_fence_commit(struct i915_sw_fence *fence);
 
 int i915_sw_fence_await_sw_fence(struct i915_sw_fence *fence,
                                  struct i915_sw_fence *after,
-                                 wait_queue_t *wq);
+                                 wait_queue_entry_t *wq);
 int i915_sw_fence_await_sw_fence_gfp(struct i915_sw_fence *fence,
                                      struct i915_sw_fence *after,
                                      gfp_t gfp);
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index 4ab8a973b61f..2e739018fb4c 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -60,8 +60,8 @@
  */
 void i915_check_vgpu(struct drm_i915_private *dev_priv)
 {
-        uint64_t magic;
-        uint32_t version;
+        u64 magic;
+        u16 version_major;
 
         BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 
@@ -69,10 +69,8 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv)
         if (magic != VGT_MAGIC)
                 return;
 
-        version = INTEL_VGT_IF_VERSION_ENCODE(
-                __raw_i915_read16(dev_priv, vgtif_reg(version_major)),
-                __raw_i915_read16(dev_priv, vgtif_reg(version_minor)));
-        if (version != INTEL_VGT_IF_VERSION) {
+        version_major = __raw_i915_read16(dev_priv, vgtif_reg(version_major));
+        if (version_major < VGT_VERSION_MAJOR) {
                 DRM_INFO("VGT interface version mismatch!\n");
                 return;
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3617927af269..96b0b01677e2 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4598,7 +4598,7 @@ static void cpt_verify_modeset(struct drm_device *dev, int pipe)
 
 static int
 skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
-                  unsigned scaler_user, int *scaler_id, unsigned int rotation,
+                  unsigned int scaler_user, int *scaler_id,
                   int src_w, int src_h, int dst_w, int dst_h)
 {
         struct intel_crtc_scaler_state *scaler_state =
@@ -4607,9 +4607,12 @@ skl_update_scaler(struct intel_crtc_state *crtc_state, bool force_detach,
                 to_intel_crtc(crtc_state->base.crtc);
         int need_scaling;
 
-        need_scaling = drm_rotation_90_or_270(rotation) ?
-                (src_h != dst_w || src_w != dst_h):
-                (src_w != dst_w || src_h != dst_h);
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
+        need_scaling = src_w != dst_w || src_h != dst_h;
 
         /*
          * if plane is being disabled or scaler is no more required or force detach
@@ -4671,7 +4674,7 @@ int skl_update_scaler_crtc(struct intel_crtc_state *state)
         const struct drm_display_mode *adjusted_mode = &state->base.adjusted_mode;
 
         return skl_update_scaler(state, !state->base.active, SKL_CRTC_INDEX,
-                &state->scaler_state.scaler_id, DRM_ROTATE_0,
+                &state->scaler_state.scaler_id,
                 state->pipe_src_w, state->pipe_src_h,
                 adjusted_mode->crtc_hdisplay, adjusted_mode->crtc_vdisplay);
 }
@@ -4700,7 +4703,6 @@ static int skl_update_scaler_plane(struct intel_crtc_state *crtc_state,
         ret = skl_update_scaler(crtc_state, force_detach,
                                 drm_plane_index(&intel_plane->base),
                                 &plane_state->scaler_id,
-                                plane_state->base.rotation,
                                 drm_rect_width(&plane_state->base.src) >> 16,
                                 drm_rect_height(&plane_state->base.src) >> 16,
                                 drm_rect_width(&plane_state->base.dst),
@@ -6101,7 +6103,7 @@ retry:
         pipe_config->fdi_lanes = lane;
 
         intel_link_compute_m_n(pipe_config->pipe_bpp, lane, fdi_dotclock,
-                               link_bw, &pipe_config->fdi_m_n);
+                               link_bw, &pipe_config->fdi_m_n, false);
 
         ret = ironlake_check_fdi_lanes(dev, intel_crtc->pipe, pipe_config);
         if (ret == -EINVAL && pipe_config->pipe_bpp > 6*3) {
@@ -6277,7 +6279,8 @@ intel_reduce_m_n_ratio(uint32_t *num, uint32_t *den)
 }
 
 static void compute_m_n(unsigned int m, unsigned int n,
-                        uint32_t *ret_m, uint32_t *ret_n)
+                        uint32_t *ret_m, uint32_t *ret_n,
+                        bool reduce_m_n)
 {
         /*
          * Reduce M/N as much as possible without loss in precision. Several DP
@@ -6285,9 +6288,11 @@ static void compute_m_n(unsigned int m, unsigned int n,
          * values. The passed in values are more likely to have the least
          * significant bits zero than M after rounding below, so do this first.
          */
-        while ((m & 1) == 0 && (n & 1) == 0) {
-                m >>= 1;
-                n >>= 1;
+        if (reduce_m_n) {
+                while ((m & 1) == 0 && (n & 1) == 0) {
+                        m >>= 1;
+                        n >>= 1;
+                }
         }
 
         *ret_n = min_t(unsigned int, roundup_pow_of_two(n), DATA_LINK_N_MAX);
@@ -6298,16 +6303,19 @@ static void compute_m_n(unsigned int m, unsigned int n,
 void
 intel_link_compute_m_n(int bits_per_pixel, int nlanes,
                        int pixel_clock, int link_clock,
-                       struct intel_link_m_n *m_n)
+                       struct intel_link_m_n *m_n,
+                       bool reduce_m_n)
 {
         m_n->tu = 64;
 
         compute_m_n(bits_per_pixel * pixel_clock,
                     link_clock * nlanes * 8,
-                    &m_n->gmch_m, &m_n->gmch_n);
+                    &m_n->gmch_m, &m_n->gmch_n,
+                    reduce_m_n);
 
         compute_m_n(pixel_clock, link_clock,
-                    &m_n->link_m, &m_n->link_n);
+                    &m_n->link_m, &m_n->link_n,
+                    reduce_m_n);
 }
 
 static inline bool intel_panel_use_ssc(struct drm_i915_private *dev_priv)
@@ -12197,6 +12205,15 @@ static void update_scanline_offset(struct intel_crtc *crtc)
          * type. For DP ports it behaves like most other platforms, but on HDMI
          * there's an extra 1 line difference. So we need to add two instead of
          * one to the value.
+         *
+         * On VLV/CHV DSI the scanline counter would appear to increment
+         * approx. 1/3 of a scanline before start of vblank. Unfortunately
+         * that means we can't tell whether we're in vblank or not while
+         * we're on that particular line. We must still set scanline_offset
+         * to 1 so that the vblank timestamps come out correct when we query
+         * the scanline counter from within the vblank interrupt handler.
+         * However if queried just before the start of vblank we'll get an
+         * answer that's slightly in the future.
          */
         if (IS_GEN2(dev_priv)) {
                 const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index ee77b519835c..fc691b8b317c 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1507,37 +1507,6 @@ static void intel_dp_print_rates(struct intel_dp *intel_dp)
         DRM_DEBUG_KMS("common rates: %s\n", str);
 }
 
-bool
-__intel_dp_read_desc(struct intel_dp *intel_dp, struct intel_dp_desc *desc)
-{
-        u32 base = drm_dp_is_branch(intel_dp->dpcd) ? DP_BRANCH_OUI :
-                                                      DP_SINK_OUI;
-
-        return drm_dp_dpcd_read(&intel_dp->aux, base, desc, sizeof(*desc)) ==
-               sizeof(*desc);
-}
-
-bool intel_dp_read_desc(struct intel_dp *intel_dp)
-{
-        struct intel_dp_desc *desc = &intel_dp->desc;
-        bool oui_sup = intel_dp->dpcd[DP_DOWN_STREAM_PORT_COUNT] &
-                       DP_OUI_SUPPORT;
-        int dev_id_len;
-
-        if (!__intel_dp_read_desc(intel_dp, desc))
-                return false;
-
-        dev_id_len = strnlen(desc->device_id, sizeof(desc->device_id));
-        DRM_DEBUG_KMS("DP %s: OUI %*phD%s dev-ID %*pE HW-rev %d.%d SW-rev %d.%d\n",
-                      drm_dp_is_branch(intel_dp->dpcd) ? "branch" : "sink",
-                      (int)sizeof(desc->oui), desc->oui, oui_sup ? "" : "(NS)",
-                      dev_id_len, desc->device_id,
-                      desc->hw_rev >> 4, desc->hw_rev & 0xf,
-                      desc->sw_major_rev, desc->sw_minor_rev);
-
-        return true;
-}
-
 static int rate_to_index(int find, const int *rates)
 {
         int i = 0;
@@ -1624,6 +1593,8 @@ intel_dp_compute_config(struct intel_encoder *encoder,
         int common_rates[DP_MAX_SUPPORTED_RATES] = {};
         int common_len;
         uint8_t link_bw, rate_select;
+        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+                                           DP_DPCD_QUIRK_LIMITED_M_N);
 
         common_len = intel_dp_common_rates(intel_dp, common_rates);
 
@@ -1753,7 +1724,8 @@ found:
         intel_link_compute_m_n(bpp, lane_count,
                                adjusted_mode->crtc_clock,
                                pipe_config->port_clock,
-                               &pipe_config->dp_m_n);
+                               &pipe_config->dp_m_n,
+                               reduce_m_n);
 
         if (intel_connector->panel.downclock_mode != NULL &&
                 dev_priv->drrs.type == SEAMLESS_DRRS_SUPPORT) {
@@ -1761,7 +1733,8 @@ found:
                         intel_link_compute_m_n(bpp, lane_count,
                                 intel_connector->panel.downclock_mode->clock,
                                 pipe_config->port_clock,
-                                &pipe_config->dp_m2_n2);
+                                &pipe_config->dp_m2_n2,
+                                reduce_m_n);
         }
 
         /*
@@ -3622,7 +3595,8 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
         if (!intel_dp_read_dpcd(intel_dp))
                 return false;
 
-        intel_dp_read_desc(intel_dp);
+        drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
+                         drm_dp_is_branch(intel_dp->dpcd));
 
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11)
                 dev_priv->no_aux_handshake = intel_dp->dpcd[DP_MAX_DOWNSPREAD] &
@@ -4624,7 +4598,8 @@ intel_dp_long_pulse(struct intel_connector *intel_connector)
 
         intel_dp_print_rates(intel_dp);
 
-        intel_dp_read_desc(intel_dp);
+        drm_dp_read_desc(&intel_dp->aux, &intel_dp->desc,
+                         drm_dp_is_branch(intel_dp->dpcd));
 
         intel_dp_configure_mst(intel_dp);
 
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index c1f62eb07c07..989e25577ac0 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -44,6 +44,8 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         int lane_count, slots;
         const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
         int mst_pbn;
+        bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+                                           DP_DPCD_QUIRK_LIMITED_M_N);
 
         pipe_config->has_pch_encoder = false;
         bpp = 24;
@@ -75,7 +77,8 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         intel_link_compute_m_n(bpp, lane_count,
                                adjusted_mode->crtc_clock,
                                pipe_config->port_clock,
-                               &pipe_config->dp_m_n);
+                               &pipe_config->dp_m_n,
+                               reduce_m_n);
 
         pipe_config->dp_m_n.tu = slots;
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index aaee3949a422..f630c7af5020 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -906,14 +906,6 @@ enum link_m_n_set {
         M2_N2
 };
 
-struct intel_dp_desc {
-        u8 oui[3];
-        u8 device_id[6];
-        u8 hw_rev;
-        u8 sw_major_rev;
-        u8 sw_minor_rev;
-} __packed;
-
 struct intel_dp_compliance_data {
         unsigned long edid;
         uint8_t video_pattern;
@@ -957,7 +949,7 @@ struct intel_dp {
         /* Max link BW for the sink as per DPCD registers */
         int max_sink_link_bw;
         /* sink or branch descriptor */
-        struct intel_dp_desc desc;
+        struct drm_dp_desc desc;
         struct drm_dp_aux aux;
         enum intel_display_power_domain aux_power_domain;
         uint8_t train_set[4];
@@ -1532,9 +1524,6 @@ static inline unsigned int intel_dp_unused_lane_mask(int lane_count)
 }
 
 bool intel_dp_read_dpcd(struct intel_dp *intel_dp);
-bool __intel_dp_read_desc(struct intel_dp *intel_dp,
-                          struct intel_dp_desc *desc);
-bool intel_dp_read_desc(struct intel_dp *intel_dp);
 int intel_dp_link_required(int pixel_clock, int bpp);
 int intel_dp_max_data_rate(int max_link_clock, int max_lanes);
 bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 854e8e0c836b..f94eacff196c 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1075,6 +1075,22 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
         return 0;
 }
 
+static bool ring_is_idle(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *dev_priv = engine->i915;
+        bool idle = true;
+
+        intel_runtime_pm_get(dev_priv);
+
+        /* No bit for gen2, so assume the CS parser is idle */
+        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+                idle = false;
+
+        intel_runtime_pm_put(dev_priv);
+
+        return idle;
+}
+
 /**
  * intel_engine_is_idle() - Report if the engine has finished process all work
  * @engine: the intel_engine_cs
@@ -1084,8 +1100,6 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
  */
 bool intel_engine_is_idle(struct intel_engine_cs *engine)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
-
         /* Any inflight/incomplete requests? */
         if (!i915_seqno_passed(intel_engine_get_seqno(engine),
                                intel_engine_last_submit(engine)))
@@ -1100,7 +1114,7 @@ bool intel_engine_is_idle(struct intel_engine_cs *engine)
                 return false;
 
         /* Ring stopped? */
-        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+        if (!ring_is_idle(engine))
                 return false;
 
         return true;
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index ded2add18b26..d93c58410bff 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -82,20 +82,10 @@ static unsigned int get_crtc_fence_y_offset(struct intel_crtc *crtc)
 static void intel_fbc_get_plane_source_size(struct intel_fbc_state_cache *cache,
                                             int *width, int *height)
 {
-        int w, h;
-
-        if (drm_rotation_90_or_270(cache->plane.rotation)) {
-                w = cache->plane.src_h;
-                h = cache->plane.src_w;
-        } else {
-                w = cache->plane.src_w;
-                h = cache->plane.src_h;
-        }
-
         if (width)
-                *width = w;
+                *width = cache->plane.src_w;
         if (height)
-                *height = h;
+                *height = cache->plane.src_h;
 }
 
 static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
@@ -746,6 +736,11 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                 cache->crtc.hsw_bdw_pixel_rate = crtc_state->pixel_rate;
 
         cache->plane.rotation = plane_state->base.rotation;
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         cache->plane.src_w = drm_rect_width(&plane_state->base.src) >> 16;
         cache->plane.src_h = drm_rect_height(&plane_state->base.src) >> 16;
         cache->plane.visible = plane_state->base.visible;
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 668f00480d97..292fedf30b00 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -149,44 +149,10 @@ static void lpe_audio_platdev_destroy(struct drm_i915_private *dev_priv)
 
 static void lpe_audio_irq_unmask(struct irq_data *d)
 {
-        struct drm_i915_private *dev_priv = d->chip_data;
-        unsigned long irqflags;
-        u32 val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT);
-
-        if (IS_CHERRYVIEW(dev_priv))
-                val |= I915_LPE_PIPE_C_INTERRUPT;
-
-        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-
-        dev_priv->irq_mask &= ~val;
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IMR, dev_priv->irq_mask);
-        POSTING_READ(VLV_IMR);
-
-        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
 static void lpe_audio_irq_mask(struct irq_data *d)
 {
-        struct drm_i915_private *dev_priv = d->chip_data;
-        unsigned long irqflags;
-        u32 val = (I915_LPE_PIPE_A_INTERRUPT |
-                I915_LPE_PIPE_B_INTERRUPT);
-
-        if (IS_CHERRYVIEW(dev_priv))
-                val |= I915_LPE_PIPE_C_INTERRUPT;
-
-        spin_lock_irqsave(&dev_priv->irq_lock, irqflags);
-
-        dev_priv->irq_mask |= val;
-        I915_WRITE(VLV_IMR, dev_priv->irq_mask);
-        I915_WRITE(VLV_IIR, val);
-        I915_WRITE(VLV_IIR, val);
-        POSTING_READ(VLV_IIR);
-
-        spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
 static struct irq_chip lpe_audio_irqchip = {
@@ -330,8 +296,6 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv)
 
         desc = irq_to_desc(dev_priv->lpe_audio.irq);
 
-        lpe_audio_irq_mask(&desc->irq_data);
-
         lpe_audio_platdev_destroy(dev_priv);
 
         irq_free_desc(dev_priv->lpe_audio.irq);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index c8f7c631fc1f..dac4e003c1f3 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1989,7 +1989,7 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
 
         ce->ring = ring;
         ce->state = vma;
-        ce->initialised = engine->init_context == NULL;
+        ce->initialised |= engine->init_context == NULL;
 
         return 0;
 
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 71cbe9c08932..5abef482eacf 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -240,7 +240,7 @@ bool lspcon_init(struct intel_digital_port *intel_dig_port)
                 return false;
         }
 
-        intel_dp_read_desc(dp);
+        drm_dp_read_desc(&dp->aux, &dp->desc, drm_dp_is_branch(dp->dpcd));
 
         DRM_DEBUG_KMS("Success: LSPCON init\n");
         return true;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 570bd603f401..078fd1bfa5ea 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3373,20 +3373,26 @@ skl_plane_downscale_amount(const struct intel_crtc_state *cstate,
 
         /* n.b., src is 16.16 fixed point, dst is whole integer */
         if (plane->id == PLANE_CURSOR) {
+                /*
+                 * Cursors only support 0/180 degree rotation,
+                 * hence no need to account for rotation here.
+                 */
                 src_w = pstate->base.src_w;
                 src_h = pstate->base.src_h;
                 dst_w = pstate->base.crtc_w;
                 dst_h = pstate->base.crtc_h;
         } else {
+                /*
+                 * Src coordinates are already rotated by 270 degrees for
+                 * the 90/270 degree plane rotation cases (to match the
+                 * GTT mapping), hence no need to account for rotation here.
+                 */
                 src_w = drm_rect_width(&pstate->base.src);
                 src_h = drm_rect_height(&pstate->base.src);
                 dst_w = drm_rect_width(&pstate->base.dst);
                 dst_h = drm_rect_height(&pstate->base.dst);
         }
 
-        if (drm_rotation_90_or_270(pstate->base.rotation))
-                swap(dst_w, dst_h);
-
         downscale_h = max(src_h / dst_h, (uint32_t)DRM_PLANE_HELPER_NO_SCALING);
         downscale_w = max(src_w / dst_w, (uint32_t)DRM_PLANE_HELPER_NO_SCALING);
 
@@ -3417,12 +3423,14 @@ skl_plane_relative_data_rate(const struct intel_crtc_state *cstate,
         if (y && format != DRM_FORMAT_NV12)
                 return 0;
 
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         width = drm_rect_width(&intel_pstate->base.src) >> 16;
         height = drm_rect_height(&intel_pstate->base.src) >> 16;
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(width, height);
-
         /* for planar format */
         if (format == DRM_FORMAT_NV12) {
                 if (y)  /* y-plane data rate */
@@ -3505,12 +3513,14 @@ skl_ddb_min_alloc(const struct drm_plane_state *pstate,
             fb->modifier != I915_FORMAT_MOD_Yf_TILED)
                 return 8;
 
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
         src_w = drm_rect_width(&intel_pstate->base.src) >> 16;
         src_h = drm_rect_height(&intel_pstate->base.src) >> 16;
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(src_w, src_h);
-
         /* Halve UV plane width and height for NV12 */
         if (fb->format->format == DRM_FORMAT_NV12 && !y) {
                 src_w /= 2;
@@ -3794,13 +3804,15 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
                 width = intel_pstate->base.crtc_w;
                 height = intel_pstate->base.crtc_h;
         } else {
+                /*
+                 * Src coordinates are already rotated by 270 degrees for
+                 * the 90/270 degree plane rotation cases (to match the
+                 * GTT mapping), hence no need to account for rotation here.
+                 */
                 width = drm_rect_width(&intel_pstate->base.src) >> 16;
                 height = drm_rect_height(&intel_pstate->base.src) >> 16;
         }
 
-        if (drm_rotation_90_or_270(pstate->rotation))
-                swap(width, height);
-
         cpp = fb->format->cpp[0];
         plane_pixel_rate = skl_adjusted_plane_pixel_rate(cstate, intel_pstate);
 
@@ -4335,11 +4347,19 @@ skl_compute_wm(struct drm_atomic_state *state)
         struct drm_crtc_state *cstate;
         struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
         struct skl_wm_values *results = &intel_state->wm_results;
+        struct drm_device *dev = state->dev;
         struct skl_pipe_wm *pipe_wm;
         bool changed = false;
         int ret, i;
 
         /*
+         * When we distrust bios wm we always need to recompute to set the
+         * expected DDB allocations for each CRTC.
+         */
+        if (to_i915(dev)->wm.distrust_bios_wm)
+                changed = true;
+
+        /*
          * If this transaction isn't actually touching any CRTC's, don't
          * bother with watermark calculation.  Note that if we pass this
          * test, we're guaranteed to hold at least one CRTC state mutex,
@@ -4349,6 +4369,7 @@ skl_compute_wm(struct drm_atomic_state *state)
          */
         for_each_new_crtc_in_state(state, crtc, cstate, i)
                 changed = true;
+
         if (!changed)
                 return 0;
 
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index c3780d0d2baf..559f1ab42bfc 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -435,8 +435,9 @@ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
         }
 
         /* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
-        if (intel_crtc->config->pipe_src_w > 3200 ||
-                                intel_crtc->config->pipe_src_h > 2000) {
+        if (dev_priv->psr.psr2_support &&
+            (intel_crtc->config->pipe_src_w > 3200 ||
+             intel_crtc->config->pipe_src_h > 2000)) {
                 dev_priv->psr.psr2_support = false;
                 return false;
         }
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8c87c717c7cd..e6517edcd16b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -83,10 +83,13 @@ int intel_usecs_to_scanlines(const struct drm_display_mode *adjusted_mode,
  */
 void intel_pipe_update_start(struct intel_crtc *crtc)
 {
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
         const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
         long timeout = msecs_to_jiffies_timeout(1);
         int scanline, min, max, vblank_start;
         wait_queue_head_t *wq = drm_crtc_vblank_waitqueue(&crtc->base);
+        bool need_vlv_dsi_wa = (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+                intel_crtc_has_type(crtc->config, INTEL_OUTPUT_DSI);
         DEFINE_WAIT(wait);
 
         vblank_start = adjusted_mode->crtc_vblank_start;
@@ -139,6 +142,24 @@ void intel_pipe_update_start(struct intel_crtc *crtc)
 
         drm_crtc_vblank_put(&crtc->base);
 
+        /*
+         * On VLV/CHV DSI the scanline counter would appear to
+         * increment approx. 1/3 of a scanline before start of vblank.
+         * The registers still get latched at start of vblank however.
+         * This means we must not write any registers on the first
+         * line of vblank (since not the whole line is actually in
+         * vblank). And unfortunately we can't use the interrupt to
+         * wait here since it will fire too soon. We could use the
+         * frame start interrupt instead since it will fire after the
+         * critical scanline, but that would require more changes
+         * in the interrupt code. So for now we'll just do the nasty
+         * thing and poll for the bad scanline to pass us by.
+         *
+         * FIXME figure out if BXT+ DSI suffers from this as well
+         */
+        while (need_vlv_dsi_wa && scanline == vblank_start)
+                scanline = intel_get_crtc_scanline(crtc);
+
         crtc->debug.scanline_start = scanline;
         crtc->debug.start_vbl_time = ktime_get();
         crtc->debug.start_vbl_count = intel_crtc_get_vblank_counter(crtc);
diff --git a/drivers/gpu/drm/i915/intel_uc.h b/drivers/gpu/drm/i915/intel_uc.h
index 4b7f73aeddac..f84115261ae7 100644
--- a/drivers/gpu/drm/i915/intel_uc.h
+++ b/drivers/gpu/drm/i915/intel_uc.h
@@ -59,8 +59,6 @@ struct drm_i915_gem_request;
  *                available in the work queue (note, the queue is shared,
  *                not per-engine). It is OK for this to be nonzero, but
  *                it should not be huge!
- *   q_fail: failed to enqueue a work item. This should never happen,
- *           because we check for space beforehand.
  *   b_fail: failed to ring the doorbell. This should never happen, unless
  *           somehow the hardware misbehaves, or maybe if the GuC firmware
  *           crashes? We probably need to reset the GPU to recover.
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
index 1afb8b06e3e1..12b85b3278cd 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_context.c
@@ -320,7 +320,7 @@ static unsigned long max_dwords(struct drm_i915_gem_object *obj)
 static int igt_ctx_exec(void *arg)
 {
         struct drm_i915_private *i915 = arg;
-        struct drm_i915_gem_object *obj;
+        struct drm_i915_gem_object *obj = NULL;
         struct drm_file *file;
         IGT_TIMEOUT(end_time);
         LIST_HEAD(objects);
@@ -359,7 +359,7 @@ static int igt_ctx_exec(void *arg)
                 }
 
                 for_each_engine(engine, i915, id) {
-                        if (dw == 0) {
+                        if (!obj) {
                                 obj = create_test_object(ctx, file, &objects);
                                 if (IS_ERR(obj)) {
                                         err = PTR_ERR(obj);
@@ -376,8 +376,10 @@ static int igt_ctx_exec(void *arg)
                                 goto out_unlock;
                         }
 
-                        if (++dw == max_dwords(obj))
+                        if (++dw == max_dwords(obj)) {
+                                obj = NULL;
                                 dw = 0;
+                        }
                         ndwords++;
                 }
                 ncontexts++;
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 8fb801fab039..8b05ecb8fdef 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -673,7 +673,7 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                 ret = drm_of_find_panel_or_bridge(child,
                                                   imx_ldb->lvds_mux ? 4 : 2, 0,
                                                   &channel->panel, &channel->bridge);
-                if (ret)
+                if (ret && ret != -ENODEV)
                         return ret;
 
                 /* panel ddc only if there is no bridge */
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 808b995a990f..b5cc6e12334c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -19,6 +19,7 @@
 #include <drm/drm_of.h>
 #include <linux/clk.h>
 #include <linux/component.h>
+#include <linux/iopoll.h>
 #include <linux/irq.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -900,16 +901,12 @@ static int mtk_dsi_host_detach(struct mipi_dsi_host *host,
 
 static void mtk_dsi_wait_for_idle(struct mtk_dsi *dsi)
 {
-        u32 timeout_ms = 500000; /* total 1s ~ 2s timeout */
-
-        while (timeout_ms--) {
-                if (!(readl(dsi->regs + DSI_INTSTA) & DSI_BUSY))
-                        break;
-
-                usleep_range(2, 4);
-        }
+        int ret;
+        u32 val;
 
-        if (timeout_ms == 0) {
+        ret = readl_poll_timeout(dsi->regs + DSI_INTSTA, val, !(val & DSI_BUSY),
+                                 4, 2000000);
+        if (ret) {
                 DRM_WARN("polling dsi wait not busy timeout!\n");
 
                 mtk_dsi_enable(dsi);
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 41a1c03b0347..0a4ffd724146 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi,
         }
 
         err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
-        if (err) {
+        if (err < 0) {
                 dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
                         err);
                 return err;
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 75382f5f0fce..10b227d83e9a 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -152,7 +152,7 @@ static struct regmap_config meson_regmap_config = {
         .max_register   = 0x1000,
 };
 
-static int meson_drv_bind(struct device *dev)
+static int meson_drv_bind_master(struct device *dev, bool has_components)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct meson_drm *priv;
@@ -233,10 +233,12 @@ static int meson_drv_bind(struct device *dev)
         if (ret)
                 goto free_drm;
 
-        ret = component_bind_all(drm->dev, drm);
-        if (ret) {
-                dev_err(drm->dev, "Couldn't bind all components\n");
-                goto free_drm;
+        if (has_components) {
+                ret = component_bind_all(drm->dev, drm);
+                if (ret) {
+                        dev_err(drm->dev, "Couldn't bind all components\n");
+                        goto free_drm;
+                }
         }
 
         ret = meson_plane_create(priv);
@@ -276,6 +278,11 @@ free_drm:
         return ret;
 }
 
+static int meson_drv_bind(struct device *dev)
+{
+        return meson_drv_bind_master(dev, true);
+}
+
 static void meson_drv_unbind(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
@@ -357,6 +364,9 @@ static int meson_drv_probe(struct platform_device *pdev)
                 count += meson_probe_remote(pdev, &match, np, remote);
         }
 
+        if (count && !match)
+                return meson_drv_bind_master(&pdev->dev, false);
+
         /* If some endpoints were found, initialize the nodes */
         if (count) {
                 dev_info(&pdev->dev, "Queued %d outputs on vpu\n", count);
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index adb411a078e8..f4b53588e071 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -1173,7 +1173,10 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
 
 
         if (IS_G200_SE(mdev)) {
-                if (mdev->unique_rev_id >= 0x02) {
+                if  (mdev->unique_rev_id >= 0x04) {
+                        WREG8(MGAREG_CRTCEXT_INDEX, 0x06);
+                        WREG8(MGAREG_CRTCEXT_DATA, 0);
+                } else if (mdev->unique_rev_id >= 0x02) {
                         u8 hi_pri_lvl;
                         u32 bpp;
                         u32 mb;
@@ -1639,6 +1642,10 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
                         if (mga_vga_calculate_mode_bandwidth(mode, bpp)
                                 > (30100 * 1024))
                                 return MODE_BANDWIDTH;
+                } else {
+                        if (mga_vga_calculate_mode_bandwidth(mode, bpp)
+                                > (55000 * 1024))
+                                return MODE_BANDWIDTH;
                 }
         } else if (mdev->type == G200_WB) {
                 if (mode->hdisplay > 1280)
diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index 5b8e23d051f2..0a31cd6d01ce 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -13,6 +13,7 @@ config DRM_MSM
         select QCOM_SCM
         select SND_SOC_HDMI_CODEC if SND_SOC
         select SYNC_FILE
+        select PM_OPP
         default y
         help
           DRM/KMS driver for MSM/snapdragon.
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
index f8f48d014978..9c34d7824988 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c
@@ -116,7 +116,7 @@ static int mdss_hw_irqdomain_map(struct irq_domain *d, unsigned int irq,
         return 0;
 }
 
-static struct irq_domain_ops mdss_hw_irqdomain_ops = {
+static const struct irq_domain_ops mdss_hw_irqdomain_ops = {
         .map = mdss_hw_irqdomain_map,
         .xlate = irq_domain_xlate_onecell,
 };
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index a38c5fe6cc19..7d3741215387 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -225,9 +225,10 @@ mdp5_plane_duplicate_state(struct drm_plane *plane)
 
         mdp5_state = kmemdup(to_mdp5_plane_state(plane->state),
                         sizeof(*mdp5_state), GFP_KERNEL);
+        if (!mdp5_state)
+                return NULL;
 
-        if (mdp5_state && mdp5_state->base.fb)
-                drm_framebuffer_reference(mdp5_state->base.fb);
+        __drm_atomic_helper_plane_duplicate_state(plane, &mdp5_state->base);
 
         return &mdp5_state->base;
 }
@@ -444,6 +445,10 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state,
                         mdp5_pipe_release(state->state, old_hwpipe);
                         mdp5_pipe_release(state->state, old_right_hwpipe);
                 }
+        } else {
+                mdp5_pipe_release(state->state, mdp5_state->hwpipe);
+                mdp5_pipe_release(state->state, mdp5_state->r_hwpipe);
+                mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 87b5695d4034..9d498eb81906 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -830,6 +830,7 @@ static struct drm_driver msm_driver = {
         .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
         .gem_prime_export   = drm_gem_prime_export,
         .gem_prime_import   = drm_gem_prime_import,
+        .gem_prime_res_obj  = msm_gem_prime_res_obj,
         .gem_prime_pin      = msm_gem_prime_pin,
         .gem_prime_unpin    = msm_gem_prime_unpin,
         .gem_prime_get_sg_table = msm_gem_prime_get_sg_table,
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 28b6f9ba5066..1b26ca626528 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -224,6 +224,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj);
 void *msm_gem_prime_vmap(struct drm_gem_object *obj);
 void msm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
 int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma);
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj);
 struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev,
                 struct dma_buf_attachment *attach, struct sg_table *sg);
 int msm_gem_prime_pin(struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
index 3f299c537b77..a2f89bac9c16 100644
--- a/drivers/gpu/drm/msm/msm_fence.c
+++ b/drivers/gpu/drm/msm/msm_fence.c
@@ -99,8 +99,8 @@ void msm_update_fence(struct msm_fence_context *fctx, uint32_t fence)
 }
 
 struct msm_fence {
-        struct msm_fence_context *fctx;
         struct dma_fence base;
+        struct msm_fence_context *fctx;
 };
 
 static inline struct msm_fence *to_msm_fence(struct dma_fence *fence)
@@ -130,19 +130,13 @@ static bool msm_fence_signaled(struct dma_fence *fence)
         return fence_completed(f->fctx, f->base.seqno);
 }
 
-static void msm_fence_release(struct dma_fence *fence)
-{
-        struct msm_fence *f = to_msm_fence(fence);
-        kfree_rcu(f, base.rcu);
-}
-
 static const struct dma_fence_ops msm_fence_ops = {
         .get_driver_name = msm_fence_get_driver_name,
         .get_timeline_name = msm_fence_get_timeline_name,
         .enable_signaling = msm_fence_enable_signaling,
         .signaled = msm_fence_signaled,
         .wait = dma_fence_default_wait,
-        .release = msm_fence_release,
+        .release = dma_fence_free,
 };
 
 struct dma_fence *
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 68e509b3b9e4..50289a23baf8 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -758,6 +758,8 @@ static int msm_gem_new_impl(struct drm_device *dev,
         struct msm_gem_object *msm_obj;
         bool use_vram = false;
 
+        WARN_ON(!mutex_is_locked(&dev->struct_mutex));
+
         switch (flags & MSM_BO_CACHE_MASK) {
         case MSM_BO_UNCACHED:
         case MSM_BO_CACHED:
@@ -853,7 +855,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
 
         size = PAGE_ALIGN(dmabuf->size);
 
+        /* Take mutex so we can modify the inactive list in msm_gem_new_impl */
+        mutex_lock(&dev->struct_mutex);
         ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj);
+        mutex_unlock(&dev->struct_mutex);
+
         if (ret)
                 goto fail;
 
diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
index 60bb290700ce..13403c6da6c7 100644
--- a/drivers/gpu/drm/msm/msm_gem_prime.c
+++ b/drivers/gpu/drm/msm/msm_gem_prime.c
@@ -70,3 +70,10 @@ void msm_gem_prime_unpin(struct drm_gem_object *obj)
         if (!obj->import_attach)
                 msm_gem_put_pages(obj);
 }
+
+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj)
+{
+        struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+        return msm_obj->resv;
+}
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 1c545ebe6a5a..7832e6421d25 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -410,12 +410,11 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                 if (!in_fence)
                         return -EINVAL;
 
-                /* TODO if we get an array-fence due to userspace merging multiple
-                 * fences, we need a way to determine if all the backing fences
-                 * are from our own context..
+                /*
+                 * Wait if the fence is from a foreign context, or if the fence
+                 * array contains any fence from a foreign context.
                  */
-
-                if (in_fence->context != gpu->fctx->context) {
+                if (!dma_fence_match_context(in_fence, gpu->fctx->context)) {
                         ret = dma_fence_wait(in_fence, true);
                         if (ret)
                                 return ret;
@@ -496,8 +495,9 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                         goto out;
                 }
 
-                if ((submit_cmd.size + submit_cmd.submit_offset) >=
-                                msm_obj->base.size) {
+                if (!submit_cmd.size ||
+                        ((submit_cmd.size + submit_cmd.submit_offset) >
+                                msm_obj->base.size)) {
                         DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size);
                         ret = -EINVAL;
                         goto out;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 97b9c38c6b3f..0fdc88d79ca8 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -549,9 +549,9 @@ static int get_clocks(struct platform_device *pdev, struct msm_gpu *gpu)
                 gpu->grp_clks[i] = get_clock(dev, name);
 
                 /* Remember the key clocks that we need to control later */
-                if (!strcmp(name, "core"))
+                if (!strcmp(name, "core") || !strcmp(name, "core_clk"))
                         gpu->core_clk = gpu->grp_clks[i];
-                else if (!strcmp(name, "rbbmtimer"))
+                else if (!strcmp(name, "rbbmtimer") || !strcmp(name, "rbbmtimer_clk"))
                         gpu->rbbmtimer_clk = gpu->grp_clks[i];
 
                 ++i;
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
index 1144e0c9e894..0abe77675b76 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
@@ -35,6 +35,13 @@
 #include "mxsfb_drv.h"
 #include "mxsfb_regs.h"
 
+#define MXS_SET_ADDR            0x4
+#define MXS_CLR_ADDR            0x8
+#define MODULE_CLKGATE          BIT(30)
+#define MODULE_SFTRST           BIT(31)
+/* 1 second delay should be plenty of time for block reset */
+#define RESET_TIMEOUT           1000000
+
 static u32 set_hsync_pulse_width(struct mxsfb_drm_private *mxsfb, u32 val)
 {
         return (val & mxsfb->devdata->hs_wdth_mask) <<
@@ -159,6 +166,36 @@ static void mxsfb_disable_controller(struct mxsfb_drm_private *mxsfb)
                 clk_disable_unprepare(mxsfb->clk_disp_axi);
 }
 
+/*
+ * Clear the bit and poll it cleared.  This is usually called with
+ * a reset address and mask being either SFTRST(bit 31) or CLKGATE
+ * (bit 30).
+ */
+static int clear_poll_bit(void __iomem *addr, u32 mask)
+{
+        u32 reg;
+
+        writel(mask, addr + MXS_CLR_ADDR);
+        return readl_poll_timeout(addr, reg, !(reg & mask), 0, RESET_TIMEOUT);
+}
+
+static int mxsfb_reset_block(void __iomem *reset_addr)
+{
+        int ret;
+
+        ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+        if (ret)
+                return ret;
+
+        writel(MODULE_CLKGATE, reset_addr + MXS_CLR_ADDR);
+
+        ret = clear_poll_bit(reset_addr, MODULE_SFTRST);
+        if (ret)
+                return ret;
+
+        return clear_poll_bit(reset_addr, MODULE_CLKGATE);
+}
+
 static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
 {
         struct drm_display_mode *m = &mxsfb->pipe.crtc.state->adjusted_mode;
@@ -173,6 +210,11 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
          */
         mxsfb_enable_axi_clk(mxsfb);
 
+        /* Mandatory eLCDIF reset as per the Reference Manual */
+        err = mxsfb_reset_block(mxsfb->base);
+        if (err)
+                return;
+
         /* Clear the FIFOs */
         writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);
 
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
index 6a567fe347b3..820a4805916f 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
@@ -4,6 +4,7 @@
 
 struct nvkm_alarm {
         struct list_head head;
+        struct list_head exec;
         u64 timestamp;
         void (*func)(struct nvkm_alarm *);
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 36268e1802b5..15a13d09d431 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -80,7 +80,7 @@ int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
-int nouveau_runtime_pm = -1;
+static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
 
 static struct drm_driver driver_stub;
@@ -495,7 +495,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         nouveau_fbcon_init(dev);
         nouveau_led_init(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_use_autosuspend(dev->dev);
                 pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                 pm_runtime_set_active(dev->dev);
@@ -527,7 +527,7 @@ nouveau_drm_unload(struct drm_device *dev)
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
 
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                 pm_runtime_get_sync(dev->dev);
                 pm_runtime_forbid(dev->dev);
         }
@@ -726,6 +726,14 @@ nouveau_pmops_thaw(struct device *dev)
         return nouveau_do_resume(drm_dev, false);
 }
 
+bool
+nouveau_pmops_runtime()
+{
+        if (nouveau_runtime_pm == -1)
+                return nouveau_is_optimus() || nouveau_is_v1_dsm();
+        return nouveau_runtime_pm == 1;
+}
+
 static int
 nouveau_pmops_runtime_suspend(struct device *dev)
 {
@@ -733,14 +741,7 @@ nouveau_pmops_runtime_suspend(struct device *dev)
         struct drm_device *drm_dev = pci_get_drvdata(pdev);
         int ret;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
@@ -765,8 +766,10 @@ nouveau_pmops_runtime_resume(struct device *dev)
         struct nvif_device *device = &nouveau_drm(drm_dev)->client.device;
         int ret;
 
-        if (nouveau_runtime_pm == 0)
-                return -EINVAL;
+        if (!nouveau_pmops_runtime()) {
+                pm_runtime_forbid(dev);
+                return -EBUSY;
+        }
 
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
@@ -796,14 +799,7 @@ nouveau_pmops_runtime_idle(struct device *dev)
         struct nouveau_drm *drm = nouveau_drm(drm_dev);
         struct drm_crtc *crtc;
 
-        if (nouveau_runtime_pm == 0) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
+        if (!nouveau_pmops_runtime()) {
                 pm_runtime_forbid(dev);
                 return -EBUSY;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index eadec2f49ad3..a11b6aaed325 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -108,8 +108,6 @@ nouveau_cli(struct drm_file *fpriv)
 #include <nvif/object.h>
 #include <nvif/device.h>
 
-extern int nouveau_runtime_pm;
-
 struct nouveau_drm {
         struct nouveau_cli client;
         struct drm_device *dev;
@@ -195,6 +193,7 @@ nouveau_drm(struct drm_device *dev)
 
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
+bool nouveau_pmops_runtime(void);
 
 #include <nvkm/core/tegra.h>
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index a4aacbc0cec8..02fe0efb9e16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -87,7 +87,7 @@ void
 nouveau_vga_init(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         /* only relevant for PCI devices */
         if (!dev->pdev)
@@ -99,10 +99,6 @@ nouveau_vga_init(struct nouveau_drm *drm)
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
         vga_switcheroo_register_client(dev->pdev, &nouveau_switcheroo_ops, runtime);
 
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
@@ -113,18 +109,13 @@ void
 nouveau_vga_fini(struct nouveau_drm *drm)
 {
         struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
 
         vga_client_register(dev->pdev, NULL, NULL, NULL);
 
         if (pci_is_thunderbolt_attached(dev->pdev))
                 return;
 
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
-
         vga_switcheroo_unregister_client(dev->pdev);
         if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
                 vga_switcheroo_fini_domain_pm_ops(drm->dev->dev);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index a7663249b3ba..06e564a9ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -2107,7 +2107,8 @@ nv50_head_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state)
                                         asyc->set.dither = true;
                         }
                 } else {
-                        asyc->set.mask = ~0;
+                        if (asyc)
+                                asyc->set.mask = ~0;
                         asyh->set.mask = ~0;
                 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
index f2a86eae0a0d..2437f7d41ca2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
                 /* Move to completed list.  We'll drop the lock before
                  * executing the callback so it can reschedule itself.
                  */
-                list_move_tail(&alarm->head, &exec);
+                list_del_init(&alarm->head);
+                list_add(&alarm->exec, &exec);
         }
 
         /* Shut down interrupt if no more pending alarms. */
@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
         spin_unlock_irqrestore(&tmr->lock, flags);
 
         /* Execute completed callbacks. */
-        list_for_each_entry_safe(alarm, atemp, &exec, head) {
-                list_del_init(&alarm->head);
+        list_for_each_entry_safe(alarm, atemp, &exec, exec) {
+                list_del(&alarm->exec);
                 alarm->func(alarm);
         }
 }
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 058340a002c2..4a340efd8ba6 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -575,8 +575,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
         if (ret)
                 return;
 
-        cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
-
         if (fb != old_state->fb) {
                 obj = to_qxl_framebuffer(fb)->obj;
                 user_bo = gem_to_qxl_bo(obj);
@@ -614,6 +612,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 qxl_bo_kunmap(cursor_bo);
                 qxl_bo_kunmap(user_bo);
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->u.set.visible = 1;
                 cmd->u.set.shape = qxl_bo_physical_address(qdev,
                                                            cursor_bo, 0);
@@ -624,6 +623,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 if (ret)
                         goto out_free_release;
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->type = QXL_CURSOR_MOVE;
         }
 
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 7ba450832e6b..ea36dc4dd5d2 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct radeon_device *rdev)
         u32 vblank_time = r600_dpm_get_vblank_time(rdev);
         u32 switch_limit = pi->mem_gddr5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+        * blanking period would allow it
+        */
+        if (r600_dpm_get_vrefresh(rdev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index ccebe0f8d2e1..ca44233ceacc 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7401,7 +7401,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -7431,7 +7431,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -9267,8 +9267,11 @@ static void dce8_program_watermarks(struct radeon_device *rdev,
         u32 tmp, wm_mask;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
 
                 /* watermark for high clocks */
                 if ((rdev->pm.pm_method == PM_METHOD_DPM) &&
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f130ec41ee4b..534637203e70 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2266,8 +2266,11 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
         fixed20_12 a, b, c;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
                 dram_channels = evergreen_get_number_of_dram_channels(rdev);
@@ -4927,7 +4930,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -4958,7 +4961,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 0a085176e79b..e06e2d8feab3 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3988,7 +3988,7 @@ static void r600_irq_ack(struct radeon_device *rdev)
                         WREG32(DC_HPD5_INT_CONTROL, tmp);
                 }
                 if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
-                        tmp = RREG32(DC_HPD5_INT_CONTROL);
+                        tmp = RREG32(DC_HPD6_INT_CONTROL);
                         tmp |= DC_HPDx_INT_ACK;
                         WREG32(DC_HPD6_INT_CONTROL, tmp);
                 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index c1c8e2208a21..e562a78510ff 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -375,7 +375,7 @@ struct radeon_fence {
         unsigned                ring;
         bool                    is_vm_update;
 
-        wait_queue_t            fence_wake;
+        wait_queue_entry_t              fence_wake;
 };
 
 int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring);
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index ef09f0a63754..e86f2bd38410 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -158,7 +158,7 @@ int radeon_fence_emit(struct radeon_device *rdev,
  * for the fence locking itself, so unlocked variants are used for
  * fence_signal, and remove_wait_queue.
  */
-static int radeon_fence_check_signaled(wait_queue_t *wait, unsigned mode, int flags, void *key)
+static int radeon_fence_check_signaled(wait_queue_entry_t *wait, unsigned mode, int flags, void *key)
 {
         struct radeon_fence *fence;
         u64 seq;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index e3e7cb1d10a2..4761f27f2ca2 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -116,7 +116,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
         if ((radeon_runtime_pm != 0) &&
             radeon_has_atpx() &&
             ((flags & RADEON_IS_IGP) == 0) &&
-            !pci_is_thunderbolt_attached(rdev->pdev))
+            !pci_is_thunderbolt_attached(dev->pdev))
                 flags |= RADEON_IS_PX;
 
         /* radeon_device_init should report only fatal error
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 7431eb4a11b7..d34d1cf33895 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -621,7 +621,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
         }
 
         /* TODO: is this still necessary on NI+ ? */
-        if ((cmd == 0 || cmd == 1 || cmd == 0x3) &&
+        if ((cmd == 0 || cmd == 0x3) &&
             (start >> 28) != (p->rdev->uvd.gpu_addr >> 28)) {
                 DRM_ERROR("msg/fb buffer %LX-%LX out of 256MB segment!\n",
                           start, end);
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index ceee87f029d9..5303f25d5280 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2284,8 +2284,11 @@ static void dce6_program_watermarks(struct radeon_device *rdev,
         fixed20_12 a, b, c;
 
         if (radeon_crtc->base.enabled && num_heads && mode) {
-                active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
-                line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
+                active_time = (u32) div_u64((u64)mode->crtc_hdisplay * 1000000,
+                                            (u32)mode->clock);
+                line_time = (u32) div_u64((u64)mode->crtc_htotal * 1000000,
+                                          (u32)mode->clock);
+                line_time = min(line_time, (u32)65535);
                 priority_a_cnt = 0;
                 priority_b_cnt = 0;
 
@@ -6317,7 +6320,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -6348,7 +6351,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index d8fa7a9c9240..ce5f2d1f9994 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -245,8 +245,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
                                       struct drm_connector_state *conn_state)
 {
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc_state);
-        struct rockchip_dp_device *dp = to_dp(encoder);
-        int ret;
 
         /*
          * The hardware IC designed that VOP must output the RGB10 video
@@ -258,16 +256,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
 
         s->output_mode = ROCKCHIP_OUT_MODE_AAAA;
         s->output_type = DRM_MODE_CONNECTOR_eDP;
-        if (dp->data->chip_type == RK3399_EDP) {
-                /*
-                 * For RK3399, VOP Lit must code the out mode to RGB888,
-                 * VOP Big must code the out mode to RGB10.
-                 */
-                ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node,
-                                                        encoder);
-                if (ret > 0)
-                        s->output_mode = ROCKCHIP_OUT_MODE_P888;
-        }
 
         return 0;
 }
diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index a2169dd3d26b..14fa1f8351e8 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -615,7 +615,6 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 {
         struct cdn_dp_device *dp = encoder_to_dp(encoder);
         int ret, val;
-        struct rockchip_crtc_state *state;
 
         ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node, encoder);
         if (ret < 0) {
@@ -625,14 +624,10 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEV_DEBUG_KMS(dp->dev, "vop %s output to cdn-dp\n",
                           (ret) ? "LIT" : "BIG");
-        state = to_rockchip_crtc_state(encoder->crtc->state);
-        if (ret) {
+        if (ret)
                 val = DP_SEL_VOP_LIT | (DP_SEL_VOP_LIT << 16);
-                state->output_mode = ROCKCHIP_OUT_MODE_P888;
-        } else {
+        else
                 val = DP_SEL_VOP_LIT << 16;
-                state->output_mode = ROCKCHIP_OUT_MODE_AAAA;
-        }
 
         ret = cdn_dp_grf_write(dp, GRF_SOC_CON9, val);
         if (ret)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 3f7a82d1e095..45589d6ce65e 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -875,6 +875,7 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
 static void vop_crtc_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
+        const struct vop_data *vop_data = vop->data;
         struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc->state);
         struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
         u16 hsync_len = adjusted_mode->hsync_end - adjusted_mode->hsync_start;
@@ -967,6 +968,13 @@ static void vop_crtc_enable(struct drm_crtc *crtc)
                 DRM_DEV_ERROR(vop->dev, "unsupported connector_type [%d]\n",
                               s->output_type);
         }
+
+        /*
+         * if vop is not support RGB10 output, need force RGB10 to RGB888.
+         */
+        if (s->output_mode == ROCKCHIP_OUT_MODE_AAAA &&
+            !(vop_data->feature & VOP_FEATURE_OUTPUT_RGB10))
+                s->output_mode = ROCKCHIP_OUT_MODE_P888;
         VOP_CTRL_SET(vop, out_mode, s->output_mode);
 
         VOP_CTRL_SET(vop, htotal_pw, (htotal << 16) | hsync_len);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 5a4faa85dbd2..9979fd0c2282 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -142,6 +142,9 @@ struct vop_data {
         const struct vop_intr *intr;
         const struct vop_win_data *win;
         unsigned int win_size;
+
+#define VOP_FEATURE_OUTPUT_RGB10        BIT(0)
+        u64 feature;
 };
 
 /* interrupt define */
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index 0da44442aab0..bafd698a28b1 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -275,6 +275,7 @@ static const struct vop_intr rk3288_vop_intr = {
 static const struct vop_data rk3288_vop = {
         .init_table = rk3288_init_reg_table,
         .table_size = ARRAY_SIZE(rk3288_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3288_vop_intr,
         .ctrl = &rk3288_ctrl_data,
         .win = rk3288_vop_win_data,
@@ -343,6 +344,7 @@ static const struct vop_reg_data rk3399_init_reg_table[] = {
 static const struct vop_data rk3399_vop_big = {
         .init_table = rk3399_init_reg_table,
         .table_size = ARRAY_SIZE(rk3399_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
         .intr = &rk3399_vop_intr,
         .ctrl = &rk3399_ctrl_data,
         /*
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index 9a1e34e48f64..81f86a67c10d 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -451,18 +451,6 @@ fail:
 
 
 #ifdef CONFIG_DRM_TEGRA_STAGING
-static struct tegra_drm_context *
-tegra_drm_file_get_context(struct tegra_drm_file *file, u32 id)
-{
-        struct tegra_drm_context *context;
-
-        mutex_lock(&file->lock);
-        context = idr_find(&file->contexts, id);
-        mutex_unlock(&file->lock);
-
-        return context;
-}
-
 static int tegra_gem_create(struct drm_device *drm, void *data,
                             struct drm_file *file)
 {
@@ -551,7 +539,7 @@ static int tegra_client_open(struct tegra_drm_file *fpriv,
         if (err < 0)
                 return err;
 
-        err = idr_alloc(&fpriv->contexts, context, 0, 0, GFP_KERNEL);
+        err = idr_alloc(&fpriv->contexts, context, 1, 0, GFP_KERNEL);
         if (err < 0) {
                 client->ops->close_channel(context);
                 return err;
@@ -606,7 +594,7 @@ static int tegra_close_channel(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -EINVAL;
                 goto unlock;
@@ -631,7 +619,7 @@ static int tegra_get_syncpt(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
@@ -660,7 +648,7 @@ static int tegra_submit(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
@@ -685,7 +673,7 @@ static int tegra_get_syncpt_base(struct drm_device *drm, void *data,
 
         mutex_lock(&fpriv->lock);
 
-        context = tegra_drm_file_get_context(fpriv, args->context);
+        context = idr_find(&fpriv->contexts, args->context);
         if (!context) {
                 err = -ENODEV;
                 goto unlock;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 130d51c5ec6a..4b948fba9eec 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -41,9 +41,9 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
 
-#define VMWGFX_DRIVER_DATE "20170221"
+#define VMWGFX_DRIVER_DATE "20170607"
 #define VMWGFX_DRIVER_MAJOR 2
-#define VMWGFX_DRIVER_MINOR 12
+#define VMWGFX_DRIVER_MINOR 13
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index b6a0806b06bf..a1c68e6a689e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
                                 return fifo_state->static_buffer;
                         else {
                                 fifo_state->dynamic_buffer = vmalloc(bytes);
+                                if (!fifo_state->dynamic_buffer)
+                                        goto out_err;
                                 return fifo_state->dynamic_buffer;
                         }
                 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ef9f3a2a4030..1d2db5d912b0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -274,108 +274,6 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 }
 
 
-
-/**
- * vmw_du_cursor_plane_update() - Update cursor image and location
- *
- * @plane: plane object to update
- * @crtc: owning CRTC of @plane
- * @fb: framebuffer to flip onto plane
- * @crtc_x: x offset of plane on crtc
- * @crtc_y: y offset of plane on crtc
- * @crtc_w: width of plane rectangle on crtc
- * @crtc_h: height of plane rectangle on crtc
- * @src_x: Not used
- * @src_y: Not used
- * @src_w: Not used
- * @src_h: Not used
- *
- *
- * RETURNS:
- * Zero on success, error code on failure
- */
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h)
-{
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-        struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
-        struct vmw_surface *surface = NULL;
-        struct vmw_dma_buffer *dmabuf = NULL;
-        s32 hotspot_x, hotspot_y;
-        int ret;
-
-        hotspot_x = du->hotspot_x + fb->hot_x;
-        hotspot_y = du->hotspot_y + fb->hot_y;
-
-        /* A lot of the code assumes this */
-        if (crtc_w != 64 || crtc_h != 64) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (vmw_framebuffer_to_vfb(fb)->dmabuf)
-                dmabuf = vmw_framebuffer_to_vfbd(fb)->buffer;
-        else
-                surface = vmw_framebuffer_to_vfbs(fb)->surface;
-
-        if (surface && !surface->snooper.image) {
-                DRM_ERROR("surface not suitable for cursor\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* setup new image */
-        ret = 0;
-        if (surface) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_surface = surface;
-
-                du->cursor_age = du->cursor_surface->snooper.age;
-
-                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                              64, 64, hotspot_x, hotspot_y);
-        } else if (dmabuf) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_dmabuf = dmabuf;
-
-                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, crtc_w, crtc_h,
-                                               hotspot_x, hotspot_y);
-        } else {
-                vmw_cursor_update_position(dev_priv, false, 0, 0);
-                goto out;
-        }
-
-        if (!ret) {
-                du->cursor_x = crtc_x + du->set_gui_x;
-                du->cursor_y = crtc_y + du->set_gui_y;
-
-                vmw_cursor_update_position(dev_priv, true,
-                                           du->cursor_x + hotspot_x,
-                                           du->cursor_y + hotspot_y);
-        }
-
-out:
-        return ret;
-}
-
-
-int vmw_du_cursor_plane_disable(struct drm_plane *plane)
-{
-        if (plane->fb) {
-                drm_framebuffer_unreference(plane->fb);
-                plane->fb = NULL;
-        }
-
-        return -EINVAL;
-}
-
-
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane)
 {
         vmw_cursor_update_position(plane->dev->dev_private, false, 0, 0);
@@ -473,18 +371,6 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
 
 
 void
-vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                   struct drm_plane_state *old_state)
-{
-        struct drm_crtc *crtc = plane->state->crtc ?: old_state->crtc;
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-
-        drm_atomic_set_fb_for_plane(plane->state, NULL);
-        vmw_cursor_update_position(dev_priv, false, 0, 0);
-}
-
-
-void
 vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                   struct drm_plane_state *old_state)
 {
@@ -1498,6 +1384,7 @@ vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
          */
         if (vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)  &&
             dmabuf && only_2d &&
+            mode_cmd->width > 64 &&  /* Don't create a proxy for cursor */
             dev_priv->active_display_unit == vmw_du_screen_target) {
                 ret = vmw_create_dmabuf_proxy(dev_priv->dev, mode_cmd,
                                               dmabuf, &surface);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 13f2f1d2818a..5f8d678ae675 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -256,10 +256,6 @@ int vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                            u16 *r, u16 *g, u16 *b,
                            uint32_t size,
                            struct drm_modeset_acquire_ctx *ctx);
-int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
-                            uint32_t handle, uint32_t width, uint32_t height,
-                            int32_t hot_x, int32_t hot_y);
-int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_set_property(struct drm_connector *connector,
                                   struct drm_property *property,
                                   uint64_t val);
@@ -339,15 +335,6 @@ void vmw_kms_create_implicit_placement_property(struct vmw_private *dev_priv,
 /* Universal Plane Helpers */
 void vmw_du_primary_plane_destroy(struct drm_plane *plane);
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane);
-int vmw_du_cursor_plane_disable(struct drm_plane *plane);
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h);
 
 /* Atomic Helpers */
 int vmw_du_primary_plane_atomic_check(struct drm_plane *plane,
@@ -356,8 +343,6 @@ int vmw_du_cursor_plane_atomic_check(struct drm_plane *plane,
                                      struct drm_plane_state *state);
 void vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                        struct drm_plane_state *old_state);
-void vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                        struct drm_plane_state *old_state);
 int vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
                                    struct drm_plane_state *new_state);
 void vmw_du_plane_cleanup_fb(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index bad31bdf09b6..50be1f034f9e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -56,6 +56,8 @@ enum stdu_content_type {
  * @right: Right side of bounding box.
  * @top: Top side of bounding box.
  * @bottom: Bottom side of bounding box.
+ * @fb_left: Left side of the framebuffer/content bounding box
+ * @fb_top: Top of the framebuffer/content bounding box
  * @buf: DMA buffer when DMA-ing between buffer and screen targets.
  * @sid: Surface ID when copying between surface and screen targets.
  */
@@ -63,6 +65,7 @@ struct vmw_stdu_dirty {
         struct vmw_kms_dirty base;
         SVGA3dTransferType  transfer;
         s32 left, right, top, bottom;
+        s32 fb_left, fb_top;
         u32 pitch;
         union {
                 struct vmw_dma_buffer *buf;
@@ -647,7 +650,7 @@ static void vmw_stdu_dmabuf_fifo_commit(struct vmw_kms_dirty *dirty)
  *
  * @dirty: The closure structure.
  *
- * This function calculates the bounding box for all the incoming clips
+ * This function calculates the bounding box for all the incoming clips.
  */
 static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 {
@@ -656,11 +659,19 @@ static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 
         dirty->num_hits = 1;
 
-        /* Calculate bounding box */
+        /* Calculate destination bounding box */
         ddirty->left = min_t(s32, ddirty->left, dirty->unit_x1);
         ddirty->top = min_t(s32, ddirty->top, dirty->unit_y1);
         ddirty->right = max_t(s32, ddirty->right, dirty->unit_x2);
         ddirty->bottom = max_t(s32, ddirty->bottom, dirty->unit_y2);
+
+        /*
+         * Calculate content bounding box.  We only need the top-left
+         * coordinate because width and height will be the same as the
+         * destination bounding box above
+         */
+        ddirty->fb_left = min_t(s32, ddirty->fb_left, dirty->fb_x);
+        ddirty->fb_top  = min_t(s32, ddirty->fb_top, dirty->fb_y);
 }
 
 
@@ -697,11 +708,11 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
         src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
         src = ttm_kmap_obj_virtual(&stdu->host_map, &not_used);
-        src += dirty->unit_y1 * src_pitch + dirty->unit_x1 * stdu->cpp;
+        src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
 
         dst_pitch = ddirty->pitch;
         dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used);
-        dst += dirty->fb_y * dst_pitch + dirty->fb_x * stdu->cpp;
+        dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
 
 
         /* Figure out the real direction */
@@ -760,7 +771,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
         }
 
 out_cleanup:
-        ddirty->left = ddirty->top = S32_MAX;
+        ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
         ddirty->right = ddirty->bottom = S32_MIN;
 }
 
@@ -812,6 +823,7 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
                 SVGA3D_READ_HOST_VRAM;
         ddirty.left = ddirty.top = S32_MAX;
         ddirty.right = ddirty.bottom = S32_MIN;
+        ddirty.fb_left = ddirty.fb_top = S32_MAX;
         ddirty.pitch = vfb->base.pitches[0];
         ddirty.buf = buf;
         ddirty.base.fifo_commit = vmw_stdu_dmabuf_fifo_commit;
@@ -1355,6 +1367,11 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
                 DRM_ERROR("Failed to bind surface to STDU.\n");
         else
                 crtc->primary->fb = plane->state->fb;
+
+        ret = vmw_stdu_update_st(dev_priv, stdu);
+
+        if (ret)
+                DRM_ERROR("Failed to update STDU.\n");
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 7681341fe32b..6b70bd259953 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1274,11 +1274,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
         int ret;
         uint32_t size;
-        uint32_t backup_handle;
+        uint32_t backup_handle = 0;
 
         if (req->multisample_count != 0)
                 return -EINVAL;
 
+        if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+                return -EINVAL;
+
         if (unlikely(vmw_user_surface_size == 0))
                 vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
                         128;
@@ -1314,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
                 ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
                                              &res->backup,
                                              &user_srf->backup_base);
-                if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
-                    res->backup_size) {
-                        DRM_ERROR("Surface backup buffer is too small.\n");
-                        vmw_dmabuf_unreference(&res->backup);
-                        ret = -EINVAL;
-                        goto out_unlock;
+                if (ret == 0) {
+                        if (res->backup->base.num_pages * PAGE_SIZE <
+                            res->backup_size) {
+                                DRM_ERROR("Surface backup buffer is too small.\n");
+                                vmw_dmabuf_unreference(&res->backup);
+                                ret = -EINVAL;
+                                goto out_unlock;
+                        } else {
+                                backup_handle = req->buffer_handle;
+                        }
                 }
         } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
                 ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1491,7 +1498,7 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
                                  dev_priv->stdu_max_height);
 
                 if (size.width > max_width || size.height > max_height) {
-                        DRM_ERROR("%ux%u\n, exeeds max surface size %ux%u",
+                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                   size.width, size.height,
                                   max_width, max_height);
                         return -EINVAL;
diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index f05ebb14fa63..ac65f52850a6 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -172,7 +172,7 @@ static int host1x_probe(struct platform_device *pdev)
 
         host->rst = devm_reset_control_get(&pdev->dev, "host1x");
         if (IS_ERR(host->rst)) {
-                err = PTR_ERR(host->clk);
+                err = PTR_ERR(host->rst);
                 dev_err(&pdev->dev, "failed to get reset: %d\n", err);
                 return err;
         }
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 16d556816b5f..2fb5f432a54c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -725,15 +725,16 @@ void ipu_set_ic_src_mux(struct ipu_soc *ipu, int csi_id, bool vdi)
         spin_lock_irqsave(&ipu->lock, flags);
 
         val = ipu_cm_read(ipu, IPU_CONF);
-        if (vdi) {
+        if (vdi)
                 val |= IPU_CONF_IC_INPUT;
-        } else {
+        else
                 val &= ~IPU_CONF_IC_INPUT;
-                if (csi_id == 1)
-                        val |= IPU_CONF_CSI_SEL;
-                else
-                        val &= ~IPU_CONF_CSI_SEL;
-        }
+
+        if (csi_id == 1)
+                val |= IPU_CONF_CSI_SEL;
+        else
+                val &= ~IPU_CONF_CSI_SEL;
+
         ipu_cm_write(ipu, val, IPU_CONF);
 
         spin_unlock_irqrestore(&ipu->lock, flags);
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c55563379e2e..c35f74c83065 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -131,8 +131,6 @@ int ipu_pre_get(struct ipu_pre *pre)
         if (pre->in_use)
                 return -EBUSY;
 
-        clk_prepare_enable(pre->clk_axi);
-
         /* first get the engine out of reset and remove clock gating */
         writel(0, pre->regs + IPU_PRE_CTRL);
 
@@ -149,12 +147,7 @@ int ipu_pre_get(struct ipu_pre *pre)
 
 void ipu_pre_put(struct ipu_pre *pre)
 {
-        u32 val;
-
-        val = IPU_PRE_CTRL_SFTRST | IPU_PRE_CTRL_CLKGATE;
-        writel(val, pre->regs + IPU_PRE_CTRL);
-
-        clk_disable_unprepare(pre->clk_axi);
+        writel(IPU_PRE_CTRL_SFTRST, pre->regs + IPU_PRE_CTRL);
 
         pre->in_use = false;
 }
@@ -249,6 +242,8 @@ static int ipu_pre_probe(struct platform_device *pdev)
         if (!pre->buffer_virt)
                 return -ENOMEM;
 
+        clk_prepare_enable(pre->clk_axi);
+
         pre->dev = dev;
         platform_set_drvdata(pdev, pre);
         mutex_lock(&ipu_pre_list_mutex);
@@ -268,6 +263,8 @@ static int ipu_pre_remove(struct platform_device *pdev)
         available_pres--;
         mutex_unlock(&ipu_pre_list_mutex);
 
+        clk_disable_unprepare(pre->clk_axi);
+
         if (pre->buffer_virt)
                 gen_pool_free(pre->iram, (unsigned long)pre->buffer_virt,
                               IPU_PRE_MAX_WIDTH * IPU_PRE_NUM_SCANLINES * 4);
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 92f1452dad57..76875f6299b8 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -417,7 +417,7 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)
 {
         struct vga_device *vgadev, *conflict;
         unsigned long flags;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         int rc = 0;
 
         vga_check_first_use();
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index fe40e5e499dd..687705c50794 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -275,10 +275,12 @@ config HID_EMS_FF
          - Trio Linker Plus II
 
 config HID_ELECOM
-        tristate "ELECOM BM084 bluetooth mouse"
+        tristate "ELECOM HID devices"
         depends on HID
         ---help---
-        Support for the ELECOM BM084 (bluetooth mouse).
+        Support for ELECOM devices:
+          - BM084 Bluetooth Mouse
+          - DEFT Trackball (Wired and wireless)
 
 config HID_ELO
         tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 16df6cc90235..a6268f2f7408 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -69,6 +69,7 @@ MODULE_DESCRIPTION("Asus HID Keyboard and TouchPad");
 #define QUIRK_IS_MULTITOUCH             BIT(3)
 #define QUIRK_NO_CONSUMER_USAGES        BIT(4)
 #define QUIRK_USE_KBD_BACKLIGHT         BIT(5)
+#define QUIRK_T100_KEYBOARD             BIT(6)
 
 #define I2C_KEYBOARD_QUIRKS                     (QUIRK_FIX_NOTEBOOK_REPORT | \
                                                  QUIRK_NO_INIT_REPORTS | \
@@ -536,6 +537,8 @@ static void asus_remove(struct hid_device *hdev)
                 drvdata->kbd_backlight->removed = true;
                 cancel_work_sync(&drvdata->kbd_backlight->work);
         }
+
+        hid_hw_stop(hdev);
 }
 
 static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
@@ -548,6 +551,12 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 hid_info(hdev, "Fixing up Asus notebook report descriptor\n");
                 rdesc[55] = 0xdd;
         }
+        if (drvdata->quirks & QUIRK_T100_KEYBOARD &&
+                 *rsize == 76 && rdesc[73] == 0x81 && rdesc[74] == 0x01) {
+                hid_info(hdev, "Fixing up Asus T100 keyb report descriptor\n");
+                rdesc[74] &= ~HID_MAIN_ITEM_CONSTANT;
+        }
+
         return rdesc;
 }
 
@@ -560,6 +569,9 @@ static const struct hid_device_id asus_devices[] = {
                 USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
                 USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2), QUIRK_USE_KBD_BACKLIGHT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+                USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD),
+          QUIRK_T100_KEYBOARD | QUIRK_NO_CONSUMER_USAGES },
         { }
 };
 MODULE_DEVICE_TABLE(hid, asus_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 37084b645785..6e040692f1d8 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -826,11 +826,35 @@ static int hid_scan_report(struct hid_device *hid)
                                  * hid-rmi should take care of them,
                                  * not hid-generic
                                  */
-                                if (IS_ENABLED(CONFIG_HID_RMI))
-                                        hid->group = HID_GROUP_RMI;
+                                hid->group = HID_GROUP_RMI;
                 break;
         }
 
+        /* fall back to generic driver in case specific driver doesn't exist */
+        switch (hid->group) {
+        case HID_GROUP_MULTITOUCH_WIN_8:
+                /* fall-through */
+        case HID_GROUP_MULTITOUCH:
+                if (!IS_ENABLED(CONFIG_HID_MULTITOUCH))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_SENSOR_HUB:
+                if (!IS_ENABLED(CONFIG_HID_SENSOR_HUB))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_RMI:
+                if (!IS_ENABLED(CONFIG_HID_RMI))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_WACOM:
+                if (!IS_ENABLED(CONFIG_HID_WACOM))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        case HID_GROUP_LOGITECH_DJ_DEVICE:
+                if (!IS_ENABLED(CONFIG_HID_LOGITECH_DJ))
+                        hid->group = HID_GROUP_GENERIC;
+                break;
+        }
         vfree(parser);
         return 0;
 }
@@ -1763,15 +1787,23 @@ EXPORT_SYMBOL_GPL(hid_disconnect);
  * used as a driver. See hid_scan_report().
  */
 static const struct hid_device_id hid_have_special_driver[] = {
+#if IS_ENABLED(CONFIG_HID_A4TECH)
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_RP_649) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ACCUTOUCH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_ACCUTOUCH_2216) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ACRUX)
         { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0xf705) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ALPS)
         { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_APPLE)
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER_ANSI) },
@@ -1792,11 +1824,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_ISO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_JIS) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL5) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ISO) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_JIS) },
@@ -1851,59 +1878,100 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_ANSI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+#endif
+#if IS_ENABLED(CONFIG_HID_APPLEIR)
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL5) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ASUS)
         { HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD) },
         { HID_I2C_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_I2C_TOUCHPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_AUREAL)
         { HID_USB_DEVICE(USB_VENDOR_ID_AUREAL, USB_DEVICE_ID_AUREAL_W01RN) },
+#endif
+#if IS_ENABLED(CONFIG_HID_BELKIN)
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_BETOP_FF)
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185BFM, 0x2208) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185PC, 0x5506) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2PC, 0x1850) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BETOP_2185V2BFM, 0x5500) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CHERRY)
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CHICONY)
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CMEDIA)
+        { HID_USB_DEVICE(USB_VENDOR_ID_CMEDIA, USB_DEVICE_ID_CM6533) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CORSAIR)
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CP2112)
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
+#endif
+#if IS_ENABLED(CONFIG_HID_CYPRESS)
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_4) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DELCOM, USB_DEVICE_ID_DELCOM_VISUAL_IND) },
+#endif
+#if IS_ENABLED(CONFIG_HID_DRAGONRISE)
         { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
         { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
-#if IS_ENABLED(CONFIG_HID_MAYFLASH)
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
 #endif
-        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_WN) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_FA) },
+#if IS_ENABLED(CONFIG_HID_ELECOM)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ELO)
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0030) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_ACCUTOUCH_2216) },
+#endif
+#if IS_ENABLED(CONFIG_HID_EMS_FF)
         { HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+#endif
+#if IS_ENABLED(CONFIG_HID_EZKEY)
         { HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GEMBIRD)
         { HID_USB_DEVICE(USB_VENDOR_ID_GEMBIRD, USB_DEVICE_ID_GEMBIRD_JPD_DUALFORCE2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0003) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GFRM)
+        { HID_BLUETOOTH_DEVICE(0x58, 0x2000) },
+        { HID_BLUETOOTH_DEVICE(0x471, 0x2210) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GREENASIA)
         { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0012) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GT683R)
+        { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_GYRATION)
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
+#endif
+#if IS_ENABLED(CONFIG_HID_HOLTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK, USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A04A) },
@@ -1912,12 +1980,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ICADE)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KENSINGTON)
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KEYTOUCH)
         { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
+#endif
+#if IS_ENABLED(CONFIG_HID_KYE)
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_MANTICORE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
@@ -1927,21 +2000,29 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LCPOWER)
         { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LED)
+        { HID_USB_DEVICE(USB_VENDOR_ID_DELCOM, USB_DEVICE_ID_DELCOM_VISUAL_IND) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_WN) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, USB_DEVICE_ID_DREAM_CHEEKY_FA) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_LUXAFOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RISO_KAGAKU, USB_DEVICE_ID_RI_KA_WEBMAIL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
+#endif
 #if IS_ENABLED(CONFIG_HID_LENOVO)
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) },
 #endif
-        { HID_USB_DEVICE(USB_VENDOR_ID_LG, USB_DEVICE_ID_LG_MELFAS_MT) },
+#if IS_ENABLED(CONFIG_HID_LOGITECH)
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RECEIVER) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_DESKTOP) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_EDGE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_DINOVO_MINI) },
@@ -1954,7 +2035,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G29_WHEEL) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_F3D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG ) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FORCE3D_PRO) },
@@ -1966,17 +2046,30 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_DFGT_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G27_WHEEL) },
-#if IS_ENABLED(CONFIG_HID_LOGITECH_DJ)
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2) },
-#endif
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WII_WHEEL) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACETRAVELLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_LUXAFOR) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LOGITECH_HIDPP)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_LOGITECH_DJ)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_UNIFYING_RECEIVER_2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MAGICMOUSE)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICMOUSE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGICTRACKPAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MAYFLASH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE1) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MICROSOFT)
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_KEYBOARD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
@@ -1992,9 +2085,22 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_600) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3KV1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MONTEREY)
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GT683R_LED_PANEL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_MULTITOUCH)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LG, USB_DEVICE_ID_LG_MELFAS_MT) },
+#endif
+#if IS_ENABLED(CONFIG_HID_WIIMOTE)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
+#endif
+#if IS_ENABLED(CONFIG_HID_NTI)
         { HID_USB_DEVICE(USB_VENDOR_ID_NTI, USB_DEVICE_ID_USB_SUN) },
+#endif
+#if IS_ENABLED(CONFIG_HID_NTRIG)
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_2) },
@@ -2014,13 +2120,41 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ORTEK)
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PANTHERLORD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GAMERON, USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, 0x0003) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PENMOUNT)
         { HID_USB_DEVICE(USB_VENDOR_ID_PENMOUNT, USB_DEVICE_ID_PENMOUNT_6000) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PETALYNX)
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PICOLCD)
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PLANTRONICS)
         { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PRIMAX)
         { HID_USB_DEVICE(USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_KEYBOARD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_RISO_KAGAKU, USB_DEVICE_ID_RI_KA_WEBMAIL) },
+#endif
+#if IS_ENABLED(CONFIG_HID_PRODIKEYS)
+        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
+#endif
+#if IS_ENABLED(CONFIG_HID_RMI)
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14) },
+#endif
 #if IS_ENABLED(CONFIG_HID_ROCCAT)
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ARVO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_ISKU) },
@@ -2048,9 +2182,21 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) },
 #endif
+#if IS_ENABLED(CONFIG_HID_SAMSUNG)
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_SKYCABLE, USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SMARTJOYPLUS)
+        { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SONY)
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_HARMONY_PS3) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SMK, USB_DEVICE_ID_SMK_PS3_BDREMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_BUZZ_CONTROLLER) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_WIRELESS_BUZZ_CONTROLLER) },
@@ -2069,9 +2215,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SPEEDLINK)
+        { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_STEELSERIES)
         { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
+#endif
+#if IS_ENABLED(CONFIG_HID_SUNPLUS)
         { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THINGM, USB_DEVICE_ID_BLINK1) },
+#endif
+#if IS_ENABLED(CONFIG_HID_THRUSTMASTER)
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb300) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323) },
@@ -2080,12 +2234,25 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb653) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb654) },
         { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TIVO)
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TOPSEED)
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+#endif
+#if IS_ENABLED(CONFIG_HID_TWINHAN)
         { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_UCLOGIC)
+        { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_HUION_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U) },
@@ -2093,20 +2260,17 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP1062) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_WIRELESS_TABLET_TWHL850) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_YIYNOVA_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_81) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+#endif
+#if IS_ENABLED(CONFIG_HID_UDRAW_PS3)
+        { HID_USB_DEVICE(USB_VENDOR_ID_THQ, USB_DEVICE_ID_THQ_PS3_UDRAW) },
+#endif
+#if IS_ENABLED(CONFIG_HID_WALTOP)
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_12_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_Q_PAD) },
@@ -2114,19 +2278,18 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_XINMO)
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ZEROPLUS)
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
+#endif
+#if IS_ENABLED(CONFIG_HID_ZYDACRON)
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
-
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE) },
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_NINTENDO, USB_DEVICE_ID_NINTENDO_WIIMOTE2) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_RAZER, USB_DEVICE_ID_RAZER_BLADE_14) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_CMEDIA, USB_DEVICE_ID_CM6533) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_COVER) },
+#endif
         { }
 };
 
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index 6e3848a8d8dd..e2c7465df69f 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -1,10 +1,8 @@
 /*
- *  HID driver for Elecom BM084 (bluetooth mouse).
- *  Removes a non-existing horizontal wheel from
- *  the HID descriptor.
- *  (This module is based on "hid-ortek".)
- *
+ *  HID driver for ELECOM devices.
  *  Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
+ *  Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
+ *  Copyright (c) 2017 Diego Elio Pettenò <flameeyes@flameeyes.eu>
  */
 
 /*
@@ -23,15 +21,61 @@
 static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 unsigned int *rsize)
 {
-        if (*rsize >= 48 && rdesc[46] == 0x05 && rdesc[47] == 0x0c) {
-                hid_info(hdev, "Fixing up Elecom BM084 report descriptor\n");
-                rdesc[47] = 0x00;
+        switch (hdev->product) {
+        case USB_DEVICE_ID_ELECOM_BM084:
+                /* The BM084 Bluetooth mouse includes a non-existing horizontal
+                 * wheel in the HID descriptor. */
+                if (*rsize >= 48 && rdesc[46] == 0x05 && rdesc[47] == 0x0c) {
+                        hid_info(hdev, "Fixing up Elecom BM084 report descriptor\n");
+                        rdesc[47] = 0x00;
+                }
+                break;
+        case USB_DEVICE_ID_ELECOM_DEFT_WIRED:
+        case USB_DEVICE_ID_ELECOM_DEFT_WIRELESS:
+                /* The DEFT trackball has eight buttons, but its descriptor only
+                 * reports five, disabling the three Fn buttons on the top of
+                 * the mouse.
+                 *
+                 * Apply the following diff to the descriptor:
+                 *
+                 * Collection (Physical),              Collection (Physical),
+                 *     Report ID (1),                      Report ID (1),
+                 *     Report Count (5),           ->      Report Count (8),
+                 *     Report Size (1),                    Report Size (1),
+                 *     Usage Page (Button),                Usage Page (Button),
+                 *     Usage Minimum (01h),                Usage Minimum (01h),
+                 *     Usage Maximum (05h),        ->      Usage Maximum (08h),
+                 *     Logical Minimum (0),                Logical Minimum (0),
+                 *     Logical Maximum (1),                Logical Maximum (1),
+                 *     Input (Variable),                   Input (Variable),
+                 *     Report Count (1),           ->      Report Count (0),
+                 *     Report Size (3),                    Report Size (3),
+                 *     Input (Constant),                   Input (Constant),
+                 *     Report Size (16),                   Report Size (16),
+                 *     Report Count (2),                   Report Count (2),
+                 *     Usage Page (Desktop),               Usage Page (Desktop),
+                 *     Usage (X),                          Usage (X),
+                 *     Usage (Y),                          Usage (Y),
+                 *     Logical Minimum (-32768),           Logical Minimum (-32768),
+                 *     Logical Maximum (32767),            Logical Maximum (32767),
+                 *     Input (Variable, Relative),         Input (Variable, Relative),
+                 * End Collection,                     End Collection,
+                 */
+                if (*rsize == 213 && rdesc[13] == 5 && rdesc[21] == 5) {
+                        hid_info(hdev, "Fixing up Elecom DEFT Fn buttons\n");
+                        rdesc[13] = 8; /* Button/Variable Report Count */
+                        rdesc[21] = 8; /* Button/Variable Usage Maximum */
+                        rdesc[29] = 0; /* Button/Constant Report Count */
+                }
+                break;
         }
         return rdesc;
 }
 
 static const struct hid_device_id elecom_devices[] = {
-        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084)},
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 643390ba749d..8ca1e8ce0af2 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -173,6 +173,7 @@
 #define USB_VENDOR_ID_ASUSTEK           0x0b05
 #define USB_DEVICE_ID_ASUSTEK_LCM       0x1726
 #define USB_DEVICE_ID_ASUSTEK_LCM2      0x175b
+#define USB_DEVICE_ID_ASUSTEK_T100_KEYBOARD     0x17e0
 #define USB_DEVICE_ID_ASUSTEK_I2C_KEYBOARD      0x8585
 #define USB_DEVICE_ID_ASUSTEK_I2C_TOUCHPAD      0x0101
 #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD1 0x1854
@@ -358,6 +359,8 @@
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
+#define USB_DEVICE_ID_ELECOM_DEFT_WIRED 0x00fe
+#define USB_DEVICE_ID_ELECOM_DEFT_WIRELESS      0x00ff
 
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
 #define USB_DEVICE_ID_DREAM_CHEEKY_WN   0x0004
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index 20b40ad26325..1d6c997b3001 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -349,6 +349,7 @@ static int magicmouse_raw_event(struct hid_device *hdev,
 
         if (input->id.product == USB_DEVICE_ID_APPLE_MAGICMOUSE) {
                 magicmouse_emit_buttons(msc, clicks & 3);
+                input_mt_report_pointer_emulation(input, true);
                 input_report_rel(input, REL_X, x);
                 input_report_rel(input, REL_Y, y);
         } else { /* USB_DEVICE_ID_APPLE_MAGICTRACKPAD */
@@ -388,16 +389,16 @@ static int magicmouse_setup_input(struct input_dev *input, struct hid_device *hd
                 __clear_bit(BTN_RIGHT, input->keybit);
                 __clear_bit(BTN_MIDDLE, input->keybit);
                 __set_bit(BTN_MOUSE, input->keybit);
-                __set_bit(BTN_TOOL_FINGER, input->keybit);
-                __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
-                __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
-                __set_bit(BTN_TOOL_QUADTAP, input->keybit);
-                __set_bit(BTN_TOOL_QUINTTAP, input->keybit);
-                __set_bit(BTN_TOUCH, input->keybit);
-                __set_bit(INPUT_PROP_POINTER, input->propbit);
                 __set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
         }
 
+        __set_bit(BTN_TOOL_FINGER, input->keybit);
+        __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
+        __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
+        __set_bit(BTN_TOOL_QUADTAP, input->keybit);
+        __set_bit(BTN_TOOL_QUINTTAP, input->keybit);
+        __set_bit(BTN_TOUCH, input->keybit);
+        __set_bit(INPUT_PROP_POINTER, input->propbit);
 
         __set_bit(EV_ABS, input->evbit);
 
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 8daa8ce64ebb..fb55fb4c39fc 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -897,6 +897,15 @@ static int i2c_hid_acpi_pdata(struct i2c_client *client,
         return 0;
 }
 
+static void i2c_hid_acpi_fix_up_power(struct device *dev)
+{
+        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev;
+
+        if (handle && acpi_bus_get_device(handle, &adev) == 0)
+                acpi_device_fix_up_power(adev);
+}
+
 static const struct acpi_device_id i2c_hid_acpi_match[] = {
         {"ACPI0C50", 0 },
         {"PNP0C50", 0 },
@@ -909,6 +918,8 @@ static inline int i2c_hid_acpi_pdata(struct i2c_client *client,
 {
         return -ENODEV;
 }
+
+static inline void i2c_hid_acpi_fix_up_power(struct device *dev) {}
 #endif
 
 #ifdef CONFIG_OF
@@ -1030,6 +1041,8 @@ static int i2c_hid_probe(struct i2c_client *client,
         if (ret < 0)
                 goto err_regulator;
 
+        i2c_hid_acpi_fix_up_power(&client->dev);
+
         pm_runtime_get_noresume(&client->dev);
         pm_runtime_set_active(&client->dev);
         pm_runtime_enable(&client->dev);
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4b225fb19a16..e274c9dc32f3 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1571,37 +1571,38 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len)
 {
         unsigned char *data = wacom->data;
 
-        if (wacom->pen_input)
+        if (wacom->pen_input) {
                 dev_dbg(wacom->pen_input->dev.parent,
                         "%s: received report #%d\n", __func__, data[0]);
-        else if (wacom->touch_input)
+
+                if (len == WACOM_PKGLEN_PENABLED ||
+                    data[0] == WACOM_REPORT_PENABLED)
+                        return wacom_tpc_pen(wacom);
+        }
+        else if (wacom->touch_input) {
                 dev_dbg(wacom->touch_input->dev.parent,
                         "%s: received report #%d\n", __func__, data[0]);
 
-        switch (len) {
-        case WACOM_PKGLEN_TPC1FG:
-                return wacom_tpc_single_touch(wacom, len);
+                switch (len) {
+                case WACOM_PKGLEN_TPC1FG:
+                        return wacom_tpc_single_touch(wacom, len);
 
-        case WACOM_PKGLEN_TPC2FG:
-                return wacom_tpc_mt_touch(wacom);
+                case WACOM_PKGLEN_TPC2FG:
+                        return wacom_tpc_mt_touch(wacom);
 
-        case WACOM_PKGLEN_PENABLED:
-                return wacom_tpc_pen(wacom);
+                default:
+                        switch (data[0]) {
+                        case WACOM_REPORT_TPC1FG:
+                        case WACOM_REPORT_TPCHID:
+                        case WACOM_REPORT_TPCST:
+                        case WACOM_REPORT_TPC1FGE:
+                                return wacom_tpc_single_touch(wacom, len);
 
-        default:
-                switch (data[0]) {
-                case WACOM_REPORT_TPC1FG:
-                case WACOM_REPORT_TPCHID:
-                case WACOM_REPORT_TPCST:
-                case WACOM_REPORT_TPC1FGE:
-                        return wacom_tpc_single_touch(wacom, len);
-
-                case WACOM_REPORT_TPCMT:
-                case WACOM_REPORT_TPCMT2:
-                        return wacom_mt_touch(wacom);
+                        case WACOM_REPORT_TPCMT:
+                        case WACOM_REPORT_TPCMT2:
+                                return wacom_mt_touch(wacom);
 
-                case WACOM_REPORT_PENABLED:
-                        return wacom_tpc_pen(wacom);
+                        }
                 }
         }
 
diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c
index 26b05106f0d3..93d28c0ec8bf 100644
--- a/drivers/hsi/clients/ssi_protocol.c
+++ b/drivers/hsi/clients/ssi_protocol.c
@@ -1066,7 +1066,7 @@ static void ssip_pn_setup(struct net_device *dev)
         dev->addr_len           = 1;
         dev->tx_queue_len       = SSIP_TXQUEUE_LEN;
 
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &phonet_header_ops;
 }
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 22d5eafd6815..5ef2814345ef 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -343,6 +343,7 @@ config SENSORS_ASB100
 
 config SENSORS_ASPEED
         tristate "ASPEED AST2400/AST2500 PWM and Fan tach driver"
+        select REGMAP
         help
           This driver provides support for ASPEED AST2400/AST2500 PWM
           and Fan Tacho controllers.
diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
index 48403a2115be..9de13d626c68 100644
--- a/drivers/hwmon/aspeed-pwm-tacho.c
+++ b/drivers/hwmon/aspeed-pwm-tacho.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/errno.h>
 #include <linux/gpio/consumer.h>
 #include <linux/delay.h>
 #include <linux/hwmon.h>
@@ -494,7 +495,7 @@ static u32 aspeed_get_fan_tach_ch_measure_period(struct aspeed_pwm_tacho_data
         return clk / (clk_unit * div_h * div_l * tacho_div * tacho_unit);
 }
 
-static u32 aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
+static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
                                       u8 fan_tach_ch)
 {
         u32 raw_data, tach_div, clk_source, sec, val;
@@ -510,6 +511,9 @@ static u32 aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
         msleep(sec);
 
         regmap_read(priv->regmap, ASPEED_PTCR_RESULT, &val);
+        if (!(val & RESULT_STATUS_MASK))
+                return -ETIMEDOUT;
+
         raw_data = val & RESULT_VALUE_MASK;
         tach_div = priv->type_fan_tach_clock_division[type];
         tach_div = 0x4 << (tach_div * 2);
@@ -561,12 +565,14 @@ static ssize_t show_rpm(struct device *dev, struct device_attribute *attr,
 {
         struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
         int index = sensor_attr->index;
-        u32 rpm;
+        int rpm;
         struct aspeed_pwm_tacho_data *priv = dev_get_drvdata(dev);
 
         rpm = aspeed_get_fan_tach_ch_rpm(priv, index);
+        if (rpm < 0)
+                return rpm;
 
-        return sprintf(buf, "%u\n", rpm);
+        return sprintf(buf, "%d\n", rpm);
 }
 
 static umode_t pwm_is_visible(struct kobject *kobj,
@@ -591,24 +597,23 @@ static umode_t fan_dev_is_visible(struct kobject *kobj,
         return a->mode;
 }
 
-static SENSOR_DEVICE_ATTR(pwm0, 0644,
-                        show_pwm, set_pwm, 0);
 static SENSOR_DEVICE_ATTR(pwm1, 0644,
-                        show_pwm, set_pwm, 1);
+                        show_pwm, set_pwm, 0);
 static SENSOR_DEVICE_ATTR(pwm2, 0644,
-                        show_pwm, set_pwm, 2);
+                        show_pwm, set_pwm, 1);
 static SENSOR_DEVICE_ATTR(pwm3, 0644,
-                        show_pwm, set_pwm, 3);
+                        show_pwm, set_pwm, 2);
 static SENSOR_DEVICE_ATTR(pwm4, 0644,
-                        show_pwm, set_pwm, 4);
+                        show_pwm, set_pwm, 3);
 static SENSOR_DEVICE_ATTR(pwm5, 0644,
-                        show_pwm, set_pwm, 5);
+                        show_pwm, set_pwm, 4);
 static SENSOR_DEVICE_ATTR(pwm6, 0644,
-                        show_pwm, set_pwm, 6);
+                        show_pwm, set_pwm, 5);
 static SENSOR_DEVICE_ATTR(pwm7, 0644,
+                        show_pwm, set_pwm, 6);
+static SENSOR_DEVICE_ATTR(pwm8, 0644,
                         show_pwm, set_pwm, 7);
 static struct attribute *pwm_dev_attrs[] = {
-        &sensor_dev_attr_pwm0.dev_attr.attr,
         &sensor_dev_attr_pwm1.dev_attr.attr,
         &sensor_dev_attr_pwm2.dev_attr.attr,
         &sensor_dev_attr_pwm3.dev_attr.attr,
@@ -616,6 +621,7 @@ static struct attribute *pwm_dev_attrs[] = {
         &sensor_dev_attr_pwm5.dev_attr.attr,
         &sensor_dev_attr_pwm6.dev_attr.attr,
         &sensor_dev_attr_pwm7.dev_attr.attr,
+        &sensor_dev_attr_pwm8.dev_attr.attr,
         NULL,
 };
 
@@ -624,40 +630,39 @@ static const struct attribute_group pwm_dev_group = {
         .is_visible = pwm_is_visible,
 };
 
-static SENSOR_DEVICE_ATTR(fan0_input, 0444,
-                show_rpm, NULL, 0);
 static SENSOR_DEVICE_ATTR(fan1_input, 0444,
-                show_rpm, NULL, 1);
+                show_rpm, NULL, 0);
 static SENSOR_DEVICE_ATTR(fan2_input, 0444,
-                show_rpm, NULL, 2);
+                show_rpm, NULL, 1);
 static SENSOR_DEVICE_ATTR(fan3_input, 0444,
-                show_rpm, NULL, 3);
+                show_rpm, NULL, 2);
 static SENSOR_DEVICE_ATTR(fan4_input, 0444,
-                show_rpm, NULL, 4);
+                show_rpm, NULL, 3);
 static SENSOR_DEVICE_ATTR(fan5_input, 0444,
-                show_rpm, NULL, 5);
+                show_rpm, NULL, 4);
 static SENSOR_DEVICE_ATTR(fan6_input, 0444,
-                show_rpm, NULL, 6);
+                show_rpm, NULL, 5);
 static SENSOR_DEVICE_ATTR(fan7_input, 0444,
-                show_rpm, NULL, 7);
+                show_rpm, NULL, 6);
 static SENSOR_DEVICE_ATTR(fan8_input, 0444,
-                show_rpm, NULL, 8);
+                show_rpm, NULL, 7);
 static SENSOR_DEVICE_ATTR(fan9_input, 0444,
-                show_rpm, NULL, 9);
+                show_rpm, NULL, 8);
 static SENSOR_DEVICE_ATTR(fan10_input, 0444,
-                show_rpm, NULL, 10);
+                show_rpm, NULL, 9);
 static SENSOR_DEVICE_ATTR(fan11_input, 0444,
-                show_rpm, NULL, 11);
+                show_rpm, NULL, 10);
 static SENSOR_DEVICE_ATTR(fan12_input, 0444,
-                show_rpm, NULL, 12);
+                show_rpm, NULL, 11);
 static SENSOR_DEVICE_ATTR(fan13_input, 0444,
-                show_rpm, NULL, 13);
+                show_rpm, NULL, 12);
 static SENSOR_DEVICE_ATTR(fan14_input, 0444,
-                show_rpm, NULL, 14);
+                show_rpm, NULL, 13);
 static SENSOR_DEVICE_ATTR(fan15_input, 0444,
+                show_rpm, NULL, 14);
+static SENSOR_DEVICE_ATTR(fan16_input, 0444,
                 show_rpm, NULL, 15);
 static struct attribute *fan_dev_attrs[] = {
-        &sensor_dev_attr_fan0_input.dev_attr.attr,
         &sensor_dev_attr_fan1_input.dev_attr.attr,
         &sensor_dev_attr_fan2_input.dev_attr.attr,
         &sensor_dev_attr_fan3_input.dev_attr.attr,
@@ -673,6 +678,7 @@ static struct attribute *fan_dev_attrs[] = {
         &sensor_dev_attr_fan13_input.dev_attr.attr,
         &sensor_dev_attr_fan14_input.dev_attr.attr,
         &sensor_dev_attr_fan15_input.dev_attr.attr,
+        &sensor_dev_attr_fan16_input.dev_attr.attr,
         NULL
 };
 
@@ -802,7 +808,6 @@ static int aspeed_pwm_tacho_probe(struct platform_device *pdev)
                 if (ret)
                         return ret;
         }
-        of_node_put(np);
 
         priv->groups[0] = &pwm_dev_group;
         priv->groups[1] = &fan_dev_group;
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index f573448d2132..e98e44e584a4 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -584,7 +584,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr,
 
         /* unmap the data buffer */
         if (dma_size != 0)
-                dma_unmap_single(&adap->dev, dma_addr, dma_size, dma_direction);
+                dma_unmap_single(dev, dma_addr, dma_size, dma_direction);
 
         if (unlikely(!time_left)) {
                 dev_err(dev, "completion wait timed out\n");
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 214bf2835d1f..8be3e6cb8fe6 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -319,7 +319,7 @@ static void rcar_i2c_dma_unmap(struct rcar_i2c_priv *priv)
         rcar_i2c_write(priv, ICFBSCR, TCYC06);
 
         dma_unmap_single(chan->device->dev, sg_dma_address(&priv->sg),
-                         priv->msg->len, priv->dma_direction);
+                         sg_dma_len(&priv->sg), priv->dma_direction);
 
         priv->dma_direction = DMA_NONE;
 }
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 0ed77eeff31e..a2e3dd715380 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -178,22 +178,39 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
                     int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmalloc(len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
-                               USB_DIR_IN, value, index, data, len, 2000);
+                               USB_DIR_IN, value, index, dmadata, len, 2000);
+
+        memcpy(data, dmadata, len);
+        kfree(dmadata);
+        return ret;
 }
 
 static int usb_write(struct i2c_adapter *adapter, int cmd,
                      int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmemdup(data, len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                               value, index, data, len, 2000);
+                               value, index, dmadata, len, 2000);
+
+        kfree(dmadata);
+        return ret;
 }
 
 static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
diff --git a/drivers/iio/adc/bcm_iproc_adc.c b/drivers/iio/adc/bcm_iproc_adc.c
index 21d38c8af21e..7f4f9c4150e3 100644
--- a/drivers/iio/adc/bcm_iproc_adc.c
+++ b/drivers/iio/adc/bcm_iproc_adc.c
@@ -143,7 +143,7 @@ static void iproc_adc_reg_dump(struct iio_dev *indio_dev)
         iproc_adc_dbg_reg(dev, adc_priv, IPROC_SOFT_BYPASS_DATA);
 }
 
-static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
 {
         u32 channel_intr_status;
         u32 intr_status;
@@ -167,7 +167,7 @@ static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
         return IRQ_NONE;
 }
 
-static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
+static irqreturn_t iproc_adc_interrupt_handler(int irq, void *data)
 {
         irqreturn_t retval = IRQ_NONE;
         struct iproc_adc_priv *adc_priv;
@@ -181,7 +181,7 @@ static irqreturn_t iproc_adc_interrupt_thread(int irq, void *data)
         adc_priv = iio_priv(indio_dev);
 
         regmap_read(adc_priv->regmap, IPROC_INTERRUPT_STATUS, &intr_status);
-        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_thread(),INTRPT_STS:%x\n",
+        dev_dbg(&indio_dev->dev, "iproc_adc_interrupt_handler(),INTRPT_STS:%x\n",
                         intr_status);
 
         intr_channels = (intr_status & IPROC_ADC_INTR_MASK) >> IPROC_ADC_INTR;
@@ -566,8 +566,8 @@ static int iproc_adc_probe(struct platform_device *pdev)
         }
 
         ret = devm_request_threaded_irq(&pdev->dev, adc_priv->irqno,
-                                iproc_adc_interrupt_thread,
                                 iproc_adc_interrupt_handler,
+                                iproc_adc_interrupt_thread,
                                 IRQF_SHARED, "iproc-adc", indio_dev);
         if (ret) {
                 dev_err(&pdev->dev, "request_irq error %d\n", ret);
diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
index ec82106480e1..b0526e4b9530 100644
--- a/drivers/iio/adc/max9611.c
+++ b/drivers/iio/adc/max9611.c
@@ -438,10 +438,10 @@ static ssize_t max9611_shunt_resistor_show(struct device *dev,
         struct max9611_dev *max9611 = iio_priv(dev_to_iio_dev(dev));
         unsigned int i, r;
 
-        i = max9611->shunt_resistor_uohm / 1000;
-        r = max9611->shunt_resistor_uohm % 1000;
+        i = max9611->shunt_resistor_uohm / 1000000;
+        r = max9611->shunt_resistor_uohm % 1000000;
 
-        return sprintf(buf, "%u.%03u\n", i, r);
+        return sprintf(buf, "%u.%06u\n", i, r);
 }
 
 static IIO_DEVICE_ATTR(in_power_shunt_resistor, 0444,
@@ -536,8 +536,8 @@ static int max9611_probe(struct i2c_client *client,
         int ret;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*max9611));
-        if (IS_ERR(indio_dev))
-                return PTR_ERR(indio_dev);
+        if (!indio_dev)
+                return -ENOMEM;
 
         i2c_set_clientdata(client, indio_dev);
 
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index dd4190b50df6..6066bbfc42fe 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -468,13 +468,13 @@ static void meson_sar_adc_unlock(struct iio_dev *indio_dev)
 static void meson_sar_adc_clear_fifo(struct iio_dev *indio_dev)
 {
         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
-        int count;
+        unsigned int count, tmp;
 
         for (count = 0; count < MESON_SAR_ADC_MAX_FIFO_SIZE; count++) {
                 if (!meson_sar_adc_get_fifo_count(indio_dev))
                         break;
 
-                regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, 0);
+                regmap_read(priv->regmap, MESON_SAR_ADC_FIFO_RD, &tmp);
         }
 }
 
diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
index b0c7d8ee5cb8..6888167ca1e6 100644
--- a/drivers/iio/adc/mxs-lradc-adc.c
+++ b/drivers/iio/adc/mxs-lradc-adc.c
@@ -718,9 +718,12 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev)
         adc->dev = dev;
 
         iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!iores)
+                return -EINVAL;
+
         adc->base = devm_ioremap(dev, iores->start, resource_size(iores));
-        if (IS_ERR(adc->base))
-                return PTR_ERR(adc->base);
+        if (!adc->base)
+                return -ENOMEM;
 
         init_completion(&adc->completion);
         spin_lock_init(&adc->lock);
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index b23527309088..81d4c39e414a 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -105,6 +105,8 @@ struct sun4i_gpadc_iio {
         bool                            no_irq;
         /* prevents concurrent reads of temperature and ADC */
         struct mutex                    mutex;
+        struct thermal_zone_device      *tzd;
+        struct device                   *sensor_device;
 };
 
 #define SUN4I_GPADC_ADC_CHANNEL(_channel, _name) {              \
@@ -502,7 +504,6 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
 {
         struct sun4i_gpadc_iio *info = iio_priv(indio_dev);
         const struct of_device_id *of_dev;
-        struct thermal_zone_device *tzd;
         struct resource *mem;
         void __iomem *base;
         int ret;
@@ -532,13 +533,14 @@ static int sun4i_gpadc_probe_dt(struct platform_device *pdev,
         if (!IS_ENABLED(CONFIG_THERMAL_OF))
                 return 0;
 
-        tzd = devm_thermal_zone_of_sensor_register(&pdev->dev, 0, info,
-                                                   &sun4i_ts_tz_ops);
-        if (IS_ERR(tzd))
+        info->sensor_device = &pdev->dev;
+        info->tzd = thermal_zone_of_sensor_register(info->sensor_device, 0,
+                                                    info, &sun4i_ts_tz_ops);
+        if (IS_ERR(info->tzd))
                 dev_err(&pdev->dev, "could not register thermal sensor: %ld\n",
-                        PTR_ERR(tzd));
+                        PTR_ERR(info->tzd));
 
-        return PTR_ERR_OR_ZERO(tzd);
+        return PTR_ERR_OR_ZERO(info->tzd);
 }
 
 static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
@@ -584,15 +586,15 @@ static int sun4i_gpadc_probe_mfd(struct platform_device *pdev,
                  * of_node, and the device from this driver as third argument to
                  * return the temperature.
                  */
-                struct thermal_zone_device *tzd;
-                tzd = devm_thermal_zone_of_sensor_register(pdev->dev.parent, 0,
-                                                           info,
-                                                           &sun4i_ts_tz_ops);
-                if (IS_ERR(tzd)) {
+                info->sensor_device = pdev->dev.parent;
+                info->tzd = thermal_zone_of_sensor_register(info->sensor_device,
+                                                            0, info,
+                                                            &sun4i_ts_tz_ops);
+                if (IS_ERR(info->tzd)) {
                         dev_err(&pdev->dev,
                                 "could not register thermal sensor: %ld\n",
-                                PTR_ERR(tzd));
-                        return PTR_ERR(tzd);
+                                PTR_ERR(info->tzd));
+                        return PTR_ERR(info->tzd);
                 }
         } else {
                 indio_dev->num_channels =
@@ -688,7 +690,13 @@ static int sun4i_gpadc_remove(struct platform_device *pdev)
 
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        if (!info->no_irq && IS_ENABLED(CONFIG_THERMAL_OF))
+
+        if (!IS_ENABLED(CONFIG_THERMAL_OF))
+                return 0;
+
+        thermal_zone_of_sensor_unregister(info->sensor_device, info->tzd);
+
+        if (!info->no_irq)
                 iio_map_array_unregister(indio_dev);
 
         return 0;
@@ -700,6 +708,7 @@ static const struct platform_device_id sun4i_gpadc_id[] = {
         { "sun6i-a31-gpadc-iio", (kernel_ulong_t)&sun6i_gpadc_data },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(platform, sun4i_gpadc_id);
 
 static struct platform_driver sun4i_gpadc_driver = {
         .driver = {
@@ -711,6 +720,7 @@ static struct platform_driver sun4i_gpadc_driver = {
         .probe = sun4i_gpadc_probe,
         .remove = sun4i_gpadc_remove,
 };
+MODULE_DEVICE_TABLE(of, sun4i_gpadc_of_id);
 
 module_platform_driver(sun4i_gpadc_driver);
 
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 4282ceca3d8f..6cbed7eb118a 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -614,7 +614,7 @@ static int tiadc_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*indio_dev));
+        indio_dev = devm_iio_device_alloc(&pdev->dev, sizeof(*adc_dev));
         if (indio_dev == NULL) {
                 dev_err(&pdev->dev, "failed to allocate iio device\n");
                 return -ENOMEM;
diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c
index dd99d273bae9..ff03324dee13 100644
--- a/drivers/iio/buffer/industrialio-buffer-dma.c
+++ b/drivers/iio/buffer/industrialio-buffer-dma.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
 #include <linux/iio/buffer-dma.h>
 #include <linux/dma-mapping.h>
 #include <linux/sizes.h>
diff --git a/drivers/iio/buffer/industrialio-buffer-dmaengine.c b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
index 9fabed47053d..2b5a320f42c5 100644
--- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c
+++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
@@ -14,6 +14,7 @@
 
 #include <linux/iio/iio.h>
 #include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
 #include <linux/iio/buffer-dma.h>
 #include <linux/iio/buffer-dmaengine.h>
 
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 96dabbd2f004..88a7c5d4e4d2 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -41,6 +41,7 @@ static const int accel_scale[] = {598, 1196, 2392, 4785};
 static const struct inv_mpu6050_reg_map reg_set_6500 = {
         .sample_rate_div        = INV_MPU6050_REG_SAMPLE_RATE_DIV,
         .lpf                    = INV_MPU6050_REG_CONFIG,
+        .accel_lpf              = INV_MPU6500_REG_ACCEL_CONFIG_2,
         .user_ctrl              = INV_MPU6050_REG_USER_CTRL,
         .fifo_en                = INV_MPU6050_REG_FIFO_EN,
         .gyro_config            = INV_MPU6050_REG_GYRO_CONFIG,
@@ -211,6 +212,37 @@ int inv_mpu6050_set_power_itg(struct inv_mpu6050_state *st, bool power_on)
 EXPORT_SYMBOL_GPL(inv_mpu6050_set_power_itg);
 
 /**
+ *  inv_mpu6050_set_lpf_regs() - set low pass filter registers, chip dependent
+ *
+ *  MPU60xx/MPU9150 use only 1 register for accelerometer + gyroscope
+ *  MPU6500 and above have a dedicated register for accelerometer
+ */
+static int inv_mpu6050_set_lpf_regs(struct inv_mpu6050_state *st,
+                                    enum inv_mpu6050_filter_e val)
+{
+        int result;
+
+        result = regmap_write(st->map, st->reg->lpf, val);
+        if (result)
+                return result;
+
+        switch (st->chip_type) {
+        case INV_MPU6050:
+        case INV_MPU6000:
+        case INV_MPU9150:
+                /* old chips, nothing to do */
+                result = 0;
+                break;
+        default:
+                /* set accel lpf */
+                result = regmap_write(st->map, st->reg->accel_lpf, val);
+                break;
+        }
+
+        return result;
+}
+
+/**
  *  inv_mpu6050_init_config() - Initialize hardware, disable FIFO.
  *
  *  Initial configuration:
@@ -233,8 +265,7 @@ static int inv_mpu6050_init_config(struct iio_dev *indio_dev)
         if (result)
                 return result;
 
-        d = INV_MPU6050_FILTER_20HZ;
-        result = regmap_write(st->map, st->reg->lpf, d);
+        result = inv_mpu6050_set_lpf_regs(st, INV_MPU6050_FILTER_20HZ);
         if (result)
                 return result;
 
@@ -537,6 +568,8 @@ error_write_raw:
  *                  would be alising. This function basically search for the
  *                  correct low pass parameters based on the fifo rate, e.g,
  *                  sampling frequency.
+ *
+ *  lpf is set automatically when setting sampling rate to avoid any aliases.
  */
 static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
 {
@@ -552,7 +585,7 @@ static int inv_mpu6050_set_lpf(struct inv_mpu6050_state *st, int rate)
         while ((h < hz[i]) && (i < ARRAY_SIZE(d) - 1))
                 i++;
         data = d[i];
-        result = regmap_write(st->map, st->reg->lpf, data);
+        result = inv_mpu6050_set_lpf_regs(st, data);
         if (result)
                 return result;
         st->chip_config.lpf = data;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
index ef13de7a2c20..953a0c09d568 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
@@ -28,6 +28,7 @@
  *  struct inv_mpu6050_reg_map - Notable registers.
  *  @sample_rate_div:   Divider applied to gyro output rate.
  *  @lpf:               Configures internal low pass filter.
+ *  @accel_lpf:         Configures accelerometer low pass filter.
  *  @user_ctrl:         Enables/resets the FIFO.
  *  @fifo_en:           Determines which data will appear in FIFO.
  *  @gyro_config:       gyro config register.
@@ -47,6 +48,7 @@
 struct inv_mpu6050_reg_map {
         u8 sample_rate_div;
         u8 lpf;
+        u8 accel_lpf;
         u8 user_ctrl;
         u8 fifo_en;
         u8 gyro_config;
@@ -188,6 +190,7 @@ struct inv_mpu6050_state {
 #define INV_MPU6050_FIFO_THRESHOLD           500
 
 /* mpu6500 registers */
+#define INV_MPU6500_REG_ACCEL_CONFIG_2      0x1D
 #define INV_MPU6500_REG_ACCEL_OFFSET        0x77
 
 /* delay time in milliseconds */
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index 978e1592c2a3..4061fed93f1f 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -451,7 +451,8 @@ static ssize_t iio_trigger_write_current(struct device *dev,
         return len;
 
 out_trigger_put:
-        iio_trigger_put(trig);
+        if (trig)
+                iio_trigger_put(trig);
         return ret;
 }
 
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index b30e0c1c6cc4..67838edd8b37 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -74,9 +74,9 @@ static const int int_time_mapping[] = {100000, 50000, 200000, 400000};
 static const struct reg_field reg_field_it =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 3, 4);
 static const struct reg_field reg_field_als_intr =
-                                REG_FIELD(LTR501_INTR, 0, 0);
-static const struct reg_field reg_field_ps_intr =
                                 REG_FIELD(LTR501_INTR, 1, 1);
+static const struct reg_field reg_field_ps_intr =
+                                REG_FIELD(LTR501_INTR, 0, 0);
 static const struct reg_field reg_field_als_rate =
                                 REG_FIELD(LTR501_ALS_MEAS_RATE, 0, 2);
 static const struct reg_field reg_field_ps_rate =
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index ddf9bee89f77..aa4df0dcc8c9 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -40,9 +40,9 @@
 #define AS3935_AFE_PWR_BIT      BIT(0)
 
 #define AS3935_INT              0x03
-#define AS3935_INT_MASK         0x07
+#define AS3935_INT_MASK         0x0f
 #define AS3935_EVENT_INT        BIT(3)
-#define AS3935_NOISE_INT        BIT(1)
+#define AS3935_NOISE_INT        BIT(0)
 
 #define AS3935_DATA             0x07
 #define AS3935_DATA_MASK        0x3F
@@ -215,7 +215,7 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 
         st->buffer[0] = val & AS3935_DATA_MASK;
         iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
-                                           pf->timestamp);
+                                           iio_get_time_ns(indio_dev));
 err_read:
         iio_trigger_notify_done(indio_dev->trig);
 
@@ -244,7 +244,7 @@ static void as3935_event_work(struct work_struct *work)
 
         switch (val) {
         case AS3935_EVENT_INT:
-                iio_trigger_poll(st->trig);
+                iio_trigger_poll_chained(st->trig);
                 break;
         case AS3935_NOISE_INT:
                 dev_warn(&st->spi->dev, "noise level is too high\n");
@@ -269,8 +269,6 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private)
 
 static void calibrate_as3935(struct as3935_state *st)
 {
-        mutex_lock(&st->lock);
-
         /* mask disturber interrupt bit */
         as3935_write(st, AS3935_INT, BIT(5));
 
@@ -280,8 +278,6 @@ static void calibrate_as3935(struct as3935_state *st)
 
         mdelay(2);
         as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
-
-        mutex_unlock(&st->lock);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -318,6 +314,8 @@ static int as3935_resume(struct device *dev)
         val &= ~AS3935_AFE_PWR_BIT;
         ret = as3935_write(st, AS3935_AFE_GAIN, val);
 
+        calibrate_as3935(st);
+
 err_resume:
         mutex_unlock(&st->lock);
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 02971e239a18..ece6926fa2e6 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -449,12 +449,7 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
                 return ret;
 
         rt = (struct rt6_info *)dst;
-        if (ipv6_addr_any(&fl6.saddr)) {
-                ret = ipv6_dev_get_saddr(addr->net, ip6_dst_idev(dst)->dev,
-                                         &fl6.daddr, 0, &fl6.saddr);
-                if (ret)
-                        goto put;
-
+        if (ipv6_addr_any(&src_in->sin6_addr)) {
                 src_in->sin6_family = AF_INET6;
                 src_in->sin6_addr = fl6.saddr;
         }
@@ -471,9 +466,6 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
 
         *pdst = dst;
         return 0;
-put:
-        dst_release(dst);
-        return ret;
 }
 #else
 static int addr6_resolve(struct sockaddr_in6 *src_in,
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 1844770f3ae8..2b4d613a3474 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1429,7 +1429,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
         primary_path->packet_life_time =
                 cm_req_get_primary_local_ack_timeout(req_msg);
         primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
-        sa_path_set_service_id(primary_path, req_msg->service_id);
+        primary_path->service_id = req_msg->service_id;
 
         if (req_msg->alt_local_lid) {
                 alt_path->dgid = req_msg->alt_local_gid;
@@ -1452,7 +1452,7 @@ static void cm_format_paths_from_req(struct cm_req_msg *req_msg,
                 alt_path->packet_life_time =
                         cm_req_get_alt_local_ack_timeout(req_msg);
                 alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
-                sa_path_set_service_id(alt_path, req_msg->service_id);
+                alt_path->service_id = req_msg->service_id;
         }
 }
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 91b7a2fe5a55..31bb82d8ecd7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1140,7 +1140,7 @@ static void cma_save_ib_info(struct sockaddr *src_addr,
                         ib->sib_pkey = path->pkey;
                         ib->sib_flowinfo = path->flow_label;
                         memcpy(&ib->sib_addr, &path->sgid, 16);
-                        ib->sib_sid = sa_path_get_service_id(path);
+                        ib->sib_sid = path->service_id;
                         ib->sib_scope_id = 0;
                 } else {
                         ib->sib_pkey = listen_ib->sib_pkey;
@@ -1274,8 +1274,7 @@ static int cma_save_req_info(const struct ib_cm_event *ib_event,
                 memcpy(&req->local_gid, &req_param->primary_path->sgid,
                        sizeof(req->local_gid));
                 req->has_gid    = true;
-                req->service_id =
-                        sa_path_get_service_id(req_param->primary_path);
+                req->service_id = req_param->primary_path->service_id;
                 req->pkey       = be16_to_cpu(req_param->primary_path->pkey);
                 if (req->pkey != req_param->bth_pkey)
                         pr_warn_ratelimited("RDMA CMA: got different BTH P_Key (0x%x) and primary path P_Key (0x%x)\n"
@@ -1827,7 +1826,8 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
         struct rdma_route *rt;
         const sa_family_t ss_family = listen_id->route.addr.src_addr.ss_family;
         struct sa_path_rec *path = ib_event->param.req_rcvd.primary_path;
-        const __be64 service_id = sa_path_get_service_id(path);
+        const __be64 service_id =
+                ib_event->param.req_rcvd.primary_path->service_id;
         int ret;
 
         id = rdma_create_id(listen_id->route.addr.dev_addr.net,
@@ -2345,9 +2345,8 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv, int timeout_ms,
         path_rec.pkey = cpu_to_be16(ib_addr_get_pkey(dev_addr));
         path_rec.numb_path = 1;
         path_rec.reversible = 1;
-        sa_path_set_service_id(&path_rec,
-                               rdma_get_service_id(&id_priv->id,
-                                                   cma_dst_addr(id_priv)));
+        path_rec.service_id = rdma_get_service_id(&id_priv->id,
+                                                  cma_dst_addr(id_priv));
 
         comp_mask = IB_SA_PATH_REC_DGID | IB_SA_PATH_REC_SGID |
                     IB_SA_PATH_REC_PKEY | IB_SA_PATH_REC_NUMB_PATH |
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index cb7d372e4bdf..d92ab4eaa8f3 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -169,6 +169,16 @@ void ib_mad_cleanup(void);
 int ib_sa_init(void);
 void ib_sa_cleanup(void);
 
+int ibnl_init(void);
+void ibnl_cleanup(void);
+
+/**
+ * Check if there are any listeners to the netlink group
+ * @group: the netlink group ID
+ * Returns 0 on success or a negative for no listeners.
+ */
+int ibnl_chk_listeners(unsigned int group);
+
 int ib_nl_handle_resolve_resp(struct sk_buff *skb,
                               struct netlink_callback *cb);
 int ib_nl_handle_set_timeout(struct sk_buff *skb,
diff --git a/drivers/infiniband/core/netlink.c b/drivers/infiniband/core/netlink.c
index b784055423c8..94931c474d41 100644
--- a/drivers/infiniband/core/netlink.c
+++ b/drivers/infiniband/core/netlink.c
@@ -37,6 +37,7 @@
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <rdma/rdma_netlink.h>
+#include "core_priv.h"
 
 struct ibnl_client {
         struct list_head                list;
@@ -55,7 +56,6 @@ int ibnl_chk_listeners(unsigned int group)
                 return -1;
         return 0;
 }
-EXPORT_SYMBOL(ibnl_chk_listeners);
 
 int ibnl_add_client(int index, int nops,
                     const struct ibnl_client_cbs cb_table[])
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index e335b09c022e..fb7aec4047c8 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -194,7 +194,7 @@ static u32 tid;
         .field_name          = "sa_path_rec:" #field
 
 static const struct ib_field path_rec_table[] = {
-        { PATH_REC_FIELD(ib.service_id),
+        { PATH_REC_FIELD(service_id),
           .offset_words = 0,
           .offset_bits  = 0,
           .size_bits    = 64 },
@@ -296,7 +296,7 @@ static const struct ib_field path_rec_table[] = {
         .field_name          = "sa_path_rec:" #field
 
 static const struct ib_field opa_path_rec_table[] = {
-        { OPA_PATH_REC_FIELD(opa.service_id),
+        { OPA_PATH_REC_FIELD(service_id),
           .offset_words = 0,
           .offset_bits  = 0,
           .size_bits    = 64 },
@@ -774,7 +774,7 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
 
         /* Now build the attributes */
         if (comp_mask & IB_SA_PATH_REC_SERVICE_ID) {
-                val64 = be64_to_cpu(sa_path_get_service_id(sa_rec));
+                val64 = be64_to_cpu(sa_rec->service_id);
                 nla_put(skb, RDMA_NLA_F_MANDATORY | LS_NLA_TYPE_SERVICE_ID,
                         sizeof(val64), &val64);
         }
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 3dbf811d3c51..21e60b1e2ff4 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -58,7 +58,7 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d
         for_each_sg(umem->sg_head.sgl, sg, umem->npages, i) {
 
                 page = sg_page(sg);
-                if (umem->writable && dirty)
+                if (!PageDirty(page) && umem->writable && dirty)
                         set_page_dirty_lock(page);
                 put_page(page);
         }
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index 0780b1afefa9..8c4ec564e495 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -321,11 +321,15 @@ int ib_umem_odp_get(struct ib_ucontext *context, struct ib_umem *umem,
                 struct vm_area_struct *vma;
                 struct hstate *h;
 
+                down_read(&mm->mmap_sem);
                 vma = find_vma(mm, ib_umem_start(umem));
-                if (!vma || !is_vm_hugetlb_page(vma))
+                if (!vma || !is_vm_hugetlb_page(vma)) {
+                        up_read(&mm->mmap_sem);
                         return -EINVAL;
+                }
                 h = hstate_vma(vma);
                 umem->page_shift = huge_page_shift(h);
+                up_read(&mm->mmap_sem);
                 umem->hugetlb = 1;
         } else {
                 umem->hugetlb = 0;
diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
index 8b9587fe2303..94fd989c9060 100644
--- a/drivers/infiniband/core/uverbs_marshall.c
+++ b/drivers/infiniband/core/uverbs_marshall.c
@@ -96,11 +96,11 @@ void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
 }
 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
 
-void __ib_copy_path_rec_to_user(struct ib_user_path_rec *dst,
-                                struct sa_path_rec *src)
+static void __ib_copy_path_rec_to_user(struct ib_user_path_rec *dst,
+                                       struct sa_path_rec *src)
 {
-        memcpy(dst->dgid, src->dgid.raw, sizeof src->dgid);
-        memcpy(dst->sgid, src->sgid.raw, sizeof src->sgid);
+        memcpy(dst->dgid, src->dgid.raw, sizeof(src->dgid));
+        memcpy(dst->sgid, src->sgid.raw, sizeof(src->sgid));
 
         dst->dlid               = htons(ntohl(sa_path_get_dlid(src)));
         dst->slid               = htons(ntohl(sa_path_get_slid(src)));
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index ebf7be8d4139..08772836fded 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -56,6 +56,10 @@
 #define BNXT_RE_MAX_SRQC_COUNT          (64 * 1024)
 #define BNXT_RE_MAX_CQ_COUNT            (64 * 1024)
 
+#define BNXT_RE_UD_QP_HW_STALL          0x400000
+
+#define BNXT_RE_RQ_WQE_THRESHOLD        32
+
 struct bnxt_re_work {
         struct work_struct      work;
         unsigned long           event;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 7ba9e699d7ab..c7bd68311d0c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -61,6 +61,48 @@
 #include "ib_verbs.h"
 #include <rdma/bnxt_re-abi.h>
 
+static int __from_ib_access_flags(int iflags)
+{
+        int qflags = 0;
+
+        if (iflags & IB_ACCESS_LOCAL_WRITE)
+                qflags |= BNXT_QPLIB_ACCESS_LOCAL_WRITE;
+        if (iflags & IB_ACCESS_REMOTE_READ)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_READ;
+        if (iflags & IB_ACCESS_REMOTE_WRITE)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_WRITE;
+        if (iflags & IB_ACCESS_REMOTE_ATOMIC)
+                qflags |= BNXT_QPLIB_ACCESS_REMOTE_ATOMIC;
+        if (iflags & IB_ACCESS_MW_BIND)
+                qflags |= BNXT_QPLIB_ACCESS_MW_BIND;
+        if (iflags & IB_ZERO_BASED)
+                qflags |= BNXT_QPLIB_ACCESS_ZERO_BASED;
+        if (iflags & IB_ACCESS_ON_DEMAND)
+                qflags |= BNXT_QPLIB_ACCESS_ON_DEMAND;
+        return qflags;
+};
+
+static enum ib_access_flags __to_ib_access_flags(int qflags)
+{
+        enum ib_access_flags iflags = 0;
+
+        if (qflags & BNXT_QPLIB_ACCESS_LOCAL_WRITE)
+                iflags |= IB_ACCESS_LOCAL_WRITE;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_WRITE)
+                iflags |= IB_ACCESS_REMOTE_WRITE;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_READ)
+                iflags |= IB_ACCESS_REMOTE_READ;
+        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_ATOMIC)
+                iflags |= IB_ACCESS_REMOTE_ATOMIC;
+        if (qflags & BNXT_QPLIB_ACCESS_MW_BIND)
+                iflags |= IB_ACCESS_MW_BIND;
+        if (qflags & BNXT_QPLIB_ACCESS_ZERO_BASED)
+                iflags |= IB_ZERO_BASED;
+        if (qflags & BNXT_QPLIB_ACCESS_ON_DEMAND)
+                iflags |= IB_ACCESS_ON_DEMAND;
+        return iflags;
+};
+
 static int bnxt_re_build_sgl(struct ib_sge *ib_sg_list,
                              struct bnxt_qplib_sge *sg_list, int num)
 {
@@ -149,8 +191,8 @@ int bnxt_re_query_device(struct ib_device *ibdev,
         ib_attr->max_total_mcast_qp_attach = 0;
         ib_attr->max_ah = dev_attr->max_ah;
 
-        ib_attr->max_fmr = dev_attr->max_fmr;
-        ib_attr->max_map_per_fmr = 1;   /* ? */
+        ib_attr->max_fmr = 0;
+        ib_attr->max_map_per_fmr = 0;
 
         ib_attr->max_srq = dev_attr->max_srq;
         ib_attr->max_srq_wr = dev_attr->max_srq_wqes;
@@ -410,6 +452,158 @@ enum rdma_link_layer bnxt_re_get_link_layer(struct ib_device *ibdev,
         return IB_LINK_LAYER_ETHERNET;
 }
 
+#define BNXT_RE_FENCE_PBL_SIZE  DIV_ROUND_UP(BNXT_RE_FENCE_BYTES, PAGE_SIZE)
+
+static void bnxt_re_create_fence_wqe(struct bnxt_re_pd *pd)
+{
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct ib_mr *ib_mr = &fence->mr->ib_mr;
+        struct bnxt_qplib_swqe *wqe = &fence->bind_wqe;
+
+        memset(wqe, 0, sizeof(*wqe));
+        wqe->type = BNXT_QPLIB_SWQE_TYPE_BIND_MW;
+        wqe->wr_id = BNXT_QPLIB_FENCE_WRID;
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP;
+        wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE;
+        wqe->bind.zero_based = false;
+        wqe->bind.parent_l_key = ib_mr->lkey;
+        wqe->bind.va = (u64)(unsigned long)fence->va;
+        wqe->bind.length = fence->size;
+        wqe->bind.access_cntl = __from_ib_access_flags(IB_ACCESS_REMOTE_READ);
+        wqe->bind.mw_type = SQ_BIND_MW_TYPE_TYPE1;
+
+        /* Save the initial rkey in fence structure for now;
+         * wqe->bind.r_key will be set at (re)bind time.
+         */
+        fence->bind_rkey = ib_inc_rkey(fence->mw->rkey);
+}
+
+static int bnxt_re_bind_fence_mw(struct bnxt_qplib_qp *qplib_qp)
+{
+        struct bnxt_re_qp *qp = container_of(qplib_qp, struct bnxt_re_qp,
+                                             qplib_qp);
+        struct ib_pd *ib_pd = qp->ib_qp.pd;
+        struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_qplib_swqe *fence_wqe = &fence->bind_wqe;
+        struct bnxt_qplib_swqe wqe;
+        int rc;
+
+        memcpy(&wqe, fence_wqe, sizeof(wqe));
+        wqe.bind.r_key = fence->bind_rkey;
+        fence->bind_rkey = ib_inc_rkey(fence->bind_rkey);
+
+        dev_dbg(rdev_to_dev(qp->rdev),
+                "Posting bind fence-WQE: rkey: %#x QP: %d PD: %p\n",
+                wqe.bind.r_key, qp->qplib_qp.id, pd);
+        rc = bnxt_qplib_post_send(&qp->qplib_qp, &wqe);
+        if (rc) {
+                dev_err(rdev_to_dev(qp->rdev), "Failed to bind fence-WQE\n");
+                return rc;
+        }
+        bnxt_qplib_post_send_db(&qp->qplib_qp);
+
+        return rc;
+}
+
+static void bnxt_re_destroy_fence_mr(struct bnxt_re_pd *pd)
+{
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_re_dev *rdev = pd->rdev;
+        struct device *dev = &rdev->en_dev->pdev->dev;
+        struct bnxt_re_mr *mr = fence->mr;
+
+        if (fence->mw) {
+                bnxt_re_dealloc_mw(fence->mw);
+                fence->mw = NULL;
+        }
+        if (mr) {
+                if (mr->ib_mr.rkey)
+                        bnxt_qplib_dereg_mrw(&rdev->qplib_res, &mr->qplib_mr,
+                                             true);
+                if (mr->ib_mr.lkey)
+                        bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+                kfree(mr);
+                fence->mr = NULL;
+        }
+        if (fence->dma_addr) {
+                dma_unmap_single(dev, fence->dma_addr, BNXT_RE_FENCE_BYTES,
+                                 DMA_BIDIRECTIONAL);
+                fence->dma_addr = 0;
+        }
+}
+
+static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd)
+{
+        int mr_access_flags = IB_ACCESS_LOCAL_WRITE | IB_ACCESS_MW_BIND;
+        struct bnxt_re_fence_data *fence = &pd->fence;
+        struct bnxt_re_dev *rdev = pd->rdev;
+        struct device *dev = &rdev->en_dev->pdev->dev;
+        struct bnxt_re_mr *mr = NULL;
+        dma_addr_t dma_addr = 0;
+        struct ib_mw *mw;
+        u64 pbl_tbl;
+        int rc;
+
+        dma_addr = dma_map_single(dev, fence->va, BNXT_RE_FENCE_BYTES,
+                                  DMA_BIDIRECTIONAL);
+        rc = dma_mapping_error(dev, dma_addr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to dma-map fence-MR-mem\n");
+                rc = -EIO;
+                fence->dma_addr = 0;
+                goto fail;
+        }
+        fence->dma_addr = dma_addr;
+
+        /* Allocate a MR */
+        mr = kzalloc(sizeof(*mr), GFP_KERNEL);
+        if (!mr) {
+                rc = -ENOMEM;
+                goto fail;
+        }
+        fence->mr = mr;
+        mr->rdev = rdev;
+        mr->qplib_mr.pd = &pd->qplib_pd;
+        mr->qplib_mr.type = CMDQ_ALLOCATE_MRW_MRW_FLAGS_PMR;
+        mr->qplib_mr.flags = __from_ib_access_flags(mr_access_flags);
+        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &mr->qplib_mr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to alloc fence-HW-MR\n");
+                goto fail;
+        }
+
+        /* Register MR */
+        mr->ib_mr.lkey = mr->qplib_mr.lkey;
+        mr->qplib_mr.va = (u64)(unsigned long)fence->va;
+        mr->qplib_mr.total_size = BNXT_RE_FENCE_BYTES;
+        pbl_tbl = dma_addr;
+        rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &mr->qplib_mr, &pbl_tbl,
+                               BNXT_RE_FENCE_PBL_SIZE, false);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Failed to register fence-MR\n");
+                goto fail;
+        }
+        mr->ib_mr.rkey = mr->qplib_mr.rkey;
+
+        /* Create a fence MW only for kernel consumers */
+        mw = bnxt_re_alloc_mw(&pd->ib_pd, IB_MW_TYPE_1, NULL);
+        if (!mw) {
+                dev_err(rdev_to_dev(rdev),
+                        "Failed to create fence-MW for PD: %p\n", pd);
+                rc = -EINVAL;
+                goto fail;
+        }
+        fence->mw = mw;
+
+        bnxt_re_create_fence_wqe(pd);
+        return 0;
+
+fail:
+        bnxt_re_destroy_fence_mr(pd);
+        return rc;
+}
+
 /* Protection Domains */
 int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
 {
@@ -417,6 +611,7 @@ int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
         struct bnxt_re_dev *rdev = pd->rdev;
         int rc;
 
+        bnxt_re_destroy_fence_mr(pd);
         if (ib_pd->uobject && pd->dpi.dbr) {
                 struct ib_ucontext *ib_uctx = ib_pd->uobject->context;
                 struct bnxt_re_ucontext *ucntx;
@@ -498,6 +693,10 @@ struct ib_pd *bnxt_re_alloc_pd(struct ib_device *ibdev,
                 }
         }
 
+        if (!udata)
+                if (bnxt_re_create_fence_mr(pd))
+                        dev_warn(rdev_to_dev(rdev),
+                                 "Failed to create Fence-MR\n");
         return &pd->ib_pd;
 dbfail:
         (void)bnxt_qplib_dealloc_pd(&rdev->qplib_res, &rdev->qplib_res.pd_tbl,
@@ -849,12 +1048,16 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp
         /* Shadow QP SQ depth should be same as QP1 RQ depth */
         qp->qplib_qp.sq.max_wqe = qp1_qp->rq.max_wqe;
         qp->qplib_qp.sq.max_sge = 2;
+        /* Q full delta can be 1 since it is internal QP */
+        qp->qplib_qp.sq.q_full_delta = 1;
 
         qp->qplib_qp.scq = qp1_qp->scq;
         qp->qplib_qp.rcq = qp1_qp->rcq;
 
         qp->qplib_qp.rq.max_wqe = qp1_qp->rq.max_wqe;
         qp->qplib_qp.rq.max_sge = qp1_qp->rq.max_sge;
+        /* Q full delta can be 1 since it is internal QP */
+        qp->qplib_qp.rq.q_full_delta = 1;
 
         qp->qplib_qp.mtu = qp1_qp->mtu;
 
@@ -917,10 +1120,6 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         qp->qplib_qp.sig_type = ((qp_init_attr->sq_sig_type ==
                                   IB_SIGNAL_ALL_WR) ? true : false);
 
-        entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1);
-        qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
-                                        dev_attr->max_qp_wqes + 1);
-
         qp->qplib_qp.sq.max_sge = qp_init_attr->cap.max_send_sge;
         if (qp->qplib_qp.sq.max_sge > dev_attr->max_qp_sges)
                 qp->qplib_qp.sq.max_sge = dev_attr->max_qp_sges;
@@ -959,6 +1158,9 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 qp->qplib_qp.rq.max_wqe = min_t(u32, entries,
                                                 dev_attr->max_qp_wqes + 1);
 
+                qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
+                                                qp_init_attr->cap.max_recv_wr;
+
                 qp->qplib_qp.rq.max_sge = qp_init_attr->cap.max_recv_sge;
                 if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges)
                         qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
@@ -967,6 +1169,12 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
         qp->qplib_qp.mtu = ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu));
 
         if (qp_init_attr->qp_type == IB_QPT_GSI) {
+                /* Allocate 1 more than what's provided */
+                entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1);
+                qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
+                                                dev_attr->max_qp_wqes + 1);
+                qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe -
+                                                qp_init_attr->cap.max_send_wr;
                 qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
                 if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges)
                         qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges;
@@ -1006,6 +1214,22 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
                 }
 
         } else {
+                /* Allocate 128 + 1 more than what's provided */
+                entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr +
+                                             BNXT_QPLIB_RESERVED_QP_WRS + 1);
+                qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
+                                                dev_attr->max_qp_wqes +
+                                                BNXT_QPLIB_RESERVED_QP_WRS + 1);
+                qp->qplib_qp.sq.q_full_delta = BNXT_QPLIB_RESERVED_QP_WRS + 1;
+
+                /*
+                 * Reserving one slot for Phantom WQE. Application can
+                 * post one extra entry in this case. But allowing this to avoid
+                 * unexpected Queue full condition
+                 */
+
+                qp->qplib_qp.sq.q_full_delta -= 1;
+
                 qp->qplib_qp.max_rd_atomic = dev_attr->max_qp_rd_atom;
                 qp->qplib_qp.max_dest_rd_atomic = dev_attr->max_qp_init_rd_atom;
                 if (udata) {
@@ -1025,6 +1249,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd,
 
         qp->ib_qp.qp_num = qp->qplib_qp.id;
         spin_lock_init(&qp->sq_lock);
+        spin_lock_init(&qp->rq_lock);
 
         if (udata) {
                 struct bnxt_re_qp_resp resp;
@@ -1129,48 +1354,6 @@ static enum ib_mtu __to_ib_mtu(u32 mtu)
         }
 }
 
-static int __from_ib_access_flags(int iflags)
-{
-        int qflags = 0;
-
-        if (iflags & IB_ACCESS_LOCAL_WRITE)
-                qflags |= BNXT_QPLIB_ACCESS_LOCAL_WRITE;
-        if (iflags & IB_ACCESS_REMOTE_READ)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_READ;
-        if (iflags & IB_ACCESS_REMOTE_WRITE)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_WRITE;
-        if (iflags & IB_ACCESS_REMOTE_ATOMIC)
-                qflags |= BNXT_QPLIB_ACCESS_REMOTE_ATOMIC;
-        if (iflags & IB_ACCESS_MW_BIND)
-                qflags |= BNXT_QPLIB_ACCESS_MW_BIND;
-        if (iflags & IB_ZERO_BASED)
-                qflags |= BNXT_QPLIB_ACCESS_ZERO_BASED;
-        if (iflags & IB_ACCESS_ON_DEMAND)
-                qflags |= BNXT_QPLIB_ACCESS_ON_DEMAND;
-        return qflags;
-};
-
-static enum ib_access_flags __to_ib_access_flags(int qflags)
-{
-        enum ib_access_flags iflags = 0;
-
-        if (qflags & BNXT_QPLIB_ACCESS_LOCAL_WRITE)
-                iflags |= IB_ACCESS_LOCAL_WRITE;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_WRITE)
-                iflags |= IB_ACCESS_REMOTE_WRITE;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_READ)
-                iflags |= IB_ACCESS_REMOTE_READ;
-        if (qflags & BNXT_QPLIB_ACCESS_REMOTE_ATOMIC)
-                iflags |= IB_ACCESS_REMOTE_ATOMIC;
-        if (qflags & BNXT_QPLIB_ACCESS_MW_BIND)
-                iflags |= IB_ACCESS_MW_BIND;
-        if (qflags & BNXT_QPLIB_ACCESS_ZERO_BASED)
-                iflags |= IB_ZERO_BASED;
-        if (qflags & BNXT_QPLIB_ACCESS_ON_DEMAND)
-                iflags |= IB_ACCESS_ON_DEMAND;
-        return iflags;
-};
-
 static int bnxt_re_modify_shadow_qp(struct bnxt_re_dev *rdev,
                                     struct bnxt_re_qp *qp1_qp,
                                     int qp_attr_mask)
@@ -1378,11 +1561,21 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
                 entries = roundup_pow_of_two(qp_attr->cap.max_send_wr);
                 qp->qplib_qp.sq.max_wqe = min_t(u32, entries,
                                                 dev_attr->max_qp_wqes + 1);
+                qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe -
+                                                qp_attr->cap.max_send_wr;
+                /*
+                 * Reserving one slot for Phantom WQE. Some application can
+                 * post one extra entry in this case. Allowing this to avoid
+                 * unexpected Queue full condition
+                 */
+                qp->qplib_qp.sq.q_full_delta -= 1;
                 qp->qplib_qp.sq.max_sge = qp_attr->cap.max_send_sge;
                 if (qp->qplib_qp.rq.max_wqe) {
                         entries = roundup_pow_of_two(qp_attr->cap.max_recv_wr);
                         qp->qplib_qp.rq.max_wqe =
                                 min_t(u32, entries, dev_attr->max_qp_wqes + 1);
+                        qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe -
+                                                       qp_attr->cap.max_recv_wr;
                         qp->qplib_qp.rq.max_sge = qp_attr->cap.max_recv_sge;
                 } else {
                         /* SRQ was used prior, just ignore the RQ caps */
@@ -1883,6 +2076,22 @@ static int bnxt_re_copy_wr_payload(struct bnxt_re_dev *rdev,
         return payload_sz;
 }
 
+static void bnxt_ud_qp_hw_stall_workaround(struct bnxt_re_qp *qp)
+{
+        if ((qp->ib_qp.qp_type == IB_QPT_UD ||
+             qp->ib_qp.qp_type == IB_QPT_GSI ||
+             qp->ib_qp.qp_type == IB_QPT_RAW_ETHERTYPE) &&
+             qp->qplib_qp.wqe_cnt == BNXT_RE_UD_QP_HW_STALL) {
+                int qp_attr_mask;
+                struct ib_qp_attr qp_attr;
+
+                qp_attr_mask = IB_QP_STATE;
+                qp_attr.qp_state = IB_QPS_RTS;
+                bnxt_re_modify_qp(&qp->ib_qp, &qp_attr, qp_attr_mask, NULL);
+                qp->qplib_qp.wqe_cnt = 0;
+        }
+}
+
 static int bnxt_re_post_send_shadow_qp(struct bnxt_re_dev *rdev,
                                        struct bnxt_re_qp *qp,
                                 struct ib_send_wr *wr)
@@ -1928,6 +2137,7 @@ bad:
                 wr = wr->next;
         }
         bnxt_qplib_post_send_db(&qp->qplib_qp);
+        bnxt_ud_qp_hw_stall_workaround(qp);
         spin_unlock_irqrestore(&qp->sq_lock, flags);
         return rc;
 }
@@ -2024,6 +2234,7 @@ bad:
                 wr = wr->next;
         }
         bnxt_qplib_post_send_db(&qp->qplib_qp);
+        bnxt_ud_qp_hw_stall_workaround(qp);
         spin_unlock_irqrestore(&qp->sq_lock, flags);
 
         return rc;
@@ -2071,7 +2282,10 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, struct ib_recv_wr *wr,
         struct bnxt_re_qp *qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
         struct bnxt_qplib_swqe wqe;
         int rc = 0, payload_sz = 0;
+        unsigned long flags;
+        u32 count = 0;
 
+        spin_lock_irqsave(&qp->rq_lock, flags);
         while (wr) {
                 /* House keeping */
                 memset(&wqe, 0, sizeof(wqe));
@@ -2100,9 +2314,21 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, struct ib_recv_wr *wr,
                         *bad_wr = wr;
                         break;
                 }
+
+                /* Ring DB if the RQEs posted reaches a threshold value */
+                if (++count >= BNXT_RE_RQ_WQE_THRESHOLD) {
+                        bnxt_qplib_post_recv_db(&qp->qplib_qp);
+                        count = 0;
+                }
+
                 wr = wr->next;
         }
-        bnxt_qplib_post_recv_db(&qp->qplib_qp);
+
+        if (count)
+                bnxt_qplib_post_recv_db(&qp->qplib_qp);
+
+        spin_unlock_irqrestore(&qp->rq_lock, flags);
+
         return rc;
 }
 
@@ -2643,12 +2869,36 @@ static void bnxt_re_process_res_ud_wc(struct ib_wc *wc,
                 wc->opcode = IB_WC_RECV_RDMA_WITH_IMM;
 }
 
+static int send_phantom_wqe(struct bnxt_re_qp *qp)
+{
+        struct bnxt_qplib_qp *lib_qp = &qp->qplib_qp;
+        unsigned long flags;
+        int rc = 0;
+
+        spin_lock_irqsave(&qp->sq_lock, flags);
+
+        rc = bnxt_re_bind_fence_mw(lib_qp);
+        if (!rc) {
+                lib_qp->sq.phantom_wqe_cnt++;
+                dev_dbg(&lib_qp->sq.hwq.pdev->dev,
+                        "qp %#x sq->prod %#x sw_prod %#x phantom_wqe_cnt %d\n",
+                        lib_qp->id, lib_qp->sq.hwq.prod,
+                        HWQ_CMP(lib_qp->sq.hwq.prod, &lib_qp->sq.hwq),
+                        lib_qp->sq.phantom_wqe_cnt);
+        }
+
+        spin_unlock_irqrestore(&qp->sq_lock, flags);
+        return rc;
+}
+
 int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
 {
         struct bnxt_re_cq *cq = container_of(ib_cq, struct bnxt_re_cq, ib_cq);
         struct bnxt_re_qp *qp;
         struct bnxt_qplib_cqe *cqe;
         int i, ncqe, budget;
+        struct bnxt_qplib_q *sq;
+        struct bnxt_qplib_qp *lib_qp;
         u32 tbl_idx;
         struct bnxt_re_sqp_entries *sqp_entry = NULL;
         unsigned long flags;
@@ -2661,7 +2911,21 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
         }
         cqe = &cq->cql[0];
         while (budget) {
-                ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget);
+                lib_qp = NULL;
+                ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget, &lib_qp);
+                if (lib_qp) {
+                        sq = &lib_qp->sq;
+                        if (sq->send_phantom) {
+                                qp = container_of(lib_qp,
+                                                  struct bnxt_re_qp, qplib_qp);
+                                if (send_phantom_wqe(qp) == -ENOMEM)
+                                        dev_err(rdev_to_dev(cq->rdev),
+                                                "Phantom failed! Scheduled to send again\n");
+                                else
+                                        sq->send_phantom = false;
+                        }
+                }
+
                 if (!ncqe)
                         break;
 
@@ -2822,6 +3086,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
         struct bnxt_re_dev *rdev = mr->rdev;
         int rc;
 
+        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
+                return rc;
+        }
+
         if (mr->npages && mr->pages) {
                 rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
                                                         &mr->qplib_frpl);
@@ -2829,8 +3099,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
                 mr->npages = 0;
                 mr->pages = NULL;
         }
-        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
-
         if (!IS_ERR_OR_NULL(mr->ib_umem))
                 ib_umem_release(mr->ib_umem);
 
@@ -2914,97 +3182,52 @@ fail:
         return ERR_PTR(rc);
 }
 
-/* Fast Memory Regions */
-struct ib_fmr *bnxt_re_alloc_fmr(struct ib_pd *ib_pd, int mr_access_flags,
-                                 struct ib_fmr_attr *fmr_attr)
+struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
+                               struct ib_udata *udata)
 {
         struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
         struct bnxt_re_dev *rdev = pd->rdev;
-        struct bnxt_re_fmr *fmr;
+        struct bnxt_re_mw *mw;
         int rc;
 
-        if (fmr_attr->max_pages > MAX_PBL_LVL_2_PGS ||
-            fmr_attr->max_maps > rdev->dev_attr.max_map_per_fmr) {
-                dev_err(rdev_to_dev(rdev), "Allocate FMR exceeded Max limit");
+        mw = kzalloc(sizeof(*mw), GFP_KERNEL);
+        if (!mw)
                 return ERR_PTR(-ENOMEM);
-        }
-        fmr = kzalloc(sizeof(*fmr), GFP_KERNEL);
-        if (!fmr)
-                return ERR_PTR(-ENOMEM);
-
-        fmr->rdev = rdev;
-        fmr->qplib_fmr.pd = &pd->qplib_pd;
-        fmr->qplib_fmr.type = CMDQ_ALLOCATE_MRW_MRW_FLAGS_PMR;
+        mw->rdev = rdev;
+        mw->qplib_mw.pd = &pd->qplib_pd;
 
-        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &fmr->qplib_fmr);
-        if (rc)
+        mw->qplib_mw.type = (type == IB_MW_TYPE_1 ?
+                               CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE1 :
+                               CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2B);
+        rc = bnxt_qplib_alloc_mrw(&rdev->qplib_res, &mw->qplib_mw);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Allocate MW failed!");
                 goto fail;
+        }
+        mw->ib_mw.rkey = mw->qplib_mw.rkey;
 
-        fmr->qplib_fmr.flags = __from_ib_access_flags(mr_access_flags);
-        fmr->ib_fmr.lkey = fmr->qplib_fmr.lkey;
-        fmr->ib_fmr.rkey = fmr->ib_fmr.lkey;
+        atomic_inc(&rdev->mw_count);
+        return &mw->ib_mw;
 
-        atomic_inc(&rdev->mr_count);
-        return &fmr->ib_fmr;
 fail:
-        kfree(fmr);
+        kfree(mw);
         return ERR_PTR(rc);
 }
 
-int bnxt_re_map_phys_fmr(struct ib_fmr *ib_fmr, u64 *page_list, int list_len,
-                         u64 iova)
+int bnxt_re_dealloc_mw(struct ib_mw *ib_mw)
 {
-        struct bnxt_re_fmr *fmr = container_of(ib_fmr, struct bnxt_re_fmr,
-                                             ib_fmr);
-        struct bnxt_re_dev *rdev = fmr->rdev;
+        struct bnxt_re_mw *mw = container_of(ib_mw, struct bnxt_re_mw, ib_mw);
+        struct bnxt_re_dev *rdev = mw->rdev;
         int rc;
 
-        fmr->qplib_fmr.va = iova;
-        fmr->qplib_fmr.total_size = list_len * PAGE_SIZE;
-
-        rc = bnxt_qplib_reg_mr(&rdev->qplib_res, &fmr->qplib_fmr, page_list,
-                               list_len, true);
-        if (rc)
-                dev_err(rdev_to_dev(rdev), "Failed to map FMR for lkey = 0x%x!",
-                        fmr->ib_fmr.lkey);
-        return rc;
-}
-
-int bnxt_re_unmap_fmr(struct list_head *fmr_list)
-{
-        struct bnxt_re_dev *rdev;
-        struct bnxt_re_fmr *fmr;
-        struct ib_fmr *ib_fmr;
-        int rc = 0;
-
-        /* Validate each FMRs inside the fmr_list */
-        list_for_each_entry(ib_fmr, fmr_list, list) {
-                fmr = container_of(ib_fmr, struct bnxt_re_fmr, ib_fmr);
-                rdev = fmr->rdev;
-
-                if (rdev) {
-                        rc = bnxt_qplib_dereg_mrw(&rdev->qplib_res,
-                                                  &fmr->qplib_fmr, true);
-                        if (rc)
-                                break;
-                }
+        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mw->qplib_mw);
+        if (rc) {
+                dev_err(rdev_to_dev(rdev), "Free MW failed: %#x\n", rc);
+                return rc;
         }
-        return rc;
-}
-
-int bnxt_re_dealloc_fmr(struct ib_fmr *ib_fmr)
-{
-        struct bnxt_re_fmr *fmr = container_of(ib_fmr, struct bnxt_re_fmr,
-                                               ib_fmr);
-        struct bnxt_re_dev *rdev = fmr->rdev;
-        int rc;
 
-        rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &fmr->qplib_fmr);
-        if (rc)
-                dev_err(rdev_to_dev(rdev), "Failed to free FMR");
-
-        kfree(fmr);
-        atomic_dec(&rdev->mr_count);
+        kfree(mw);
+        atomic_dec(&rdev->mw_count);
         return rc;
 }
 
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index 5c3d71765454..6c160f6a5398 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -44,11 +44,23 @@ struct bnxt_re_gid_ctx {
         u32                     refcnt;
 };
 
+#define BNXT_RE_FENCE_BYTES     64
+struct bnxt_re_fence_data {
+        u32 size;
+        u8 va[BNXT_RE_FENCE_BYTES];
+        dma_addr_t dma_addr;
+        struct bnxt_re_mr *mr;
+        struct ib_mw *mw;
+        struct bnxt_qplib_swqe bind_wqe;
+        u32 bind_rkey;
+};
+
 struct bnxt_re_pd {
         struct bnxt_re_dev      *rdev;
         struct ib_pd            ib_pd;
         struct bnxt_qplib_pd    qplib_pd;
         struct bnxt_qplib_dpi   dpi;
+        struct bnxt_re_fence_data fence;
 };
 
 struct bnxt_re_ah {
@@ -62,6 +74,7 @@ struct bnxt_re_qp {
         struct bnxt_re_dev      *rdev;
         struct ib_qp            ib_qp;
         spinlock_t              sq_lock;        /* protect sq */
+        spinlock_t              rq_lock;        /* protect rq */
         struct bnxt_qplib_qp    qplib_qp;
         struct ib_umem          *sumem;
         struct ib_umem          *rumem;
@@ -181,12 +194,9 @@ int bnxt_re_map_mr_sg(struct ib_mr *ib_mr, struct scatterlist *sg, int sg_nents,
 struct ib_mr *bnxt_re_alloc_mr(struct ib_pd *ib_pd, enum ib_mr_type mr_type,
                                u32 max_num_sg);
 int bnxt_re_dereg_mr(struct ib_mr *mr);
-struct ib_fmr *bnxt_re_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
-                                 struct ib_fmr_attr *fmr_attr);
-int bnxt_re_map_phys_fmr(struct ib_fmr *fmr, u64 *page_list, int list_len,
-                         u64 iova);
-int bnxt_re_unmap_fmr(struct list_head *fmr_list);
-int bnxt_re_dealloc_fmr(struct ib_fmr *fmr);
+struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
+                               struct ib_udata *udata);
+int bnxt_re_dealloc_mw(struct ib_mw *mw);
 struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                                   u64 virt_addr, int mr_access_flags,
                                   struct ib_udata *udata);
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 5d355401179b..1fce5e73216b 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -507,10 +507,6 @@ static int bnxt_re_register_ib(struct bnxt_re_dev *rdev)
         ibdev->dereg_mr                 = bnxt_re_dereg_mr;
         ibdev->alloc_mr                 = bnxt_re_alloc_mr;
         ibdev->map_mr_sg                = bnxt_re_map_mr_sg;
-        ibdev->alloc_fmr                = bnxt_re_alloc_fmr;
-        ibdev->map_phys_fmr             = bnxt_re_map_phys_fmr;
-        ibdev->unmap_fmr                = bnxt_re_unmap_fmr;
-        ibdev->dealloc_fmr              = bnxt_re_dealloc_fmr;
 
         ibdev->reg_user_mr              = bnxt_re_reg_user_mr;
         ibdev->alloc_ucontext           = bnxt_re_alloc_ucontext;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 43d08b5e9085..f05500bcdcf1 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -284,7 +284,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_qp1 req;
-        struct creq_create_qp1_resp *resp;
+        struct creq_create_qp1_resp resp;
         struct bnxt_qplib_pbl *pbl;
         struct bnxt_qplib_q *sq = &qp->sq;
         struct bnxt_qplib_q *rq = &qp->rq;
@@ -394,31 +394,12 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 
         req.pd_id = cpu_to_le32(qp->pd->id);
 
-        resp = (struct creq_create_qp1_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: FP: CREATE_QP1 send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP1 timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP1 failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        qp->id = le32_to_cpu(resp->xid);
+
+        qp->id = le32_to_cpu(resp.xid);
         qp->cur_qp_state = CMDQ_MODIFY_QP_NEW_STATE_RESET;
         sq->flush_in_progress = false;
         rq->flush_in_progress = false;
@@ -442,7 +423,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct sq_send *hw_sq_send_hdr, **hw_sq_send_ptr;
         struct cmdq_create_qp req;
-        struct creq_create_qp_resp *resp;
+        struct creq_create_qp_resp resp;
         struct bnxt_qplib_pbl *pbl;
         struct sq_psn_search **psn_search_ptr;
         unsigned long int psn_search, poff = 0;
@@ -627,31 +608,12 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         }
         req.pd_id = cpu_to_le32(qp->pd->id);
 
-        resp = (struct creq_create_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        qp->id = le32_to_cpu(resp->xid);
+
+        qp->id = le32_to_cpu(resp.xid);
         qp->cur_qp_state = CMDQ_MODIFY_QP_NEW_STATE_RESET;
         sq->flush_in_progress = false;
         rq->flush_in_progress = false;
@@ -769,10 +731,11 @@ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_modify_qp req;
-        struct creq_modify_qp_resp *resp;
+        struct creq_modify_qp_resp resp;
         u16 cmd_flags = 0, pkey;
         u32 temp32[4];
         u32 bmask;
+        int rc;
 
         RCFW_CMD_PREP(req, MODIFY_QP, cmd_flags);
 
@@ -862,27 +825,10 @@ int bnxt_qplib_modify_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 
         req.vlan_pcp_vlan_dei_vlan_id = cpu_to_le16(qp->vlan_id);
 
-        resp = (struct creq_modify_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: MODIFY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
         qp->cur_qp_state = qp->state;
         return 0;
 }
@@ -891,37 +837,26 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_query_qp req;
-        struct creq_query_qp_resp *resp;
+        struct creq_query_qp_resp resp;
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
         struct creq_query_qp_resp_sb *sb;
         u16 cmd_flags = 0;
         u32 temp32[4];
-        int i;
+        int i, rc = 0;
 
         RCFW_CMD_PREP(req, QUERY_QP, cmd_flags);
 
+        sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+        if (!sbuf)
+                return -ENOMEM;
+        sb = sbuf->sb;
+
         req.qp_cid = cpu_to_le32(qp->id);
         req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
-        resp = (struct creq_query_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     (void **)&sb, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: QUERY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          (void *)sbuf, 0);
+        if (rc)
+                goto bail;
         /* Extract the context from the side buffer */
         qp->state = sb->en_sqd_async_notify_state &
                         CREQ_QUERY_QP_RESP_SB_STATE_MASK;
@@ -976,7 +911,9 @@ int bnxt_qplib_query_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
         qp->dest_qpn = le32_to_cpu(sb->dest_qp_id);
         memcpy(qp->smac, sb->src_mac, 6);
         qp->vlan_id = le16_to_cpu(sb->vlan_pcp_vlan_dei_vlan_id);
-        return 0;
+bail:
+        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
+        return rc;
 }
 
 static void __clean_cq(struct bnxt_qplib_cq *cq, u64 qp)
@@ -1021,34 +958,18 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_qp req;
-        struct creq_destroy_qp_resp *resp;
+        struct creq_destroy_qp_resp resp;
         unsigned long flags;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DESTROY_QP, cmd_flags);
 
         req.qp_cid = cpu_to_le32(qp->id);
-        resp = (struct creq_destroy_qp_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_QP failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
 
         /* Must walk the associated CQs to nullified the QP ptr */
         spin_lock_irqsave(&qp->scq->hwq.lock, flags);
@@ -1162,8 +1083,12 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
                 rc = -EINVAL;
                 goto done;
         }
-        if (HWQ_CMP((sq->hwq.prod + 1), &sq->hwq) ==
-            HWQ_CMP(sq->hwq.cons, &sq->hwq)) {
+
+        if (bnxt_qplib_queue_full(sq)) {
+                dev_err(&sq->hwq.pdev->dev,
+                        "QPLIB: prod = %#x cons = %#x qdepth = %#x delta = %#x",
+                        sq->hwq.prod, sq->hwq.cons, sq->hwq.max_elements,
+                        sq->q_full_delta);
                 rc = -ENOMEM;
                 goto done;
         }
@@ -1373,6 +1298,9 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
         }
 
         sq->hwq.prod++;
+
+        qp->wqe_cnt++;
+
 done:
         return rc;
 }
@@ -1411,8 +1339,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
                 rc = -EINVAL;
                 goto done;
         }
-        if (HWQ_CMP((rq->hwq.prod + 1), &rq->hwq) ==
-            HWQ_CMP(rq->hwq.cons, &rq->hwq)) {
+        if (bnxt_qplib_queue_full(rq)) {
                 dev_err(&rq->hwq.pdev->dev,
                         "QPLIB: FP: QP (0x%x) RQ is full!", qp->id);
                 rc = -EINVAL;
@@ -1483,7 +1410,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_cq req;
-        struct creq_create_cq_resp *resp;
+        struct creq_create_cq_resp resp;
         struct bnxt_qplib_pbl *pbl;
         u16 cmd_flags = 0;
         int rc;
@@ -1525,30 +1452,12 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
                         (cq->cnq_hw_ring_id & CMDQ_CREATE_CQ_CNQ_ID_MASK) <<
                          CMDQ_CREATE_CQ_CNQ_ID_SFT);
 
-        resp = (struct creq_create_cq_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: CREATE_CQ failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
                 goto fail;
-        }
-        cq->id = le32_to_cpu(resp->xid);
+
+        cq->id = le32_to_cpu(resp.xid);
         cq->dbr_base = res->dpi_tbl.dbr_bar_reg_iomem;
         cq->period = BNXT_QPLIB_QUEUE_START_PERIOD;
         init_waitqueue_head(&cq->waitq);
@@ -1566,33 +1475,17 @@ int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_cq req;
-        struct creq_destroy_cq_resp *resp;
+        struct creq_destroy_cq_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DESTROY_CQ, cmd_flags);
 
         req.cq_cid = cpu_to_le32(cq->id);
-        resp = (struct creq_destroy_cq_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: FP: DESTROY_CQ failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
         bnxt_qplib_free_hwq(res->pdev, &cq->hwq);
         return 0;
 }
@@ -1664,14 +1557,113 @@ static int __flush_rq(struct bnxt_qplib_q *rq, struct bnxt_qplib_qp *qp,
         return rc;
 }
 
+/* Note: SQE is valid from sw_sq_cons up to cqe_sq_cons (exclusive)
+ *       CQE is track from sw_cq_cons to max_element but valid only if VALID=1
+ */
+static int do_wa9060(struct bnxt_qplib_qp *qp, struct bnxt_qplib_cq *cq,
+                     u32 cq_cons, u32 sw_sq_cons, u32 cqe_sq_cons)
+{
+        struct bnxt_qplib_q *sq = &qp->sq;
+        struct bnxt_qplib_swq *swq;
+        u32 peek_sw_cq_cons, peek_raw_cq_cons, peek_sq_cons_idx;
+        struct cq_base *peek_hwcqe, **peek_hw_cqe_ptr;
+        struct cq_req *peek_req_hwcqe;
+        struct bnxt_qplib_qp *peek_qp;
+        struct bnxt_qplib_q *peek_sq;
+        int i, rc = 0;
+
+        /* Normal mode */
+        /* Check for the psn_search marking before completing */
+        swq = &sq->swq[sw_sq_cons];
+        if (swq->psn_search &&
+            le32_to_cpu(swq->psn_search->flags_next_psn) & 0x80000000) {
+                /* Unmark */
+                swq->psn_search->flags_next_psn = cpu_to_le32
+                        (le32_to_cpu(swq->psn_search->flags_next_psn)
+                                     & ~0x80000000);
+                dev_dbg(&cq->hwq.pdev->dev,
+                        "FP: Process Req cq_cons=0x%x qp=0x%x sq cons sw=0x%x cqe=0x%x marked!\n",
+                        cq_cons, qp->id, sw_sq_cons, cqe_sq_cons);
+                sq->condition = true;
+                sq->send_phantom = true;
+
+                /* TODO: Only ARM if the previous SQE is ARMALL */
+                bnxt_qplib_arm_cq(cq, DBR_DBR_TYPE_CQ_ARMALL);
+
+                rc = -EAGAIN;
+                goto out;
+        }
+        if (sq->condition) {
+                /* Peek at the completions */
+                peek_raw_cq_cons = cq->hwq.cons;
+                peek_sw_cq_cons = cq_cons;
+                i = cq->hwq.max_elements;
+                while (i--) {
+                        peek_sw_cq_cons = HWQ_CMP((peek_sw_cq_cons), &cq->hwq);
+                        peek_hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
+                        peek_hwcqe = &peek_hw_cqe_ptr[CQE_PG(peek_sw_cq_cons)]
+                                                     [CQE_IDX(peek_sw_cq_cons)];
+                        /* If the next hwcqe is VALID */
+                        if (CQE_CMP_VALID(peek_hwcqe, peek_raw_cq_cons,
+                                          cq->hwq.max_elements)) {
+                                /* If the next hwcqe is a REQ */
+                                if ((peek_hwcqe->cqe_type_toggle &
+                                    CQ_BASE_CQE_TYPE_MASK) ==
+                                    CQ_BASE_CQE_TYPE_REQ) {
+                                        peek_req_hwcqe = (struct cq_req *)
+                                                         peek_hwcqe;
+                                        peek_qp = (struct bnxt_qplib_qp *)
+                                                ((unsigned long)
+                                                 le64_to_cpu
+                                                 (peek_req_hwcqe->qp_handle));
+                                        peek_sq = &peek_qp->sq;
+                                        peek_sq_cons_idx = HWQ_CMP(le16_to_cpu(
+                                                peek_req_hwcqe->sq_cons_idx) - 1
+                                                , &sq->hwq);
+                                        /* If the hwcqe's sq's wr_id matches */
+                                        if (peek_sq == sq &&
+                                            sq->swq[peek_sq_cons_idx].wr_id ==
+                                            BNXT_QPLIB_FENCE_WRID) {
+                                                /*
+                                                 *  Unbreak only if the phantom
+                                                 *  comes back
+                                                 */
+                                                dev_dbg(&cq->hwq.pdev->dev,
+                                                        "FP:Got Phantom CQE");
+                                                sq->condition = false;
+                                                sq->single = true;
+                                                rc = 0;
+                                                goto out;
+                                        }
+                                }
+                                /* Valid but not the phantom, so keep looping */
+                        } else {
+                                /* Not valid yet, just exit and wait */
+                                rc = -EINVAL;
+                                goto out;
+                        }
+                        peek_sw_cq_cons++;
+                        peek_raw_cq_cons++;
+                }
+                dev_err(&cq->hwq.pdev->dev,
+                        "Should not have come here! cq_cons=0x%x qp=0x%x sq cons sw=0x%x hw=0x%x",
+                        cq_cons, qp->id, sw_sq_cons, cqe_sq_cons);
+                rc = -EINVAL;
+        }
+out:
+        return rc;
+}
+
 static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
                                      struct cq_req *hwcqe,
-                                     struct bnxt_qplib_cqe **pcqe, int *budget)
+                                     struct bnxt_qplib_cqe **pcqe, int *budget,
+                                     u32 cq_cons, struct bnxt_qplib_qp **lib_qp)
 {
         struct bnxt_qplib_qp *qp;
         struct bnxt_qplib_q *sq;
         struct bnxt_qplib_cqe *cqe;
-        u32 sw_cons, cqe_cons;
+        u32 sw_sq_cons, cqe_sq_cons;
+        struct bnxt_qplib_swq *swq;
         int rc = 0;
 
         qp = (struct bnxt_qplib_qp *)((unsigned long)
@@ -1683,13 +1675,13 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
         }
         sq = &qp->sq;
 
-        cqe_cons = HWQ_CMP(le16_to_cpu(hwcqe->sq_cons_idx), &sq->hwq);
-        if (cqe_cons > sq->hwq.max_elements) {
+        cqe_sq_cons = HWQ_CMP(le16_to_cpu(hwcqe->sq_cons_idx), &sq->hwq);
+        if (cqe_sq_cons > sq->hwq.max_elements) {
                 dev_err(&cq->hwq.pdev->dev,
                         "QPLIB: FP: CQ Process req reported ");
                 dev_err(&cq->hwq.pdev->dev,
                         "QPLIB: sq_cons_idx 0x%x which exceeded max 0x%x",
-                        cqe_cons, sq->hwq.max_elements);
+                        cqe_sq_cons, sq->hwq.max_elements);
                 return -EINVAL;
         }
         /* If we were in the middle of flushing the SQ, continue */
@@ -1698,53 +1690,74 @@ static int bnxt_qplib_cq_process_req(struct bnxt_qplib_cq *cq,
 
         /* Require to walk the sq's swq to fabricate CQEs for all previously
          * signaled SWQEs due to CQE aggregation from the current sq cons
-         * to the cqe_cons
+         * to the cqe_sq_cons
          */
         cqe = *pcqe;
         while (*budget) {
-                sw_cons = HWQ_CMP(sq->hwq.cons, &sq->hwq);
-                if (sw_cons == cqe_cons)
+                sw_sq_cons = HWQ_CMP(sq->hwq.cons, &sq->hwq);
+                if (sw_sq_cons == cqe_sq_cons)
+                        /* Done */
                         break;
+
+                swq = &sq->swq[sw_sq_cons];
                 memset(cqe, 0, sizeof(*cqe));
                 cqe->opcode = CQ_BASE_CQE_TYPE_REQ;
                 cqe->qp_handle = (u64)(unsigned long)qp;
                 cqe->src_qp = qp->id;
-                cqe->wr_id = sq->swq[sw_cons].wr_id;
-                cqe->type = sq->swq[sw_cons].type;
+                cqe->wr_id = swq->wr_id;
+                if (cqe->wr_id == BNXT_QPLIB_FENCE_WRID)
+                        goto skip;
+                cqe->type = swq->type;
 
                 /* For the last CQE, check for status.  For errors, regardless
                  * of the request being signaled or not, it must complete with
                  * the hwcqe error status
                  */
-                if (HWQ_CMP((sw_cons + 1), &sq->hwq) == cqe_cons &&
+                if (HWQ_CMP((sw_sq_cons + 1), &sq->hwq) == cqe_sq_cons &&
                     hwcqe->status != CQ_REQ_STATUS_OK) {
                         cqe->status = hwcqe->status;
                         dev_err(&cq->hwq.pdev->dev,
                                 "QPLIB: FP: CQ Processed Req ");
                         dev_err(&cq->hwq.pdev->dev,
                                 "QPLIB: wr_id[%d] = 0x%llx with status 0x%x",
-                                sw_cons, cqe->wr_id, cqe->status);
+                                sw_sq_cons, cqe->wr_id, cqe->status);
                         cqe++;
                         (*budget)--;
                         sq->flush_in_progress = true;
                         /* Must block new posting of SQ and RQ */
                         qp->state = CMDQ_MODIFY_QP_NEW_STATE_ERR;
+                        sq->condition = false;
+                        sq->single = false;
                 } else {
-                        if (sq->swq[sw_cons].flags &
-                            SQ_SEND_FLAGS_SIGNAL_COMP) {
+                        if (swq->flags & SQ_SEND_FLAGS_SIGNAL_COMP) {
+                                /* Before we complete, do WA 9060 */
+                                if (do_wa9060(qp, cq, cq_cons, sw_sq_cons,
+                                              cqe_sq_cons)) {
+                                        *lib_qp = qp;
+                                        goto out;
+                                }
                                 cqe->status = CQ_REQ_STATUS_OK;
                                 cqe++;
                                 (*budget)--;
                         }
                 }
+skip:
                 sq->hwq.cons++;
+                if (sq->single)
+                        break;
         }
+out:
         *pcqe = cqe;
-        if (!*budget && HWQ_CMP(sq->hwq.cons, &sq->hwq) != cqe_cons) {
+        if (HWQ_CMP(sq->hwq.cons, &sq->hwq) != cqe_sq_cons) {
                 /* Out of budget */
                 rc = -EAGAIN;
                 goto done;
         }
+        /*
+         * Back to normal completion mode only after it has completed all of
+         * the WC for this CQE
+         */
+        sq->single = false;
         if (!sq->flush_in_progress)
                 goto done;
 flush:
@@ -2074,7 +2087,7 @@ static int bnxt_qplib_cq_process_cutoff(struct bnxt_qplib_cq *cq,
 }
 
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
-                       int num_cqes)
+                       int num_cqes, struct bnxt_qplib_qp **lib_qp)
 {
         struct cq_base *hw_cqe, **hw_cqe_ptr;
         unsigned long flags;
@@ -2099,7 +2112,8 @@ int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                 case CQ_BASE_CQE_TYPE_REQ:
                         rc = bnxt_qplib_cq_process_req(cq,
                                                        (struct cq_req *)hw_cqe,
-                                                       &cqe, &budget);
+                                                       &cqe, &budget,
+                                                       sw_cons, lib_qp);
                         break;
                 case CQ_BASE_CQE_TYPE_RES_RC:
                         rc = bnxt_qplib_cq_process_res_rc(cq,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index f0150f8da1e3..36b7b7db0e3f 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -88,6 +88,7 @@ struct bnxt_qplib_swq {
 
 struct bnxt_qplib_swqe {
         /* General */
+#define BNXT_QPLIB_FENCE_WRID   0x46454E43      /* "FENC" */
         u64                             wr_id;
         u8                              reqs_type;
         u8                              type;
@@ -216,9 +217,16 @@ struct bnxt_qplib_q {
         struct scatterlist              *sglist;
         u32                             nmap;
         u32                             max_wqe;
+        u16                             q_full_delta;
         u16                             max_sge;
         u32                             psn;
         bool                            flush_in_progress;
+        bool                            condition;
+        bool                            single;
+        bool                            send_phantom;
+        u32                             phantom_wqe_cnt;
+        u32                             phantom_cqe_cnt;
+        u32                             next_cq_cons;
 };
 
 struct bnxt_qplib_qp {
@@ -242,6 +250,7 @@ struct bnxt_qplib_qp {
         u8                              timeout;
         u8                              retry_cnt;
         u8                              rnr_retry;
+        u64                             wqe_cnt;
         u32                             min_rnr_timer;
         u32                             max_rd_atomic;
         u32                             max_dest_rd_atomic;
@@ -301,6 +310,13 @@ struct bnxt_qplib_qp {
         (!!((hdr)->cqe_type_toggle & CQ_BASE_TOGGLE) ==         \
            !((raw_cons) & (cp_bit)))
 
+static inline bool bnxt_qplib_queue_full(struct bnxt_qplib_q *qplib_q)
+{
+        return HWQ_CMP((qplib_q->hwq.prod + qplib_q->q_full_delta),
+                       &qplib_q->hwq) == HWQ_CMP(qplib_q->hwq.cons,
+                                                 &qplib_q->hwq);
+}
+
 struct bnxt_qplib_cqe {
         u8                              status;
         u8                              type;
@@ -432,7 +448,7 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
 int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
-                       int num);
+                       int num, struct bnxt_qplib_qp **qp);
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type);
 void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
 int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
index 23fb7260662b..16e42754dbec 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -39,72 +39,55 @@
 #include <linux/spinlock.h>
 #include <linux/pci.h>
 #include <linux/prefetch.h>
+#include <linux/delay.h>
+
 #include "roce_hsi.h"
 #include "qplib_res.h"
 #include "qplib_rcfw.h"
 static void bnxt_qplib_service_creq(unsigned long data);
 
 /* Hardware communication channel */
-int bnxt_qplib_rcfw_wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
+static int __wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
 {
         u16 cbit;
         int rc;
 
-        cookie &= RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
-        if (!test_bit(cbit, rcfw->cmdq_bitmap))
-                dev_warn(&rcfw->pdev->dev,
-                         "QPLIB: CMD bit %d for cookie 0x%x is not set?",
-                         cbit, cookie);
-
         rc = wait_event_timeout(rcfw->waitq,
                                 !test_bit(cbit, rcfw->cmdq_bitmap),
                                 msecs_to_jiffies(RCFW_CMD_WAIT_TIME_MS));
-        if (!rc) {
-                dev_warn(&rcfw->pdev->dev,
-                         "QPLIB: Bono Error: timeout %d msec, msg {0x%x}\n",
-                         RCFW_CMD_WAIT_TIME_MS, cookie);
-        }
-
-        return rc;
+        return rc ? 0 : -ETIMEDOUT;
 };
 
-int bnxt_qplib_rcfw_block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
+static int __block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie)
 {
-        u32 count = -1;
+        u32 count = RCFW_BLOCKED_CMD_WAIT_COUNT;
         u16 cbit;
 
-        cookie &= RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
         if (!test_bit(cbit, rcfw->cmdq_bitmap))
                 goto done;
         do {
+                mdelay(1); /* 1m sec */
                 bnxt_qplib_service_creq((unsigned long)rcfw);
         } while (test_bit(cbit, rcfw->cmdq_bitmap) && --count);
 done:
-        return count;
+        return count ? 0 : -ETIMEDOUT;
 };
 
-void *bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
-                                   struct cmdq_base *req, void **crsbe,
-                                   u8 is_block)
+static int __send_message(struct bnxt_qplib_rcfw *rcfw, struct cmdq_base *req,
+                          struct creq_base *resp, void *sb, u8 is_block)
 {
-        struct bnxt_qplib_crsq *crsq = &rcfw->crsq;
         struct bnxt_qplib_cmdqe *cmdqe, **cmdq_ptr;
         struct bnxt_qplib_hwq *cmdq = &rcfw->cmdq;
-        struct bnxt_qplib_hwq *crsb = &rcfw->crsb;
-        struct bnxt_qplib_crsqe *crsqe = NULL;
-        struct bnxt_qplib_crsbe **crsb_ptr;
+        struct bnxt_qplib_crsq *crsqe;
         u32 sw_prod, cmdq_prod;
-        u8 retry_cnt = 0xFF;
-        dma_addr_t dma_addr;
         unsigned long flags;
         u32 size, opcode;
         u16 cookie, cbit;
         int pg, idx;
         u8 *preq;
 
-retry:
         opcode = req->opcode;
         if (!test_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags) &&
             (opcode != CMDQ_BASE_OPCODE_QUERY_FUNC &&
@@ -112,63 +95,50 @@ retry:
                 dev_err(&rcfw->pdev->dev,
                         "QPLIB: RCFW not initialized, reject opcode 0x%x",
                         opcode);
-                return NULL;
+                return -EINVAL;
         }
 
         if (test_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags) &&
             opcode == CMDQ_BASE_OPCODE_INITIALIZE_FW) {
                 dev_err(&rcfw->pdev->dev, "QPLIB: RCFW already initialized!");
-                return NULL;
+                return -EINVAL;
         }
 
         /* Cmdq are in 16-byte units, each request can consume 1 or more
          * cmdqe
          */
         spin_lock_irqsave(&cmdq->lock, flags);
-        if (req->cmd_size > cmdq->max_elements -
-            ((HWQ_CMP(cmdq->prod, cmdq) - HWQ_CMP(cmdq->cons, cmdq)) &
-             (cmdq->max_elements - 1))) {
+        if (req->cmd_size >= HWQ_FREE_SLOTS(cmdq)) {
                 dev_err(&rcfw->pdev->dev, "QPLIB: RCFW: CMDQ is full!");
                 spin_unlock_irqrestore(&cmdq->lock, flags);
-
-                if (!retry_cnt--)
-                        return NULL;
-                goto retry;
+                return -EAGAIN;
         }
 
-        retry_cnt = 0xFF;
 
-        cookie = atomic_inc_return(&rcfw->seq_num) & RCFW_MAX_COOKIE_VALUE;
+        cookie = rcfw->seq_num & RCFW_MAX_COOKIE_VALUE;
         cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
         if (is_block)
                 cookie |= RCFW_CMD_IS_BLOCKING;
+
+        set_bit(cbit, rcfw->cmdq_bitmap);
         req->cookie = cpu_to_le16(cookie);
-        if (test_and_set_bit(cbit, rcfw->cmdq_bitmap)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW MAX outstanding cmd reached!");
-                atomic_dec(&rcfw->seq_num);
+        crsqe = &rcfw->crsqe_tbl[cbit];
+        if (crsqe->resp) {
                 spin_unlock_irqrestore(&cmdq->lock, flags);
-
-                if (!retry_cnt--)
-                        return NULL;
-                goto retry;
+                return -EBUSY;
         }
-        /* Reserve a resp buffer slot if requested */
-        if (req->resp_size && crsbe) {
-                spin_lock(&crsb->lock);
-                sw_prod = HWQ_CMP(crsb->prod, crsb);
-                crsb_ptr = (struct bnxt_qplib_crsbe **)crsb->pbl_ptr;
-                *crsbe = (void *)&crsb_ptr[get_crsb_pg(sw_prod)]
-                                          [get_crsb_idx(sw_prod)];
-                bnxt_qplib_crsb_dma_next(crsb->pbl_dma_ptr, sw_prod, &dma_addr);
-                req->resp_addr = cpu_to_le64(dma_addr);
-                crsb->prod++;
-                spin_unlock(&crsb->lock);
-
-                req->resp_size = (sizeof(struct bnxt_qplib_crsbe) +
-                                  BNXT_QPLIB_CMDQE_UNITS - 1) /
-                                 BNXT_QPLIB_CMDQE_UNITS;
+        memset(resp, 0, sizeof(*resp));
+        crsqe->resp = (struct creq_qp_event *)resp;
+        crsqe->resp->cookie = req->cookie;
+        crsqe->req_size = req->cmd_size;
+        if (req->resp_size && sb) {
+                struct bnxt_qplib_rcfw_sbuf *sbuf = sb;
+
+                req->resp_addr = cpu_to_le64(sbuf->dma_addr);
+                req->resp_size = (sbuf->size + BNXT_QPLIB_CMDQE_UNITS - 1) /
+                                  BNXT_QPLIB_CMDQE_UNITS;
         }
+
         cmdq_ptr = (struct bnxt_qplib_cmdqe **)cmdq->pbl_ptr;
         preq = (u8 *)req;
         size = req->cmd_size * BNXT_QPLIB_CMDQE_UNITS;
@@ -190,23 +160,24 @@ retry:
                 preq += min_t(u32, size, sizeof(*cmdqe));
                 size -= min_t(u32, size, sizeof(*cmdqe));
                 cmdq->prod++;
+                rcfw->seq_num++;
         } while (size > 0);
 
+        rcfw->seq_num++;
+
         cmdq_prod = cmdq->prod;
         if (rcfw->flags & FIRMWARE_FIRST_FLAG) {
-                /* The very first doorbell write is required to set this flag
-                 * which prompts the FW to reset its internal pointers
+                /* The very first doorbell write
+                 * is required to set this flag
+                 * which prompts the FW to reset
+                 * its internal pointers
                  */
                 cmdq_prod |= FIRMWARE_FIRST_FLAG;
                 rcfw->flags &= ~FIRMWARE_FIRST_FLAG;
         }
-        sw_prod = HWQ_CMP(crsq->prod, crsq);
-        crsqe = &crsq->crsq[sw_prod];
-        memset(crsqe, 0, sizeof(*crsqe));
-        crsq->prod++;
-        crsqe->req_size = req->cmd_size;
 
         /* ring CMDQ DB */
+        wmb();
         writel(cmdq_prod, rcfw->cmdq_bar_reg_iomem +
                rcfw->cmdq_bar_reg_prod_off);
         writel(RCFW_CMDQ_TRIG_VAL, rcfw->cmdq_bar_reg_iomem +
@@ -214,9 +185,56 @@ retry:
 done:
         spin_unlock_irqrestore(&cmdq->lock, flags);
         /* Return the CREQ response pointer */
-        return crsqe ? &crsqe->qp_event : NULL;
+        return 0;
 }
 
+int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
+                                 struct cmdq_base *req,
+                                 struct creq_base *resp,
+                                 void *sb, u8 is_block)
+{
+        struct creq_qp_event *evnt = (struct creq_qp_event *)resp;
+        u16 cookie;
+        u8 opcode, retry_cnt = 0xFF;
+        int rc = 0;
+
+        do {
+                opcode = req->opcode;
+                rc = __send_message(rcfw, req, resp, sb, is_block);
+                cookie = le16_to_cpu(req->cookie) & RCFW_MAX_COOKIE_VALUE;
+                if (!rc)
+                        break;
+
+                if (!retry_cnt || (rc != -EAGAIN && rc != -EBUSY)) {
+                        /* send failed */
+                        dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x send failed",
+                                cookie, opcode);
+                        return rc;
+                }
+                is_block ? mdelay(1) : usleep_range(500, 1000);
+
+        } while (retry_cnt--);
+
+        if (is_block)
+                rc = __block_for_resp(rcfw, cookie);
+        else
+                rc = __wait_for_resp(rcfw, cookie);
+        if (rc) {
+                /* timed out */
+                dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x timedout (%d)msec",
+                        cookie, opcode, RCFW_CMD_WAIT_TIME_MS);
+                return rc;
+        }
+
+        if (evnt->status) {
+                /* failed with status */
+                dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x status %#x",
+                        cookie, opcode, evnt->status);
+                rc = -EFAULT;
+        }
+
+        return rc;
+}
 /* Completions */
 static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
                                          struct creq_func_event *func_event)
@@ -260,12 +278,12 @@ static int bnxt_qplib_process_func_event(struct bnxt_qplib_rcfw *rcfw,
 static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
                                        struct creq_qp_event *qp_event)
 {
-        struct bnxt_qplib_crsq *crsq = &rcfw->crsq;
         struct bnxt_qplib_hwq *cmdq = &rcfw->cmdq;
-        struct bnxt_qplib_crsqe *crsqe;
-        u16 cbit, cookie, blocked = 0;
+        struct bnxt_qplib_crsq *crsqe;
         unsigned long flags;
-        u32 sw_cons;
+        u16 cbit, blocked = 0;
+        u16 cookie;
+        __le16  mcookie;
 
         switch (qp_event->event) {
         case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION:
@@ -275,24 +293,31 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
         default:
                 /* Command Response */
                 spin_lock_irqsave(&cmdq->lock, flags);
-                sw_cons = HWQ_CMP(crsq->cons, crsq);
-                crsqe = &crsq->crsq[sw_cons];
-                crsq->cons++;
-                memcpy(&crsqe->qp_event, qp_event, sizeof(crsqe->qp_event));
-
-                cookie = le16_to_cpu(crsqe->qp_event.cookie);
+                cookie = le16_to_cpu(qp_event->cookie);
+                mcookie = qp_event->cookie;
                 blocked = cookie & RCFW_CMD_IS_BLOCKING;
                 cookie &= RCFW_MAX_COOKIE_VALUE;
                 cbit = cookie % RCFW_MAX_OUTSTANDING_CMD;
+                crsqe = &rcfw->crsqe_tbl[cbit];
+                if (crsqe->resp &&
+                    crsqe->resp->cookie  == mcookie) {
+                        memcpy(crsqe->resp, qp_event, sizeof(*qp_event));
+                        crsqe->resp = NULL;
+                } else {
+                        dev_err(&rcfw->pdev->dev,
+                                "QPLIB: CMD %s resp->cookie = %#x, evnt->cookie = %#x",
+                                crsqe->resp ? "mismatch" : "collision",
+                                crsqe->resp ? crsqe->resp->cookie : 0, mcookie);
+                }
                 if (!test_and_clear_bit(cbit, rcfw->cmdq_bitmap))
                         dev_warn(&rcfw->pdev->dev,
                                  "QPLIB: CMD bit %d was not requested", cbit);
-
                 cmdq->cons += crsqe->req_size;
-                spin_unlock_irqrestore(&cmdq->lock, flags);
+                crsqe->req_size = 0;
+
                 if (!blocked)
                         wake_up(&rcfw->waitq);
-                break;
+                spin_unlock_irqrestore(&cmdq->lock, flags);
         }
         return 0;
 }
@@ -305,12 +330,12 @@ static void bnxt_qplib_service_creq(unsigned long data)
         struct creq_base *creqe, **creq_ptr;
         u32 sw_cons, raw_cons;
         unsigned long flags;
-        u32 type;
+        u32 type, budget = CREQ_ENTRY_POLL_BUDGET;
 
-        /* Service the CREQ until empty */
+        /* Service the CREQ until budget is over */
         spin_lock_irqsave(&creq->lock, flags);
         raw_cons = creq->cons;
-        while (1) {
+        while (budget > 0) {
                 sw_cons = HWQ_CMP(raw_cons, creq);
                 creq_ptr = (struct creq_base **)creq->pbl_ptr;
                 creqe = &creq_ptr[get_creq_pg(sw_cons)][get_creq_idx(sw_cons)];
@@ -320,15 +345,9 @@ static void bnxt_qplib_service_creq(unsigned long data)
                 type = creqe->type & CREQ_BASE_TYPE_MASK;
                 switch (type) {
                 case CREQ_BASE_TYPE_QP_EVENT:
-                        if (!bnxt_qplib_process_qp_event
-                            (rcfw, (struct creq_qp_event *)creqe))
-                                rcfw->creq_qp_event_processed++;
-                        else {
-                                dev_warn(&rcfw->pdev->dev, "QPLIB: crsqe with");
-                                dev_warn(&rcfw->pdev->dev,
-                                         "QPLIB: type = 0x%x not handled",
-                                         type);
-                        }
+                        bnxt_qplib_process_qp_event
+                                (rcfw, (struct creq_qp_event *)creqe);
+                        rcfw->creq_qp_event_processed++;
                         break;
                 case CREQ_BASE_TYPE_FUNC_EVENT:
                         if (!bnxt_qplib_process_func_event
@@ -346,7 +365,9 @@ static void bnxt_qplib_service_creq(unsigned long data)
                         break;
                 }
                 raw_cons++;
+                budget--;
         }
+
         if (creq->cons != raw_cons) {
                 creq->cons = raw_cons;
                 CREQ_DB_REARM(rcfw->creq_bar_reg_iomem, raw_cons,
@@ -375,23 +396,16 @@ static irqreturn_t bnxt_qplib_creq_irq(int irq, void *dev_instance)
 /* RCFW */
 int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw)
 {
-        struct creq_deinitialize_fw_resp *resp;
         struct cmdq_deinitialize_fw req;
+        struct creq_deinitialize_fw_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         RCFW_CMD_PREP(req, DEINITIALIZE_FW, cmd_flags);
-        resp = (struct creq_deinitialize_fw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp)
-                return -EINVAL;
-
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie)))
-                return -ETIMEDOUT;
-
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie))
-                return -EFAULT;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
 
         clear_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags);
         return 0;
@@ -417,9 +431,10 @@ static int __get_pbl_pg_idx(struct bnxt_qplib_pbl *pbl)
 int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
                          struct bnxt_qplib_ctx *ctx, int is_virtfn)
 {
-        struct creq_initialize_fw_resp *resp;
         struct cmdq_initialize_fw req;
+        struct creq_initialize_fw_resp resp;
         u16 cmd_flags = 0, level;
+        int rc;
 
         RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags);
 
@@ -482,37 +497,19 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
 
 skip_ctx_setup:
         req.stat_ctx_id = cpu_to_le32(ctx->stats.fw_id);
-        resp = (struct creq_initialize_fw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: RCFW: INITIALIZE_FW failed");
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
         set_bit(FIRMWARE_INITIALIZED_FLAG, &rcfw->flags);
         return 0;
 }
 
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw)
 {
-        bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->crsb);
-        kfree(rcfw->crsq.crsq);
+        kfree(rcfw->crsqe_tbl);
         bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->cmdq);
         bnxt_qplib_free_hwq(rcfw->pdev, &rcfw->creq);
-
         rcfw->pdev = NULL;
 }
 
@@ -539,21 +536,11 @@ int bnxt_qplib_alloc_rcfw_channel(struct pci_dev *pdev,
                 goto fail;
         }
 
-        rcfw->crsq.max_elements = rcfw->cmdq.max_elements;
-        rcfw->crsq.crsq = kcalloc(rcfw->crsq.max_elements,
-                                  sizeof(*rcfw->crsq.crsq), GFP_KERNEL);
-        if (!rcfw->crsq.crsq)
+        rcfw->crsqe_tbl = kcalloc(rcfw->cmdq.max_elements,
+                                  sizeof(*rcfw->crsqe_tbl), GFP_KERNEL);
+        if (!rcfw->crsqe_tbl)
                 goto fail;
 
-        rcfw->crsb.max_elements = BNXT_QPLIB_CRSBE_MAX_CNT;
-        if (bnxt_qplib_alloc_init_hwq(rcfw->pdev, &rcfw->crsb, NULL, 0,
-                                      &rcfw->crsb.max_elements,
-                                      BNXT_QPLIB_CRSBE_UNITS, 0, PAGE_SIZE,
-                                      HWQ_TYPE_CTX)) {
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: HW channel CRSB allocation failed");
-                goto fail;
-        }
         return 0;
 
 fail:
@@ -606,7 +593,7 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
         int rc;
 
         /* General */
-        atomic_set(&rcfw->seq_num, 0);
+        rcfw->seq_num = 0;
         rcfw->flags = FIRMWARE_FIRST_FLAG;
         bmap_size = BITS_TO_LONGS(RCFW_MAX_OUTSTANDING_CMD *
                                   sizeof(unsigned long));
@@ -636,10 +623,6 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
 
         rcfw->cmdq_bar_reg_trig_off = RCFW_COMM_TRIG_OFFSET;
 
-        /* CRSQ */
-        rcfw->crsq.prod = 0;
-        rcfw->crsq.cons = 0;
-
         /* CREQ */
         rcfw->creq_bar_reg = RCFW_COMM_CONS_PCI_BAR_REGION;
         res_base = pci_resource_start(pdev, rcfw->creq_bar_reg);
@@ -692,3 +675,34 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
         __iowrite32_copy(rcfw->cmdq_bar_reg_iomem, &init, sizeof(init) / 4);
         return 0;
 }
+
+struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
+                struct bnxt_qplib_rcfw *rcfw,
+                u32 size)
+{
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
+
+        sbuf = kzalloc(sizeof(*sbuf), GFP_ATOMIC);
+        if (!sbuf)
+                return NULL;
+
+        sbuf->size = size;
+        sbuf->sb = dma_zalloc_coherent(&rcfw->pdev->dev, sbuf->size,
+                                       &sbuf->dma_addr, GFP_ATOMIC);
+        if (!sbuf->sb)
+                goto bail;
+
+        return sbuf;
+bail:
+        kfree(sbuf);
+        return NULL;
+}
+
+void bnxt_qplib_rcfw_free_sbuf(struct bnxt_qplib_rcfw *rcfw,
+                               struct bnxt_qplib_rcfw_sbuf *sbuf)
+{
+        if (sbuf->sb)
+                dma_free_coherent(&rcfw->pdev->dev, sbuf->size,
+                                  sbuf->sb, sbuf->dma_addr);
+        kfree(sbuf);
+}
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
index d3567d75bf58..09ce121770cd 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
@@ -73,6 +73,7 @@
 #define RCFW_MAX_OUTSTANDING_CMD        BNXT_QPLIB_CMDQE_MAX_CNT
 #define RCFW_MAX_COOKIE_VALUE           0x7FFF
 #define RCFW_CMD_IS_BLOCKING            0x8000
+#define RCFW_BLOCKED_CMD_WAIT_COUNT     0x4E20
 
 /* Cmdq contains a fix number of a 16-Byte slots */
 struct bnxt_qplib_cmdqe {
@@ -94,32 +95,6 @@ struct bnxt_qplib_crsbe {
         u8                      data[1024];
 };
 
-/* CRSQ SB */
-#define BNXT_QPLIB_CRSBE_MAX_CNT        4
-#define BNXT_QPLIB_CRSBE_UNITS          sizeof(struct bnxt_qplib_crsbe)
-#define BNXT_QPLIB_CRSBE_CNT_PER_PG     (PAGE_SIZE / BNXT_QPLIB_CRSBE_UNITS)
-
-#define MAX_CRSB_IDX                    (BNXT_QPLIB_CRSBE_MAX_CNT - 1)
-#define MAX_CRSB_IDX_PER_PG             (BNXT_QPLIB_CRSBE_CNT_PER_PG - 1)
-
-static inline u32 get_crsb_pg(u32 val)
-{
-        return (val & ~MAX_CRSB_IDX_PER_PG) / BNXT_QPLIB_CRSBE_CNT_PER_PG;
-}
-
-static inline u32 get_crsb_idx(u32 val)
-{
-        return val & MAX_CRSB_IDX_PER_PG;
-}
-
-static inline void bnxt_qplib_crsb_dma_next(dma_addr_t *pg_map_arr,
-                                            u32 prod, dma_addr_t *dma_addr)
-{
-                *dma_addr = pg_map_arr[(prod) / BNXT_QPLIB_CRSBE_CNT_PER_PG];
-                *dma_addr += ((prod) % BNXT_QPLIB_CRSBE_CNT_PER_PG) *
-                              BNXT_QPLIB_CRSBE_UNITS;
-}
-
 /* CREQ */
 /* Allocate 1 per QP for async error notification for now */
 #define BNXT_QPLIB_CREQE_MAX_CNT        (64 * 1024)
@@ -158,17 +133,19 @@ static inline u32 get_creq_idx(u32 val)
 #define CREQ_DB(db, raw_cons, cp_bit)                           \
         writel(CREQ_DB_CP_FLAGS | ((raw_cons) & ((cp_bit) - 1)), db)
 
+#define CREQ_ENTRY_POLL_BUDGET          0x100
+
 /* HWQ */
-struct bnxt_qplib_crsqe {
-        struct creq_qp_event    qp_event;
+
+struct bnxt_qplib_crsq {
+        struct creq_qp_event    *resp;
         u32                     req_size;
 };
 
-struct bnxt_qplib_crsq {
-        struct bnxt_qplib_crsqe *crsq;
-        u32                     prod;
-        u32                     cons;
-        u32                     max_elements;
+struct bnxt_qplib_rcfw_sbuf {
+        void *sb;
+        dma_addr_t dma_addr;
+        u32 size;
 };
 
 /* RCFW Communication Channels */
@@ -185,7 +162,7 @@ struct bnxt_qplib_rcfw {
         wait_queue_head_t       waitq;
         int                     (*aeq_handler)(struct bnxt_qplib_rcfw *,
                                                struct creq_func_event *);
-        atomic_t                seq_num;
+        u32                     seq_num;
 
         /* Bar region info */
         void __iomem            *cmdq_bar_reg_iomem;
@@ -203,8 +180,7 @@ struct bnxt_qplib_rcfw {
 
         /* Actual Cmd and Resp Queues */
         struct bnxt_qplib_hwq   cmdq;
-        struct bnxt_qplib_crsq  crsq;
-        struct bnxt_qplib_hwq   crsb;
+        struct bnxt_qplib_crsq  *crsqe_tbl;
 };
 
 void bnxt_qplib_free_rcfw_channel(struct bnxt_qplib_rcfw *rcfw);
@@ -219,11 +195,14 @@ int bnxt_qplib_enable_rcfw_channel(struct pci_dev *pdev,
                                         (struct bnxt_qplib_rcfw *,
                                          struct creq_func_event *));
 
-int bnxt_qplib_rcfw_block_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie);
-int bnxt_qplib_rcfw_wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie);
-void *bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
-                                   struct cmdq_base *req, void **crsbe,
-                                   u8 is_block);
+struct bnxt_qplib_rcfw_sbuf *bnxt_qplib_rcfw_alloc_sbuf(
+                                struct bnxt_qplib_rcfw *rcfw,
+                                u32 size);
+void bnxt_qplib_rcfw_free_sbuf(struct bnxt_qplib_rcfw *rcfw,
+                               struct bnxt_qplib_rcfw_sbuf *sbuf);
+int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
+                                 struct cmdq_base *req, struct creq_base *resp,
+                                 void *sbuf, u8 is_block);
 
 int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);
 int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h
index 6277d802ca4b..2e4855509719 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h
@@ -48,6 +48,10 @@ extern const struct bnxt_qplib_gid bnxt_qplib_gid_zero;
 
 #define HWQ_CMP(idx, hwq)       ((idx) & ((hwq)->max_elements - 1))
 
+#define HWQ_FREE_SLOTS(hwq)     (hwq->max_elements - \
+                                ((HWQ_CMP(hwq->prod, hwq)\
+                                - HWQ_CMP(hwq->cons, hwq))\
+                                & (hwq->max_elements - 1)))
 enum bnxt_qplib_hwq_type {
         HWQ_TYPE_CTX,
         HWQ_TYPE_QUEUE,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index 7b31eccedf11..fde18cf0e406 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -55,37 +55,30 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                             struct bnxt_qplib_dev_attr *attr)
 {
         struct cmdq_query_func req;
-        struct creq_query_func_resp *resp;
+        struct creq_query_func_resp resp;
+        struct bnxt_qplib_rcfw_sbuf *sbuf;
         struct creq_query_func_resp_sb *sb;
         u16 cmd_flags = 0;
         u32 temp;
         u8 *tqm_alloc;
-        int i;
+        int i, rc = 0;
 
         RCFW_CMD_PREP(req, QUERY_FUNC, cmd_flags);
 
-        req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
-        resp = (struct creq_query_func_resp *)
-                bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void **)&sb,
-                                             0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: QUERY_FUNC failed ");
+        sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
+        if (!sbuf) {
                 dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
+                        "QPLIB: SP: QUERY_FUNC alloc side buffer failed");
+                return -ENOMEM;
         }
+
+        sb = sbuf->sb;
+        req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          (void *)sbuf, 0);
+        if (rc)
+                goto bail;
+
         /* Extract the context from the side buffer */
         attr->max_qp = le32_to_cpu(sb->max_qp);
         attr->max_qp_rd_atom =
@@ -95,6 +88,11 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 sb->max_qp_init_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ?
                 BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_init_rd_atom;
         attr->max_qp_wqes = le16_to_cpu(sb->max_qp_wr);
+        /*
+         * 128 WQEs needs to be reserved for the HW (8916). Prevent
+         * reporting the max number
+         */
+        attr->max_qp_wqes -= BNXT_QPLIB_RESERVED_QP_WRS;
         attr->max_qp_sges = sb->max_sge;
         attr->max_cq = le32_to_cpu(sb->max_cq);
         attr->max_cq_wqes = le32_to_cpu(sb->max_cqe);
@@ -130,7 +128,10 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                 attr->tqm_alloc_reqs[i * 4 + 2] = *(++tqm_alloc);
                 attr->tqm_alloc_reqs[i * 4 + 3] = *(++tqm_alloc);
         }
-        return 0;
+
+bail:
+        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
+        return rc;
 }
 
 /* SGID */
@@ -178,8 +179,9 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         /* Remove GID from the SGID table */
         if (update) {
                 struct cmdq_delete_gid req;
-                struct creq_delete_gid_resp *resp;
+                struct creq_delete_gid_resp resp;
                 u16 cmd_flags = 0;
+                int rc;
 
                 RCFW_CMD_PREP(req, DELETE_GID, cmd_flags);
                 if (sgid_tbl->hw_id[index] == 0xFFFF) {
@@ -188,31 +190,10 @@ int bnxt_qplib_del_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                         return -EINVAL;
                 }
                 req.gid_index = cpu_to_le16(sgid_tbl->hw_id[index]);
-                resp = (struct creq_delete_gid_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, NULL,
-                                                     0);
-                if (!resp) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID send failed");
-                        return -EINVAL;
-                }
-                if (!bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie))) {
-                        /* Cmd timed out */
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID timed out");
-                        return -ETIMEDOUT;
-                }
-                if (resp->status ||
-                    le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: DELETE_GID failed ");
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                                resp->status, le16_to_cpu(req.cookie),
-                                le16_to_cpu(resp->cookie));
-                        return -EINVAL;
-                }
+                rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                                  (void *)&resp, NULL, 0);
+                if (rc)
+                        return rc;
         }
         memcpy(&sgid_tbl->tbl[index], &bnxt_qplib_gid_zero,
                sizeof(bnxt_qplib_gid_zero));
@@ -234,7 +215,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                                                    struct bnxt_qplib_res,
                                                    sgid_tbl);
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
-        int i, free_idx, rc = 0;
+        int i, free_idx;
 
         if (!sgid_tbl) {
                 dev_err(&res->pdev->dev, "QPLIB: SGID table not allocated");
@@ -266,10 +247,11 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
         }
         if (update) {
                 struct cmdq_add_gid req;
-                struct creq_add_gid_resp *resp;
+                struct creq_add_gid_resp resp;
                 u16 cmd_flags = 0;
                 u32 temp32[4];
                 u16 temp16[3];
+                int rc;
 
                 RCFW_CMD_PREP(req, ADD_GID, cmd_flags);
 
@@ -290,31 +272,11 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
                 req.src_mac[1] = cpu_to_be16(temp16[1]);
                 req.src_mac[2] = cpu_to_be16(temp16[2]);
 
-                resp = (struct creq_add_gid_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-                if (!resp) {
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: SP: ADD_GID send failed");
-                        return -EINVAL;
-                }
-                if (!bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie))) {
-                        /* Cmd timed out */
-                        dev_err(&res->pdev->dev,
-                                "QPIB: SP: ADD_GID timed out");
-                        return -ETIMEDOUT;
-                }
-                if (resp->status ||
-                    le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                        dev_err(&res->pdev->dev, "QPLIB: SP: ADD_GID failed ");
-                        dev_err(&res->pdev->dev,
-                                "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                                resp->status, le16_to_cpu(req.cookie),
-                                le16_to_cpu(resp->cookie));
-                        return -EINVAL;
-                }
-                sgid_tbl->hw_id[free_idx] = le32_to_cpu(resp->xid);
+                rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                                  (void *)&resp, NULL, 0);
+                if (rc)
+                        return rc;
+                sgid_tbl->hw_id[free_idx] = le32_to_cpu(resp.xid);
         }
         /* Add GID to the sgid_tbl */
         memcpy(&sgid_tbl->tbl[free_idx], gid, sizeof(*gid));
@@ -325,7 +287,7 @@ int bnxt_qplib_add_sgid(struct bnxt_qplib_sgid_tbl *sgid_tbl,
 
         *index = free_idx;
         /* unlock */
-        return rc;
+        return 0;
 }
 
 /* pkeys */
@@ -422,10 +384,11 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_create_ah req;
-        struct creq_create_ah_resp *resp;
+        struct creq_create_ah_resp resp;
         u16 cmd_flags = 0;
         u32 temp32[4];
         u16 temp16[3];
+        int rc;
 
         RCFW_CMD_PREP(req, CREATE_AH, cmd_flags);
 
@@ -450,28 +413,12 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
         req.dest_mac[1] = cpu_to_le16(temp16[1]);
         req.dest_mac[2] = cpu_to_le16(temp16[2]);
 
-        resp = (struct creq_create_ah_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 1);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: CREATE_AH failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
-        ah->id = le32_to_cpu(resp->xid);
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 1);
+        if (rc)
+                return rc;
+
+        ah->id = le32_to_cpu(resp.xid);
         return 0;
 }
 
@@ -479,35 +426,19 @@ int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_destroy_ah req;
-        struct creq_destroy_ah_resp *resp;
+        struct creq_destroy_ah_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         /* Clean up the AH table in the device */
         RCFW_CMD_PREP(req, DESTROY_AH, cmd_flags);
 
         req.ah_cid = cpu_to_le32(ah->id);
 
-        resp = (struct creq_destroy_ah_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 1);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DESTROY_AH failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 1);
+        if (rc)
+                return rc;
         return 0;
 }
 
@@ -516,8 +447,9 @@ int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_deallocate_key req;
-        struct creq_deallocate_key_resp *resp;
+        struct creq_deallocate_key_resp resp;
         u16 cmd_flags = 0;
+        int rc;
 
         if (mrw->lkey == 0xFFFFFFFF) {
                 dev_info(&res->pdev->dev,
@@ -536,27 +468,11 @@ int bnxt_qplib_free_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
         else
                 req.key = cpu_to_le32(mrw->lkey);
 
-        resp = (struct creq_deallocate_key_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: FREE_MR failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
+                                          NULL, 0);
+        if (rc)
+                return rc;
+
         /* Free the qplib's MRW memory */
         if (mrw->hwq.max_elements)
                 bnxt_qplib_free_hwq(res->pdev, &mrw->hwq);
@@ -568,9 +484,10 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_allocate_mrw req;
-        struct creq_allocate_mrw_resp *resp;
+        struct creq_allocate_mrw_resp resp;
         u16 cmd_flags = 0;
         unsigned long tmp;
+        int rc;
 
         RCFW_CMD_PREP(req, ALLOCATE_MRW, cmd_flags);
 
@@ -584,33 +501,17 @@ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw)
         tmp = (unsigned long)mrw;
         req.mrw_handle = cpu_to_le64(tmp);
 
-        resp = (struct creq_allocate_mrw_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, 0);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW send failed");
-                return -EINVAL;
-        }
-        if (!bnxt_qplib_rcfw_wait_for_resp(rcfw, le16_to_cpu(req.cookie))) {
-                /* Cmd timed out */
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: ALLOC_MRW failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
+        if (rc)
+                return rc;
+
         if ((mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE1)  ||
             (mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2A) ||
             (mrw->type == CMDQ_ALLOCATE_MRW_MRW_FLAGS_MW_TYPE2B))
-                mrw->rkey = le32_to_cpu(resp->xid);
+                mrw->rkey = le32_to_cpu(resp.xid);
         else
-                mrw->lkey = le32_to_cpu(resp->xid);
+                mrw->lkey = le32_to_cpu(resp.xid);
         return 0;
 }
 
@@ -619,40 +520,17 @@ int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_deregister_mr req;
-        struct creq_deregister_mr_resp *resp;
+        struct creq_deregister_mr_resp resp;
         u16 cmd_flags = 0;
         int rc;
 
         RCFW_CMD_PREP(req, DEREGISTER_MR, cmd_flags);
 
         req.lkey = cpu_to_le32(mrw->lkey);
-        resp = (struct creq_deregister_mr_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, block);
-        if (!resp) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DEREG_MR send failed");
-                return -EINVAL;
-        }
-        if (block)
-                rc = bnxt_qplib_rcfw_block_for_resp(rcfw,
-                                                    le16_to_cpu(req.cookie));
-        else
-                rc = bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie));
-        if (!rc) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "QPLIB: SP: DEREG_MR timed out");
-                return -ETIMEDOUT;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&rcfw->pdev->dev, "QPLIB: SP: DEREG_MR failed ");
-                dev_err(&rcfw->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, block);
+        if (rc)
+                return rc;
 
         /* Free the qplib's MR memory */
         if (mrw->hwq.max_elements) {
@@ -669,7 +547,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_register_mr req;
-        struct creq_register_mr_resp *resp;
+        struct creq_register_mr_resp resp;
         u16 cmd_flags = 0, level;
         int pg_ptrs, pages, i, rc;
         dma_addr_t **pbl_ptr;
@@ -730,36 +608,11 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
         req.key = cpu_to_le32(mr->lkey);
         req.mr_size = cpu_to_le64(mr->total_size);
 
-        resp = (struct creq_register_mr_resp *)
-                        bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
-                                                     NULL, block);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "SP: REG_MR send failed");
-                rc = -EINVAL;
-                goto fail;
-        }
-        if (block)
-                rc = bnxt_qplib_rcfw_block_for_resp(rcfw,
-                                                    le16_to_cpu(req.cookie));
-        else
-                rc = bnxt_qplib_rcfw_wait_for_resp(rcfw,
-                                                   le16_to_cpu(req.cookie));
-        if (!rc) {
-                /* Cmd timed out */
-                dev_err(&res->pdev->dev, "SP: REG_MR timed out");
-                rc = -ETIMEDOUT;
-                goto fail;
-        }
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: REG_MR failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: SP: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                rc = -EINVAL;
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, block);
+        if (rc)
                 goto fail;
-        }
+
         return 0;
 
 fail:
@@ -804,35 +657,15 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids)
 {
         struct bnxt_qplib_rcfw *rcfw = res->rcfw;
         struct cmdq_map_tc_to_cos req;
-        struct creq_map_tc_to_cos_resp *resp;
+        struct creq_map_tc_to_cos_resp resp;
         u16 cmd_flags = 0;
-        int tleft;
+        int rc = 0;
 
         RCFW_CMD_PREP(req, MAP_TC_TO_COS, cmd_flags);
         req.cos0 = cpu_to_le16(cids[0]);
         req.cos1 = cpu_to_le16(cids[1]);
 
-        resp = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, NULL, 0);
-        if (!resp) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS send failed");
-                return -EINVAL;
-        }
-
-        tleft = bnxt_qplib_rcfw_block_for_resp(rcfw, le16_to_cpu(req.cookie));
-        if (!tleft) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS timed out");
-                return -ETIMEDOUT;
-        }
-
-        if (resp->status ||
-            le16_to_cpu(resp->cookie) != le16_to_cpu(req.cookie)) {
-                dev_err(&res->pdev->dev, "QPLIB: SP: MAP_TC2COS failed ");
-                dev_err(&res->pdev->dev,
-                        "QPLIB: with status 0x%x cmdq 0x%x resp 0x%x",
-                        resp->status, le16_to_cpu(req.cookie),
-                        le16_to_cpu(resp->cookie));
-                return -EINVAL;
-        }
-
+        rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+                                          (void *)&resp, NULL, 0);
         return 0;
 }
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
index 1442a617e968..a543f959098b 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -40,6 +40,8 @@
 #ifndef __BNXT_QPLIB_SP_H__
 #define __BNXT_QPLIB_SP_H__
 
+#define BNXT_QPLIB_RESERVED_QP_WRS      128
+
 struct bnxt_qplib_dev_attr {
         char                            fw_ver[32];
         u16                             max_sgid;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b6fe45924c6e..0910faf3587b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -488,6 +488,7 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
 
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         release_ep_resources(ep);
+        kfree_skb(skb);
         return 0;
 }
 
@@ -498,6 +499,7 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
         ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
         c4iw_put_ep(&ep->parent_ep->com);
         release_ep_resources(ep);
+        kfree_skb(skb);
         return 0;
 }
 
@@ -569,11 +571,13 @@ static void abort_arp_failure(void *handle, struct sk_buff *skb)
 
         pr_debug("%s rdev %p\n", __func__, rdev);
         req->cmd = CPL_ABORT_NO_RST;
+        skb_get(skb);
         ret = c4iw_ofld_send(rdev, skb);
         if (ret) {
                 __state_set(&ep->com, DEAD);
                 queue_arp_failure_cpl(ep, skb, FAKE_CPL_PUT_EP_SAFE);
-        }
+        } else
+                kfree_skb(skb);
 }
 
 static int send_flowc(struct c4iw_ep *ep)
@@ -2517,7 +2521,8 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                 goto reject;
         }
 
-        hdrs = sizeof(struct iphdr) + sizeof(struct tcphdr) +
+        hdrs = ((iptype == 4) ? sizeof(struct iphdr) : sizeof(struct ipv6hdr)) +
+               sizeof(struct tcphdr) +
                ((enable_tcp_timestamps && req->tcpopt.tstamp) ? 12 : 0);
         if (peer_mss && child_ep->mtu > (peer_mss + hdrs))
                 child_ep->mtu = peer_mss + hdrs;
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 329fb65e8fb0..ae0b79aeea2e 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -767,7 +767,7 @@ void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
                 kfree(entry);
         }
 
-        list_for_each_safe(pos, nxt, &uctx->qpids) {
+        list_for_each_safe(pos, nxt, &uctx->cqids) {
                 entry = list_entry(pos, struct c4iw_qid_list, entry);
                 list_del_init(&entry->entry);
                 kfree(entry);
@@ -880,13 +880,15 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
         rdev->free_workq = create_singlethread_workqueue("iw_cxgb4_free");
         if (!rdev->free_workq) {
                 err = -ENOMEM;
-                goto err_free_status_page;
+                goto err_free_status_page_and_wr_log;
         }
 
         rdev->status_page->db_off = 0;
 
         return 0;
-err_free_status_page:
+err_free_status_page_and_wr_log:
+        if (c4iw_wr_log && rdev->wr_log)
+                kfree(rdev->wr_log);
         free_page((unsigned long)rdev->status_page);
 destroy_ocqp_pool:
         c4iw_ocqp_pool_destroy(rdev);
@@ -903,9 +905,11 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 {
         destroy_workqueue(rdev->free_workq);
         kfree(rdev->wr_log);
+        c4iw_release_dev_ucontext(rdev, &rdev->uctx);
         free_page((unsigned long)rdev->status_page);
         c4iw_pblpool_destroy(rdev);
         c4iw_rqtpool_destroy(rdev);
+        c4iw_ocqp_pool_destroy(rdev);
         c4iw_destroy_resource(&rdev->resource);
 }
 
@@ -971,7 +975,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
                  devp->rdev.lldi.sge_egrstatuspagesize);
 
         devp->rdev.hw_queue.t4_eq_status_entries =
-                devp->rdev.lldi.sge_ingpadboundary > 64 ? 2 : 1;
+                devp->rdev.lldi.sge_egrstatuspagesize / 64;
         devp->rdev.hw_queue.t4_max_eq_size = 65520;
         devp->rdev.hw_queue.t4_max_iq_size = 65520;
         devp->rdev.hw_queue.t4_max_rq_size = 8192 -
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 5d6b1eeaa9a0..2ba00b89df6a 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -6312,25 +6312,38 @@ static void handle_8051_request(struct hfi1_pportdata *ppd)
         }
 }
 
-static void write_global_credit(struct hfi1_devdata *dd,
-                                u8 vau, u16 total, u16 shared)
+/*
+ * Set up allocation unit vaulue.
+ */
+void set_up_vau(struct hfi1_devdata *dd, u8 vau)
 {
-        write_csr(dd, SEND_CM_GLOBAL_CREDIT,
-                  ((u64)total <<
-                   SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SHIFT) |
-                  ((u64)shared <<
-                   SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SHIFT) |
-                  ((u64)vau << SEND_CM_GLOBAL_CREDIT_AU_SHIFT));
+        u64 reg = read_csr(dd, SEND_CM_GLOBAL_CREDIT);
+
+        /* do not modify other values in the register */
+        reg &= ~SEND_CM_GLOBAL_CREDIT_AU_SMASK;
+        reg |= (u64)vau << SEND_CM_GLOBAL_CREDIT_AU_SHIFT;
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, reg);
 }
 
 /*
  * Set up initial VL15 credits of the remote.  Assumes the rest of
- * the CM credit registers are zero from a previous global or credit reset .
+ * the CM credit registers are zero from a previous global or credit reset.
+ * Shared limit for VL15 will always be 0.
  */
-void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf)
+void set_up_vl15(struct hfi1_devdata *dd, u16 vl15buf)
 {
-        /* leave shared count at zero for both global and VL15 */
-        write_global_credit(dd, vau, vl15buf, 0);
+        u64 reg = read_csr(dd, SEND_CM_GLOBAL_CREDIT);
+
+        /* set initial values for total and shared credit limit */
+        reg &= ~(SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SMASK |
+                 SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SMASK);
+
+        /*
+         * Set total limit to be equal to VL15 credits.
+         * Leave shared limit at 0.
+         */
+        reg |= (u64)vl15buf << SEND_CM_GLOBAL_CREDIT_TOTAL_CREDIT_LIMIT_SHIFT;
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, reg);
 
         write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
                   << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
@@ -6348,9 +6361,11 @@ void reset_link_credits(struct hfi1_devdata *dd)
         for (i = 0; i < TXE_NUM_DATA_VL; i++)
                 write_csr(dd, SEND_CM_CREDIT_VL + (8 * i), 0);
         write_csr(dd, SEND_CM_CREDIT_VL15, 0);
-        write_global_credit(dd, 0, 0, 0);
+        write_csr(dd, SEND_CM_GLOBAL_CREDIT, 0);
         /* reset the CM block */
         pio_send_control(dd, PSC_CM_RESET);
+        /* reset cached value */
+        dd->vl15buf_cached = 0;
 }
 
 /* convert a vCU to a CU */
@@ -6839,24 +6854,35 @@ void handle_link_up(struct work_struct *work)
 {
         struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
                                                   link_up_work);
+        struct hfi1_devdata *dd = ppd->dd;
+
         set_link_state(ppd, HLS_UP_INIT);
 
         /* cache the read of DC_LCB_STS_ROUND_TRIP_LTP_CNT */
-        read_ltp_rtt(ppd->dd);
+        read_ltp_rtt(dd);
         /*
          * OPA specifies that certain counters are cleared on a transition
          * to link up, so do that.
          */
-        clear_linkup_counters(ppd->dd);
+        clear_linkup_counters(dd);
         /*
          * And (re)set link up default values.
          */
         set_linkup_defaults(ppd);
 
+        /*
+         * Set VL15 credits. Use cached value from verify cap interrupt.
+         * In case of quick linkup or simulator, vl15 value will be set by
+         * handle_linkup_change. VerifyCap interrupt handler will not be
+         * called in those scenarios.
+         */
+        if (!(quick_linkup || dd->icode == ICODE_FUNCTIONAL_SIMULATOR))
+                set_up_vl15(dd, dd->vl15buf_cached);
+
         /* enforce link speed enabled */
         if ((ppd->link_speed_active & ppd->link_speed_enabled) == 0) {
                 /* oops - current speed is not enabled, bounce */
-                dd_dev_err(ppd->dd,
+                dd_dev_err(dd,
                            "Link speed active 0x%x is outside enabled 0x%x, downing link\n",
                            ppd->link_speed_active, ppd->link_speed_enabled);
                 set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SPEED_POLICY, 0,
@@ -7357,7 +7383,14 @@ void handle_verify_cap(struct work_struct *work)
          */
         if (vau == 0)
                 vau = 1;
-        set_up_vl15(dd, vau, vl15buf);
+        set_up_vau(dd, vau);
+
+        /*
+         * Set VL15 credits to 0 in global credit register. Cache remote VL15
+         * credits value and wait for link-up interrupt ot set it.
+         */
+        set_up_vl15(dd, 0);
+        dd->vl15buf_cached = vl15buf;
 
         /* set up the LCB CRC mode */
         crc_mask = ppd->port_crc_mode_enabled & partner_supported_crc;
diff --git a/drivers/infiniband/hw/hfi1/chip_registers.h b/drivers/infiniband/hw/hfi1/chip_registers.h
index 5bfa839d1c48..793514f1d15f 100644
--- a/drivers/infiniband/hw/hfi1/chip_registers.h
+++ b/drivers/infiniband/hw/hfi1/chip_registers.h
@@ -839,7 +839,9 @@
 #define SEND_CM_CTRL_FORCE_CREDIT_MODE_SMASK 0x8ull
 #define SEND_CM_CTRL_RESETCSR 0x0000000000000020ull
 #define SEND_CM_GLOBAL_CREDIT (TXE + 0x000000000508)
+#define SEND_CM_GLOBAL_CREDIT_AU_MASK 0x7ull
 #define SEND_CM_GLOBAL_CREDIT_AU_SHIFT 16
+#define SEND_CM_GLOBAL_CREDIT_AU_SMASK 0x70000ull
 #define SEND_CM_GLOBAL_CREDIT_RESETCSR 0x0000094000030000ull
 #define SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_MASK 0xFFFFull
 #define SEND_CM_GLOBAL_CREDIT_SHARED_LIMIT_SHIFT 0
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index da322e6668cc..414a04a481c2 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -1045,6 +1045,14 @@ struct hfi1_devdata {
         /* initial vl15 credits to use */
         u16 vl15_init;
 
+        /*
+         * Cached value for vl15buf, read during verify cap interrupt. VL15
+         * credits are to be kept at 0 and set when handling the link-up
+         * interrupt. This removes the possibility of receiving VL15 MAD
+         * packets before this HFI is ready.
+         */
+        u16 vl15buf_cached;
+
         /* Misc small ints */
         u8 n_krcv_queues;
         u8 qos_shift;
@@ -1598,7 +1606,8 @@ int hfi1_rcvbuf_validate(u32 size, u8 type, u16 *encode);
 int fm_get_table(struct hfi1_pportdata *ppd, int which, void *t);
 int fm_set_table(struct hfi1_pportdata *ppd, int which, void *t);
 
-void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf);
+void set_up_vau(struct hfi1_devdata *dd, u8 vau);
+void set_up_vl15(struct hfi1_devdata *dd, u16 vl15buf);
 void reset_link_credits(struct hfi1_devdata *dd);
 void assign_remote_cm_au_table(struct hfi1_devdata *dd, u8 vcu);
 
diff --git a/drivers/infiniband/hw/hfi1/intr.c b/drivers/infiniband/hw/hfi1/intr.c
index ba265d0ae93b..04a5082d5ac5 100644
--- a/drivers/infiniband/hw/hfi1/intr.c
+++ b/drivers/infiniband/hw/hfi1/intr.c
@@ -130,7 +130,8 @@ void handle_linkup_change(struct hfi1_devdata *dd, u32 linkup)
                  * the remote values.  Both sides must be using the values.
                  */
                 if (quick_linkup || dd->icode == ICODE_FUNCTIONAL_SIMULATOR) {
-                        set_up_vl15(dd, dd->vau, dd->vl15_init);
+                        set_up_vau(dd, dd->vau);
+                        set_up_vl15(dd, dd->vl15_init);
                         assign_remote_cm_au_table(dd, dd->vcu);
                 }
 
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 93faf86d54b6..6a9f6f9819e1 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -207,8 +207,8 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
         /*
          * Save BARs and command to rewrite after device reset.
          */
-        dd->pcibar0 = addr;
-        dd->pcibar1 = addr >> 32;
+        pci_read_config_dword(dd->pcidev, PCI_BASE_ADDRESS_0, &dd->pcibar0);
+        pci_read_config_dword(dd->pcidev, PCI_BASE_ADDRESS_1, &dd->pcibar1);
         pci_read_config_dword(dd->pcidev, PCI_ROM_ADDRESS, &dd->pci_rom);
         pci_read_config_word(dd->pcidev, PCI_COMMAND, &dd->pci_command);
         pcie_capability_read_word(dd->pcidev, PCI_EXP_DEVCTL, &dd->pcie_devctl);
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 069bdaf061ab..1080778a1f7c 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -2159,8 +2159,11 @@ send_last:
                 ret = hfi1_rvt_get_rwqe(qp, 1);
                 if (ret < 0)
                         goto nack_op_err;
-                if (!ret)
+                if (!ret) {
+                        /* peer will send again */
+                        rvt_put_ss(&qp->r_sge);
                         goto rnr_nak;
+                }
                 wc.ex.imm_data = ohdr->u.rc.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
                 goto send_last;
diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
index 50d140d25e38..2f3bbcac1e34 100644
--- a/drivers/infiniband/hw/hfi1/sysfs.c
+++ b/drivers/infiniband/hw/hfi1/sysfs.c
@@ -196,7 +196,8 @@ static const struct sysfs_ops port_cc_sysfs_ops = {
 };
 
 static struct attribute *port_cc_default_attributes[] = {
-        &cc_prescan_attr.attr
+        &cc_prescan_attr.attr,
+        NULL
 };
 
 static struct kobj_type port_cc_ktype = {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index f3bc01bce483..6ae98aa7f74e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -784,7 +784,6 @@ static void i40iw_build_mpa_v2(struct i40iw_cm_node *cm_node,
         }
 
         ctrl_ird |= IETF_PEER_TO_PEER;
-        ctrl_ird |= IETF_FLPDU_ZERO_LEN;
 
         switch (mpa_key) {
         case MPA_KEY_REQUEST:
@@ -2446,8 +2445,8 @@ static void i40iw_handle_rcv_mpa(struct i40iw_cm_node *cm_node,
                 } else {
                         type = I40IW_CM_EVENT_CONNECTED;
                         cm_node->state = I40IW_CM_STATE_OFFLOADED;
-                        i40iw_send_ack(cm_node);
                 }
+                i40iw_send_ack(cm_node);
                 break;
         default:
                 pr_err("%s wrong cm_node state =%d\n", __func__, cm_node->state);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index f82483b3d1e7..a027e2072477 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -285,28 +285,20 @@ void i40iw_change_l2params(struct i40iw_sc_vsi *vsi, struct i40iw_l2params *l2pa
         struct i40iw_sc_dev *dev = vsi->dev;
         struct i40iw_sc_qp *qp = NULL;
         bool qs_handle_change = false;
-        bool mss_change = false;
         unsigned long flags;
         u16 qs_handle;
         int i;
 
-        if (vsi->mss != l2params->mss) {
-                mss_change = true;
-                vsi->mss = l2params->mss;
-        }
+        vsi->mss = l2params->mss;
 
         i40iw_fill_qos_list(l2params->qs_handle_list);
         for (i = 0; i < I40IW_MAX_USER_PRIORITY; i++) {
                 qs_handle = l2params->qs_handle_list[i];
                 if (vsi->qos[i].qs_handle != qs_handle)
                         qs_handle_change = true;
-                else if (!mss_change)
-                        continue;       /* no MSS nor qs handle change */
                 spin_lock_irqsave(&vsi->qos[i].lock, flags);
                 qp = i40iw_get_qp(&vsi->qos[i].qplist, qp);
                 while (qp) {
-                        if (mss_change)
-                                i40iw_qp_mss_modify(dev, qp);
                         if (qs_handle_change) {
                                 qp->qs_handle = qs_handle;
                                 /* issue cqp suspend command */
@@ -2395,7 +2387,6 @@ static enum i40iw_status_code i40iw_sc_qp_modify(
 
         set_64bit_val(wqe,
                       8,
-                      LS_64(info->new_mss, I40IW_CQPSQ_QP_NEWMSS) |
                       LS_64(term_len, I40IW_CQPSQ_QP_TERMLEN));
 
         set_64bit_val(wqe, 16, qp->hw_host_ctx_pa);
@@ -2410,7 +2401,6 @@ static enum i40iw_status_code i40iw_sc_qp_modify(
                  LS_64(info->cq_num_valid, I40IW_CQPSQ_QP_CQNUMVALID) |
                  LS_64(info->force_loopback, I40IW_CQPSQ_QP_FORCELOOPBACK) |
                  LS_64(qp->qp_type, I40IW_CQPSQ_QP_QPTYPE) |
-                 LS_64(info->mss_change, I40IW_CQPSQ_QP_MSSCHANGE) |
                  LS_64(info->static_rsrc, I40IW_CQPSQ_QP_STATRSRC) |
                  LS_64(info->remove_hash_idx, I40IW_CQPSQ_QP_REMOVEHASHENTRY) |
                  LS_64(term_actions, I40IW_CQPSQ_QP_TERMACT) |
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 2728af3103ce..e0f47cc2effc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -1319,13 +1319,13 @@ static enum i40iw_status_code i40iw_initialize_dev(struct i40iw_device *iwdev,
         status = i40iw_obj_aligned_mem(iwdev, &mem, I40IW_QUERY_FPM_BUF_SIZE,
                                        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK);
         if (status)
-                goto exit;
+                goto error;
         info.fpm_query_buf_pa = mem.pa;
         info.fpm_query_buf = mem.va;
         status = i40iw_obj_aligned_mem(iwdev, &mem, I40IW_COMMIT_FPM_BUF_SIZE,
                                        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK);
         if (status)
-                goto exit;
+                goto error;
         info.fpm_commit_buf_pa = mem.pa;
         info.fpm_commit_buf = mem.va;
         info.hmc_fn_id = ldev->fid;
@@ -1347,11 +1347,9 @@ static enum i40iw_status_code i40iw_initialize_dev(struct i40iw_device *iwdev,
         info.exception_lan_queue = 1;
         info.vchnl_send = i40iw_virtchnl_send;
         status = i40iw_device_init(&iwdev->sc_dev, &info);
-exit:
-        if (status) {
-                kfree(iwdev->hmc_info_mem);
-                iwdev->hmc_info_mem = NULL;
-        }
+
+        if (status)
+                goto error;
         memset(&vsi_info, 0, sizeof(vsi_info));
         vsi_info.dev = &iwdev->sc_dev;
         vsi_info.back_vsi = (void *)iwdev;
@@ -1362,11 +1360,19 @@ exit:
                 memset(&stats_info, 0, sizeof(stats_info));
                 stats_info.fcn_id = ldev->fid;
                 stats_info.pestat = kzalloc(sizeof(*stats_info.pestat), GFP_KERNEL);
+                if (!stats_info.pestat) {
+                        status = I40IW_ERR_NO_MEMORY;
+                        goto error;
+                }
                 stats_info.stats_initialize = true;
                 if (stats_info.pestat)
                         i40iw_vsi_stats_init(&iwdev->vsi, &stats_info);
         }
         return status;
+error:
+        kfree(iwdev->hmc_info_mem);
+        iwdev->hmc_info_mem = NULL;
+        return status;
 }
 
 /**
@@ -1933,7 +1939,7 @@ static int i40iw_virtchnl_receive(struct i40e_info *ldev,
 bool i40iw_vf_clear_to_send(struct i40iw_sc_dev *dev)
 {
         struct i40iw_device *iwdev;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         iwdev = dev->back_dev;
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_osdep.h b/drivers/infiniband/hw/i40iw/i40iw_osdep.h
index aa66c1c63dfa..f27be3e7830b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_osdep.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_osdep.h
@@ -199,7 +199,6 @@ void i40iw_cqp_spawn_worker(struct i40iw_sc_dev *dev,
                             struct i40iw_virtchnl_work_info *work_info, u32 iw_vf_idx);
 void *i40iw_remove_head(struct list_head *list);
 void i40iw_qp_suspend_resume(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp, bool suspend);
-void i40iw_qp_mss_modify(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp);
 
 void i40iw_term_modify_qp(struct i40iw_sc_qp *qp, u8 next_state, u8 term, u8 term_len);
 void i40iw_terminate_done(struct i40iw_sc_qp *qp, int timeout_occurred);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h
index 7b76259752b0..959ec81fba99 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_type.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_type.h
@@ -541,7 +541,6 @@ struct i40iw_create_qp_info {
 struct i40iw_modify_qp_info {
         u64 rx_win0;
         u64 rx_win1;
-        u16 new_mss;
         u8 next_iwarp_state;
         u8 termlen;
         bool ord_valid;
@@ -554,7 +553,6 @@ struct i40iw_modify_qp_info {
         bool dont_send_term;
         bool dont_send_fin;
         bool cached_var_valid;
-        bool mss_change;
         bool force_loopback;
 };
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 409a3781e735..56d986924a4c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -757,23 +757,6 @@ void i40iw_qp_suspend_resume(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp, b
 }
 
 /**
- * i40iw_qp_mss_modify - modify mss for qp
- * @dev: hardware control device structure
- * @qp: hardware control qp
- */
-void i40iw_qp_mss_modify(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp)
-{
-        struct i40iw_device *iwdev = (struct i40iw_device *)dev->back_dev;
-        struct i40iw_qp *iwqp = (struct i40iw_qp *)qp->back_qp;
-        struct i40iw_modify_qp_info info;
-
-        memset(&info, 0, sizeof(info));
-        info.mss_change = true;
-        info.new_mss = qp->vsi->mss;
-        i40iw_hw_modify_qp(iwdev, iwqp, &info, false);
-}
-
-/**
  * i40iw_term_modify_qp - modify qp for term message
  * @qp: hardware control qp
  * @next_state: qp's next state
diff --git a/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c b/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
index f4d13683a403..48fd327f876b 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c
@@ -443,10 +443,7 @@ enum i40iw_status_code i40iw_vchnl_recv_pf(struct i40iw_sc_dev *dev,
         if (!dev->vchnl_up)
                 return I40IW_ERR_NOT_READY;
         if (vchnl_msg->iw_op_code == I40IW_VCHNL_OP_GET_VER) {
-                if (vchnl_msg->iw_op_ver != I40IW_VCHNL_OP_GET_VER_V0)
-                        vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
-                else
-                        vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
+                vchnl_pf_send_get_ver_resp(dev, vf_id, vchnl_msg);
                 return I40IW_SUCCESS;
         }
         for (iw_vf_idx = 0; iw_vf_idx < I40IW_MAX_PE_ENABLED_VF_COUNT; iw_vf_idx++) {
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index b4694717f6f3..21d31cb1325f 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1578,6 +1578,7 @@ static void mlx4_ib_multiplex_mad(struct mlx4_ib_demux_pv_ctx *ctx, struct ib_wc
         if (port < 0)
                 return;
         ah.av.ib.port_pd = cpu_to_be32(port << 24 | (be32_to_cpu(ah.av.ib.port_pd) & 0xffffff));
+        ah.ibah.type = rdma_ah_find_type(&dev->ib_dev, port);
 
         mlx4_ib_query_ah(&ah.ibah, &ah_attr);
         if (rdma_ah_get_ah_flags(&ah_attr) & IB_AH_GRH)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index d45772da0963..9ecc089d4529 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2979,6 +2979,18 @@ error_0:
         return ret;
 }
 
+static u8 mlx5_get_umr_fence(u8 umr_fence_cap)
+{
+        switch (umr_fence_cap) {
+        case MLX5_CAP_UMR_FENCE_NONE:
+                return MLX5_FENCE_MODE_NONE;
+        case MLX5_CAP_UMR_FENCE_SMALL:
+                return MLX5_FENCE_MODE_INITIATOR_SMALL;
+        default:
+                return MLX5_FENCE_MODE_STRONG_ORDERING;
+        }
+}
+
 static int create_dev_resources(struct mlx5_ib_resources *devr)
 {
         struct ib_srq_init_attr attr;
@@ -3680,8 +3692,10 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
         dev->ib_dev.check_mr_status     = mlx5_ib_check_mr_status;
         dev->ib_dev.get_port_immutable  = mlx5_port_immutable;
         dev->ib_dev.get_dev_fw_str      = get_dev_fw_str;
-        dev->ib_dev.alloc_rdma_netdev   = mlx5_ib_alloc_rdma_netdev;
-        dev->ib_dev.free_rdma_netdev    = mlx5_ib_free_rdma_netdev;
+        if (MLX5_CAP_GEN(mdev, ipoib_enhanced_offloads)) {
+                dev->ib_dev.alloc_rdma_netdev   = mlx5_ib_alloc_rdma_netdev;
+                dev->ib_dev.free_rdma_netdev    = mlx5_ib_free_rdma_netdev;
+        }
         if (mlx5_core_is_pf(mdev)) {
                 dev->ib_dev.get_vf_config       = mlx5_ib_get_vf_config;
                 dev->ib_dev.set_vf_link_state   = mlx5_ib_set_vf_link_state;
@@ -3693,6 +3707,8 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
 
         mlx5_ib_internal_fill_odp_caps(dev);
 
+        dev->umr_fence = mlx5_get_umr_fence(MLX5_CAP_GEN(mdev, umr_fence));
+
         if (MLX5_CAP_GEN(mdev, imaicl)) {
                 dev->ib_dev.alloc_mw            = mlx5_ib_alloc_mw;
                 dev->ib_dev.dealloc_mw          = mlx5_ib_dealloc_mw;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 38c877bc45e5..bdcf25410c99 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -349,7 +349,7 @@ struct mlx5_ib_qp {
         struct mlx5_ib_wq       rq;
 
         u8                      sq_signal_bits;
-        u8                      fm_cache;
+        u8                      next_fence;
         struct mlx5_ib_wq       sq;
 
         /* serialize qp state modifications
@@ -654,6 +654,7 @@ struct mlx5_ib_dev {
         struct mlx5_ib_port     *port;
         struct mlx5_sq_bfreg     bfreg;
         struct mlx5_sq_bfreg     fp_bfreg;
+        u8                              umr_fence;
 };
 
 static inline struct mlx5_ib_cq *to_mibcq(struct mlx5_core_cq *mcq)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 93959e1e43a3..ebb6768684de 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3738,24 +3738,6 @@ static void dump_wqe(struct mlx5_ib_qp *qp, int idx, int size_16)
         }
 }
 
-static u8 get_fence(u8 fence, struct ib_send_wr *wr)
-{
-        if (unlikely(wr->opcode == IB_WR_LOCAL_INV &&
-                     wr->send_flags & IB_SEND_FENCE))
-                return MLX5_FENCE_MODE_STRONG_ORDERING;
-
-        if (unlikely(fence)) {
-                if (wr->send_flags & IB_SEND_FENCE)
-                        return MLX5_FENCE_MODE_SMALL_AND_FENCE;
-                else
-                        return fence;
-        } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
-                return MLX5_FENCE_MODE_FENCE;
-        }
-
-        return 0;
-}
-
 static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct mlx5_wqe_ctrl_seg **ctrl,
                      struct ib_send_wr *wr, unsigned *idx,
@@ -3784,8 +3766,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
 static void finish_wqe(struct mlx5_ib_qp *qp,
                        struct mlx5_wqe_ctrl_seg *ctrl,
                        u8 size, unsigned idx, u64 wr_id,
-                       int nreq, u8 fence, u8 next_fence,
-                       u32 mlx5_opcode)
+                       int nreq, u8 fence, u32 mlx5_opcode)
 {
         u8 opmod = 0;
 
@@ -3793,7 +3774,6 @@ static void finish_wqe(struct mlx5_ib_qp *qp,
                                              mlx5_opcode | ((u32)opmod << 24));
         ctrl->qpn_ds = cpu_to_be32(size | (qp->trans_qp.base.mqp.qpn << 8));
         ctrl->fm_ce_se |= fence;
-        qp->fm_cache = next_fence;
         if (unlikely(qp->wq_sig))
                 ctrl->signature = wq_sig(ctrl);
 
@@ -3853,7 +3833,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
-                fence = qp->fm_cache;
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
@@ -3870,6 +3849,19 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         goto out;
                 }
 
+                if (wr->opcode == IB_WR_LOCAL_INV ||
+                    wr->opcode == IB_WR_REG_MR) {
+                        fence = dev->umr_fence;
+                        next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
+                } else if (wr->send_flags & IB_SEND_FENCE) {
+                        if (qp->next_fence)
+                                fence = MLX5_FENCE_MODE_SMALL_AND_FENCE;
+                        else
+                                fence = MLX5_FENCE_MODE_FENCE;
+                } else {
+                        fence = qp->next_fence;
+                }
+
                 switch (ibqp->qp_type) {
                 case IB_QPT_XRC_INI:
                         xrc = seg;
@@ -3896,7 +3888,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 goto out;
 
                         case IB_WR_LOCAL_INV:
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 qp->sq.wr_data[idx] = IB_WR_LOCAL_INV;
                                 ctrl->imm = cpu_to_be32(wr->ex.invalidate_rkey);
                                 set_linv_wr(qp, &seg, &size);
@@ -3904,7 +3895,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 break;
 
                         case IB_WR_REG_MR:
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 qp->sq.wr_data[idx] = IB_WR_REG_MR;
                                 ctrl->imm = cpu_to_be32(reg_wr(wr)->key);
                                 err = set_reg_wr(qp, reg_wr(wr), &seg, &size);
@@ -3927,9 +3917,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_UMR);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_UMR);
                                 /*
                                  * SET_PSV WQEs are not signaled and solicited
                                  * on error
@@ -3954,9 +3943,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_SET_PSV);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_SET_PSV);
                                 err = begin_wqe(qp, &seg, &ctrl, wr,
                                                 &idx, &size, nreq);
                                 if (err) {
@@ -3966,7 +3954,6 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 err = set_psv_wr(&sig_handover_wr(wr)->sig_attrs->wire,
                                                  mr->sig->psv_wire.psv_idx, &seg,
                                                  &size);
@@ -3976,9 +3963,9 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                         goto out;
                                 }
 
-                                finish_wqe(qp, ctrl, size, idx, wr->wr_id,
-                                           nreq, get_fence(fence, wr),
-                                           next_fence, MLX5_OPCODE_SET_PSV);
+                                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
+                                           fence, MLX5_OPCODE_SET_PSV);
+                                qp->next_fence = MLX5_FENCE_MODE_INITIATOR_SMALL;
                                 num_sge = 0;
                                 goto skip_psv;
 
@@ -4089,8 +4076,8 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         }
                 }
 
-                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq,
-                           get_fence(fence, wr), next_fence,
+                qp->next_fence = next_fence;
+                finish_wqe(qp, ctrl, size, idx, wr->wr_id, nreq, fence,
                            mlx5_ib_opcode[wr->opcode]);
 skip_psv:
                 if (0)
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index fb983df7c157..30b256a2c54e 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -610,7 +610,6 @@ static void build_mpa_v2(struct nes_cm_node *cm_node,
                 ctrl_ord = cm_node->ord_size & IETF_NO_IRD_ORD;
         }
         ctrl_ird |= IETF_PEER_TO_PEER;
-        ctrl_ird |= IETF_FLPDU_ZERO_LEN;
 
         switch (mpa_key) {
         case MPA_KEY_REQUEST:
@@ -1826,7 +1825,7 @@ static void handle_rcv_mpa(struct nes_cm_node *cm_node, struct sk_buff *skb)
                         type = NES_CM_EVENT_CONNECTED;
                         cm_node->state = NES_CM_STATE_TSA;
                 }
-
+                send_ack(cm_node, NULL);
                 break;
         default:
                 WARN_ON(1);
diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h
index aa08c76a4245..d961f79b317c 100644
--- a/drivers/infiniband/hw/qedr/qedr.h
+++ b/drivers/infiniband/hw/qedr/qedr.h
@@ -58,7 +58,10 @@
 #define QEDR_MSG_QP   "  QP"
 #define QEDR_MSG_GSI  " GSI"
 
-#define QEDR_CQ_MAGIC_NUMBER   (0x11223344)
+#define QEDR_CQ_MAGIC_NUMBER    (0x11223344)
+
+#define FW_PAGE_SIZE            (RDMA_RING_PAGE_SIZE)
+#define FW_PAGE_SHIFT           (12)
 
 struct qedr_dev;
 
diff --git a/drivers/infiniband/hw/qedr/qedr_cm.c b/drivers/infiniband/hw/qedr/qedr_cm.c
index 3d7705cec770..d86dbe814d98 100644
--- a/drivers/infiniband/hw/qedr/qedr_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_cm.c
@@ -270,11 +270,13 @@ static inline int qedr_gsi_build_header(struct qedr_dev *dev,
                 return rc;
         }
 
-        vlan_id = rdma_vlan_dev_vlan_id(sgid_attr.ndev);
-        if (vlan_id < VLAN_CFI_MASK)
-                has_vlan = true;
-        if (sgid_attr.ndev)
+        if (sgid_attr.ndev) {
+                vlan_id = rdma_vlan_dev_vlan_id(sgid_attr.ndev);
+                if (vlan_id < VLAN_CFI_MASK)
+                        has_vlan = true;
+
                 dev_put(sgid_attr.ndev);
+        }
 
         if (!memcmp(&sgid, &zgid, sizeof(sgid))) {
                 DP_ERR(dev, "gsi post send: GID not found GID index %d\n",
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 17685cfea6a2..d6723c365c7f 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -653,14 +653,15 @@ static int qedr_prepare_pbl_tbl(struct qedr_dev *dev,
 
 static void qedr_populate_pbls(struct qedr_dev *dev, struct ib_umem *umem,
                                struct qedr_pbl *pbl,
-                               struct qedr_pbl_info *pbl_info)
+                               struct qedr_pbl_info *pbl_info, u32 pg_shift)
 {
         int shift, pg_cnt, pages, pbe_cnt, total_num_pbes = 0;
+        u32 fw_pg_cnt, fw_pg_per_umem_pg;
         struct qedr_pbl *pbl_tbl;
         struct scatterlist *sg;
         struct regpair *pbe;
+        u64 pg_addr;
         int entry;
-        u32 addr;
 
         if (!pbl_info->num_pbes)
                 return;
@@ -683,29 +684,35 @@ static void qedr_populate_pbls(struct qedr_dev *dev, struct ib_umem *umem,
 
         shift = umem->page_shift;
 
+        fw_pg_per_umem_pg = BIT(umem->page_shift - pg_shift);
+
         for_each_sg(umem->sg_head.sgl, sg, umem->nmap, entry) {
                 pages = sg_dma_len(sg) >> shift;
+                pg_addr = sg_dma_address(sg);
                 for (pg_cnt = 0; pg_cnt < pages; pg_cnt++) {
-                        /* store the page address in pbe */
-                        pbe->lo = cpu_to_le32(sg_dma_address(sg) +
-                                              (pg_cnt << shift));
-                        addr = upper_32_bits(sg_dma_address(sg) +
-                                             (pg_cnt << shift));
-                        pbe->hi = cpu_to_le32(addr);
-                        pbe_cnt++;
-                        total_num_pbes++;
-                        pbe++;
-
-                        if (total_num_pbes == pbl_info->num_pbes)
-                                return;
-
-                        /* If the given pbl is full storing the pbes,
-                         * move to next pbl.
-                         */
-                        if (pbe_cnt == (pbl_info->pbl_size / sizeof(u64))) {
-                                pbl_tbl++;
-                                pbe = (struct regpair *)pbl_tbl->va;
-                                pbe_cnt = 0;
+                        for (fw_pg_cnt = 0; fw_pg_cnt < fw_pg_per_umem_pg;) {
+                                pbe->lo = cpu_to_le32(pg_addr);
+                                pbe->hi = cpu_to_le32(upper_32_bits(pg_addr));
+
+                                pg_addr += BIT(pg_shift);
+                                pbe_cnt++;
+                                total_num_pbes++;
+                                pbe++;
+
+                                if (total_num_pbes == pbl_info->num_pbes)
+                                        return;
+
+                                /* If the given pbl is full storing the pbes,
+                                 * move to next pbl.
+                                 */
+                                if (pbe_cnt ==
+                                    (pbl_info->pbl_size / sizeof(u64))) {
+                                        pbl_tbl++;
+                                        pbe = (struct regpair *)pbl_tbl->va;
+                                        pbe_cnt = 0;
+                                }
+
+                                fw_pg_cnt++;
                         }
                 }
         }
@@ -754,7 +761,7 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                                        u64 buf_addr, size_t buf_len,
                                        int access, int dmasync)
 {
-        int page_cnt;
+        u32 fw_pages;
         int rc;
 
         q->buf_addr = buf_addr;
@@ -766,8 +773,10 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                 return PTR_ERR(q->umem);
         }
 
-        page_cnt = ib_umem_page_count(q->umem);
-        rc = qedr_prepare_pbl_tbl(dev, &q->pbl_info, page_cnt, 0);
+        fw_pages = ib_umem_page_count(q->umem) <<
+            (q->umem->page_shift - FW_PAGE_SHIFT);
+
+        rc = qedr_prepare_pbl_tbl(dev, &q->pbl_info, fw_pages, 0);
         if (rc)
                 goto err0;
 
@@ -777,7 +786,8 @@ static inline int qedr_init_user_queue(struct ib_ucontext *ib_ctx,
                 goto err0;
         }
 
-        qedr_populate_pbls(dev, q->umem, q->pbl_tbl, &q->pbl_info);
+                qedr_populate_pbls(dev, q->umem, q->pbl_tbl, &q->pbl_info,
+                                   FW_PAGE_SHIFT);
 
         return 0;
 
@@ -2226,7 +2236,7 @@ struct ib_mr *qedr_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
                 goto err1;
 
         qedr_populate_pbls(dev, mr->umem, mr->info.pbl_table,
-                           &mr->info.pbl_info);
+                           &mr->info.pbl_info, mr->umem->page_shift);
 
         rc = dev->ops->rdma_alloc_tid(dev->rdma_ctx, &mr->hw_mr.itid);
         if (rc) {
@@ -3209,6 +3219,10 @@ static int process_req(struct qedr_dev *dev, struct qedr_qp *qp,
                 case IB_WC_REG_MR:
                         qp->wqe_wr_id[qp->sq.cons].mr->info.completed++;
                         break;
+                case IB_WC_RDMA_READ:
+                case IB_WC_SEND:
+                        wc->byte_len = qp->wqe_wr_id[qp->sq.cons].bytes_len;
+                        break;
                 default:
                         break;
                 }
diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c
index fc8b88514da5..4ddbcac5eabe 100644
--- a/drivers/infiniband/hw/qib/qib_rc.c
+++ b/drivers/infiniband/hw/qib/qib_rc.c
@@ -1956,8 +1956,10 @@ send_last:
                 ret = qib_get_rwqe(qp, 1);
                 if (ret < 0)
                         goto nack_op_err;
-                if (!ret)
+                if (!ret) {
+                        rvt_put_ss(&qp->r_sge);
                         goto rnr_nak;
+                }
                 wc.ex.imm_data = ohdr->u.rc.imm_data;
                 hdrsize += 4;
                 wc.wc_flags = IB_WC_WITH_IMM;
diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
index ecdba2fce083..1ac5b8551a4d 100644
--- a/drivers/infiniband/sw/rxe/rxe.h
+++ b/drivers/infiniband/sw/rxe/rxe.h
@@ -68,6 +68,7 @@
 static inline u32 rxe_crc32(struct rxe_dev *rxe,
                             u32 crc, void *next, size_t len)
 {
+        u32 retval;
         int err;
 
         SHASH_DESC_ON_STACK(shash, rxe->tfm);
@@ -81,7 +82,9 @@ static inline u32 rxe_crc32(struct rxe_dev *rxe,
                 return crc32_le(crc, next, len);
         }
 
-        return *(u32 *)shash_desc_ctx(shash);
+        retval = *(u32 *)shash_desc_ctx(shash);
+        barrier_data(shash_desc_ctx(shash));
+        return retval;
 }
 
 int rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 83d709e74dfb..073e66783f1d 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -740,13 +740,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr,
 
                 sge = ibwr->sg_list;
                 for (i = 0; i < num_sge; i++, sge++) {
-                        if (qp->is_user && copy_from_user(p, (__user void *)
-                                            (uintptr_t)sge->addr, sge->length))
-                                return -EFAULT;
-
-                        else if (!qp->is_user)
-                                memcpy(p, (void *)(uintptr_t)sge->addr,
-                                       sge->length);
+                        memcpy(p, (void *)(uintptr_t)sge->addr,
+                                        sge->length);
 
                         p += sge->length;
                 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index 874b24366e4d..7871379342f4 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -178,7 +178,7 @@ static inline int ib_speed_enum_to_int(int speed)
 static int ipoib_get_link_ksettings(struct net_device *netdev,
                                     struct ethtool_link_ksettings *cmd)
 {
-        struct ipoib_dev_priv *priv = netdev_priv(netdev);
+        struct ipoib_dev_priv *priv = ipoib_priv(netdev);
         struct ib_port_attr attr;
         int ret, speed, width;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 0060b2f9f659..efe7402f4885 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -863,7 +863,6 @@ dev_stop:
         set_bit(IPOIB_STOP_REAPER, &priv->flags);
         cancel_delayed_work(&priv->ah_reap_task);
         set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
-        napi_enable(&priv->napi);
         ipoib_ib_dev_stop(dev);
         return -1;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 2869d1adb1de..1015a63de6ae 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1590,12 +1590,14 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
         wait_for_completion(&priv->ntbl.deleted);
 }
 
-void ipoib_dev_uninit_default(struct net_device *dev)
+static void ipoib_dev_uninit_default(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = ipoib_priv(dev);
 
         ipoib_transport_dev_cleanup(dev);
 
+        netif_napi_del(&priv->napi);
+
         ipoib_cm_dev_cleanup(dev);
 
         kfree(priv->rx_ring);
@@ -1649,6 +1651,7 @@ out_rx_ring_cleanup:
         kfree(priv->rx_ring);
 
 out:
+        netif_napi_del(&priv->napi);
         return -ENOMEM;
 }
 
@@ -2237,6 +2240,7 @@ event_failed:
 
 device_init_failed:
         free_netdev(priv->dev);
+        kfree(priv);
 
 alloc_mem_failed:
         return ERR_PTR(result);
@@ -2277,7 +2281,7 @@ static void ipoib_add_one(struct ib_device *device)
 
 static void ipoib_remove_one(struct ib_device *device, void *client_data)
 {
-        struct ipoib_dev_priv *priv, *tmp;
+        struct ipoib_dev_priv *priv, *tmp, *cpriv, *tcpriv;
         struct list_head *dev_list = client_data;
 
         if (!dev_list)
@@ -2300,7 +2304,14 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 flush_workqueue(priv->wq);
 
                 unregister_netdev(priv->dev);
-                free_netdev(priv->dev);
+                if (device->free_rdma_netdev)
+                        device->free_rdma_netdev(priv->dev);
+                else
+                        free_netdev(priv->dev);
+
+                list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list)
+                        kfree(cpriv);
+
                 kfree(priv);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 36dc4fcaa3cd..081b33deff1b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -133,13 +133,13 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
         snprintf(intf_name, sizeof intf_name, "%s.%04x",
                  ppriv->dev->name, pkey);
 
+        if (!rtnl_trylock())
+                return restart_syscall();
+
         priv = ipoib_intf_alloc(ppriv->ca, ppriv->port, intf_name);
         if (!priv)
                 return -ENOMEM;
 
-        if (!rtnl_trylock())
-                return restart_syscall();
-
         down_write(&ppriv->vlan_rwsem);
 
         /*
@@ -167,8 +167,10 @@ out:
 
         rtnl_unlock();
 
-        if (result)
+        if (result) {
                 free_netdev(priv->dev);
+                kfree(priv);
+        }
 
         return result;
 }
@@ -209,6 +211,7 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
 
         if (dev) {
                 free_netdev(dev);
+                kfree(priv);
                 return 0;
         }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index def723a5df29..2354c742caa1 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -320,7 +320,7 @@ static int srp_new_cm_id(struct srp_rdma_ch *ch)
         ch->path.sgid = target->sgid;
         ch->path.dgid = target->orig_dgid;
         ch->path.pkey = target->pkey;
-        sa_path_set_service_id(&ch->path, target->service_id);
+        ch->path.service_id = target->service_id;
 
         return 0;
 }
@@ -575,7 +575,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
         return 0;
 
 err_qp:
-        srp_destroy_qp(ch, qp);
+        ib_destroy_qp(qp);
 
 err_send_cq:
         ib_free_cq(send_cq);
diff --git a/drivers/input/keyboard/tm2-touchkey.c b/drivers/input/keyboard/tm2-touchkey.c
index 485900f953e0..abc266e40e17 100644
--- a/drivers/input/keyboard/tm2-touchkey.c
+++ b/drivers/input/keyboard/tm2-touchkey.c
@@ -213,7 +213,7 @@ static int tm2_touchkey_probe(struct i2c_client *client,
         /* led device */
         touchkey->led_dev.name = TM2_TOUCHKEY_DEV_NAME;
         touchkey->led_dev.brightness = LED_FULL;
-        touchkey->led_dev.max_brightness = LED_FULL;
+        touchkey->led_dev.max_brightness = LED_ON;
         touchkey->led_dev.brightness_set = tm2_touchkey_led_brightness_set;
 
         error = devm_led_classdev_register(&client->dev, &touchkey->led_dev);
diff --git a/drivers/input/misc/axp20x-pek.c b/drivers/input/misc/axp20x-pek.c
index f11807db6979..400869e61a06 100644
--- a/drivers/input/misc/axp20x-pek.c
+++ b/drivers/input/misc/axp20x-pek.c
@@ -256,6 +256,42 @@ static int axp20x_pek_probe_input_device(struct axp20x_pek *axp20x_pek,
         return 0;
 }
 
+#ifdef CONFIG_ACPI
+static bool axp20x_pek_should_register_input(struct axp20x_pek *axp20x_pek,
+                                             struct platform_device *pdev)
+{
+        unsigned long long hrv = 0;
+        acpi_status status;
+
+        if (IS_ENABLED(CONFIG_INPUT_SOC_BUTTON_ARRAY) &&
+            axp20x_pek->axp20x->variant == AXP288_ID) {
+                status = acpi_evaluate_integer(ACPI_HANDLE(pdev->dev.parent),
+                                               "_HRV", NULL, &hrv);
+                if (ACPI_FAILURE(status))
+                        dev_err(&pdev->dev, "Failed to get PMIC hardware revision\n");
+
+                /*
+                 * On Cherry Trail platforms (hrv == 3), do not register the
+                 * input device if there is an "INTCFD9" or "ACPI0011" gpio
+                 * button ACPI device, as that handles the power button too,
+                 * and otherwise we end up reporting all presses twice.
+                 */
+                if (hrv == 3 && (acpi_dev_present("INTCFD9", NULL, -1) ||
+                                 acpi_dev_present("ACPI0011", NULL, -1)))
+                        return false;
+
+        }
+
+        return true;
+}
+#else
+static bool axp20x_pek_should_register_input(struct axp20x_pek *axp20x_pek,
+                                             struct platform_device *pdev)
+{
+        return true;
+}
+#endif
+
 static int axp20x_pek_probe(struct platform_device *pdev)
 {
         struct axp20x_pek *axp20x_pek;
@@ -268,13 +304,7 @@ static int axp20x_pek_probe(struct platform_device *pdev)
 
         axp20x_pek->axp20x = dev_get_drvdata(pdev->dev.parent);
 
-        /*
-         * Do not register the input device if there is an "INTCFD9"
-         * gpio button ACPI device, that handles the power button too,
-         * and otherwise we end up reporting all presses twice.
-         */
-        if (!acpi_dev_found("INTCFD9") ||
-            !IS_ENABLED(CONFIG_INPUT_SOC_BUTTON_ARRAY)) {
+        if (axp20x_pek_should_register_input(axp20x_pek, pdev)) {
                 error = axp20x_pek_probe_input_device(axp20x_pek, pdev);
                 if (error)
                         return error;
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index a679e56c44cd..f431da07f861 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -554,32 +554,34 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
                                      struct completion *completion)
 {
         struct device *dev = &client->dev;
-        long ret;
         int error;
         int len;
-        u8 buffer[ETP_I2C_INF_LENGTH];
+        u8 buffer[ETP_I2C_REPORT_LEN];
+
+        len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN);
+        if (len != ETP_I2C_REPORT_LEN) {
+                error = len < 0 ? len : -EIO;
+                dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n",
+                        error, len);
+        }
 
         reinit_completion(completion);
         enable_irq(client->irq);
 
         error = elan_i2c_write_cmd(client, ETP_I2C_STAND_CMD, ETP_I2C_RESET);
-        if (!error)
-                ret = wait_for_completion_interruptible_timeout(completion,
-                                                        msecs_to_jiffies(300));
-        disable_irq(client->irq);
-
         if (error) {
                 dev_err(dev, "device reset failed: %d\n", error);
-                return error;
-        } else if (ret == 0) {
+        } else if (!wait_for_completion_timeout(completion,
+                                                msecs_to_jiffies(300))) {
                 dev_err(dev, "timeout waiting for device reset\n");
-                return -ETIMEDOUT;
-        } else if (ret < 0) {
-                error = ret;
-                dev_err(dev, "error waiting for device reset: %d\n", error);
-                return error;
+                error = -ETIMEDOUT;
         }
 
+        disable_irq(client->irq);
+
+        if (error)
+                return error;
+
         len = i2c_master_recv(client, buffer, ETP_I2C_INF_LENGTH);
         if (len != ETP_I2C_INF_LENGTH) {
                 error = len < 0 ? len : -EIO;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index e73d968023f7..f1fa1f172107 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,8 +1118,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E546   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
+ * Fujitsu LIFEBOOK E557   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
  * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
@@ -1525,6 +1527,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E546  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -1546,6 +1555,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 131df9d3660f..16c30460ef04 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -176,6 +176,12 @@ static const char * const smbus_pnp_ids[] = {
         NULL
 };
 
+static const char * const forcepad_pnp_ids[] = {
+        "SYN300D",
+        "SYN3014",
+        NULL
+};
+
 /*
  * Send a command to the synpatics touchpad by special commands
  */
@@ -397,6 +403,8 @@ static int synaptics_query_hardware(struct psmouse *psmouse,
 {
         int error;
 
+        memset(info, 0, sizeof(*info));
+
         error = synaptics_identify(psmouse, info);
         if (error)
                 return error;
@@ -480,13 +488,6 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
         { }
 };
 
-/* This list has been kindly provided by Synaptics. */
-static const char * const forcepad_pnp_ids[] = {
-        "SYN300D",
-        "SYN3014",
-        NULL
-};
-
 /*****************************************************************************
  *      Synaptics communications functions
  ****************************************************************************/
@@ -1687,7 +1688,8 @@ enum {
         SYNAPTICS_INTERTOUCH_ON,
 };
 
-static int synaptics_intertouch = SYNAPTICS_INTERTOUCH_NOT_SET;
+static int synaptics_intertouch = IS_ENABLED(CONFIG_RMI4_SMB) ?
+                SYNAPTICS_INTERTOUCH_NOT_SET : SYNAPTICS_INTERTOUCH_OFF;
 module_param_named(synaptics_intertouch, synaptics_intertouch, int, 0644);
 MODULE_PARM_DESC(synaptics_intertouch, "Use a secondary bus for the Synaptics device.");
 
@@ -1737,8 +1739,16 @@ static int synaptics_setup_intertouch(struct psmouse *psmouse,
 
         if (synaptics_intertouch == SYNAPTICS_INTERTOUCH_NOT_SET) {
                 if (!psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
-                    !psmouse_matches_pnp_id(psmouse, smbus_pnp_ids))
+                    !psmouse_matches_pnp_id(psmouse, smbus_pnp_ids)) {
+
+                        if (!psmouse_matches_pnp_id(psmouse, forcepad_pnp_ids))
+                                psmouse_info(psmouse,
+                                             "Your touchpad (%s) says it can support a different bus. "
+                                             "If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org.\n",
+                                             psmouse->ps2dev.serio->firmware_id);
+
                         return -ENXIO;
+                }
         }
 
         psmouse_info(psmouse, "Trying to set up SMBus access\n");
@@ -1810,6 +1820,15 @@ int synaptics_init(struct psmouse *psmouse)
         }
 
         if (SYN_CAP_INTERTOUCH(info.ext_cap_0c)) {
+                if ((!IS_ENABLED(CONFIG_RMI4_SMB) ||
+                     !IS_ENABLED(CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS)) &&
+                    /* Forcepads need F21, which is not ready */
+                    !psmouse_matches_pnp_id(psmouse, forcepad_pnp_ids)) {
+                        psmouse_warn(psmouse,
+                                     "The touchpad can support a better bus than the too old PS/2 protocol. "
+                                     "Make sure MOUSE_PS2_SYNAPTICS_SMBUS and RMI4_SMB are enabled to get a better touchpad experience.\n");
+                }
+
                 error = synaptics_setup_intertouch(psmouse, &info, true);
                 if (!error)
                         return PSMOUSE_SYNAPTICS_SMBUS;
diff --git a/drivers/input/rmi4/rmi_f03.c b/drivers/input/rmi4/rmi_f03.c
index 77dad045a468..ad71a5e768dc 100644
--- a/drivers/input/rmi4/rmi_f03.c
+++ b/drivers/input/rmi4/rmi_f03.c
@@ -146,7 +146,7 @@ static int rmi_f03_register_pt(struct f03_data *f03)
         if (!serio)
                 return -ENOMEM;
 
-        serio->id.type = SERIO_8042;
+        serio->id.type = SERIO_PS_PSTHRU;
         serio->write = rmi_f03_pt_write;
         serio->port_data = f03;
 
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 2302aef2b2d4..dd042a9b0aaa 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -350,6 +350,7 @@ static bool mxt_object_readable(unsigned int type)
         case MXT_TOUCH_KEYARRAY_T15:
         case MXT_TOUCH_PROXIMITY_T23:
         case MXT_TOUCH_PROXKEY_T52:
+        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
         case MXT_PROCI_GRIPFACE_T20:
         case MXT_PROCG_NOISE_T22:
         case MXT_PROCI_ONETOUCH_T24:
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 8cf8d8d5d4ef..f872817e81e4 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -471,7 +471,7 @@ static EDT_ATTR(gain, S_IWUSR | S_IRUGO, WORK_REGISTER_GAIN,
 static EDT_ATTR(offset, S_IWUSR | S_IRUGO, WORK_REGISTER_OFFSET,
                 M09_REGISTER_OFFSET, 0, 31);
 static EDT_ATTR(threshold, S_IWUSR | S_IRUGO, WORK_REGISTER_THRESHOLD,
-                M09_REGISTER_THRESHOLD, 20, 80);
+                M09_REGISTER_THRESHOLD, 0, 80);
 static EDT_ATTR(report_rate, S_IWUSR | S_IRUGO, WORK_REGISTER_REPORT_RATE,
                 NO_REGISTER, 3, 14);
 
diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
index 813dd68a5c82..0dbcf105f7db 100644
--- a/drivers/input/touchscreen/silead.c
+++ b/drivers/input/touchscreen/silead.c
@@ -526,6 +526,7 @@ static int __maybe_unused silead_ts_suspend(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
 
+        disable_irq(client->irq);
         silead_ts_set_power(client, SILEAD_POWER_OFF);
         return 0;
 }
@@ -551,6 +552,8 @@ static int __maybe_unused silead_ts_resume(struct device *dev)
                 return -ENODEV;
         }
 
+        enable_irq(client->irq);
+
         return 0;
 }
 
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index b8dcf44df441..8cb60829a7a1 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -118,6 +118,7 @@ static const struct iommu_ops
 
         ops = iommu_ops_from_fwnode(fwnode);
         if ((ops && !ops->of_xlate) ||
+            !of_device_is_available(iommu_spec->np) ||
             (!ops && !of_iommu_driver_present(iommu_spec->np)))
                 return NULL;
 
@@ -236,6 +237,12 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
                         ops = ERR_PTR(err);
         }
 
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
+
         return ops;
 }
 
diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c
index bb3ac5fe5846..72a391e01011 100644
--- a/drivers/irqchip/irq-xtensa-mx.c
+++ b/drivers/irqchip/irq-xtensa-mx.c
@@ -142,7 +142,7 @@ static struct irq_chip xtensa_mx_irq_chip = {
 int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_mx_irq_domain_ops,
                                 &xtensa_mx_irq_chip);
         irq_set_default_host(root_domain);
diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c
index 472ae1770964..f728755fa292 100644
--- a/drivers/irqchip/irq-xtensa-pic.c
+++ b/drivers/irqchip/irq-xtensa-pic.c
@@ -89,7 +89,7 @@ static struct irq_chip xtensa_irq_chip = {
 int __init xtensa_pic_init_legacy(struct device_node *interrupt_parent)
 {
         struct irq_domain *root_domain =
-                irq_domain_add_legacy(NULL, NR_IRQS, 0, 0,
+                irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0,
                                 &xtensa_irq_domain_ops, &xtensa_irq_chip);
         irq_set_default_host(root_domain);
         return 0;
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index d07dd5196ffc..8aa158a09180 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
                        id);
                 return NULL;
         } else {
-                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
                 if (!rs)
                         return NULL;
                 rs->state = CCPResetIdle;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 8b7faea2ddf8..422dced7c90a 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -75,7 +75,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
                 if (sk->sk_state != MISDN_BOUND)
                         continue;
                 if (!cskb)
-                        cskb = skb_copy(skb, GFP_KERNEL);
+                        cskb = skb_copy(skb, GFP_ATOMIC);
                 if (!cskb) {
                         printk(KERN_WARNING "%s no skb\n", __func__);
                         break;
diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c
index 1548259297c1..2cfd9389ee96 100644
--- a/drivers/leds/leds-bcm6328.c
+++ b/drivers/leds/leds-bcm6328.c
@@ -242,7 +242,7 @@ static int bcm6328_hwled(struct device *dev, struct device_node *nc, u32 reg,
 
                 spin_lock_irqsave(lock, flags);
                 val = bcm6328_led_read(addr);
-                val |= (BIT(reg) << (((sel % 4) * 4) + 16));
+                val |= (BIT(reg % 4) << (((sel % 4) * 4) + 16));
                 bcm6328_led_write(addr, val);
                 spin_unlock_irqrestore(lock, flags);
         }
@@ -269,7 +269,7 @@ static int bcm6328_hwled(struct device *dev, struct device_node *nc, u32 reg,
 
                 spin_lock_irqsave(lock, flags);
                 val = bcm6328_led_read(addr);
-                val |= (BIT(reg) << ((sel % 4) * 4));
+                val |= (BIT(reg % 4) << ((sel % 4) * 4));
                 bcm6328_led_write(addr, val);
                 spin_unlock_irqrestore(lock, flags);
         }
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 78a7ce816a47..9a873118ea5f 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -285,7 +285,7 @@ static int pca955x_probe(struct i2c_client *client,
                         "slave address 0x%02x\n",
                         client->name, chip->bits, client->addr);
 
-        if (!i2c_check_functionality(adapter, I2C_FUNC_I2C))
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
                 return -EIO;
 
         if (pdata) {
diff --git a/drivers/leds/trigger/ledtrig-heartbeat.c b/drivers/leds/trigger/ledtrig-heartbeat.c
index afa3b4099214..e95ea65380c8 100644
--- a/drivers/leds/trigger/ledtrig-heartbeat.c
+++ b/drivers/leds/trigger/ledtrig-heartbeat.c
@@ -20,7 +20,6 @@
 #include <linux/sched/loadavg.h>
 #include <linux/leds.h>
 #include <linux/reboot.h>
-#include <linux/suspend.h>
 #include "../leds.h"
 
 static int panic_heartbeats;
@@ -163,30 +162,6 @@ static struct led_trigger heartbeat_led_trigger = {
         .deactivate = heartbeat_trig_deactivate,
 };
 
-static int heartbeat_pm_notifier(struct notifier_block *nb,
-                                 unsigned long pm_event, void *unused)
-{
-        int rc;
-
-        switch (pm_event) {
-        case PM_SUSPEND_PREPARE:
-        case PM_HIBERNATION_PREPARE:
-        case PM_RESTORE_PREPARE:
-                led_trigger_unregister(&heartbeat_led_trigger);
-                break;
-        case PM_POST_SUSPEND:
-        case PM_POST_HIBERNATION:
-        case PM_POST_RESTORE:
-                rc = led_trigger_register(&heartbeat_led_trigger);
-                if (rc)
-                        pr_err("could not re-register heartbeat trigger\n");
-                break;
-        default:
-                break;
-        }
-        return NOTIFY_DONE;
-}
-
 static int heartbeat_reboot_notifier(struct notifier_block *nb,
                                      unsigned long code, void *unused)
 {
@@ -201,10 +176,6 @@ static int heartbeat_panic_notifier(struct notifier_block *nb,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block heartbeat_pm_nb = {
-        .notifier_call = heartbeat_pm_notifier,
-};
-
 static struct notifier_block heartbeat_reboot_nb = {
         .notifier_call = heartbeat_reboot_notifier,
 };
@@ -221,14 +192,12 @@ static int __init heartbeat_trig_init(void)
                 atomic_notifier_chain_register(&panic_notifier_list,
                                                &heartbeat_panic_nb);
                 register_reboot_notifier(&heartbeat_reboot_nb);
-                register_pm_notifier(&heartbeat_pm_nb);
         }
         return rc;
 }
 
 static void __exit heartbeat_trig_exit(void)
 {
-        unregister_pm_notifier(&heartbeat_pm_nb);
         unregister_reboot_notifier(&heartbeat_reboot_nb);
         atomic_notifier_chain_unregister(&panic_notifier_list,
                                          &heartbeat_panic_nb);
diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h
index 9b80417cd547..73da1f5626cb 100644
--- a/drivers/md/bcache/btree.h
+++ b/drivers/md/bcache/btree.h
@@ -207,7 +207,7 @@ void bkey_put(struct cache_set *c, struct bkey *k);
 
 struct btree_op {
         /* for waiting on btree reserve in btree_split() */
-        wait_queue_t            wait;
+        wait_queue_entry_t              wait;
 
         /* Btree level at which we start taking write locks */
         short                   lock;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index bf7419a56454..f4eace5ea184 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -485,10 +485,10 @@ void bitmap_print_sb(struct bitmap *bitmap)
         pr_debug("         magic: %08x\n", le32_to_cpu(sb->magic));
         pr_debug("       version: %d\n", le32_to_cpu(sb->version));
         pr_debug("          uuid: %08x.%08x.%08x.%08x\n",
-                 *(__u32 *)(sb->uuid+0),
-                 *(__u32 *)(sb->uuid+4),
-                 *(__u32 *)(sb->uuid+8),
-                 *(__u32 *)(sb->uuid+12));
+                 le32_to_cpu(*(__u32 *)(sb->uuid+0)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+4)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+8)),
+                 le32_to_cpu(*(__u32 *)(sb->uuid+12)));
         pr_debug("        events: %llu\n",
                  (unsigned long long) le64_to_cpu(sb->events));
         pr_debug("events cleared: %llu\n",
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index cd8139593ccd..840c1496b2b1 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1334,7 +1334,7 @@ int dm_bufio_issue_flush(struct dm_bufio_client *c)
 {
         struct dm_io_request io_req = {
                 .bi_op = REQ_OP_WRITE,
-                .bi_op_flags = REQ_PREFLUSH,
+                .bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
                 .mem.type = DM_IO_KMEM,
                 .mem.ptr.addr = NULL,
                 .client = c->dm_io,
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index c7f7c8d76576..7910bfe50da4 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -783,7 +783,8 @@ static void write_journal(struct dm_integrity_c *ic, unsigned commit_start, unsi
                         for (i = 0; i < commit_sections; i++)
                                 rw_section_mac(ic, commit_start + i, true);
                 }
-                rw_journal(ic, REQ_OP_WRITE, REQ_FUA, commit_start, commit_sections, &io_comp);
+                rw_journal(ic, REQ_OP_WRITE, REQ_FUA | REQ_SYNC, commit_start,
+                           commit_sections, &io_comp);
         } else {
                 unsigned to_end;
                 io_comp.in_flight = (atomic_t)ATOMIC_INIT(2);
@@ -2374,21 +2375,6 @@ static void dm_integrity_set(struct dm_target *ti, struct dm_integrity_c *ic)
         blk_queue_max_integrity_segments(disk->queue, UINT_MAX);
 }
 
-/* FIXME: use new kvmalloc */
-static void *dm_integrity_kvmalloc(size_t size, gfp_t gfp)
-{
-        void *ptr = NULL;
-
-        if (size <= PAGE_SIZE)
-                ptr = kmalloc(size, GFP_KERNEL | gfp);
-        if (!ptr && size <= KMALLOC_MAX_SIZE)
-                ptr = kmalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | gfp);
-        if (!ptr)
-                ptr = __vmalloc(size, GFP_KERNEL | gfp, PAGE_KERNEL);
-
-        return ptr;
-}
-
 static void dm_integrity_free_page_list(struct dm_integrity_c *ic, struct page_list *pl)
 {
         unsigned i;
@@ -2407,7 +2393,7 @@ static struct page_list *dm_integrity_alloc_page_list(struct dm_integrity_c *ic)
         struct page_list *pl;
         unsigned i;
 
-        pl = dm_integrity_kvmalloc(page_list_desc_size, __GFP_ZERO);
+        pl = kvmalloc(page_list_desc_size, GFP_KERNEL | __GFP_ZERO);
         if (!pl)
                 return NULL;
 
@@ -2437,7 +2423,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
         struct scatterlist **sl;
         unsigned i;
 
-        sl = dm_integrity_kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), __GFP_ZERO);
+        sl = kvmalloc(ic->journal_sections * sizeof(struct scatterlist *), GFP_KERNEL | __GFP_ZERO);
         if (!sl)
                 return NULL;
 
@@ -2453,7 +2439,7 @@ static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_int
 
                 n_pages = (end_index - start_index + 1);
 
-                s = dm_integrity_kvmalloc(n_pages * sizeof(struct scatterlist), 0);
+                s = kvmalloc(n_pages * sizeof(struct scatterlist), GFP_KERNEL);
                 if (!s) {
                         dm_integrity_free_journal_scatterlist(ic, sl);
                         return NULL;
@@ -2617,7 +2603,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 goto bad;
                         }
 
-                        sg = dm_integrity_kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), 0);
+                        sg = kvmalloc((ic->journal_pages + 1) * sizeof(struct scatterlist), GFP_KERNEL);
                         if (!sg) {
                                 *error = "Unable to allocate sg list";
                                 r = -ENOMEM;
@@ -2673,7 +2659,7 @@ static int create_journal(struct dm_integrity_c *ic, char **error)
                                 r = -ENOMEM;
                                 goto bad;
                         }
-                        ic->sk_requests = dm_integrity_kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), __GFP_ZERO);
+                        ic->sk_requests = kvmalloc(ic->journal_sections * sizeof(struct skcipher_request *), GFP_KERNEL | __GFP_ZERO);
                         if (!ic->sk_requests) {
                                 *error = "Unable to allocate sk requests";
                                 r = -ENOMEM;
@@ -2740,7 +2726,7 @@ retest_commit_id:
                 r = -ENOMEM;
                 goto bad;
         }
-        ic->journal_tree = dm_integrity_kvmalloc(journal_tree_size, 0);
+        ic->journal_tree = kvmalloc(journal_tree_size, GFP_KERNEL);
         if (!ic->journal_tree) {
                 *error = "Could not allocate memory for journal tree";
                 r = -ENOMEM;
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 0555b4410e05..41852ae287a5 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1710,12 +1710,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
         }
 
         /*
-         * Try to avoid low memory issues when a device is suspended.
+         * Use __GFP_HIGH to avoid low memory issues when a device is
+         * suspended and the ioctl is needed to resume it.
          * Use kmalloc() rather than vmalloc() when we can.
          */
         dmi = NULL;
         noio_flag = memalloc_noio_save();
-        dmi = kvmalloc(param_kernel->data_size, GFP_KERNEL);
+        dmi = kvmalloc(param_kernel->data_size, GFP_KERNEL | __GFP_HIGH);
         memalloc_noio_restore(noio_flag);
 
         if (!dmi) {
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index a95cbb80fb34..e61c45047c25 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -260,7 +260,7 @@ static int mirror_flush(struct dm_target *ti)
         struct mirror *m;
         struct dm_io_request io_req = {
                 .bi_op = REQ_OP_WRITE,
-                .bi_op_flags = REQ_PREFLUSH,
+                .bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
                 .mem.type = DM_IO_KMEM,
                 .mem.ptr.addr = NULL,
                 .client = ms->io_client,
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index b93476c3ba3f..c5534d294773 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -741,7 +741,8 @@ static void persistent_commit_exception(struct dm_exception_store *store,
         /*
          * Commit exceptions to disk.
          */
-        if (ps->valid && area_io(ps, REQ_OP_WRITE, REQ_PREFLUSH | REQ_FUA))
+        if (ps->valid && area_io(ps, REQ_OP_WRITE,
+                                 REQ_PREFLUSH | REQ_FUA | REQ_SYNC))
                 ps->valid = 0;
 
         /*
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 97de961a3bfc..1ec9b2c51c07 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -166,7 +166,7 @@ static int verity_hash_init(struct dm_verity *v, struct ahash_request *req,
                 return r;
         }
 
-        if (likely(v->version >= 1))
+        if (likely(v->salt_size && (v->version >= 1)))
                 r = verity_hash_update(v, req, v->salt, v->salt_size, res);
 
         return r;
@@ -177,7 +177,7 @@ static int verity_hash_final(struct dm_verity *v, struct ahash_request *req,
 {
         int r;
 
-        if (unlikely(!v->version)) {
+        if (unlikely(v->salt_size && (!v->version))) {
                 r = verity_hash_update(v, req, v->salt, v->salt_size, res);
 
                 if (r < 0) {
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6ef9500226c0..37ccd73c79ec 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1657,7 +1657,7 @@ static struct mapped_device *alloc_dev(int minor)
 
         bio_init(&md->flush_bio, NULL, 0);
         md->flush_bio.bi_bdev = md->bdev;
-        md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        md->flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
 
         dm_stats_init(&md->stats);
 
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 7299ce2f08a8..03082e17c65c 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -1311,8 +1311,10 @@ static int add_new_disk(struct mddev *mddev, struct md_rdev *rdev)
         cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
         lock_comm(cinfo, 1);
         ret = __sendmsg(cinfo, &cmsg);
-        if (ret)
+        if (ret) {
+                unlock_comm(cinfo);
                 return ret;
+        }
         cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE;
         ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX);
         cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 10367ffe92e3..87edc342ccb3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -765,7 +765,7 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
             test_bit(FailFast, &rdev->flags) &&
             !test_bit(LastDev, &rdev->flags))
                 ff = MD_FAILFAST;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_FUA | ff;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA | ff;
 
         atomic_inc(&mddev->pending_writes);
         submit_bio(bio);
@@ -5174,6 +5174,18 @@ static void mddev_delayed_delete(struct work_struct *ws)
 
 static void no_op(struct percpu_ref *r) {}
 
+int mddev_init_writes_pending(struct mddev *mddev)
+{
+        if (mddev->writes_pending.percpu_count_ptr)
+                return 0;
+        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
+                return -ENOMEM;
+        /* We want to start with the refcount at zero */
+        percpu_ref_put(&mddev->writes_pending);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_init_writes_pending);
+
 static int md_alloc(dev_t dev, char *name)
 {
         /*
@@ -5239,10 +5251,6 @@ static int md_alloc(dev_t dev, char *name)
         blk_queue_make_request(mddev->queue, md_make_request);
         blk_set_stacking_limits(&mddev->queue->limits);
 
-        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
-                goto abort;
-        /* We want to start with the refcount at zero */
-        percpu_ref_put(&mddev->writes_pending);
         disk = alloc_disk(1 << shift);
         if (!disk) {
                 blk_cleanup_queue(mddev->queue);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 11f15146ce51..0fa1de42c42b 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -648,6 +648,7 @@ extern void md_unregister_thread(struct md_thread **threadp);
 extern void md_wakeup_thread(struct md_thread *thread);
 extern void md_check_recovery(struct mddev *mddev);
 extern void md_reap_sync_thread(struct mddev *mddev);
+extern int mddev_init_writes_pending(struct mddev *mddev);
 extern void md_write_start(struct mddev *mddev, struct bio *bi);
 extern void md_write_inc(struct mddev *mddev, struct bio *bi);
 extern void md_write_end(struct mddev *mddev);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index af5056d56878..e1a7e3d4c5e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3063,6 +3063,8 @@ static int raid1_run(struct mddev *mddev)
                         mdname(mddev));
                 return -EIO;
         }
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
         /*
          * copy the already verified devices into our private RAID1
          * bookkeeping area. [whatever we allocate in run(),
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4343d7ff9916..797ed60abd5e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3611,6 +3611,9 @@ static int raid10_run(struct mddev *mddev)
         int first = 1;
         bool discard_supported = false;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->private == NULL) {
                 conf = setup_conf(mddev);
                 if (IS_ERR(conf))
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 4c00bc248287..0a7af8b0a80a 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -1782,7 +1782,7 @@ static int r5l_log_write_empty_meta_block(struct r5l_log *log, sector_t pos,
         mb->checksum = cpu_to_le32(crc32c_le(log->uuid_checksum,
                                              mb, PAGE_SIZE));
         if (!sync_page_io(log->rdev, pos, PAGE_SIZE, page, REQ_OP_WRITE,
-                          REQ_FUA, false)) {
+                          REQ_SYNC | REQ_FUA, false)) {
                 __free_page(page);
                 return -EIO;
         }
@@ -2388,7 +2388,7 @@ r5c_recovery_rewrite_data_only_stripes(struct r5l_log *log,
                 mb->checksum = cpu_to_le32(crc32c_le(log->uuid_checksum,
                                                      mb, PAGE_SIZE));
                 sync_page_io(log->rdev, ctx->pos, PAGE_SIZE, page,
-                             REQ_OP_WRITE, REQ_FUA, false);
+                             REQ_OP_WRITE, REQ_SYNC | REQ_FUA, false);
                 sh->log_start = ctx->pos;
                 list_add_tail(&sh->r5c, &log->stripe_in_journal_list);
                 atomic_inc(&log->stripe_in_journal_count);
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 5d25bebf3328..ccce92e68d7f 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -907,8 +907,8 @@ static int ppl_write_empty_header(struct ppl_log *log)
         pplhdr->checksum = cpu_to_le32(~crc32c_le(~0, pplhdr, PAGE_SIZE));
 
         if (!sync_page_io(rdev, rdev->ppl.sector - rdev->data_offset,
-                          PPL_HEADER_SIZE, page, REQ_OP_WRITE | REQ_FUA, 0,
-                          false)) {
+                          PPL_HEADER_SIZE, page, REQ_OP_WRITE | REQ_SYNC |
+                          REQ_FUA, 0, false)) {
                 md_error(rdev->mddev, rdev);
                 ret = -EIO;
         }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 9c4f7659f8b1..ec0f951ae19f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4085,10 +4085,15 @@ static void handle_parity_checks5(struct r5conf *conf, struct stripe_head *sh,
                         set_bit(STRIPE_INSYNC, &sh->state);
                 else {
                         atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
-                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
                                 /* don't try to repair!! */
                                 set_bit(STRIPE_INSYNC, &sh->state);
-                        else {
+                                pr_warn_ratelimited("%s: mismatch sector in range "
+                                                    "%llu-%llu\n", mdname(conf->mddev),
+                                                    (unsigned long long) sh->sector,
+                                                    (unsigned long long) sh->sector +
+                                                    STRIPE_SECTORS);
+                        } else {
                                 sh->check_state = check_state_compute_run;
                                 set_bit(STRIPE_COMPUTE_RUN, &sh->state);
                                 set_bit(STRIPE_OP_COMPUTE_BLK, &s->ops_request);
@@ -4237,10 +4242,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
                         }
                 } else {
                         atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
-                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
+                        if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery)) {
                                 /* don't try to repair!! */
                                 set_bit(STRIPE_INSYNC, &sh->state);
-                        else {
+                                pr_warn_ratelimited("%s: mismatch sector in range "
+                                                    "%llu-%llu\n", mdname(conf->mddev),
+                                                    (unsigned long long) sh->sector,
+                                                    (unsigned long long) sh->sector +
+                                                    STRIPE_SECTORS);
+                        } else {
                                 int *target = &sh->ops.target;
 
                                 sh->ops.target = -1;
@@ -7108,6 +7118,9 @@ static int raid5_run(struct mddev *mddev)
         long long min_offset_diff = 0;
         int first = 1;
 
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
+
         if (mddev->recovery_cp != MaxSector)
                 pr_notice("md/raid:%s: not clean -- starting background reconstruction\n",
                           mdname(mddev));
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index b72edd27f880..55d9c2b82b7e 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -2,6 +2,12 @@
 # Multimedia device configuration
 #
 
+config CEC_CORE
+        tristate
+
+config CEC_NOTIFIER
+        bool
+
 menuconfig MEDIA_SUPPORT
         tristate "Multimedia support"
         depends on HAS_IOMEM
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 523fea3648ad..044503aa8801 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -4,8 +4,6 @@
 
 media-objs      := media-device.o media-devnode.o media-entity.o
 
-obj-$(CONFIG_CEC_CORE) += cec/
-
 #
 # I2C drivers should come before other drivers, otherwise they'll fail
 # when compiled as builtin drivers
@@ -26,6 +24,8 @@ obj-$(CONFIG_DVB_CORE)  += dvb-core/
 # There are both core and drivers at RC subtree - merge before drivers
 obj-y += rc/
 
+obj-$(CONFIG_CEC_CORE) += cec/
+
 #
 # Finally, merge the drivers that require the core
 #
diff --git a/drivers/media/cec/Kconfig b/drivers/media/cec/Kconfig
index f944d93e3167..43428cec3a01 100644
--- a/drivers/media/cec/Kconfig
+++ b/drivers/media/cec/Kconfig
@@ -1,19 +1,6 @@
-config CEC_CORE
-        tristate
-        depends on MEDIA_CEC_SUPPORT
-        default y
-
-config MEDIA_CEC_NOTIFIER
-        bool
-
 config MEDIA_CEC_RC
         bool "HDMI CEC RC integration"
         depends on CEC_CORE && RC_CORE
+        depends on CEC_CORE=m || RC_CORE=y
         ---help---
           Pass on CEC remote control messages to the RC framework.
-
-config MEDIA_CEC_DEBUG
-        bool "HDMI CEC debugfs interface"
-        depends on CEC_CORE && DEBUG_FS
-        ---help---
-          Turns on the DebugFS interface for CEC devices.
diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
index 402a6c62a3e8..eaf408e64669 100644
--- a/drivers/media/cec/Makefile
+++ b/drivers/media/cec/Makefile
@@ -1,6 +1,6 @@
 cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
 
-ifeq ($(CONFIG_MEDIA_CEC_NOTIFIER),y)
+ifeq ($(CONFIG_CEC_NOTIFIER),y)
   cec-objs += cec-notifier.o
 endif
 
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index f5fe01c9da8a..9dfc79800c71 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1864,7 +1864,7 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
                 WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
 }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
 /*
  * Log the current state of the CEC adapter.
  * Very useful for debugging.
diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index 0860fb458757..999926f731c8 100644
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c
@@ -271,16 +271,10 @@ static long cec_receive(struct cec_adapter *adap, struct cec_fh *fh,
                         bool block, struct cec_msg __user *parg)
 {
         struct cec_msg msg = {};
-        long err = 0;
+        long err;
 
         if (copy_from_user(&msg, parg, sizeof(msg)))
                 return -EFAULT;
-        mutex_lock(&adap->lock);
-        if (!adap->is_configured && fh->mode_follower < CEC_MODE_MONITOR)
-                err = -ENONET;
-        mutex_unlock(&adap->lock);
-        if (err)
-                return err;
 
         err = cec_receive_msg(fh, &msg, block);
         if (err)
diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index f9ebff90f8eb..2f87748ba4fc 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -187,7 +187,7 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
         put_device(&devnode->dev);
 }
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 static void cec_cec_notify(struct cec_adapter *adap, u16 pa)
 {
         cec_s_phys_addr(adap, pa, false);
@@ -323,7 +323,7 @@ int cec_register_adapter(struct cec_adapter *adap,
         }
 
         dev_set_drvdata(&adap->devnode.dev, adap);
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         if (!top_cec_dir)
                 return 0;
 
@@ -355,7 +355,7 @@ void cec_unregister_adapter(struct cec_adapter *adap)
         adap->rc = NULL;
 #endif
         debugfs_remove_recursive(adap->cec_dir);
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         if (adap->notifier)
                 cec_notifier_unregister(adap->notifier);
 #endif
@@ -395,7 +395,7 @@ static int __init cec_devnode_init(void)
                 return ret;
         }
 
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
         top_cec_dir = debugfs_create_dir("cec", NULL);
         if (IS_ERR_OR_NULL(top_cec_dir)) {
                 pr_warn("cec: Failed to create debugfs cec dir\n");
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index fd181c99ce11..aaa9471c7d11 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -220,7 +220,8 @@ config VIDEO_ADV7604
 
 config VIDEO_ADV7604_CEC
         bool "Enable Analog Devices ADV7604 CEC support"
-        depends on VIDEO_ADV7604 && CEC_CORE
+        depends on VIDEO_ADV7604
+        select CEC_CORE
         ---help---
           When selected the adv7604 will support the optional
           HDMI CEC feature.
@@ -240,7 +241,8 @@ config VIDEO_ADV7842
 
 config VIDEO_ADV7842_CEC
         bool "Enable Analog Devices ADV7842 CEC support"
-        depends on VIDEO_ADV7842 && CEC_CORE
+        depends on VIDEO_ADV7842
+        select CEC_CORE
         ---help---
           When selected the adv7842 will support the optional
           HDMI CEC feature.
@@ -478,7 +480,8 @@ config VIDEO_ADV7511
 
 config VIDEO_ADV7511_CEC
         bool "Enable Analog Devices ADV7511 CEC support"
-        depends on VIDEO_ADV7511 && CEC_CORE
+        depends on VIDEO_ADV7511
+        select CEC_CORE
         ---help---
           When selected the adv7511 will support the optional
           HDMI CEC feature.
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index acef4eca269f..3251cba89e8f 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -223,7 +223,7 @@ static void i2c_wr8(struct v4l2_subdev *sd, u16 reg, u8 val)
 static void i2c_wr8_and_or(struct v4l2_subdev *sd, u16 reg,
                 u8 mask, u8 val)
 {
-        i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2);
+        i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1);
 }
 
 static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg)
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index ac026ee1ca07..041cb80a26b1 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -501,8 +501,9 @@ if CEC_PLATFORM_DRIVERS
 
 config VIDEO_SAMSUNG_S5P_CEC
        tristate "Samsung S5P CEC driver"
-       depends on CEC_CORE && (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for Samsung S5P HDMI CEC interface. It uses the
          generic CEC framework interface.
@@ -511,8 +512,9 @@ config VIDEO_SAMSUNG_S5P_CEC
 
 config VIDEO_STI_HDMI_CEC
        tristate "STMicroelectronics STiH4xx HDMI CEC driver"
-       depends on CEC_CORE && (ARCH_STI || COMPILE_TEST)
-       select MEDIA_CEC_NOTIFIER
+       depends on ARCH_STI || COMPILE_TEST
+       select CEC_CORE
+       select CEC_NOTIFIER
        ---help---
          This is a driver for STIH4xx HDMI CEC interface. It uses the
          generic CEC framework interface.
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
index 57a842ff3097..b7731b18ecae 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c
@@ -493,10 +493,10 @@ static int vdec_h264_get_param(unsigned long h_vdec,
 }
 
 static struct vdec_common_if vdec_h264_if = {
-        vdec_h264_init,
-        vdec_h264_decode,
-        vdec_h264_get_param,
-        vdec_h264_deinit,
+        .init           = vdec_h264_init,
+        .decode         = vdec_h264_decode,
+        .get_param      = vdec_h264_get_param,
+        .deinit         = vdec_h264_deinit,
 };
 
 struct vdec_common_if *get_h264_dec_comm_if(void);
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
index 6e7a62ae0842..b9fad6a48879 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c
@@ -620,10 +620,10 @@ static void vdec_vp8_deinit(unsigned long h_vdec)
 }
 
 static struct vdec_common_if vdec_vp8_if = {
-        vdec_vp8_init,
-        vdec_vp8_decode,
-        vdec_vp8_get_param,
-        vdec_vp8_deinit,
+        .init           = vdec_vp8_init,
+        .decode         = vdec_vp8_decode,
+        .get_param      = vdec_vp8_get_param,
+        .deinit         = vdec_vp8_deinit,
 };
 
 struct vdec_common_if *get_vp8_dec_comm_if(void);
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
index 5539b1853f16..1daee1207469 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
@@ -979,10 +979,10 @@ static int vdec_vp9_get_param(unsigned long h_vdec,
 }
 
 static struct vdec_common_if vdec_vp9_if = {
-        vdec_vp9_init,
-        vdec_vp9_decode,
-        vdec_vp9_get_param,
-        vdec_vp9_deinit,
+        .init           = vdec_vp9_init,
+        .decode         = vdec_vp9_decode,
+        .get_param      = vdec_vp9_get_param,
+        .deinit         = vdec_vp9_deinit,
 };
 
 struct vdec_common_if *get_vp9_dec_comm_if(void);
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index b36ac19dc6e4..154de92dd809 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -26,7 +26,8 @@ config VIDEO_VIVID
 
 config VIDEO_VIVID_CEC
         bool "Enable CEC emulation support"
-        depends on VIDEO_VIVID && CEC_CORE
+        depends on VIDEO_VIVID
+        select CEC_CORE
         ---help---
           When selected the vivid module will emulate the optional
           HDMI CEC feature.
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 90f66dc7c0d7..a2fc1a1d58b0 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle);
  */
 void ir_raw_event_handle(struct rc_dev *dev)
 {
-        if (!dev->raw)
+        if (!dev->raw || !dev->raw->thread)
                 return;
 
         wake_up_process(dev->raw->thread);
@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev)
 {
         int rc;
         struct ir_raw_handler *handler;
+        struct task_struct *thread;
 
         if (!dev)
                 return -EINVAL;
@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev)
          * because the event is coming from userspace
          */
         if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw,
-                                               "rc%u", dev->minor);
+                thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u",
+                                     dev->minor);
 
-                if (IS_ERR(dev->raw->thread)) {
-                        rc = PTR_ERR(dev->raw->thread);
+                if (IS_ERR(thread)) {
+                        rc = PTR_ERR(thread);
                         goto out;
                 }
+
+                dev->raw->thread = thread;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/rc/sir_ir.c b/drivers/media/rc/sir_ir.c
index e12ec50bf0bf..90a5f8fd5eea 100644
--- a/drivers/media/rc/sir_ir.c
+++ b/drivers/media/rc/sir_ir.c
@@ -183,9 +183,15 @@ static irqreturn_t sir_interrupt(int irq, void *dev_id)
         static unsigned long delt;
         unsigned long deltintr;
         unsigned long flags;
+        int counter = 0;
         int iir, lsr;
 
         while ((iir = inb(io + UART_IIR) & UART_IIR_ID)) {
+                if (++counter > 256) {
+                        dev_err(&sir_ir_dev->dev, "Trapped in interrupt");
+                        break;
+                }
+
                 switch (iir & UART_IIR_ID) { /* FIXME toto treba preriedit */
                 case UART_IIR_MSI:
                         (void)inb(io + UART_MSR);
diff --git a/drivers/media/usb/pulse8-cec/Kconfig b/drivers/media/usb/pulse8-cec/Kconfig
index 8937f3986a01..18ead44824ba 100644
--- a/drivers/media/usb/pulse8-cec/Kconfig
+++ b/drivers/media/usb/pulse8-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_PULSE8_CEC
         tristate "Pulse Eight HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/Kconfig b/drivers/media/usb/rainshadow-cec/Kconfig
index 3eb86607efb8..030ef01b1ff0 100644
--- a/drivers/media/usb/rainshadow-cec/Kconfig
+++ b/drivers/media/usb/rainshadow-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_RAINSHADOW_CEC
         tristate "RainShadow Tech HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
         select SERIO
         select SERIO_SERPORT
         ---help---
diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
index 541ca543f71f..4126552c9055 100644
--- a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
@@ -119,7 +119,7 @@ static void rain_irq_work_handler(struct work_struct *work)
 
         while (true) {
                 unsigned long flags;
-                bool exit_loop;
+                bool exit_loop = false;
                 char data;
 
                 spin_lock_irqsave(&rain->buf_lock, flags);
@@ -336,6 +336,7 @@ static int rain_connect(struct serio *serio, struct serio_driver *drv)
         serio_set_drvdata(serio, rain);
         INIT_WORK(&rain->work, rain_irq_work_handler);
         mutex_init(&rain->write_lock);
+        spin_lock_init(&rain->buf_lock);
 
         err = serio_open(serio, drv);
         if (err)
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 94afbbf92807..c0175ea7e7ad 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -868,7 +868,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
 
 void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
 {
-        if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+        if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
                 return NULL;
 
         return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 35910f945bfa..99e644cda4d1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -581,7 +581,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
         return of_platform_populate(np, NULL, NULL, dev);
 }
 
-static int atmel_ebi_resume(struct device *dev)
+static __maybe_unused int atmel_ebi_resume(struct device *dev)
 {
         struct atmel_ebi *ebi = dev_get_drvdata(dev);
         struct atmel_ebi_dev *ebid;
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 17b433f1ce23..0761271d68c5 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -159,11 +159,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
 
         /* Do this outside the status_mutex to avoid a circular dependency with
          * the locking in cxl_mmap_fault() */
-        if (copy_from_user(&work, uwork,
-                           sizeof(struct cxl_ioctl_start_work))) {
-                rc = -EFAULT;
-                goto out;
-        }
+        if (copy_from_user(&work, uwork, sizeof(work)))
+                return -EFAULT;
 
         mutex_lock(&ctx->status_mutex);
         if (ctx->status != OPENED) {
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 871a2f09c718..8d6ea9712dbd 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -1302,13 +1302,16 @@ int cxl_native_register_psl_err_irq(struct cxl *adapter)
 
 void cxl_native_release_psl_err_irq(struct cxl *adapter)
 {
-        if (adapter->native->err_virq != irq_find_mapping(NULL, adapter->native->err_hwirq))
+        if (adapter->native->err_virq == 0 ||
+            adapter->native->err_virq !=
+            irq_find_mapping(NULL, adapter->native->err_hwirq))
                 return;
 
         cxl_p1_write(adapter, CXL_PSL_ErrIVTE, 0x0000000000000000);
         cxl_unmap_irq(adapter->native->err_virq, adapter);
         cxl_ops->release_one_irq(adapter, adapter->native->err_hwirq);
         kfree(adapter->irq_name);
+        adapter->native->err_virq = 0;
 }
 
 int cxl_native_register_serr_irq(struct cxl_afu *afu)
@@ -1346,13 +1349,15 @@ int cxl_native_register_serr_irq(struct cxl_afu *afu)
 
 void cxl_native_release_serr_irq(struct cxl_afu *afu)
 {
-        if (afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
+        if (afu->serr_virq == 0 ||
+            afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
                 return;
 
         cxl_p1n_write(afu, CXL_PSL_SERR_An, 0x0000000000000000);
         cxl_unmap_irq(afu->serr_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->serr_hwirq);
         kfree(afu->err_irq_name);
+        afu->serr_virq = 0;
 }
 
 int cxl_native_register_psl_irq(struct cxl_afu *afu)
@@ -1375,12 +1380,15 @@ int cxl_native_register_psl_irq(struct cxl_afu *afu)
 
 void cxl_native_release_psl_irq(struct cxl_afu *afu)
 {
-        if (afu->native->psl_virq != irq_find_mapping(NULL, afu->native->psl_hwirq))
+        if (afu->native->psl_virq == 0 ||
+            afu->native->psl_virq !=
+            irq_find_mapping(NULL, afu->native->psl_hwirq))
                 return;
 
         cxl_unmap_irq(afu->native->psl_virq, afu);
         cxl_ops->release_one_irq(afu->adapter, afu->native->psl_hwirq);
         kfree(afu->psl_irq_name);
+        afu->native->psl_virq = 0;
 }
 
 static void recover_psl_err(struct cxl_afu *afu, u64 errstat)
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index d1928fdd0f43..07aad8576334 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -763,8 +763,10 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *a,
 {
         struct mei_cl_device *cldev = to_mei_cl_device(dev);
         const uuid_le *uuid = mei_me_cl_uuid(cldev->me_cl);
+        u8 version = mei_me_cl_ver(cldev->me_cl);
 
-        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:", cldev->name, uuid);
+        return scnprintf(buf, PAGE_SIZE, "mei:%s:%pUl:%02X:",
+                         cldev->name, uuid, version);
 }
 static DEVICE_ATTR_RO(modalias);
 
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index c862cd4583cc..b8069eec18cb 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -309,6 +309,9 @@ static inline enum xp_retval
 xpc_send(short partid, int ch_number, u32 flags, void *payload,
          u16 payload_size)
 {
+        if (!xpc_interface.send)
+                return xpNotLoaded;
+
         return xpc_interface.send(partid, ch_number, flags, payload,
                                   payload_size);
 }
@@ -317,6 +320,9 @@ static inline enum xp_retval
 xpc_send_notify(short partid, int ch_number, u32 flags, void *payload,
                 u16 payload_size, xpc_notify_func func, void *key)
 {
+        if (!xpc_interface.send_notify)
+                return xpNotLoaded;
+
         return xpc_interface.send_notify(partid, ch_number, flags, payload,
                                          payload_size, func, key);
 }
@@ -324,12 +330,16 @@ xpc_send_notify(short partid, int ch_number, u32 flags, void *payload,
 static inline void
 xpc_received(short partid, int ch_number, void *payload)
 {
-        return xpc_interface.received(partid, ch_number, payload);
+        if (xpc_interface.received)
+                xpc_interface.received(partid, ch_number, payload);
 }
 
 static inline enum xp_retval
 xpc_partid_to_nasids(short partid, void *nasids)
 {
+        if (!xpc_interface.partid_to_nasids)
+                return xpNotLoaded;
+
         return xpc_interface.partid_to_nasids(partid, nasids);
 }
 
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 01be66d02ca8..6d7f557fd1c1 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -69,23 +69,9 @@ struct xpc_registration xpc_registrations[XPC_MAX_NCHANNELS];
 EXPORT_SYMBOL_GPL(xpc_registrations);
 
 /*
- * Initialize the XPC interface to indicate that XPC isn't loaded.
+ * Initialize the XPC interface to NULL to indicate that XPC isn't loaded.
  */
-static enum xp_retval
-xpc_notloaded(void)
-{
-        return xpNotLoaded;
-}
-
-struct xpc_interface xpc_interface = {
-        (void (*)(int))xpc_notloaded,
-        (void (*)(int))xpc_notloaded,
-        (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
-        (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
-                           void *))xpc_notloaded,
-        (void (*)(short, int, void *))xpc_notloaded,
-        (enum xp_retval(*)(short, void *))xpc_notloaded
-};
+struct xpc_interface xpc_interface = { };
 EXPORT_SYMBOL_GPL(xpc_interface);
 
 /*
@@ -115,17 +101,7 @@ EXPORT_SYMBOL_GPL(xpc_set_interface);
 void
 xpc_clear_interface(void)
 {
-        xpc_interface.connect = (void (*)(int))xpc_notloaded;
-        xpc_interface.disconnect = (void (*)(int))xpc_notloaded;
-        xpc_interface.send = (enum xp_retval(*)(short, int, u32, void *, u16))
-            xpc_notloaded;
-        xpc_interface.send_notify = (enum xp_retval(*)(short, int, u32, void *,
-                                                       u16, xpc_notify_func,
-                                                       void *))xpc_notloaded;
-        xpc_interface.received = (void (*)(short, int, void *))
-            xpc_notloaded;
-        xpc_interface.partid_to_nasids = (enum xp_retval(*)(short, void *))
-            xpc_notloaded;
+        memset(&xpc_interface, 0, sizeof(xpc_interface));
 }
 EXPORT_SYMBOL_GPL(xpc_clear_interface);
 
@@ -188,7 +164,8 @@ xpc_connect(int ch_number, xpc_channel_func func, void *key, u16 payload_size,
 
         mutex_unlock(&registration->mutex);
 
-        xpc_interface.connect(ch_number);
+        if (xpc_interface.connect)
+                xpc_interface.connect(ch_number);
 
         return xpSuccess;
 }
@@ -237,7 +214,8 @@ xpc_disconnect(int ch_number)
         registration->assigned_limit = 0;
         registration->idle_limit = 0;
 
-        xpc_interface.disconnect(ch_number);
+        if (xpc_interface.disconnect)
+                xpc_interface.disconnect(ch_number);
 
         mutex_unlock(&registration->mutex);
 
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index 1304160de168..13ef162cf066 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -27,6 +27,7 @@ struct mmc_pwrseq_simple {
         struct mmc_pwrseq pwrseq;
         bool clk_enabled;
         u32 post_power_on_delay_ms;
+        u32 power_off_delay_us;
         struct clk *ext_clk;
         struct gpio_descs *reset_gpios;
 };
@@ -78,6 +79,10 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host)
 
         mmc_pwrseq_simple_set_gpios_value(pwrseq, 1);
 
+        if (pwrseq->power_off_delay_us)
+                usleep_range(pwrseq->power_off_delay_us,
+                        2 * pwrseq->power_off_delay_us);
+
         if (!IS_ERR(pwrseq->ext_clk) && pwrseq->clk_enabled) {
                 clk_disable_unprepare(pwrseq->ext_clk);
                 pwrseq->clk_enabled = false;
@@ -119,6 +124,8 @@ static int mmc_pwrseq_simple_probe(struct platform_device *pdev)
 
         device_property_read_u32(dev, "post-power-on-delay-ms",
                                  &pwrseq->post_power_on_delay_ms);
+        device_property_read_u32(dev, "power-off-delay-us",
+                                 &pwrseq->power_off_delay_us);
 
         pwrseq->pwrseq.dev = dev;
         pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops;
diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c
index 772d0900026d..951d2cdd7888 100644
--- a/drivers/mmc/host/cavium-octeon.c
+++ b/drivers/mmc/host/cavium-octeon.c
@@ -108,7 +108,7 @@ static void octeon_mmc_release_bus(struct cvm_mmc_host *host)
 static void octeon_mmc_int_enable(struct cvm_mmc_host *host, u64 val)
 {
         writeq(val, host->base + MIO_EMM_INT(host));
-        if (!host->dma_active || (host->dma_active && !host->has_ciu3))
+        if (!host->has_ciu3)
                 writeq(val, host->base + MIO_EMM_INT_EN(host));
 }
 
@@ -267,7 +267,7 @@ static int octeon_mmc_probe(struct platform_device *pdev)
         }
 
         host->global_pwr_gpiod = devm_gpiod_get_optional(&pdev->dev,
-                                                         "power-gpios",
+                                                         "power",
                                                          GPIOD_OUT_HIGH);
         if (IS_ERR(host->global_pwr_gpiod)) {
                 dev_err(&pdev->dev, "Invalid power GPIO\n");
@@ -288,11 +288,20 @@ static int octeon_mmc_probe(struct platform_device *pdev)
                 if (ret) {
                         dev_err(&pdev->dev, "Error populating slots\n");
                         octeon_mmc_set_shared_power(host, 0);
-                        return ret;
+                        goto error;
                 }
                 i++;
         }
         return 0;
+
+error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
+        return ret;
 }
 
 static int octeon_mmc_remove(struct platform_device *pdev)
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index fe3d77267cd6..b9cc95998799 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -146,6 +146,12 @@ static int thunder_mmc_probe(struct pci_dev *pdev,
         return 0;
 
 error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
         clk_disable_unprepare(host->clk);
         return ret;
 }
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 58b51ba6aabd..b8aaf0fdb77c 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -839,14 +839,14 @@ static void cvm_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 cvm_mmc_reset_bus(slot);
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 0);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, 0);
                 break;
 
         case MMC_POWER_UP:
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 1);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
                 break;
         }
@@ -968,20 +968,15 @@ static int cvm_mmc_of_parse(struct device *dev, struct cvm_mmc_slot *slot)
                 return -EINVAL;
         }
 
-        mmc->supply.vmmc = devm_regulator_get_optional(dev, "vmmc");
-        if (IS_ERR(mmc->supply.vmmc)) {
-                if (PTR_ERR(mmc->supply.vmmc) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                /*
-                 * Legacy Octeon firmware has no regulator entry, fall-back to
-                 * a hard-coded voltage to get a sane OCR.
-                 */
+        ret = mmc_regulator_get_supply(mmc);
+        if (ret == -EPROBE_DEFER)
+                return ret;
+        /*
+         * Legacy Octeon firmware has no regulator entry, fall-back to
+         * a hard-coded voltage to get a sane OCR.
+         */
+        if (IS_ERR(mmc->supply.vmmc))
                 mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
-        } else {
-                ret = mmc_regulator_get_ocrmask(mmc->supply.vmmc);
-                if (ret > 0)
-                        mmc->ocr_avail = ret;
-        }
 
         /* Common MMC bindings */
         ret = mmc_of_parse(mmc);
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 1842ed341af1..de962c2d5e00 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -210,6 +210,15 @@ static void meson_mmc_get_transfer_mode(struct mmc_host *mmc,
         int i;
         bool use_desc_chain_mode = true;
 
+        /*
+         * Broken SDIO with AP6255-based WiFi on Khadas VIM Pro has been
+         * reported. For some strange reason this occurs in descriptor
+         * chain mode only. So let's fall back to bounce buffer mode
+         * for command SD_IO_RW_EXTENDED.
+         */
+        if (mrq->cmd->opcode == SD_IO_RW_EXTENDED)
+                return;
+
         for_each_sg(data->sg, sg, data->sg_len, i)
                 /* check for 8 byte alignment */
                 if (sg->offset & 7) {
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 3275d4995812..61666d269771 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -187,7 +187,8 @@ static const struct sdhci_iproc_data iproc_cygnus_data = {
 };
 
 static const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = {
-        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+                  SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
         .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN,
         .ops = &sdhci_iproc_ops,
 };
diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c
index 6356781f1cca..f7e26b031e76 100644
--- a/drivers/mmc/host/sdhci-xenon-phy.c
+++ b/drivers/mmc/host/sdhci-xenon-phy.c
@@ -787,14 +787,6 @@ int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios)
         return ret;
 }
 
-void xenon_clean_phy(struct sdhci_host *host)
-{
-        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
-        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
-
-        kfree(priv->phy_params);
-}
-
 static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
                          const char *phy_name)
 {
@@ -819,11 +811,7 @@ static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
         if (ret)
                 return ret;
 
-        ret = xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
-        if (ret)
-                xenon_clean_phy(host);
-
-        return ret;
+        return xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
 }
 
 int xenon_phy_parse_dt(struct device_node *np, struct sdhci_host *host)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 67246655315b..bc1781bb070b 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -486,7 +486,7 @@ static int xenon_probe(struct platform_device *pdev)
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto clean_phy_param;
+                goto err_clk;
 
         err = sdhci_add_host(host);
         if (err)
@@ -496,8 +496,6 @@ static int xenon_probe(struct platform_device *pdev)
 
 remove_sdhc:
         xenon_sdhc_unprepare(host);
-clean_phy_param:
-        xenon_clean_phy(host);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -510,8 +508,6 @@ static int xenon_remove(struct platform_device *pdev)
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        xenon_clean_phy(host);
-
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 6e6523ea01ce..73debb42dc2f 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -93,7 +93,6 @@ struct xenon_priv {
 };
 
 int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios);
-void xenon_clean_phy(struct sdhci_host *host);
 int xenon_phy_parse_dt(struct device_node *np,
                        struct sdhci_host *host);
 void xenon_soc_pad_ctrl(struct sdhci_host *host,
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d474378ed810..b1dd12729f19 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -202,7 +202,7 @@ static int nand_ooblayout_free_lp_hamming(struct mtd_info *mtd, int section,
         return 0;
 }
 
-const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
+static const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
         .ecc = nand_ooblayout_ecc_lp_hamming,
         .free = nand_ooblayout_free_lp_hamming,
 };
@@ -4361,7 +4361,7 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
         /* Initialize the ->data_interface field. */
         ret = nand_init_data_interface(chip);
         if (ret)
-                return ret;
+                goto err_nand_init;
 
         /*
          * Setup the data interface correctly on the chip and controller side.
@@ -4373,7 +4373,7 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
          */
         ret = nand_setup_data_interface(chip);
         if (ret)
-                return ret;
+                goto err_nand_init;
 
         nand_maf_id = chip->id.data[0];
         nand_dev_id = chip->id.data[1];
@@ -4404,6 +4404,12 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips,
         mtd->size = i * chip->chipsize;
 
         return 0;
+
+err_nand_init:
+        /* Free manufacturer priv data. */
+        nand_manufacturer_cleanup(chip);
+
+        return ret;
 }
 EXPORT_SYMBOL(nand_scan_ident);
 
@@ -4574,18 +4580,23 @@ int nand_scan_tail(struct mtd_info *mtd)
 
         /* New bad blocks should be marked in OOB, flash-based BBT, or both */
         if (WARN_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-                   !(chip->bbt_options & NAND_BBT_USE_FLASH)))
-                return -EINVAL;
+                   !(chip->bbt_options & NAND_BBT_USE_FLASH))) {
+                ret = -EINVAL;
+                goto err_ident;
+        }
 
         if (invalid_ecc_page_accessors(chip)) {
                 pr_err("Invalid ECC page accessors setup\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_ident;
         }
 
         if (!(chip->options & NAND_OWN_BUFFERS)) {
                 nbuf = kzalloc(sizeof(*nbuf), GFP_KERNEL);
-                if (!nbuf)
-                        return -ENOMEM;
+                if (!nbuf) {
+                        ret = -ENOMEM;
+                        goto err_ident;
+                }
 
                 nbuf->ecccalc = kmalloc(mtd->oobsize, GFP_KERNEL);
                 if (!nbuf->ecccalc) {
@@ -4608,8 +4619,10 @@ int nand_scan_tail(struct mtd_info *mtd)
 
                 chip->buffers = nbuf;
         } else {
-                if (!chip->buffers)
-                        return -ENOMEM;
+                if (!chip->buffers) {
+                        ret = -ENOMEM;
+                        goto err_ident;
+                }
         }
 
         /* Set the internal oob buffer location, just after the page data */
@@ -4842,7 +4855,11 @@ int nand_scan_tail(struct mtd_info *mtd)
                 return 0;
 
         /* Build bad block table */
-        return chip->scan_bbt(mtd);
+        ret = chip->scan_bbt(mtd);
+        if (ret)
+                goto err_free;
+        return 0;
+
 err_free:
         if (nbuf) {
                 kfree(nbuf->databuf);
@@ -4850,6 +4867,13 @@ err_free:
                 kfree(nbuf->ecccalc);
                 kfree(nbuf);
         }
+
+err_ident:
+        /* Clean up nand_scan_ident(). */
+
+        /* Free manufacturer priv data. */
+        nand_manufacturer_cleanup(chip);
+
         return ret;
 }
 EXPORT_SYMBOL(nand_scan_tail);
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index 9d5ca0e540b5..92e2cf8e9ff9 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -6,7 +6,6 @@
  * published by the Free Software Foundation.
  *
  */
-#include <linux/module.h>
 #include <linux/mtd/nand.h>
 #include <linux/sizes.h>
 
diff --git a/drivers/mtd/nand/nand_samsung.c b/drivers/mtd/nand/nand_samsung.c
index 9cfc4035a420..1e0755997762 100644
--- a/drivers/mtd/nand/nand_samsung.c
+++ b/drivers/mtd/nand/nand_samsung.c
@@ -84,6 +84,9 @@ static void samsung_nand_decode_id(struct nand_chip *chip)
                         case 7:
                                 chip->ecc_strength_ds = 60;
                                 break;
+                        default:
+                                WARN(1, "Could not decode ECC info");
+                                chip->ecc_step_ds = 0;
                         }
                 }
         } else {
diff --git a/drivers/mtd/nand/tango_nand.c b/drivers/mtd/nand/tango_nand.c
index 05b6e1065203..49b286c6c10f 100644
--- a/drivers/mtd/nand/tango_nand.c
+++ b/drivers/mtd/nand/tango_nand.c
@@ -55,10 +55,10 @@
  * byte 1 for other packets in the page (PKT_N, for N > 0)
  * ERR_COUNT_PKT_N is the max error count over all but the first packet.
  */
-#define DECODE_OK_PKT_0(v)      ((v) & BIT(7))
-#define DECODE_OK_PKT_N(v)      ((v) & BIT(15))
 #define ERR_COUNT_PKT_0(v)      (((v) >> 0) & 0x3f)
 #define ERR_COUNT_PKT_N(v)      (((v) >> 8) & 0x3f)
+#define DECODE_FAIL_PKT_0(v)    (((v) & BIT(7)) == 0)
+#define DECODE_FAIL_PKT_N(v)    (((v) & BIT(15)) == 0)
 
 /* Offsets relative to pbus_base */
 #define PBUS_CS_CTRL    0x83c
@@ -193,6 +193,8 @@ static int check_erased_page(struct nand_chip *chip, u8 *buf)
                                                   chip->ecc.strength);
                 if (res < 0)
                         mtd->ecc_stats.failed++;
+                else
+                        mtd->ecc_stats.corrected += res;
 
                 bitflips = max(res, bitflips);
                 buf += pkt_size;
@@ -202,9 +204,11 @@ static int check_erased_page(struct nand_chip *chip, u8 *buf)
         return bitflips;
 }
 
-static int decode_error_report(struct tango_nfc *nfc)
+static int decode_error_report(struct nand_chip *chip)
 {
         u32 status, res;
+        struct mtd_info *mtd = nand_to_mtd(chip);
+        struct tango_nfc *nfc = to_tango_nfc(chip->controller);
 
         status = readl_relaxed(nfc->reg_base + NFC_XFER_STATUS);
         if (status & PAGE_IS_EMPTY)
@@ -212,10 +216,14 @@ static int decode_error_report(struct tango_nfc *nfc)
 
         res = readl_relaxed(nfc->mem_base + ERROR_REPORT);
 
-        if (DECODE_OK_PKT_0(res) && DECODE_OK_PKT_N(res))
-                return max(ERR_COUNT_PKT_0(res), ERR_COUNT_PKT_N(res));
+        if (DECODE_FAIL_PKT_0(res) || DECODE_FAIL_PKT_N(res))
+                return -EBADMSG;
+
+        /* ERR_COUNT_PKT_N is max, not sum, but that's all we have */
+        mtd->ecc_stats.corrected +=
+                ERR_COUNT_PKT_0(res) + ERR_COUNT_PKT_N(res);
 
-        return -EBADMSG;
+        return max(ERR_COUNT_PKT_0(res), ERR_COUNT_PKT_N(res));
 }
 
 static void tango_dma_callback(void *arg)
@@ -282,7 +290,7 @@ static int tango_read_page(struct mtd_info *mtd, struct nand_chip *chip,
         if (err)
                 return err;
 
-        res = decode_error_report(nfc);
+        res = decode_error_report(chip);
         if (res < 0) {
                 chip->ecc.read_oob_raw(mtd, chip, page);
                 res = check_erased_page(chip, buf);
@@ -663,6 +671,7 @@ static const struct of_device_id tango_nand_ids[] = {
         { .compatible = "sigma,smp8758-nand" },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, tango_nand_ids);
 
 static struct platform_driver tango_nand_driver = {
         .probe  = tango_nand_probe,
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index b44a6aeb346d..e5386ab706ec 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -90,10 +90,13 @@ enum ad_link_speed_type {
         AD_LINK_SPEED_100MBPS,
         AD_LINK_SPEED_1000MBPS,
         AD_LINK_SPEED_2500MBPS,
+        AD_LINK_SPEED_5000MBPS,
         AD_LINK_SPEED_10000MBPS,
+        AD_LINK_SPEED_14000MBPS,
         AD_LINK_SPEED_20000MBPS,
         AD_LINK_SPEED_25000MBPS,
         AD_LINK_SPEED_40000MBPS,
+        AD_LINK_SPEED_50000MBPS,
         AD_LINK_SPEED_56000MBPS,
         AD_LINK_SPEED_100000MBPS,
 };
@@ -259,10 +262,13 @@ static inline int __check_agg_selection_timer(struct port *port)
  *     %AD_LINK_SPEED_100MBPS,
  *     %AD_LINK_SPEED_1000MBPS,
  *     %AD_LINK_SPEED_2500MBPS,
+ *     %AD_LINK_SPEED_5000MBPS,
  *     %AD_LINK_SPEED_10000MBPS
+ *     %AD_LINK_SPEED_14000MBPS,
  *     %AD_LINK_SPEED_20000MBPS
  *     %AD_LINK_SPEED_25000MBPS
  *     %AD_LINK_SPEED_40000MBPS
+ *     %AD_LINK_SPEED_50000MBPS
  *     %AD_LINK_SPEED_56000MBPS
  *     %AD_LINK_SPEED_100000MBPS
  */
@@ -296,10 +302,18 @@ static u16 __get_link_speed(struct port *port)
                         speed = AD_LINK_SPEED_2500MBPS;
                         break;
 
+                case SPEED_5000:
+                        speed = AD_LINK_SPEED_5000MBPS;
+                        break;
+
                 case SPEED_10000:
                         speed = AD_LINK_SPEED_10000MBPS;
                         break;
 
+                case SPEED_14000:
+                        speed = AD_LINK_SPEED_14000MBPS;
+                        break;
+
                 case SPEED_20000:
                         speed = AD_LINK_SPEED_20000MBPS;
                         break;
@@ -312,6 +326,10 @@ static u16 __get_link_speed(struct port *port)
                         speed = AD_LINK_SPEED_40000MBPS;
                         break;
 
+                case SPEED_50000:
+                        speed = AD_LINK_SPEED_50000MBPS;
+                        break;
+
                 case SPEED_56000:
                         speed = AD_LINK_SPEED_56000MBPS;
                         break;
@@ -707,9 +725,15 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                 case AD_LINK_SPEED_2500MBPS:
                         bandwidth = nports * 2500;
                         break;
+                case AD_LINK_SPEED_5000MBPS:
+                        bandwidth = nports * 5000;
+                        break;
                 case AD_LINK_SPEED_10000MBPS:
                         bandwidth = nports * 10000;
                         break;
+                case AD_LINK_SPEED_14000MBPS:
+                        bandwidth = nports * 14000;
+                        break;
                 case AD_LINK_SPEED_20000MBPS:
                         bandwidth = nports * 20000;
                         break;
@@ -719,6 +743,9 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator)
                 case AD_LINK_SPEED_40000MBPS:
                         bandwidth = nports * 40000;
                         break;
+                case AD_LINK_SPEED_50000MBPS:
+                        bandwidth = nports * 50000;
+                        break;
                 case AD_LINK_SPEED_56000MBPS:
                         bandwidth = nports * 56000;
                         break;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 73313318399c..8ab6bdbe1682 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2612,11 +2612,13 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
         bond_for_each_slave_rcu(bond, slave, iter) {
                 unsigned long trans_start = dev_trans_start(slave->dev);
 
+                slave->new_link = BOND_LINK_NOCHANGE;
+
                 if (slave->link != BOND_LINK_UP) {
                         if (bond_time_in_interval(bond, trans_start, 1) &&
                             bond_time_in_interval(bond, slave->last_rx, 1)) {
 
-                                slave->link  = BOND_LINK_UP;
+                                slave->new_link = BOND_LINK_UP;
                                 slave_state_changed = 1;
 
                                 /* primary_slave has no meaning in round-robin
@@ -2643,7 +2645,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                         if (!bond_time_in_interval(bond, trans_start, 2) ||
                             !bond_time_in_interval(bond, slave->last_rx, 2)) {
 
-                                slave->link  = BOND_LINK_DOWN;
+                                slave->new_link = BOND_LINK_DOWN;
                                 slave_state_changed = 1;
 
                                 if (slave->link_failure_count < UINT_MAX)
@@ -2674,6 +2676,11 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                 if (!rtnl_trylock())
                         goto re_arm;
 
+                bond_for_each_slave(bond, slave, iter) {
+                        if (slave->new_link != BOND_LINK_NOCHANGE)
+                                slave->link = slave->new_link;
+                }
+
                 if (slave_state_changed) {
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
@@ -4185,7 +4192,6 @@ static void bond_destructor(struct net_device *bond_dev)
         struct bonding *bond = netdev_priv(bond_dev);
         if (bond->wq)
                 destroy_workqueue(bond->wq);
-        free_netdev(bond_dev);
 }
 
 void bond_setup(struct net_device *bond_dev)
@@ -4205,7 +4211,8 @@ void bond_setup(struct net_device *bond_dev)
         bond_dev->netdev_ops = &bond_netdev_ops;
         bond_dev->ethtool_ops = &bond_ethtool_ops;
 
-        bond_dev->destructor = bond_destructor;
+        bond_dev->needs_free_netdev = true;
+        bond_dev->priv_destructor = bond_destructor;
 
         SET_NETDEV_DEVTYPE(bond_dev, &bond_type);
 
@@ -4729,7 +4736,7 @@ int bond_create(struct net *net, const char *name)
 
         rtnl_unlock();
         if (res < 0)
-                bond_destructor(bond_dev);
+                free_netdev(bond_dev);
         return res;
 }
 
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index ddabce759456..71a7c3b44fdd 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -1121,7 +1121,7 @@ static void cfhsi_setup(struct net_device *dev)
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
         dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
         dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->netdev_ops = &cfhsi_netdevops;
         for (i = 0; i < CFHSI_PRIO_LAST; ++i)
                 skb_queue_head_init(&cfhsi->qhead[i]);
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index c2dea4916e5d..76e1d3545105 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -428,7 +428,7 @@ static void caifdev_setup(struct net_device *dev)
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
         dev->mtu = CAIF_MAX_MTU;
         dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         skb_queue_head_init(&serdev->head);
         serdev->common.link_select = CAIF_LINK_LOW_LATENCY;
         serdev->common.use_frag = true;
diff --git a/drivers/net/caif/caif_spi.c b/drivers/net/caif/caif_spi.c
index 3a529fbe539f..fc21afe852b9 100644
--- a/drivers/net/caif/caif_spi.c
+++ b/drivers/net/caif/caif_spi.c
@@ -712,7 +712,7 @@ static void cfspi_setup(struct net_device *dev)
         dev->flags = IFF_NOARP | IFF_POINTOPOINT;
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->mtu = SPI_MAX_PAYLOAD_SIZE;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         skb_queue_head_init(&cfspi->qhead);
         skb_queue_head_init(&cfspi->chead);
         cfspi->cfdev.link_select = CAIF_LINK_HIGH_BANDW;
diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c
index 6122768c8644..1794ea0420b7 100644
--- a/drivers/net/caif/caif_virtio.c
+++ b/drivers/net/caif/caif_virtio.c
@@ -617,7 +617,7 @@ static void cfv_netdev_setup(struct net_device *netdev)
         netdev->tx_queue_len = 100;
         netdev->flags = IFF_POINTOPOINT | IFF_NOARP;
         netdev->mtu = CFV_DEF_MTU_SIZE;
-        netdev->destructor = free_netdev;
+        netdev->needs_free_netdev = true;
 }
 
 /* Create debugfs counters for the device */
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 611d16a7061d..ae4ed03dc642 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -391,6 +391,9 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
         can_update_state_error_stats(dev, new_state);
         priv->state = new_state;
 
+        if (!cf)
+                return;
+
         if (unlikely(new_state == CAN_STATE_BUS_OFF)) {
                 cf->can_id |= CAN_ERR_BUSOFF;
                 return;
diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c
index 0d57be5ea97b..85268be0c913 100644
--- a/drivers/net/can/peak_canfd/peak_canfd.c
+++ b/drivers/net/can/peak_canfd/peak_canfd.c
@@ -489,7 +489,7 @@ int peak_canfd_handle_msgs_list(struct peak_canfd_priv *priv,
                                 struct pucan_rx_msg *msg_list, int msg_count)
 {
         void *msg_ptr = msg_list;
-        int i, msg_size;
+        int i, msg_size = 0;
 
         for (i = 0; i < msg_count; i++) {
                 msg_size = peak_canfd_handle_msg(priv, msg_ptr);
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index eb7173713bbc..6a6e896e52fa 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -417,7 +417,7 @@ static int slc_open(struct net_device *dev)
 static void slc_free_netdev(struct net_device *dev)
 {
         int i = dev->base_addr;
-        free_netdev(dev);
+
         slcan_devs[i] = NULL;
 }
 
@@ -436,7 +436,8 @@ static const struct net_device_ops slc_netdev_ops = {
 static void slc_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &slc_netdev_ops;
-        dev->destructor         = slc_free_netdev;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = slc_free_netdev;
 
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
@@ -761,8 +762,6 @@ static void __exit slcan_exit(void)
                 if (sl->tty) {
                         printk(KERN_ERR "%s: tty discipline still running\n",
                                dev->name);
-                        /* Intentionally leak the control block. */
-                        dev->destructor = NULL;
                 }
 
                 unregister_netdev(dev);
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index eecee7f8dfb7..afcc1312dbaf 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -265,6 +265,8 @@ static int gs_cmd_reset(struct gs_usb *gsusb, struct gs_can *gsdev)
                              sizeof(*dm),
                              1000);
 
+        kfree(dm);
+
         return rc;
 }
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 57913dbbae0a..1ca76e03e965 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -908,8 +908,6 @@ static int peak_usb_probe(struct usb_interface *intf,
         const struct peak_usb_adapter *peak_usb_adapter = NULL;
         int i, err = -ENOMEM;
 
-        usb_dev = interface_to_usbdev(intf);
-
         /* get corresponding PCAN-USB adapter */
         for (i = 0; i < ARRAY_SIZE(peak_usb_adapters_list); i++)
                 if (peak_usb_adapters_list[i]->device_id == usb_id_product) {
@@ -920,7 +918,7 @@ static int peak_usb_probe(struct usb_interface *intf,
         if (!peak_usb_adapter) {
                 /* should never come except device_id bad usage in this file */
                 pr_err("%s: didn't find device id. 0x%x in devices list\n",
-                        PCAN_USB_DRIVER_NAME, usb_dev->descriptor.idProduct);
+                        PCAN_USB_DRIVER_NAME, usb_id_product);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index facca33d53e9..a8cb33264ff1 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -152,7 +152,7 @@ static const struct net_device_ops vcan_netdev_ops = {
 static void vcan_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_CAN;
-        dev->mtu                = CAN_MTU;
+        dev->mtu                = CANFD_MTU;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->tx_queue_len       = 0;
@@ -163,7 +163,7 @@ static void vcan_setup(struct net_device *dev)
                 dev->flags |= IFF_ECHO;
 
         dev->netdev_ops         = &vcan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static struct rtnl_link_ops vcan_link_ops __read_mostly = {
diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
index 7fbb24795681..cfe889e8f172 100644
--- a/drivers/net/can/vxcan.c
+++ b/drivers/net/can/vxcan.c
@@ -150,13 +150,13 @@ static const struct net_device_ops vxcan_netdev_ops = {
 static void vxcan_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_CAN;
-        dev->mtu                = CAN_MTU;
+        dev->mtu                = CANFD_MTU;
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
         dev->tx_queue_len       = 0;
         dev->flags              = (IFF_NOARP|IFF_ECHO);
         dev->netdev_ops         = &vxcan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /* forward declaration for rtnl_create_link() */
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 96046bb12ca1..14c0be98e0a4 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -114,13 +114,13 @@ static inline int mv88e6xxx_g2_set_eeprom16(struct mv88e6xxx_chip *chip,
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip, int src_dev,
-                           int src_port, u16 data)
+static inline int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip,
+                                         int src_dev, int src_port, u16 data)
 {
         return -EOPNOTSUPP;
 }
 
-int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
+static inline int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
 {
         return -EOPNOTSUPP;
 }
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 149244aac20a..9905b52fe293 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -328,7 +328,6 @@ static void dummy_free_netdev(struct net_device *dev)
         struct dummy_priv *priv = netdev_priv(dev);
 
         kfree(priv->vfinfo);
-        free_netdev(dev);
 }
 
 static void dummy_setup(struct net_device *dev)
@@ -338,7 +337,8 @@ static void dummy_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &dummy_netdev_ops;
         dev->ethtool_ops = &dummy_ethtool_ops;
-        dev->destructor = dummy_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = dummy_free_netdev;
 
         /* Fill in device structure with ethernet-generic values. */
         dev->flags |= IFF_NOARP;
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index b0a3b85fc6f8..db02bc2fb4b2 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -748,13 +748,13 @@ static int ax_init_dev(struct net_device *dev)
 
         ret = ax_mii_init(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         ax_NS8390_init(dev, 0);
 
         ret = register_netdev(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         netdev_info(dev, "%dbit, irq %d, %lx, MAC: %pM\n",
                     ei_local->word16 ? 16 : 8, dev->irq, dev->base_addr,
@@ -762,9 +762,6 @@ static int ax_init_dev(struct net_device *dev)
 
         return 0;
 
- out_irq:
-        /* cleanup irq */
-        free_irq(dev->irq, dev);
  err_out:
         return ret;
 }
diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
index 08d11cede9c9..f5b237e0bd60 100644
--- a/drivers/net/ethernet/amazon/ena/ena_com.c
+++ b/drivers/net/ethernet/amazon/ena/ena_com.c
@@ -61,6 +61,8 @@
 
 #define ENA_MMIO_READ_TIMEOUT 0xFFFFFFFF
 
+#define ENA_REGS_ADMIN_INTR_MASK 1
+
 /*****************************************************************************/
 /*****************************************************************************/
 /*****************************************************************************/
@@ -232,11 +234,9 @@ static struct ena_comp_ctx *__ena_com_submit_admin_cmd(struct ena_com_admin_queu
         tail_masked = admin_queue->sq.tail & queue_size_mask;
 
         /* In case of queue FULL */
-        cnt = admin_queue->sq.tail - admin_queue->sq.head;
+        cnt = atomic_read(&admin_queue->outstanding_cmds);
         if (cnt >= admin_queue->q_depth) {
-                pr_debug("admin queue is FULL (tail %d head %d depth: %d)\n",
-                         admin_queue->sq.tail, admin_queue->sq.head,
-                         admin_queue->q_depth);
+                pr_debug("admin queue is full.\n");
                 admin_queue->stats.out_of_space++;
                 return ERR_PTR(-ENOSPC);
         }
@@ -508,15 +508,20 @@ static int ena_com_comp_status_to_errno(u8 comp_status)
 static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_ctx,
                                                      struct ena_com_admin_queue *admin_queue)
 {
-        unsigned long flags;
-        u32 start_time;
+        unsigned long flags, timeout;
         int ret;
 
-        start_time = ((u32)jiffies_to_usecs(jiffies));
+        timeout = jiffies + ADMIN_CMD_TIMEOUT_US;
+
+        while (1) {
+                spin_lock_irqsave(&admin_queue->q_lock, flags);
+                ena_com_handle_admin_completion(admin_queue);
+                spin_unlock_irqrestore(&admin_queue->q_lock, flags);
+
+                if (comp_ctx->status != ENA_CMD_SUBMITTED)
+                        break;
 
-        while (comp_ctx->status == ENA_CMD_SUBMITTED) {
-                if ((((u32)jiffies_to_usecs(jiffies)) - start_time) >
-                    ADMIN_CMD_TIMEOUT_US) {
+                if (time_is_before_jiffies(timeout)) {
                         pr_err("Wait for completion (polling) timeout\n");
                         /* ENA didn't have any completion */
                         spin_lock_irqsave(&admin_queue->q_lock, flags);
@@ -528,10 +533,6 @@ static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_c
                         goto err;
                 }
 
-                spin_lock_irqsave(&admin_queue->q_lock, flags);
-                ena_com_handle_admin_completion(admin_queue);
-                spin_unlock_irqrestore(&admin_queue->q_lock, flags);
-
                 msleep(100);
         }
 
@@ -1455,6 +1456,12 @@ void ena_com_admin_destroy(struct ena_com_dev *ena_dev)
 
 void ena_com_set_admin_polling_mode(struct ena_com_dev *ena_dev, bool polling)
 {
+        u32 mask_value = 0;
+
+        if (polling)
+                mask_value = ENA_REGS_ADMIN_INTR_MASK;
+
+        writel(mask_value, ena_dev->reg_bar + ENA_REGS_INTR_MASK_OFF);
         ena_dev->admin_queue.polling = polling;
 }
 
diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 67b2338f8fb3..3ee55e2fd694 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -80,7 +80,6 @@ static const struct ena_stats ena_stats_tx_strings[] = {
         ENA_STAT_TX_ENTRY(tx_poll),
         ENA_STAT_TX_ENTRY(doorbells),
         ENA_STAT_TX_ENTRY(prepare_ctx_err),
-        ENA_STAT_TX_ENTRY(missing_tx_comp),
         ENA_STAT_TX_ENTRY(bad_req_id),
 };
 
@@ -94,6 +93,7 @@ static const struct ena_stats ena_stats_rx_strings[] = {
         ENA_STAT_RX_ENTRY(dma_mapping_err),
         ENA_STAT_RX_ENTRY(bad_desc_num),
         ENA_STAT_RX_ENTRY(rx_copybreak_pkt),
+        ENA_STAT_RX_ENTRY(empty_rx_ring),
 };
 
 static const struct ena_stats ena_stats_ena_com_strings[] = {
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 7c1214d78855..4f16ed38bcf3 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -190,6 +190,7 @@ static void ena_init_io_rings(struct ena_adapter *adapter)
                 rxr->sgl_size = adapter->max_rx_sgl_size;
                 rxr->smoothed_interval =
                         ena_com_get_nonadaptive_moderation_interval_rx(ena_dev);
+                rxr->empty_rx_queue = 0;
         }
 }
 
@@ -1078,6 +1079,26 @@ inline void ena_adjust_intr_moderation(struct ena_ring *rx_ring,
         rx_ring->per_napi_bytes = 0;
 }
 
+static inline void ena_unmask_interrupt(struct ena_ring *tx_ring,
+                                        struct ena_ring *rx_ring)
+{
+        struct ena_eth_io_intr_reg intr_reg;
+
+        /* Update intr register: rx intr delay,
+         * tx intr delay and interrupt unmask
+         */
+        ena_com_update_intr_reg(&intr_reg,
+                                rx_ring->smoothed_interval,
+                                tx_ring->smoothed_interval,
+                                true);
+
+        /* It is a shared MSI-X.
+         * Tx and Rx CQ have pointer to it.
+         * So we use one of them to reach the intr reg
+         */
+        ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+}
+
 static inline void ena_update_ring_numa_node(struct ena_ring *tx_ring,
                                              struct ena_ring *rx_ring)
 {
@@ -1108,7 +1129,6 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
 {
         struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi);
         struct ena_ring *tx_ring, *rx_ring;
-        struct ena_eth_io_intr_reg intr_reg;
 
         u32 tx_work_done;
         u32 rx_work_done;
@@ -1149,22 +1169,9 @@ static int ena_io_poll(struct napi_struct *napi, int budget)
                         if (ena_com_get_adaptive_moderation_enabled(rx_ring->ena_dev))
                                 ena_adjust_intr_moderation(rx_ring, tx_ring);
 
-                        /* Update intr register: rx intr delay,
-                         * tx intr delay and interrupt unmask
-                         */
-                        ena_com_update_intr_reg(&intr_reg,
-                                                rx_ring->smoothed_interval,
-                                                tx_ring->smoothed_interval,
-                                                true);
-
-                        /* It is a shared MSI-X.
-                         * Tx and Rx CQ have pointer to it.
-                         * So we use one of them to reach the intr reg
-                         */
-                        ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+                        ena_unmask_interrupt(tx_ring, rx_ring);
                 }
 
-
                 ena_update_ring_numa_node(tx_ring, rx_ring);
 
                 ret = rx_work_done;
@@ -1485,6 +1492,11 @@ static int ena_up_complete(struct ena_adapter *adapter)
 
         ena_napi_enable_all(adapter);
 
+        /* Enable completion queues interrupt */
+        for (i = 0; i < adapter->num_queues; i++)
+                ena_unmask_interrupt(&adapter->tx_ring[i],
+                                     &adapter->rx_ring[i]);
+
         /* schedule napi in case we had pending packets
          * from the last time we disable napi
          */
@@ -1532,6 +1544,7 @@ static int ena_create_io_tx_queue(struct ena_adapter *adapter, int qid)
                           "Failed to get TX queue handlers. TX queue num %d rc: %d\n",
                           qid, rc);
                 ena_com_destroy_io_queue(ena_dev, ena_qid);
+                return rc;
         }
 
         ena_com_update_numa_node(tx_ring->ena_com_io_cq, ctx.numa_node);
@@ -1596,6 +1609,7 @@ static int ena_create_io_rx_queue(struct ena_adapter *adapter, int qid)
                           "Failed to get RX queue handlers. RX queue num %d rc: %d\n",
                           qid, rc);
                 ena_com_destroy_io_queue(ena_dev, ena_qid);
+                return rc;
         }
 
         ena_com_update_numa_node(rx_ring->ena_com_io_cq, ctx.numa_node);
@@ -1981,6 +1995,7 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_info->tx_descs = nb_hw_desc;
         tx_info->last_jiffies = jiffies;
+        tx_info->print_once = 0;
 
         tx_ring->next_to_use = ENA_TX_RING_IDX_NEXT(next_to_use,
                 tx_ring->ring_size);
@@ -2550,13 +2565,44 @@ err:
                 "Reset attempt failed. Can not reset the device\n");
 }
 
-static void check_for_missing_tx_completions(struct ena_adapter *adapter)
+static int check_missing_comp_in_queue(struct ena_adapter *adapter,
+                                       struct ena_ring *tx_ring)
 {
         struct ena_tx_buffer *tx_buf;
         unsigned long last_jiffies;
+        u32 missed_tx = 0;
+        int i;
+
+        for (i = 0; i < tx_ring->ring_size; i++) {
+                tx_buf = &tx_ring->tx_buffer_info[i];
+                last_jiffies = tx_buf->last_jiffies;
+                if (unlikely(last_jiffies &&
+                             time_is_before_jiffies(last_jiffies + TX_TIMEOUT))) {
+                        if (!tx_buf->print_once)
+                                netif_notice(adapter, tx_err, adapter->netdev,
+                                             "Found a Tx that wasn't completed on time, qid %d, index %d.\n",
+                                             tx_ring->qid, i);
+
+                        tx_buf->print_once = 1;
+                        missed_tx++;
+
+                        if (unlikely(missed_tx > MAX_NUM_OF_TIMEOUTED_PACKETS)) {
+                                netif_err(adapter, tx_err, adapter->netdev,
+                                          "The number of lost tx completions is above the threshold (%d > %d). Reset the device\n",
+                                          missed_tx, MAX_NUM_OF_TIMEOUTED_PACKETS);
+                                set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
+                                return -EIO;
+                        }
+                }
+        }
+
+        return 0;
+}
+
+static void check_for_missing_tx_completions(struct ena_adapter *adapter)
+{
         struct ena_ring *tx_ring;
-        int i, j, budget;
-        u32 missed_tx;
+        int i, budget, rc;
 
         /* Make sure the driver doesn't turn the device in other process */
         smp_rmb();
@@ -2572,31 +2618,9 @@ static void check_for_missing_tx_completions(struct ena_adapter *adapter)
         for (i = adapter->last_monitored_tx_qid; i < adapter->num_queues; i++) {
                 tx_ring = &adapter->tx_ring[i];
 
-                for (j = 0; j < tx_ring->ring_size; j++) {
-                        tx_buf = &tx_ring->tx_buffer_info[j];
-                        last_jiffies = tx_buf->last_jiffies;
-                        if (unlikely(last_jiffies && time_is_before_jiffies(last_jiffies + TX_TIMEOUT))) {
-                                netif_notice(adapter, tx_err, adapter->netdev,
-                                             "Found a Tx that wasn't completed on time, qid %d, index %d.\n",
-                                             tx_ring->qid, j);
-
-                                u64_stats_update_begin(&tx_ring->syncp);
-                                missed_tx = tx_ring->tx_stats.missing_tx_comp++;
-                                u64_stats_update_end(&tx_ring->syncp);
-
-                                /* Clear last jiffies so the lost buffer won't
-                                 * be counted twice.
-                                 */
-                                tx_buf->last_jiffies = 0;
-
-                                if (unlikely(missed_tx > MAX_NUM_OF_TIMEOUTED_PACKETS)) {
-                                        netif_err(adapter, tx_err, adapter->netdev,
-                                                  "The number of lost tx completion is above the threshold (%d > %d). Reset the device\n",
-                                                  missed_tx, MAX_NUM_OF_TIMEOUTED_PACKETS);
-                                        set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags);
-                                }
-                        }
-                }
+                rc = check_missing_comp_in_queue(adapter, tx_ring);
+                if (unlikely(rc))
+                        return;
 
                 budget--;
                 if (!budget)
@@ -2606,6 +2630,58 @@ static void check_for_missing_tx_completions(struct ena_adapter *adapter)
         adapter->last_monitored_tx_qid = i % adapter->num_queues;
 }
 
+/* trigger napi schedule after 2 consecutive detections */
+#define EMPTY_RX_REFILL 2
+/* For the rare case where the device runs out of Rx descriptors and the
+ * napi handler failed to refill new Rx descriptors (due to a lack of memory
+ * for example).
+ * This case will lead to a deadlock:
+ * The device won't send interrupts since all the new Rx packets will be dropped
+ * The napi handler won't allocate new Rx descriptors so the device will be
+ * able to send new packets.
+ *
+ * This scenario can happen when the kernel's vm.min_free_kbytes is too small.
+ * It is recommended to have at least 512MB, with a minimum of 128MB for
+ * constrained environment).
+ *
+ * When such a situation is detected - Reschedule napi
+ */
+static void check_for_empty_rx_ring(struct ena_adapter *adapter)
+{
+        struct ena_ring *rx_ring;
+        int i, refill_required;
+
+        if (!test_bit(ENA_FLAG_DEV_UP, &adapter->flags))
+                return;
+
+        if (test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))
+                return;
+
+        for (i = 0; i < adapter->num_queues; i++) {
+                rx_ring = &adapter->rx_ring[i];
+
+                refill_required =
+                        ena_com_sq_empty_space(rx_ring->ena_com_io_sq);
+                if (unlikely(refill_required == (rx_ring->ring_size - 1))) {
+                        rx_ring->empty_rx_queue++;
+
+                        if (rx_ring->empty_rx_queue >= EMPTY_RX_REFILL) {
+                                u64_stats_update_begin(&rx_ring->syncp);
+                                rx_ring->rx_stats.empty_rx_ring++;
+                                u64_stats_update_end(&rx_ring->syncp);
+
+                                netif_err(adapter, drv, adapter->netdev,
+                                          "trigger refill for ring %d\n", i);
+
+                                napi_schedule(rx_ring->napi);
+                                rx_ring->empty_rx_queue = 0;
+                        }
+                } else {
+                        rx_ring->empty_rx_queue = 0;
+                }
+        }
+}
+
 /* Check for keep alive expiration */
 static void check_for_missing_keep_alive(struct ena_adapter *adapter)
 {
@@ -2660,6 +2736,8 @@ static void ena_timer_service(unsigned long data)
 
         check_for_missing_tx_completions(adapter);
 
+        check_for_empty_rx_ring(adapter);
+
         if (debug_area)
                 ena_dump_stats_to_buf(adapter, debug_area);
 
@@ -2840,6 +2918,11 @@ static void ena_release_bars(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
 {
         int release_bars;
 
+        if (ena_dev->mem_bar)
+                devm_iounmap(&pdev->dev, ena_dev->mem_bar);
+
+        devm_iounmap(&pdev->dev, ena_dev->reg_bar);
+
         release_bars = pci_select_bars(pdev, IORESOURCE_MEM) & ENA_BAR_MASK;
         pci_release_selected_regions(pdev, release_bars);
 }
@@ -2927,8 +3010,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_free_ena_dev;
         }
 
-        ena_dev->reg_bar = ioremap(pci_resource_start(pdev, ENA_REG_BAR),
-                                   pci_resource_len(pdev, ENA_REG_BAR));
+        ena_dev->reg_bar = devm_ioremap(&pdev->dev,
+                                        pci_resource_start(pdev, ENA_REG_BAR),
+                                        pci_resource_len(pdev, ENA_REG_BAR));
         if (!ena_dev->reg_bar) {
                 dev_err(&pdev->dev, "failed to remap regs bar\n");
                 rc = -EFAULT;
@@ -2948,8 +3032,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         ena_set_push_mode(pdev, ena_dev, &get_feat_ctx);
 
         if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) {
-                ena_dev->mem_bar = ioremap_wc(pci_resource_start(pdev, ENA_MEM_BAR),
-                                              pci_resource_len(pdev, ENA_MEM_BAR));
+                ena_dev->mem_bar = devm_ioremap_wc(&pdev->dev,
+                                                   pci_resource_start(pdev, ENA_MEM_BAR),
+                                                   pci_resource_len(pdev, ENA_MEM_BAR));
                 if (!ena_dev->mem_bar) {
                         rc = -EFAULT;
                         goto err_device_destroy;
diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
index 0e22bce6239d..a4d3d5e21068 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
@@ -45,7 +45,7 @@
 
 #define DRV_MODULE_VER_MAJOR    1
 #define DRV_MODULE_VER_MINOR    1
-#define DRV_MODULE_VER_SUBMINOR 2
+#define DRV_MODULE_VER_SUBMINOR 7
 
 #define DRV_MODULE_NAME         "ena"
 #ifndef DRV_MODULE_VERSION
@@ -146,7 +146,18 @@ struct ena_tx_buffer {
         u32 tx_descs;
         /* num of buffers used by this skb */
         u32 num_of_bufs;
-        /* Save the last jiffies to detect missing tx packets */
+
+        /* Used for detect missing tx packets to limit the number of prints */
+        u32 print_once;
+        /* Save the last jiffies to detect missing tx packets
+         *
+         * sets to non zero value on ena_start_xmit and set to zero on
+         * napi and timer_Service_routine.
+         *
+         * while this value is not protected by lock,
+         * a given packet is not expected to be handled by ena_start_xmit
+         * and by napi/timer_service at the same time.
+         */
         unsigned long last_jiffies;
         struct ena_com_buf bufs[ENA_PKT_MAX_BUFS];
 } ____cacheline_aligned;
@@ -170,7 +181,6 @@ struct ena_stats_tx {
         u64 napi_comp;
         u64 tx_poll;
         u64 doorbells;
-        u64 missing_tx_comp;
         u64 bad_req_id;
 };
 
@@ -184,6 +194,7 @@ struct ena_stats_rx {
         u64 dma_mapping_err;
         u64 bad_desc_num;
         u64 rx_copybreak_pkt;
+        u64 empty_rx_ring;
 };
 
 struct ena_ring {
@@ -231,6 +242,7 @@ struct ena_ring {
                 struct ena_stats_tx tx_stats;
                 struct ena_stats_rx rx_stats;
         };
+        int empty_rx_queue;
 } ____cacheline_aligned;
 
 struct ena_stats_dev {
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index b3bc87fe3764..0a98c369df20 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -324,7 +324,7 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
                               struct xgbe_ring *ring,
                               struct xgbe_ring_data *rdata)
 {
-        int order, ret;
+        int ret;
 
         if (!ring->rx_hdr_pa.pages) {
                 ret = xgbe_alloc_pages(pdata, &ring->rx_hdr_pa, GFP_ATOMIC, 0);
@@ -333,9 +333,8 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
         }
 
         if (!ring->rx_buf_pa.pages) {
-                order = max_t(int, PAGE_ALLOC_COSTLY_ORDER - 1, 0);
                 ret = xgbe_alloc_pages(pdata, &ring->rx_buf_pa, GFP_ATOMIC,
-                                       order);
+                                       PAGE_ALLOC_COSTLY_ORDER);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
index b8e3d88f0879..a66aee51ab5b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h
@@ -193,9 +193,6 @@ int hw_atl_utils_hw_get_regs(struct aq_hw_s *self,
                              struct aq_hw_caps_s *aq_hw_caps,
                              u32 *regs_buff);
 
-int hw_atl_utils_hw_get_settings(struct aq_hw_s *self,
-                                 struct ethtool_cmd *cmd);
-
 int hw_atl_utils_hw_set_power(struct aq_hw_s *self,
                               unsigned int power_state);
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 099b374c1b17..5274501428e4 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2026,9 +2026,12 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         priv->num_rx_desc_words = params->num_rx_desc_words;
 
         priv->irq0 = platform_get_irq(pdev, 0);
-        if (!priv->is_lite)
+        if (!priv->is_lite) {
                 priv->irq1 = platform_get_irq(pdev, 1);
-        priv->wol_irq = platform_get_irq(pdev, 2);
+                priv->wol_irq = platform_get_irq(pdev, 2);
+        } else {
+                priv->wol_irq = platform_get_irq(pdev, 1);
+        }
         if (priv->irq0 <= 0 || (priv->irq1 <= 0 && !priv->is_lite)) {
                 dev_err(&pdev->dev, "invalid interrupts\n");
                 ret = -EINVAL;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index eccb3d1b6abb..f619c4cac51f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1926,7 +1926,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
         }
 
         /* select a non-FCoE queue */
-        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
 }
 
 void bnx2x_set_num_queues(struct bnx2x *bp)
@@ -3883,15 +3883,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* when transmitting in a vf, start bd must hold the ethertype
                  * for fw to enforce it
                  */
+                u16 vlan_tci = 0;
 #ifndef BNX2X_STOP_ON_ERROR
-                if (IS_VF(bp))
+                if (IS_VF(bp)) {
 #endif
-                        tx_start_bd->vlan_or_ethertype =
-                                cpu_to_le16(ntohs(eth->h_proto));
+                        /* Still need to consider inband vlan for enforced */
+                        if (__vlan_get_tag(skb, &vlan_tci)) {
+                                tx_start_bd->vlan_or_ethertype =
+                                        cpu_to_le16(ntohs(eth->h_proto));
+                        } else {
+                                tx_start_bd->bd_flags.as_bitfield |=
+                                        (X_ETH_INBAND_VLAN <<
+                                         ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT);
+                                tx_start_bd->vlan_or_ethertype =
+                                        cpu_to_le16(vlan_tci);
+                        }
 #ifndef BNX2X_STOP_ON_ERROR
-                else
+                } else {
                         /* used by FW for packet accounting */
                         tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
+                }
 #endif
         }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index bdfd53b46bc5..9ca994d0bab6 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -901,6 +901,8 @@ static void bnx2x_vf_flr(struct bnx2x *bp, struct bnx2x_virtf *vf)
         /* release VF resources */
         bnx2x_vf_free_resc(bp, vf);
 
+        vf->malicious = false;
+
         /* re-open the mailbox */
         bnx2x_vf_enable_mbx(bp, vf->abs_vfid);
         return;
@@ -1822,9 +1824,11 @@ get_vf:
                    vf->abs_vfid, qidx);
                 bnx2x_vf_handle_rss_update_eqe(bp, vf);
         case EVENT_RING_OPCODE_VF_FLR:
-        case EVENT_RING_OPCODE_MALICIOUS_VF:
                 /* Do nothing for now */
                 return 0;
+        case EVENT_RING_OPCODE_MALICIOUS_VF:
+                vf->malicious = true;
+                return 0;
         }
 
         return 0;
@@ -1905,6 +1909,13 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                         continue;
                 }
 
+                if (vf->malicious) {
+                        DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                               "vf %d malicious so no stats for it\n",
+                               vf->abs_vfid);
+                        continue;
+                }
+
                 DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
                        "add addresses for vf %d\n", vf->abs_vfid);
                 for_each_vfq(vf, j) {
@@ -3042,7 +3053,7 @@ void bnx2x_vf_pci_dealloc(struct bnx2x *bp)
 {
         BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->vf2pf_mbox_mapping,
                        sizeof(struct bnx2x_vf_mbx_msg));
-        BNX2X_PCI_FREE(bp->vf2pf_mbox, bp->pf2vf_bulletin_mapping,
+        BNX2X_PCI_FREE(bp->pf2vf_bulletin, bp->pf2vf_bulletin_mapping,
                        sizeof(union pf_vf_bulletin));
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 888d0b6632e8..53466f6cebab 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -141,6 +141,7 @@ struct bnx2x_virtf {
 #define VF_RESET        3       /* VF FLR'd, pending cleanup */
 
         bool flr_clnup_stage;   /* true during flr cleanup */
+        bool malicious;         /* true if FW indicated so, until FLR */
 
         /* dma */
         dma_addr_t fw_stat_map;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_main.h b/drivers/net/ethernet/cavium/liquidio/octeon_main.h
index bed9ef17bc26..7ccffbb0019e 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_main.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_main.h
@@ -144,7 +144,7 @@ static inline int
 sleep_cond(wait_queue_head_t *wait_queue, int *condition)
 {
         int errno = 0;
-        wait_queue_t we;
+        wait_queue_entry_t we;
 
         init_waitqueue_entry(&we, current);
         add_wait_queue(wait_queue, &we);
@@ -171,7 +171,7 @@ sleep_timeout_cond(wait_queue_head_t *wait_queue,
                    int *condition,
                    int timeout)
 {
-        wait_queue_t we;
+        wait_queue_entry_t we;
 
         init_waitqueue_entry(&we, current);
         add_wait_queue(wait_queue, &we);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 38a5c6764bb5..ea1bfcf1870a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2196,10 +2196,14 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto irq_err;
         }
+
+        mutex_lock(&uld_mutex);
         enable_rx(adap);
         t4_sge_start(adap);
         t4_intr_enable(adap);
         adap->flags |= FULL_INIT_DONE;
+        mutex_unlock(&uld_mutex);
+
         notify_ulds(adap, CXGB4_STATE_UP);
 #if IS_ENABLED(CONFIG_IPV6)
         update_clip(adap);
@@ -2771,6 +2775,9 @@ void t4_fatal_err(struct adapter *adap)
 {
         int port;
 
+        if (pci_channel_offline(adap->pdev))
+                return;
+
         /* Disable the SGE since ULDs are going to free resources that
          * could be exposed to the adapter.  RDMA MWs for example...
          */
@@ -3882,9 +3889,10 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
         spin_lock(&adap->stats_lock);
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                netif_device_detach(dev);
-                netif_carrier_off(dev);
+                if (dev) {
+                        netif_device_detach(dev);
+                        netif_carrier_off(dev);
+                }
         }
         spin_unlock(&adap->stats_lock);
         disable_interrupts(adap);
@@ -3963,12 +3971,13 @@ static void eeh_resume(struct pci_dev *pdev)
         rtnl_lock();
         for_each_port(adap, i) {
                 struct net_device *dev = adap->port[i];
-
-                if (netif_running(dev)) {
-                        link_start(dev);
-                        cxgb_set_rxmode(dev);
+                if (dev) {
+                        if (netif_running(dev)) {
+                                link_start(dev);
+                                cxgb_set_rxmode(dev);
+                        }
+                        netif_device_attach(dev);
                 }
-                netif_device_attach(dev);
         }
         rtnl_unlock();
 }
@@ -4516,7 +4525,7 @@ static void dummy_setup(struct net_device *dev)
         /* Initialize the device structure. */
         dev->netdev_ops = &cxgb4_mgmt_netdev_ops;
         dev->ethtool_ops = &cxgb4_mgmt_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 }
 
 static int config_mgmt_dev(struct pci_dev *pdev)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index aded42b96f6d..3a34aa629f7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -4557,8 +4557,13 @@ void t4_intr_enable(struct adapter *adapter)
  */
 void t4_intr_disable(struct adapter *adapter)
 {
-        u32 whoami = t4_read_reg(adapter, PL_WHOAMI_A);
-        u32 pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
+        u32 whoami, pf;
+
+        if (pci_channel_offline(adapter->pdev))
+                return;
+
+        whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+        pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
                         SOURCEPF_G(whoami) : T6_SOURCEPF_G(whoami);
 
         t4_write_reg(adapter, MYPF_REG(PL_PF_INT_ENABLE_A), 0);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index 3549d3876278..f2d623a7aee0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x2B
+#define T4FW_VERSION_MICRO 0x2D
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x2B
+#define T5FW_VERSION_MICRO 0x2D
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x2B
+#define T6FW_VERSION_MICRO 0x2D
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index f3a09ab55900..4eee18ce9be4 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5078,9 +5078,11 @@ static netdev_features_t be_features_check(struct sk_buff *skb,
         struct be_adapter *adapter = netdev_priv(dev);
         u8 l4_hdr = 0;
 
-        /* The code below restricts offload features for some tunneled packets.
+        /* The code below restricts offload features for some tunneled and
+         * Q-in-Q packets.
          * Offload features for normal (non tunnel) packets are unchanged.
          */
+        features = vlan_features_check(skb, features);
         if (!skb->encapsulation ||
             !(adapter->flags & BE_FLAGS_VXLAN_OFFLOADS))
                 return features;
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index e863ba74d005..8bb0db990c8f 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -739,6 +739,8 @@ static int ethoc_open(struct net_device *dev)
         if (ret)
                 return ret;
 
+        napi_enable(&priv->napi);
+
         ethoc_init_ring(priv, dev->mem_start);
         ethoc_reset(priv);
 
@@ -754,7 +756,6 @@ static int ethoc_open(struct net_device *dev)
         priv->old_duplex = -1;
 
         phy_start(dev->phydev);
-        napi_enable(&priv->napi);
 
         if (netif_msg_ifup(priv)) {
                 dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 56a563f90b0b..f7c8649fd28f 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3192,7 +3192,7 @@ static int fec_reset_phy(struct platform_device *pdev)
 {
         int err, phy_reset;
         bool active_high = false;
-        int msec = 1;
+        int msec = 1, phy_post_delay = 0;
         struct device_node *np = pdev->dev.of_node;
 
         if (!np)
@@ -3209,6 +3209,11 @@ static int fec_reset_phy(struct platform_device *pdev)
         else if (!gpio_is_valid(phy_reset))
                 return 0;
 
+        err = of_property_read_u32(np, "phy-reset-post-delay", &phy_post_delay);
+        /* valid reset duration should be less than 1s */
+        if (!err && phy_post_delay > 1000)
+                return -EINVAL;
+
         active_high = of_property_read_bool(np, "phy-reset-active-high");
 
         err = devm_gpio_request_one(&pdev->dev, phy_reset,
@@ -3226,6 +3231,15 @@ static int fec_reset_phy(struct platform_device *pdev)
 
         gpio_set_value_cansleep(phy_reset, !active_high);
 
+        if (!phy_post_delay)
+                return 0;
+
+        if (phy_post_delay > 20)
+                msleep(phy_post_delay);
+        else
+                usleep_range(phy_post_delay * 1000,
+                             phy_post_delay * 1000 + 1000);
+
         return 0;
 }
 #else /* CONFIG_OF */
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 446c7b374ff5..a10de1e9c157 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -381,7 +381,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
 {
         const struct of_device_id *id =
                 of_match_device(fsl_pq_mdio_match, &pdev->dev);
-        const struct fsl_pq_mdio_data *data = id->data;
+        const struct fsl_pq_mdio_data *data;
         struct device_node *np = pdev->dev.of_node;
         struct resource res;
         struct device_node *tbi;
@@ -389,6 +389,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
         struct mii_bus *new_bus;
         int err;
 
+        if (!id) {
+                dev_err(&pdev->dev, "Failed to match device\n");
+                return -ENODEV;
+        }
+
+        data = id->data;
+
         dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
 
         new_bus = mdiobus_alloc_size(sizeof(*priv));
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 508923f39ccf..259e69a52ec5 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -343,6 +343,7 @@ static int emac_reset(struct emac_instance *dev)
 {
         struct emac_regs __iomem *p = dev->emacp;
         int n = 20;
+        bool __maybe_unused try_internal_clock = false;
 
         DBG(dev, "reset" NL);
 
@@ -355,6 +356,7 @@ static int emac_reset(struct emac_instance *dev)
         }
 
 #ifdef CONFIG_PPC_DCR_NATIVE
+do_retry:
         /*
          * PPC460EX/GT Embedded Processor Advanced User's Manual
          * section 28.10.1 Mode Register 0 (EMACx_MR0) states:
@@ -362,10 +364,19 @@ static int emac_reset(struct emac_instance *dev)
          * of the EMAC. If none is present, select the internal clock
          * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
          * After a soft reset, select the external clock.
+         *
+         * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the
+         * ethernet cable is not attached. This causes the reset to timeout
+         * and the PHY detection code in emac_init_phy() is unable to
+         * communicate and detect the AR8035-A PHY. As a result, the emac
+         * driver bails out early and the user has no ethernet.
+         * In order to stay compatible with existing configurations, the
+         * driver will temporarily switch to the internal clock, after
+         * the first reset fails.
          */
         if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-                if (dev->phy_address == 0xffffffff &&
-                    dev->phy_map == 0xffffffff) {
+                if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+                                           dev->phy_map == 0xffffffff)) {
                         /* No PHY: select internal loop clock before reset */
                         dcri_clrset(SDR0, SDR0_ETH_CFG,
                                     0, SDR0_ETH_CFG_ECS << dev->cell_index);
@@ -383,8 +394,15 @@ static int emac_reset(struct emac_instance *dev)
 
 #ifdef CONFIG_PPC_DCR_NATIVE
         if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
-                if (dev->phy_address == 0xffffffff &&
-                    dev->phy_map == 0xffffffff) {
+                if (!n && !try_internal_clock) {
+                        /* first attempt has timed out. */
+                        n = 20;
+                        try_internal_clock = true;
+                        goto do_retry;
+                }
+
+                if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+                                           dev->phy_map == 0xffffffff)) {
                         /* No PHY: restore external clock source after reset */
                         dcri_clrset(SDR0, SDR0_ETH_CFG,
                                     SDR0_ETH_CFG_ECS << dev->cell_index, 0);
@@ -2460,20 +2478,24 @@ static int emac_mii_bus_reset(struct mii_bus *bus)
         return emac_reset(dev);
 }
 
+static int emac_mdio_phy_start_aneg(struct mii_phy *phy,
+                                    struct phy_device *phy_dev)
+{
+        phy_dev->autoneg = phy->autoneg;
+        phy_dev->speed = phy->speed;
+        phy_dev->duplex = phy->duplex;
+        phy_dev->advertising = phy->advertising;
+        return phy_start_aneg(phy_dev);
+}
+
 static int emac_mdio_setup_aneg(struct mii_phy *phy, u32 advertise)
 {
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
 
-        dev->phy.autoneg = AUTONEG_ENABLE;
-        dev->phy.speed = SPEED_1000;
-        dev->phy.duplex = DUPLEX_FULL;
-        dev->phy.advertising = advertise;
         phy->autoneg = AUTONEG_ENABLE;
-        phy->speed = dev->phy.speed;
-        phy->duplex = dev->phy.duplex;
         phy->advertising = advertise;
-        return phy_start_aneg(dev->phy_dev);
+        return emac_mdio_phy_start_aneg(phy, dev->phy_dev);
 }
 
 static int emac_mdio_setup_forced(struct mii_phy *phy, int speed, int fd)
@@ -2481,13 +2503,10 @@ static int emac_mdio_setup_forced(struct mii_phy *phy, int speed, int fd)
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
 
-        dev->phy.autoneg =  AUTONEG_DISABLE;
-        dev->phy.speed = speed;
-        dev->phy.duplex = fd;
         phy->autoneg = AUTONEG_DISABLE;
         phy->speed = speed;
         phy->duplex = fd;
-        return phy_start_aneg(dev->phy_dev);
+        return emac_mdio_phy_start_aneg(phy, dev->phy_dev);
 }
 
 static int emac_mdio_poll_link(struct mii_phy *phy)
@@ -2509,16 +2528,17 @@ static int emac_mdio_read_link(struct mii_phy *phy)
 {
         struct net_device *ndev = phy->dev;
         struct emac_instance *dev = netdev_priv(ndev);
+        struct phy_device *phy_dev = dev->phy_dev;
         int res;
 
-        res = phy_read_status(dev->phy_dev);
+        res = phy_read_status(phy_dev);
         if (res)
                 return res;
 
-        dev->phy.speed = phy->speed;
-        dev->phy.duplex = phy->duplex;
-        dev->phy.pause = phy->pause;
-        dev->phy.asym_pause = phy->asym_pause;
+        phy->speed = phy_dev->speed;
+        phy->duplex = phy_dev->duplex;
+        phy->pause = phy_dev->pause;
+        phy->asym_pause = phy_dev->asym_pause;
         return 0;
 }
 
@@ -2528,13 +2548,6 @@ static int emac_mdio_init_phy(struct mii_phy *phy)
         struct emac_instance *dev = netdev_priv(ndev);
 
         phy_start(dev->phy_dev);
-        dev->phy.autoneg = phy->autoneg;
-        dev->phy.speed = phy->speed;
-        dev->phy.duplex = phy->duplex;
-        dev->phy.advertising = phy->advertising;
-        dev->phy.pause = phy->pause;
-        dev->phy.asym_pause = phy->asym_pause;
-
         return phy_init_hw(dev->phy_dev);
 }
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 4f2d329dba99..c0fbeb387db4 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -81,7 +81,7 @@
 static const char ibmvnic_driver_name[] = "ibmvnic";
 static const char ibmvnic_driver_string[] = "IBM System i/p Virtual NIC Driver";
 
-MODULE_AUTHOR("Santiago Leon <santi_leon@yahoo.com>");
+MODULE_AUTHOR("Santiago Leon");
 MODULE_DESCRIPTION("IBM System i/p Virtual NIC Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
@@ -1468,6 +1468,11 @@ static void ibmvnic_netpoll_controller(struct net_device *dev)
 }
 #endif
 
+static int ibmvnic_change_mtu(struct net_device *netdev, int new_mtu)
+{
+        return -EOPNOTSUPP;
+}
+
 static const struct net_device_ops ibmvnic_netdev_ops = {
         .ndo_open               = ibmvnic_open,
         .ndo_stop               = ibmvnic_close,
@@ -1479,6 +1484,7 @@ static const struct net_device_ops ibmvnic_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ibmvnic_netpoll_controller,
 #endif
+        .ndo_change_mtu         = ibmvnic_change_mtu,
 };
 
 /* ethtool functions */
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index cdde3cc28fb5..44d9610f7a15 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -399,6 +399,7 @@ struct i40e_pf {
 #define I40E_FLAG_RX_CSUM_ENABLED               BIT_ULL(1)
 #define I40E_FLAG_MSI_ENABLED                   BIT_ULL(2)
 #define I40E_FLAG_MSIX_ENABLED                  BIT_ULL(3)
+#define I40E_FLAG_HW_ATR_EVICT_ENABLED          BIT_ULL(4)
 #define I40E_FLAG_RSS_ENABLED                   BIT_ULL(6)
 #define I40E_FLAG_VMDQ_ENABLED                  BIT_ULL(7)
 #define I40E_FLAG_IWARP_ENABLED                 BIT_ULL(10)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 7a8eb486b9ea..894c8e57ba00 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -224,7 +224,7 @@ static const struct i40e_priv_flags i40e_gstrings_priv_flags[] = {
         I40E_PRIV_FLAG("LinkPolling", I40E_FLAG_LINK_POLLING_ENABLED, 0),
         I40E_PRIV_FLAG("flow-director-atr", I40E_FLAG_FD_ATR_ENABLED, 0),
         I40E_PRIV_FLAG("veb-stats", I40E_FLAG_VEB_STATS_ENABLED, 0),
-        I40E_PRIV_FLAG("hw-atr-eviction", I40E_FLAG_HW_ATR_EVICT_CAPABLE, 0),
+        I40E_PRIV_FLAG("hw-atr-eviction", I40E_FLAG_HW_ATR_EVICT_ENABLED, 0),
         I40E_PRIV_FLAG("legacy-rx", I40E_FLAG_LEGACY_RX, 0),
 };
 
@@ -4092,7 +4092,7 @@ flags_complete:
 
         /* Only allow ATR evict on hardware that is capable of handling it */
         if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
-                pf->flags &= ~I40E_FLAG_HW_ATR_EVICT_CAPABLE;
+                pf->flags &= ~I40E_FLAG_HW_ATR_EVICT_ENABLED;
 
         if (changed_flags & I40E_FLAG_TRUE_PROMISC_SUPPORT) {
                 u16 sw_flags = 0, valid_flags = 0;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d5c9c9e06ff5..a7a4b28b4144 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -295,7 +295,7 @@ struct i40e_vsi *i40e_find_vsi_from_id(struct i40e_pf *pf, u16 id)
  **/
 void i40e_service_event_schedule(struct i40e_pf *pf)
 {
-        if (!test_bit(__I40E_VSI_DOWN, pf->state) &&
+        if (!test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
                 queue_work(i40e_wq, &pf->service_task);
 }
@@ -3611,7 +3611,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
                  * this is not a performance path and napi_schedule()
                  * can deal with rescheduling.
                  */
-                if (!test_bit(__I40E_VSI_DOWN, pf->state))
+                if (!test_bit(__I40E_DOWN, pf->state))
                         napi_schedule_irqoff(&q_vector->napi);
         }
 
@@ -3687,7 +3687,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
 enable_intr:
         /* re-enable interrupt causes */
         wr32(hw, I40E_PFINT_ICR0_ENA, ena_mask);
-        if (!test_bit(__I40E_VSI_DOWN, pf->state)) {
+        if (!test_bit(__I40E_DOWN, pf->state)) {
                 i40e_service_event_schedule(pf);
                 i40e_irq_dynamic_enable_icr0(pf, false);
         }
@@ -6203,7 +6203,7 @@ static void i40e_fdir_reinit_subtask(struct i40e_pf *pf)
 {
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 return;
 
         if (test_bit(__I40E_FD_FLUSH_REQUESTED, pf->state))
@@ -6344,7 +6344,7 @@ static void i40e_watchdog_subtask(struct i40e_pf *pf)
         int i;
 
         /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state) ||
+        if (test_bit(__I40E_DOWN, pf->state) ||
             test_bit(__I40E_CONFIG_BUSY, pf->state))
                 return;
 
@@ -6399,9 +6399,9 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
                 reset_flags |= BIT(__I40E_GLOBAL_RESET_REQUESTED);
                 clear_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
         }
-        if (test_bit(__I40E_VSI_DOWN_REQUESTED, pf->state)) {
-                reset_flags |= BIT(__I40E_VSI_DOWN_REQUESTED);
-                clear_bit(__I40E_VSI_DOWN_REQUESTED, pf->state);
+        if (test_bit(__I40E_DOWN_REQUESTED, pf->state)) {
+                reset_flags |= BIT(__I40E_DOWN_REQUESTED);
+                clear_bit(__I40E_DOWN_REQUESTED, pf->state);
         }
 
         /* If there's a recovery already waiting, it takes
@@ -6415,7 +6415,7 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
 
         /* If we're already down or resetting, just bail */
         if (reset_flags &&
-            !test_bit(__I40E_VSI_DOWN, pf->state) &&
+            !test_bit(__I40E_DOWN, pf->state) &&
             !test_bit(__I40E_CONFIG_BUSY, pf->state)) {
                 rtnl_lock();
                 i40e_do_reset(pf, reset_flags, true);
@@ -7002,7 +7002,7 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
         u32 val;
         int v;
 
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                 goto clear_recovery;
         dev_dbg(&pf->pdev->dev, "Rebuilding internal switch\n");
 
@@ -8821,11 +8821,12 @@ static int i40e_sw_init(struct i40e_pf *pf)
                     (pf->hw.aq.api_min_ver > 4))) {
                 /* Supported in FW API version higher than 1.4 */
                 pf->flags |= I40E_FLAG_GENEVE_OFFLOAD_CAPABLE;
-                pf->flags = I40E_FLAG_HW_ATR_EVICT_CAPABLE;
-        } else {
-                pf->flags = I40E_FLAG_HW_ATR_EVICT_CAPABLE;
         }
 
+        /* Enable HW ATR eviction if possible */
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
+                pf->flags |= I40E_FLAG_HW_ATR_EVICT_ENABLED;
+
         pf->eeprom_version = 0xDEAD;
         pf->lan_veb = I40E_NO_VEB;
         pf->lan_vsi = I40E_NO_VSI;
@@ -9767,7 +9768,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
                 return -ENODEV;
         }
         if (vsi == pf->vsi[pf->lan_vsi] &&
-            !test_bit(__I40E_VSI_DOWN, pf->state)) {
+            !test_bit(__I40E_DOWN, pf->state)) {
                 dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
                 return -ENODEV;
         }
@@ -11003,7 +11004,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         pf->next_vsi = 0;
         pf->pdev = pdev;
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         hw = &pf->hw;
         hw->back = pf;
@@ -11293,7 +11294,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * before setting up the misc vector or we get a race and the vector
          * ends up disabled forever.
          */
-        clear_bit(__I40E_VSI_DOWN, pf->state);
+        clear_bit(__I40E_DOWN, pf->state);
 
         /* In case of MSIX we are going to setup the misc vector right here
          * to handle admin queue events etc. In case of legacy and MSI
@@ -11448,7 +11449,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         /* Unwind what we've done if something failed in the setup */
 err_vsis:
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         i40e_clear_interrupt_scheme(pf);
         kfree(pf->vsi);
 err_switch_setup:
@@ -11500,7 +11501,7 @@ static void i40e_remove(struct pci_dev *pdev)
 
         /* no more scheduling of any task */
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         if (pf->service_timer.data)
                 del_timer_sync(&pf->service_timer);
         if (pf->service_task.func)
@@ -11740,7 +11741,7 @@ static void i40e_shutdown(struct pci_dev *pdev)
         struct i40e_hw *hw = &pf->hw;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
         rtnl_lock();
         i40e_prep_for_reset(pf, true);
         rtnl_unlock();
@@ -11789,7 +11790,7 @@ static int i40e_suspend(struct pci_dev *pdev, pm_message_t state)
         int retval = 0;
 
         set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
 
         if (pf->wol_en && (pf->flags & I40E_FLAG_WOL_MC_MAGIC_PKT_WAKE))
                 i40e_enable_mc_magic_wake(pf);
@@ -11841,7 +11842,7 @@ static int i40e_resume(struct pci_dev *pdev)
 
         /* handling the reset will rebuild the device state */
         if (test_and_clear_bit(__I40E_SUSPENDED, pf->state)) {
-                clear_bit(__I40E_VSI_DOWN, pf->state);
+                clear_bit(__I40E_DOWN, pf->state);
                 rtnl_lock();
                 i40e_reset_and_rebuild(pf, false, true);
                 rtnl_unlock();
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 29321a6167a6..77115c25d96f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1854,7 +1854,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
@@ -2340,7 +2341,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
         /* Due to lack of space, no more new filters can be programmed */
         if (th->syn && (pf->flags & I40E_FLAG_FD_ATR_AUTO_DISABLED))
                 return;
-        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE) {
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_ENABLED) {
                 /* HW ATR eviction will take care of removing filters on FIN
                  * and RST packets.
                  */
@@ -2402,7 +2403,7 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct sk_buff *skb,
                         I40E_TXD_FLTR_QW1_CNTINDEX_SHIFT) &
                         I40E_TXD_FLTR_QW1_CNTINDEX_MASK;
 
-        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_CAPABLE)
+        if (pf->flags & I40E_FLAG_HW_ATR_EVICT_ENABLED)
                 dtype_cmd |= I40E_TXD_FLTR_QW1_ATR_MASK;
 
         fdir_desc->qindex_flex_ptype_vsi = cpu_to_le32(flex_ptype);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 95c23fbaa211..0fb38ca78900 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3017,10 +3017,12 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,
                                            VLAN_VID_MASK));
         }
 
+        spin_unlock_bh(&vsi->mac_filter_hash_lock);
         if (vlan_id || qos)
                 ret = i40e_vsi_add_pvid(vsi, vlanprio);
         else
                 i40e_vsi_remove_pvid(vsi);
+        spin_lock_bh(&vsi->mac_filter_hash_lock);
 
         if (vlan_id) {
                 dev_info(&pf->pdev->dev, "Setting VLAN %d, QOS 0x%x on VF %d\n",
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index dfe241a12ad0..12b02e530503 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1190,7 +1190,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
         unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
         struct sk_buff *skb;
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 9b875d776b29..33c901622ed5 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3719,7 +3719,7 @@ static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
                                     dma_addr_t *dma_addr,
                                     phys_addr_t *phys_addr)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         *dma_addr = mvpp2_percpu_read(priv, cpu,
                                       MVPP2_BM_PHY_ALLOC_REG(bm_pool->id));
@@ -3740,6 +3740,8 @@ static void mvpp2_bm_bufs_get_addrs(struct device *dev, struct mvpp2 *priv,
                 if (sizeof(phys_addr_t) == 8)
                         *phys_addr |= (u64)phys_addr_highbits << 32;
         }
+
+        put_cpu();
 }
 
 /* Free all buffers from the pool */
@@ -3920,18 +3922,12 @@ static inline u32 mvpp2_bm_cookie_pool_set(u32 cookie, int pool)
         return bm;
 }
 
-/* Get pool number from a BM cookie */
-static inline int mvpp2_bm_cookie_pool_get(unsigned long cookie)
-{
-        return (cookie >> MVPP2_BM_COOKIE_POOL_OFFS) & 0xFF;
-}
-
 /* Release buffer to BM */
 static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
                                      dma_addr_t buf_dma_addr,
                                      phys_addr_t buf_phys_addr)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         if (port->priv->hw_version == MVPP22) {
                 u32 val = 0;
@@ -3958,15 +3954,15 @@ static inline void mvpp2_bm_pool_put(struct mvpp2_port *port, int pool,
                            MVPP2_BM_VIRT_RLS_REG, buf_phys_addr);
         mvpp2_percpu_write(port->priv, cpu,
                            MVPP2_BM_PHY_RLS_REG(pool), buf_dma_addr);
+
+        put_cpu();
 }
 
 /* Refill BM pool */
-static void mvpp2_pool_refill(struct mvpp2_port *port, u32 bm,
+static void mvpp2_pool_refill(struct mvpp2_port *port, int pool,
                               dma_addr_t dma_addr,
                               phys_addr_t phys_addr)
 {
-        int pool = mvpp2_bm_cookie_pool_get(bm);
-
         mvpp2_bm_pool_put(port, pool, dma_addr, phys_addr);
 }
 
@@ -4186,8 +4182,6 @@ static void mvpp22_port_mii_set(struct mvpp2_port *port)
 {
         u32 val;
 
-        return;
-
         /* Only GOP port 0 has an XLG MAC */
         if (port->gop_id == 0) {
                 val = readl(port->base + MVPP22_XLG_CTRL3_REG);
@@ -4515,21 +4509,6 @@ static void mvpp2_rxq_offset_set(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_RXQ_CONFIG_REG(prxq), val);
 }
 
-/* Obtain BM cookie information from descriptor */
-static u32 mvpp2_bm_cookie_build(struct mvpp2_port *port,
-                                 struct mvpp2_rx_desc *rx_desc)
-{
-        int cpu = smp_processor_id();
-        int pool;
-
-        pool = (mvpp2_rxdesc_status_get(port, rx_desc) &
-                MVPP2_RXD_BM_POOL_ID_MASK) >>
-                MVPP2_RXD_BM_POOL_ID_OFFS;
-
-        return ((pool & 0xFF) << MVPP2_BM_COOKIE_POOL_OFFS) |
-               ((cpu & 0xFF) << MVPP2_BM_COOKIE_CPU_OFFS);
-}
-
 /* Tx descriptors helper methods */
 
 /* Get pointer to next Tx descriptor to be processed (send) by HW */
@@ -4757,7 +4736,7 @@ static void mvpp2_txp_max_tx_size_set(struct mvpp2_port *port)
 static void mvpp2_rx_pkts_coal_set(struct mvpp2_port *port,
                                    struct mvpp2_rx_queue *rxq)
 {
-        int cpu = smp_processor_id();
+        int cpu = get_cpu();
 
         if (rxq->pkts_coal > MVPP2_OCCUPIED_THRESH_MASK)
                 rxq->pkts_coal = MVPP2_OCCUPIED_THRESH_MASK;
@@ -4765,6 +4744,8 @@ static void mvpp2_rx_pkts_coal_set(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_THRESH_REG,
                            rxq->pkts_coal);
+
+        put_cpu();
 }
 
 static u32 mvpp2_usec_to_cycles(u32 usec, unsigned long clk_hz)
@@ -4945,7 +4926,7 @@ static int mvpp2_rxq_init(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_RXQ_STATUS_REG(rxq->id), 0);
 
         /* Set Rx descriptors queue starting address - indirect access */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         if (port->priv->hw_version == MVPP21)
                 rxq_dma = rxq->descs_dma;
@@ -4954,6 +4935,7 @@ static int mvpp2_rxq_init(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_ADDR_REG, rxq_dma);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_SIZE_REG, rxq->size);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_INDEX_REG, 0);
+        put_cpu();
 
         /* Set Offset */
         mvpp2_rxq_offset_set(port, rxq->id, NET_SKB_PAD);
@@ -4980,9 +4962,13 @@ static void mvpp2_rxq_drop_pkts(struct mvpp2_port *port,
 
         for (i = 0; i < rx_received; i++) {
                 struct mvpp2_rx_desc *rx_desc = mvpp2_rxq_next_desc_get(rxq);
-                u32 bm = mvpp2_bm_cookie_build(port, rx_desc);
+                u32 status = mvpp2_rxdesc_status_get(port, rx_desc);
+                int pool;
+
+                pool = (status & MVPP2_RXD_BM_POOL_ID_MASK) >>
+                        MVPP2_RXD_BM_POOL_ID_OFFS;
 
-                mvpp2_pool_refill(port, bm,
+                mvpp2_pool_refill(port, pool,
                                   mvpp2_rxdesc_dma_addr_get(port, rx_desc),
                                   mvpp2_rxdesc_cookie_get(port, rx_desc));
         }
@@ -5012,10 +4998,11 @@ static void mvpp2_rxq_deinit(struct mvpp2_port *port,
          * free descriptor number
          */
         mvpp2_write(port->priv, MVPP2_RXQ_STATUS_REG(rxq->id), 0);
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_NUM_REG, rxq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_ADDR_REG, 0);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_RXQ_DESC_SIZE_REG, 0);
+        put_cpu();
 }
 
 /* Create and initialize a Tx queue */
@@ -5038,7 +5025,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         txq->last_desc = txq->size - 1;
 
         /* Set Tx descriptors queue starting address - indirect access */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_ADDR_REG,
                            txq->descs_dma);
@@ -5063,6 +5050,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG,
                            MVPP2_PREF_BUF_PTR(desc) | MVPP2_PREF_BUF_SIZE_16 |
                            MVPP2_PREF_BUF_THRESH(desc_per_txq / 2));
+        put_cpu();
 
         /* WRR / EJP configuration - indirect access */
         tx_port_num = mvpp2_egress_port(port);
@@ -5133,10 +5121,11 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
         mvpp2_write(port->priv, MVPP2_TXQ_SCHED_TOKEN_CNTR_REG(txq->id), 0);
 
         /* Set Tx descriptors queue starting address and size */
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_ADDR_REG, 0);
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_DESC_SIZE_REG, 0);
+        put_cpu();
 }
 
 /* Cleanup Tx ports */
@@ -5146,7 +5135,7 @@ static void mvpp2_txq_clean(struct mvpp2_port *port, struct mvpp2_tx_queue *txq)
         int delay, pending, cpu;
         u32 val;
 
-        cpu = smp_processor_id();
+        cpu = get_cpu();
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_NUM_REG, txq->id);
         val = mvpp2_percpu_read(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG);
         val |= MVPP2_TXQ_DRAIN_EN_MASK;
@@ -5173,6 +5162,7 @@ static void mvpp2_txq_clean(struct mvpp2_port *port, struct mvpp2_tx_queue *txq)
 
         val &= ~MVPP2_TXQ_DRAIN_EN_MASK;
         mvpp2_percpu_write(port->priv, cpu, MVPP2_TXQ_PREF_BUF_REG, val);
+        put_cpu();
 
         for_each_present_cpu(cpu) {
                 txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
@@ -5420,7 +5410,7 @@ static void mvpp2_rx_csum(struct mvpp2_port *port, u32 status,
 
 /* Reuse skb if possible, or allocate a new skb and add it to BM pool */
 static int mvpp2_rx_refill(struct mvpp2_port *port,
-                           struct mvpp2_bm_pool *bm_pool, u32 bm)
+                           struct mvpp2_bm_pool *bm_pool, int pool)
 {
         dma_addr_t dma_addr;
         phys_addr_t phys_addr;
@@ -5432,7 +5422,7 @@ static int mvpp2_rx_refill(struct mvpp2_port *port,
         if (!buf)
                 return -ENOMEM;
 
-        mvpp2_pool_refill(port, bm, dma_addr, phys_addr);
+        mvpp2_pool_refill(port, pool, dma_addr, phys_addr);
 
         return 0;
 }
@@ -5490,7 +5480,7 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 unsigned int frag_size;
                 dma_addr_t dma_addr;
                 phys_addr_t phys_addr;
-                u32 bm, rx_status;
+                u32 rx_status;
                 int pool, rx_bytes, err;
                 void *data;
 
@@ -5502,8 +5492,8 @@ static int mvpp2_rx(struct mvpp2_port *port, int rx_todo,
                 phys_addr = mvpp2_rxdesc_cookie_get(port, rx_desc);
                 data = (void *)phys_to_virt(phys_addr);
 
-                bm = mvpp2_bm_cookie_build(port, rx_desc);
-                pool = mvpp2_bm_cookie_pool_get(bm);
+                pool = (rx_status & MVPP2_RXD_BM_POOL_ID_MASK) >>
+                        MVPP2_RXD_BM_POOL_ID_OFFS;
                 bm_pool = &port->priv->bm_pools[pool];
 
                 /* In case of an error, release the requested buffer pointer
@@ -5516,7 +5506,7 @@ err_drop_frame:
                         dev->stats.rx_errors++;
                         mvpp2_rx_error(port, rx_desc);
                         /* Return the buffer to the pool */
-                        mvpp2_pool_refill(port, bm, dma_addr, phys_addr);
+                        mvpp2_pool_refill(port, pool, dma_addr, phys_addr);
                         continue;
                 }
 
@@ -5531,7 +5521,7 @@ err_drop_frame:
                         goto err_drop_frame;
                 }
 
-                err = mvpp2_rx_refill(port, bm_pool, bm);
+                err = mvpp2_rx_refill(port, bm_pool, pool);
                 if (err) {
                         netdev_err(port->dev, "failed to refill BM pools\n");
                         goto err_drop_frame;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index ae5fdc2df654..ffbcb27c05e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1562,11 +1562,6 @@ static int mlx4_en_flow_replace(struct net_device *dev,
                 qpn = priv->drop_qp.qpn;
         else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
                 qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
-                if (qpn < priv->rss_map.base_qpn ||
-                    qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
-                        en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
-                        return -EINVAL;
-                }
         } else {
                 if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
                         en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 1a670b681555..0710b3677464 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -35,6 +35,7 @@
 #include <linux/etherdevice.h>
 
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 #include <linux/export.h>
 
 #include "mlx4.h"
@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
 
+        if (!mlx4_qp_lookup(dev, rule->qpn)) {
+                mlx4_err_rule(dev, "QP doesn't exist\n", rule);
+                ret = -EINVAL;
+                goto out;
+        }
+
         trans_rule_ctrl_to_hw(rule, mailbox->buf);
 
         size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
 
         list_for_each_entry(cur, &rule->list, list) {
                 ret = parse_trans_rule(dev, cur, mailbox->buf + size);
-                if (ret < 0) {
-                        mlx4_free_cmd_mailbox(dev, mailbox);
-                        return ret;
-                }
+                if (ret < 0)
+                        goto out;
+
                 size += ret;
         }
 
@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
                 }
         }
 
+out:
         mlx4_free_cmd_mailbox(dev, mailbox);
 
         return ret;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2d6abd4662b1..5a310d313e94 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -384,6 +384,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
                 __mlx4_qp_free_icm(dev, qpn);
 }
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
+{
+        struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
+        struct mlx4_qp *qp;
+
+        spin_lock(&qp_table->lock);
+
+        qp = __mlx4_qp_lookup(dev, qpn);
+
+        spin_unlock(&qp_table->lock);
+        return qp;
+}
+
 int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -471,6 +484,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
         }
 
         if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
+                if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
+                        mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
+
                 qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
                 cmd->qp_context.qos_vport = params->qos_vport;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 07516545474f..812783865205 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -5255,6 +5255,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
 
+static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
+                           struct mlx4_vf_immed_vlan_work *work)
+{
+        ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
+        ctx->qp_context.qos_vport = work->qos_vport;
+}
+
 void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
 {
         struct mlx4_vf_immed_vlan_work *work =
@@ -5369,11 +5376,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
                                         qp->sched_queue & 0xC7;
                                 upd_context->qp_context.pri_path.sched_queue |=
                                         ((work->qos & 0x7) << 3);
-                                upd_context->qp_mask |=
-                                        cpu_to_be64(1ULL <<
-                                                    MLX4_UPD_QP_MASK_QOS_VPP);
-                                upd_context->qp_context.qos_vport =
-                                        work->qos_vport;
+
+                                if (dev->caps.flags2 &
+                                    MLX4_DEV_CAP_FLAG2_QOS_VPP)
+                                        update_qos_vpp(upd_context, work);
                         }
 
                         err = mlx4_cmd(dev, mailbox->dma,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5bdaf3d545b2..10d282841f5b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -774,7 +774,7 @@ static void cb_timeout_handler(struct work_struct *work)
         mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
                        mlx5_command_str(msg_to_opcode(ent->in)),
                        msg_to_opcode(ent->in));
-        mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+        mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
 }
 
 static void cmd_work_handler(struct work_struct *work)
@@ -804,6 +804,7 @@ static void cmd_work_handler(struct work_struct *work)
         }
 
         cmd->ent_arr[ent->idx] = ent;
+        set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
         memset(lay, 0, sizeof(*lay));
@@ -825,6 +826,20 @@ static void cmd_work_handler(struct work_struct *work)
         if (ent->callback)
                 schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
 
+        /* Skip sending command to fw if internal error */
+        if (pci_channel_offline(dev->pdev) ||
+            dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+                u8 status = 0;
+                u32 drv_synd;
+
+                ent->ret = mlx5_internal_err_ret_value(dev, msg_to_opcode(ent->in), &drv_synd, &status);
+                MLX5_SET(mbox_out, ent->out, status, status);
+                MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+                return;
+        }
+
         /* ring doorbell after the descriptor is valid */
         mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
         wmb();
@@ -835,7 +850,7 @@ static void cmd_work_handler(struct work_struct *work)
                 poll_timeout(ent);
                 /* make sure we read the descriptor after ownership is SW */
                 rmb();
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
         }
 }
 
@@ -879,7 +894,7 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
                 wait_for_completion(&ent->done);
         } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
                 ent->ret = -ETIMEDOUT;
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
         }
 
         err = ent->ret;
@@ -1375,7 +1390,7 @@ static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg)
         }
 }
 
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -1395,6 +1410,19 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                         struct semaphore *sem;
 
                         ent = cmd->ent_arr[i];
+
+                        /* if we already completed the command, ignore it */
+                        if (!test_and_clear_bit(MLX5_CMD_ENT_STATE_PENDING_COMP,
+                                                &ent->state)) {
+                                /* only real completion can free the cmd slot */
+                                if (!forced) {
+                                        mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
+                                                      ent->idx);
+                                        free_ent(cmd, ent->idx);
+                                }
+                                continue;
+                        }
+
                         if (ent->callback)
                                 cancel_delayed_work(&ent->cb_timeout_work);
                         if (ent->page_queue)
@@ -1417,7 +1445,10 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                                 mlx5_core_dbg(dev, "command completed. ret 0x%x, delivery status %s(0x%x)\n",
                                               ent->ret, deliv_status_to_str(ent->status), ent->status);
                         }
-                        free_ent(cmd, ent->idx);
+
+                        /* only real completion will free the entry slot */
+                        if (!forced)
+                                free_ent(cmd, ent->idx);
 
                         if (ent->callback) {
                                 ds = ent->ts2 - ent->ts1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 2fd044b23875..944fc1742464 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -458,13 +458,15 @@ struct mlx5e_mpw_info {
 
 struct mlx5e_rx_am_stats {
         int ppms; /* packets per msec */
+        int bpms; /* bytes per msec */
         int epms; /* events per msec */
 };
 
 struct mlx5e_rx_am_sample {
-        ktime_t         time;
-        unsigned int    pkt_ctr;
-        u16             event_ctr;
+        ktime_t time;
+        u32     pkt_ctr;
+        u32     byte_ctr;
+        u16     event_ctr;
 };
 
 struct mlx5e_rx_am { /* Adaptive Moderation */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 7b1566f0ae58..66b5fec15313 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1041,6 +1041,8 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq *sq)
 #define MLX5_IB_GRH_BYTES       40
 #define MLX5_IPOIB_ENCAP_LEN    4
 #define MLX5_GID_SIZE           16
+#define MLX5_IPOIB_PSEUDO_LEN   20
+#define MLX5_IPOIB_HARD_LEN     (MLX5_IPOIB_PSEUDO_LEN + MLX5_IPOIB_ENCAP_LEN)
 
 static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct mlx5_cqe64 *cqe,
@@ -1048,6 +1050,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct sk_buff *skb)
 {
         struct net_device *netdev = rq->netdev;
+        char *pseudo_header;
         u8 *dgid;
         u8 g;
 
@@ -1076,8 +1079,11 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
         if (likely(netdev->features & NETIF_F_RXHASH))
                 mlx5e_skb_set_hash(cqe, skb);
 
+        /* 20 bytes of ipoib header and 4 for encap existing */
+        pseudo_header = skb_push(skb, MLX5_IPOIB_PSEUDO_LEN);
+        memset(pseudo_header, 0, MLX5_IPOIB_PSEUDO_LEN);
         skb_reset_mac_header(skb);
-        skb_pull(skb, MLX5_IPOIB_ENCAP_LEN);
+        skb_pull(skb, MLX5_IPOIB_HARD_LEN);
 
         skb->dev = netdev;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
index 02dd3a95ed8f..acf32fe952cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
@@ -183,28 +183,27 @@ static void mlx5e_am_exit_parking(struct mlx5e_rx_am *am)
         mlx5e_am_step(am);
 }
 
+#define IS_SIGNIFICANT_DIFF(val, ref) \
+        (((100 * abs((val) - (ref))) / (ref)) > 10) /* more than 10% difference */
+
 static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
                                   struct mlx5e_rx_am_stats *prev)
 {
-        int diff;
-
-        if (!prev->ppms)
-                return curr->ppms ? MLX5E_AM_STATS_BETTER :
+        if (!prev->bpms)
+                return curr->bpms ? MLX5E_AM_STATS_BETTER :
                                     MLX5E_AM_STATS_SAME;
 
-        diff = curr->ppms - prev->ppms;
-        if (((100 * abs(diff)) / prev->ppms) > 10) /* more than 10% diff */
-                return (diff > 0) ? MLX5E_AM_STATS_BETTER :
-                                    MLX5E_AM_STATS_WORSE;
+        if (IS_SIGNIFICANT_DIFF(curr->bpms, prev->bpms))
+                return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
-        if (!prev->epms)
-                return curr->epms ? MLX5E_AM_STATS_WORSE :
-                                    MLX5E_AM_STATS_SAME;
+        if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
+                return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
-        diff = curr->epms - prev->epms;
-        if (((100 * abs(diff)) / prev->epms) > 10) /* more than 10% diff */
-                return (diff < 0) ? MLX5E_AM_STATS_BETTER :
-                                    MLX5E_AM_STATS_WORSE;
+        if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
+                return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
+                                                   MLX5E_AM_STATS_WORSE;
 
         return MLX5E_AM_STATS_SAME;
 }
@@ -266,10 +265,13 @@ static void mlx5e_am_sample(struct mlx5e_rq *rq,
 {
         s->time      = ktime_get();
         s->pkt_ctr   = rq->stats.packets;
+        s->byte_ctr  = rq->stats.bytes;
         s->event_ctr = rq->cq.event_ctr;
 }
 
 #define MLX5E_AM_NEVENTS 64
+#define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
+#define BIT_GAP(bits, end, start) ((((end) - (start)) + BIT_ULL(bits)) & (BIT_ULL(bits) - 1))
 
 static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
                                 struct mlx5e_rx_am_sample *end,
@@ -277,13 +279,17 @@ static void mlx5e_am_calc_stats(struct mlx5e_rx_am_sample *start,
 {
         /* u32 holds up to 71 minutes, should be enough */
         u32 delta_us = ktime_us_delta(end->time, start->time);
-        unsigned int npkts = end->pkt_ctr - start->pkt_ctr;
+        u32 npkts = BIT_GAP(BITS_PER_TYPE(u32), end->pkt_ctr, start->pkt_ctr);
+        u32 nbytes = BIT_GAP(BITS_PER_TYPE(u32), end->byte_ctr,
+                             start->byte_ctr);
 
         if (!delta_us)
                 return;
 
-        curr_stats->ppms =            (npkts * USEC_PER_MSEC) / delta_us;
-        curr_stats->epms = (MLX5E_AM_NEVENTS * USEC_PER_MSEC) / delta_us;
+        curr_stats->ppms = DIV_ROUND_UP(npkts * USEC_PER_MSEC, delta_us);
+        curr_stats->bpms = DIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us);
+        curr_stats->epms = DIV_ROUND_UP(MLX5E_AM_NEVENTS * USEC_PER_MSEC,
+                                        delta_us);
 }
 
 void mlx5e_rx_am_work(struct work_struct *work)
@@ -308,7 +314,8 @@ void mlx5e_rx_am(struct mlx5e_rq *rq)
 
         switch (am->state) {
         case MLX5E_AM_MEASURE_IN_PROGRESS:
-                nevents = rq->cq.event_ctr - am->start_sample.event_ctr;
+                nevents = BIT_GAP(BITS_PER_TYPE(u16), rq->cq.event_ctr,
+                                  am->start_sample.event_ctr);
                 if (nevents < MLX5E_AM_NEVENTS)
                         break;
                 mlx5e_am_sample(rq, &end_sample);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 53e4992d6511..f81c3aa60b46 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -417,20 +417,13 @@ struct mlx5e_stats {
 };
 
 static const struct counter_desc mlx5e_pme_status_desc[] = {
-        { "module_plug", 0 },
         { "module_unplug", 8 },
 };
 
 static const struct counter_desc mlx5e_pme_error_desc[] = {
-        { "module_pwr_budget_exd", 0 },  /* power budget exceed */
-        { "module_long_range", 8 },      /* long range for non MLNX cable */
-        { "module_bus_stuck", 16 },      /* bus stuck (I2C or data shorted) */
-        { "module_no_eeprom", 24 },      /* no eeprom/retry time out */
-        { "module_enforce_part", 32 },   /* enforce part number list */
-        { "module_unknown_id", 40 },     /* unknown identifier */
-        { "module_high_temp", 48 },      /* high temperature */
+        { "module_bus_stuck", 16 },       /* bus stuck (I2C or data shorted) */
+        { "module_high_temp", 48 },       /* high temperature */
         { "module_bad_shorted", 56 },    /* bad or shorted cable/module */
-        { "module_unknown_status", 64 },
 };
 
 #endif /* __MLX5_EN_STATS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 11c27e4fadf6..ec63158ab643 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -43,6 +43,7 @@
 #include <net/tc_act/tc_vlan.h>
 #include <net/tc_act/tc_tunnel_key.h>
 #include <net/tc_act/tc_pedit.h>
+#include <net/tc_act/tc_csum.h>
 #include <net/vxlan.h>
 #include <net/arp.h>
 #include "en.h"
@@ -384,7 +385,7 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
                 if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                         mlx5_encap_dealloc(priv->mdev, e->encap_id);
 
-                hlist_del_rcu(&e->encap_hlist);
+                hash_del_rcu(&e->encap_hlist);
                 kfree(e->encap_header);
                 kfree(e);
         }
@@ -925,11 +926,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr)
 {
         struct pedit_headers *set_masks, *add_masks, *set_vals, *add_vals;
-        int i, action_size, nactions, max_actions, first, last;
+        int i, action_size, nactions, max_actions, first, last, first_z;
         void *s_masks_p, *a_masks_p, *vals_p;
-        u32 s_mask, a_mask, val;
         struct mlx5_fields *f;
         u8 cmd, field_bsize;
+        u32 s_mask, a_mask;
         unsigned long mask;
         void *action;
 
@@ -946,7 +947,8 @@ static int offload_pedit_fields(struct pedit_headers *masks,
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
                 /* avoid seeing bits set from previous iterations */
-                s_mask = a_mask = mask = val = 0;
+                s_mask = 0;
+                a_mask = 0;
 
                 s_masks_p = (void *)set_masks + f->offset;
                 a_masks_p = (void *)add_masks + f->offset;
@@ -981,12 +983,12 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                         memset(a_masks_p, 0, f->size);
                 }
 
-                memcpy(&val, vals_p, f->size);
-
                 field_bsize = f->size * BITS_PER_BYTE;
+
+                first_z = find_first_zero_bit(&mask, field_bsize);
                 first = find_first_bit(&mask, field_bsize);
                 last  = find_last_bit(&mask, field_bsize);
-                if (first > 0 || last != (field_bsize - 1)) {
+                if (first > 0 || last != (field_bsize - 1) || first_z < last) {
                         printk(KERN_WARNING "mlx5: partial rewrite (mask %lx) is currently not offloaded\n",
                                mask);
                         return -EOPNOTSUPP;
@@ -1002,11 +1004,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                 }
 
                 if (field_bsize == 32)
-                        MLX5_SET(set_action_in, action, data, ntohl(val));
+                        MLX5_SET(set_action_in, action, data, ntohl(*(__be32 *)vals_p));
                 else if (field_bsize == 16)
-                        MLX5_SET(set_action_in, action, data, ntohs(val));
+                        MLX5_SET(set_action_in, action, data, ntohs(*(__be16 *)vals_p));
                 else if (field_bsize == 8)
-                        MLX5_SET(set_action_in, action, data, val);
+                        MLX5_SET(set_action_in, action, data, *(u8 *)vals_p);
 
                 action += action_size;
                 nactions++;
@@ -1109,6 +1111,28 @@ out_err:
         return err;
 }
 
+static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 update_flags)
+{
+        u32 prot_flags = TCA_CSUM_UPDATE_FLAG_IPV4HDR | TCA_CSUM_UPDATE_FLAG_TCP |
+                         TCA_CSUM_UPDATE_FLAG_UDP;
+
+        /*  The HW recalcs checksums only if re-writing headers */
+        if (!(action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)) {
+                netdev_warn(priv->netdev,
+                            "TC csum action is only offloaded with pedit\n");
+                return false;
+        }
+
+        if (update_flags & ~prot_flags) {
+                netdev_warn(priv->netdev,
+                            "can't offload TC csum action for some header/s - flags %#x\n",
+                            update_flags);
+                return false;
+        }
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1149,6 +1173,14 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_skbedit_mark(a)) {
                         u32 mark = tcf_skbedit_mark(a);
 
@@ -1651,6 +1683,14 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_mirred_egress_redirect(a)) {
                         int ifindex = tcf_mirred_ifindex(a);
                         struct net_device *out_dev, *encap_dev = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ea5d8d37a75c..33eae5ad2fb0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -422,7 +422,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr)
                         break;
 
                 case MLX5_EVENT_TYPE_CMD:
-                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector));
+                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false);
                         break;
 
                 case MLX5_EVENT_TYPE_PORT_CHANGE:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 0e487e8ca634..8f5125ccd8d4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -862,7 +862,7 @@ struct mlx5_flow_table *mlx5_create_vport_flow_table(struct mlx5_flow_namespace
         ft_attr.level   = level;
         ft_attr.prio    = prio;
 
-        return __mlx5_create_flow_table(ns, &ft_attr, FS_FT_OP_MOD_NORMAL, 0);
+        return __mlx5_create_flow_table(ns, &ft_attr, FS_FT_OP_MOD_NORMAL, vport);
 }
 
 struct mlx5_flow_table*
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d0515391d33b..f27f84ffbc85 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -90,7 +90,7 @@ static void trigger_cmd_completions(struct mlx5_core_dev *dev)
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 
         mlx5_core_dbg(dev, "vector 0x%llx\n", vector);
-        mlx5_cmd_comp_handler(dev, vector);
+        mlx5_cmd_comp_handler(dev, vector, true);
         return;
 
 no_trig:
@@ -275,10 +275,8 @@ static void poll_health(unsigned long data)
         struct mlx5_core_health *health = &dev->priv.health;
         u32 count;
 
-        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
-                mod_timer(&health->timer, get_next_poll_jiffies());
-                return;
-        }
+        if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
+                goto out;
 
         count = ioread32be(health->health_counter);
         if (count == health->prev)
@@ -290,8 +288,6 @@ static void poll_health(unsigned long data)
         if (health->miss_counter == MAX_MISSES) {
                 dev_err(&dev->pdev->dev, "device's health compromised - reached miss count\n");
                 print_health_info(dev);
-        } else {
-                mod_timer(&health->timer, get_next_poll_jiffies());
         }
 
         if (in_fatal(dev) && !health->sick) {
@@ -305,6 +301,9 @@ static void poll_health(unsigned long data)
                                 "new health works are not permitted at this stage\n");
                 spin_unlock(&health->wq_lock);
         }
+
+out:
+        mod_timer(&health->timer, get_next_poll_jiffies());
 }
 
 void mlx5_start_health_poll(struct mlx5_core_dev *dev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 0c123d571b4c..4f577a5abf88 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -537,8 +537,10 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
         /* disable cmdif checksum */
         MLX5_SET(cmd_hca_cap, set_hca_cap, cmdif_checksum, 0);
 
-        /* If the HCA supports 4K UARs use it */
-        if (MLX5_CAP_GEN_MAX(dev, uar_4k))
+        /* Enable 4K UAR only when HCA supports it and page size is bigger
+         * than 4K.
+         */
+        if (MLX5_CAP_GEN_MAX(dev, uar_4k) && PAGE_SIZE > 4096)
                 MLX5_SET(cmd_hca_cap, set_hca_cap, uar_4k, 1);
 
         MLX5_SET(cmd_hca_cap, set_hca_cap, log_uar_page_sz, PAGE_SHIFT - 12);
@@ -612,7 +614,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         struct mlx5_priv *priv  = &mdev->priv;
         struct msix_entry *msix = priv->msix_arr;
         int irq                 = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
-        int err;
 
         if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
                 mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
@@ -622,18 +623,11 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                         priv->irq_info[i].mask);
 
-        err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
-        if (err) {
-                mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x",
-                               irq);
-                goto err_clear_mask;
-        }
+        if (IS_ENABLED(CONFIG_SMP) &&
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
 
         return 0;
-
-err_clear_mask:
-        free_cpumask_var(priv->irq_info[i].mask);
-        return err;
 }
 
 static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 483241b4b05d..a672f6a860dc 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -2956,7 +2956,7 @@ static u32 qed_grc_dump_ctx_data(struct qed_hwfn *p_hwfn,
                                 qed_wr(p_hwfn,
                                        p_ptt,
                                        s_storm_defs[storm_id].cm_ctx_wr_addr,
-                                       BIT(9) | lid);
+                                       (i << 9) | lid);
                                 *(dump_buf + offset) = qed_rd(p_hwfn,
                                                               p_ptt,
                                                               rd_reg_addr);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 537d1236a4fe..715b3aaf83ac 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1730,7 +1730,8 @@ void qed_get_protocol_stats(struct qed_dev *cdev,
                 qed_get_protocol_stats_iscsi(cdev, &stats->iscsi_stats);
                 break;
         default:
-                DP_ERR(cdev, "Invalid protocol type = %d\n", type);
+                DP_VERBOSE(cdev, QED_MSG_SP,
+                           "Invalid protocol type = %d\n", type);
                 return;
         }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 7245b1072518..81312924df14 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1824,22 +1824,44 @@ struct qlcnic_hardware_ops {
         u32 (*get_cap_size)(void *, int);
         void (*set_sys_info)(void *, int, u32);
         void (*store_cap_mask)(void *, u32);
+        bool (*encap_rx_offload) (struct qlcnic_adapter *adapter);
+        bool (*encap_tx_offload) (struct qlcnic_adapter *adapter);
 };
 
 extern struct qlcnic_nic_template qlcnic_vf_ops;
 
-static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_tx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_TX_OFFLOAD;
 }
 
-static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_rx_offload(struct qlcnic_adapter *adapter)
 {
         return adapter->ahw->extra_capability[0] &
                QLCNIC_83XX_FW_CAPAB_ENCAP_RX_OFFLOAD;
 }
 
+static inline bool qlcnic_82xx_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_82xx_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+
+static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_rx_offload(adapter);
+}
+
+static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_tx_offload(adapter);
+}
+
 static inline int qlcnic_start_firmware(struct qlcnic_adapter *adapter)
 {
         return adapter->nic_ops->start_firmware(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4fb68797630e..f7080d0ab874 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -242,6 +242,8 @@ static struct qlcnic_hardware_ops qlcnic_83xx_hw_ops = {
         .get_cap_size                   = qlcnic_83xx_get_cap_size,
         .set_sys_info                   = qlcnic_83xx_set_sys_info,
         .store_cap_mask                 = qlcnic_83xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_83xx_ops = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 838cc0ceafd8..7848cf04b29a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
                         }
                         return -EIO;
                 }
-                usleep_range(1000, 1500);
+                udelay(1200);
         }
 
         if (id_reg)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index b6628aaa6e4a..1b5f7d57b6f8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -632,6 +632,8 @@ static struct qlcnic_hardware_ops qlcnic_hw_ops = {
         .get_cap_size                   = qlcnic_82xx_get_cap_size,
         .set_sys_info                   = qlcnic_82xx_set_sys_info,
         .store_cap_mask                 = qlcnic_82xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_82xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_82xx_encap_tx_offload,
 };
 
 static int qlcnic_check_multi_tx_capability(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 2f656f395f39..c58180f40844 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -77,6 +77,8 @@ static struct qlcnic_hardware_ops qlcnic_sriov_vf_hw_ops = {
         .free_mac_list                  = qlcnic_sriov_vf_free_mac_list,
         .enable_sds_intr                = qlcnic_83xx_enable_sds_intr,
         .disable_sds_intr               = qlcnic_83xx_disable_sds_intr,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 
 static struct qlcnic_nic_template qlcnic_sriov_vf_ops = {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index cc065ffbe4b5..bcd4708b3745 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -931,7 +931,7 @@ int emac_mac_up(struct emac_adapter *adpt)
         emac_mac_config(adpt);
         emac_mac_rx_descs_refill(adpt, &adpt->rx_q);
 
-        adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
+        adpt->phydev->irq = PHY_POLL;
         ret = phy_connect_direct(netdev, adpt->phydev, emac_adjust_link,
                                  PHY_INTERFACE_MODE_SGMII);
         if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 441c19366489..18461fcb9815 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -13,15 +13,11 @@
 /* Qualcomm Technologies, Inc. EMAC PHY Controller driver.
  */
 
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_net.h>
 #include <linux/of_mdio.h>
 #include <linux/phy.h>
 #include <linux/iopoll.h>
 #include <linux/acpi.h>
 #include "emac.h"
-#include "emac-mac.h"
 
 /* EMAC base register offsets */
 #define EMAC_MDIO_CTRL                                        0x001414
@@ -52,62 +48,10 @@
 
 #define MDIO_WAIT_TIMES                                           1000
 
-#define EMAC_LINK_SPEED_DEFAULT (\
-                EMAC_LINK_SPEED_10_HALF  |\
-                EMAC_LINK_SPEED_10_FULL  |\
-                EMAC_LINK_SPEED_100_HALF |\
-                EMAC_LINK_SPEED_100_FULL |\
-                EMAC_LINK_SPEED_1GB_FULL)
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The autopoll feature takes over the MDIO bus.  In order for
- * the PHY driver to be able to talk to the PHY over the MDIO
- * bus, we need to temporarily disable the autopoll feature.
- */
-static int emac_phy_mdio_autopoll_disable(struct emac_adapter *adpt)
-{
-        u32 val;
-
-        /* disable autopoll */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, MDIO_AP_EN, 0);
-
-        /* wait for any mdio polling to complete */
-        if (!readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, val,
-                                !(val & MDIO_BUSY), 100, MDIO_WAIT_TIMES * 100))
-                return 0;
-
-        /* failed to disable; ensure it is enabled before returning */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-
-        return -EBUSY;
-}
-
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The EMAC has the ability to poll the external PHY on the MDIO
- * bus for link state changes.  This eliminates the need for the
- * driver to poll the phy.  If if the link state does change,
- * the EMAC issues an interrupt on behalf of the PHY.
- */
-static void emac_phy_mdio_autopoll_enable(struct emac_adapter *adpt)
-{
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-}
-
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -122,24 +66,15 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)),
                                100, MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
-        else
-                ret = (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
 }
 
 static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
 {
         struct emac_adapter *adpt = bus->priv;
         u32 reg;
-        int ret;
-
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
 
         emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                           (addr << PHY_ADDR_SHFT));
@@ -155,11 +90,9 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
         if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                                !(reg & (MDIO_START | MDIO_BUSY)), 100,
                                MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
+                return -EIO;
 
-        emac_phy_mdio_autopoll_enable(adpt);
-
-        return ret;
+        return 0;
 }
 
 /* Configure the MDIO bus and connect the external PHY */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 28a8cdc36485..98a326faea29 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -50,19 +50,7 @@
 #define DMAR_DLY_CNT_DEF                                    15
 #define DMAW_DLY_CNT_DEF                                     4
 
-#define IMR_NORMAL_MASK         (\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
-
-#define IMR_EXTENDED_MASK       (\
-                SW_MAN_INT      |\
-                ISR_OVER        |\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
+#define IMR_NORMAL_MASK         (ISR_ERROR | ISR_OVER | ISR_TX_PKT)
 
 #define ISR_TX_PKT      (\
         TX_PKT_INT      |\
@@ -70,10 +58,6 @@
         TX_PKT_INT2     |\
         TX_PKT_INT3)
 
-#define ISR_GPHY_LINK        (\
-        GPHY_LINK_UP_INT     |\
-        GPHY_LINK_DOWN_INT)
-
 #define ISR_OVER        (\
         RFD0_UR_INT     |\
         RFD1_UR_INT     |\
@@ -187,10 +171,6 @@ irqreturn_t emac_isr(int _irq, void *data)
         if (status & ISR_OVER)
                 net_warn_ratelimited("warning: TX/RX overflow\n");
 
-        /* link event */
-        if (status & ISR_GPHY_LINK)
-                phy_mac_interrupt(adpt->phydev, !!(status & GPHY_LINK_UP_INT));
-
 exit:
         /* enable the interrupt */
         writel(irq->mask, adpt->base + EMAC_INT_MASK);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 3cd7989c007d..784782da3a85 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -230,18 +230,6 @@ static void ravb_ring_free(struct net_device *ndev, int q)
         int ring_size;
         int i;
 
-        /* Free RX skb ringbuffer */
-        if (priv->rx_skb[q]) {
-                for (i = 0; i < priv->num_rx_ring[q]; i++)
-                        dev_kfree_skb(priv->rx_skb[q][i]);
-        }
-        kfree(priv->rx_skb[q]);
-        priv->rx_skb[q] = NULL;
-
-        /* Free aligned TX buffers */
-        kfree(priv->tx_align[q]);
-        priv->tx_align[q] = NULL;
-
         if (priv->rx_ring[q]) {
                 for (i = 0; i < priv->num_rx_ring[q]; i++) {
                         struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
@@ -270,6 +258,18 @@ static void ravb_ring_free(struct net_device *ndev, int q)
                 priv->tx_ring[q] = NULL;
         }
 
+        /* Free RX skb ringbuffer */
+        if (priv->rx_skb[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++)
+                        dev_kfree_skb(priv->rx_skb[q][i]);
+        }
+        kfree(priv->rx_skb[q]);
+        priv->rx_skb[q] = NULL;
+
+        /* Free aligned TX buffers */
+        kfree(priv->tx_align[q]);
+        priv->tx_align[q] = NULL;
+
         /* Free TX skb ringbuffer.
          * SKBs are freed by ravb_tx_free() call above.
          */
diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 489ef146201e..6a9c954492f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -37,6 +37,7 @@
 #define TSE_PCS_CONTROL_AN_EN_MASK                      BIT(12)
 #define TSE_PCS_CONTROL_REG                             0x00
 #define TSE_PCS_CONTROL_RESTART_AN_MASK                 BIT(9)
+#define TSE_PCS_CTRL_AUTONEG_SGMII                      0x1140
 #define TSE_PCS_IF_MODE_REG                             0x28
 #define TSE_PCS_LINK_TIMER_0_REG                        0x24
 #define TSE_PCS_LINK_TIMER_1_REG                        0x26
@@ -65,6 +66,7 @@
 #define TSE_PCS_SW_RESET_TIMEOUT                        100
 #define TSE_PCS_USE_SGMII_AN_MASK                       BIT(1)
 #define TSE_PCS_USE_SGMII_ENA                           BIT(0)
+#define TSE_PCS_IF_USE_SGMII                            0x03
 
 #define SGMII_ADAPTER_CTRL_REG                          0x00
 #define SGMII_ADAPTER_DISABLE                           0x0001
@@ -101,7 +103,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs)
 {
         int ret = 0;
 
-        writew(TSE_PCS_USE_SGMII_ENA, base + TSE_PCS_IF_MODE_REG);
+        writew(TSE_PCS_IF_USE_SGMII, base + TSE_PCS_IF_MODE_REG);
+
+        writew(TSE_PCS_CTRL_AUTONEG_SGMII, base + TSE_PCS_CONTROL_REG);
 
         writew(TSE_PCS_SGMII_LINK_TIMER_0, base + TSE_PCS_LINK_TIMER_0_REG);
         writew(TSE_PCS_SGMII_LINK_TIMER_1, base + TSE_PCS_LINK_TIMER_1_REG);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index aa6476439aee..e0ef02f9503b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@ -214,13 +214,13 @@ static int dwmac4_wrback_get_tx_timestamp_status(struct dma_desc *p)
 {
         /* Context type from W/B descriptor must be zero */
         if (le32_to_cpu(p->des3) & TDES3_CONTEXT_TYPE)
-                return -EINVAL;
+                return 0;
 
         /* Tx Timestamp Status is 1 so des0 and des1'll have valid values */
         if (le32_to_cpu(p->des3) & TDES3_TIMESTAMP_STATUS)
-                return 0;
+                return 1;
 
-        return 1;
+        return 0;
 }
 
 static inline u64 dwmac4_get_timestamp(void *desc, u32 ats)
@@ -282,7 +282,10 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
                 }
         }
 exit:
-        return ret;
+        if (likely(ret == 0))
+                return 1;
+
+        return 0;
 }
 
 static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a74c481401c4..d16d11bfc046 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -434,14 +434,14 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
                 return;
 
         /* check tx tstamp status */
-        if (!priv->hw->desc->get_tx_timestamp_status(p)) {
+        if (priv->hw->desc->get_tx_timestamp_status(p)) {
                 /* get the valid tstamp */
                 ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
 
                 memset(&shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
                 shhwtstamp.hwtstamp = ns_to_ktime(ns);
 
-                netdev_info(priv->dev, "get valid TX hw timestamp %llu\n", ns);
+                netdev_dbg(priv->dev, "get valid TX hw timestamp %llu\n", ns);
                 /* pass tstamp to stack */
                 skb_tstamp_tx(skb, &shhwtstamp);
         }
@@ -468,19 +468,19 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
                 return;
 
         /* Check if timestamp is available */
-        if (!priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
+        if (priv->hw->desc->get_rx_timestamp_status(p, priv->adv_ts)) {
                 /* For GMAC4, the valid timestamp is from CTX next desc. */
                 if (priv->plat->has_gmac4)
                         ns = priv->hw->desc->get_timestamp(np, priv->adv_ts);
                 else
                         ns = priv->hw->desc->get_timestamp(p, priv->adv_ts);
 
-                netdev_info(priv->dev, "get valid RX hw timestamp %llu\n", ns);
+                netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
                 shhwtstamp = skb_hwtstamps(skb);
                 memset(shhwtstamp, 0, sizeof(struct skb_shared_hwtstamps));
                 shhwtstamp->hwtstamp = ns_to_ktime(ns);
         } else  {
-                netdev_err(priv->dev, "cannot get RX hw timestamp\n");
+                netdev_dbg(priv->dev, "cannot get RX hw timestamp\n");
         }
 }
 
@@ -546,7 +546,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         /* PTP v1, UDP, any kind of event packet */
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -578,7 +581,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
                         ptp_v2 = PTP_TCR_TSVER2ENA;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -612,7 +618,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                         config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
                         ptp_v2 = PTP_TCR_TSVER2ENA;
                         /* take time stamp for all event messages */
-                        snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+                        if (priv->plat->has_gmac4)
+                                snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
+                        else
+                                snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
 
                         ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
                         ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
@@ -1208,7 +1217,7 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
         u32 rx_count = priv->plat->rx_queues_to_use;
         unsigned int bfsize = 0;
         int ret = -ENOMEM;
-        u32 queue;
+        int queue;
         int i;
 
         if (priv->hw->mode->set_16kib_bfsize)
@@ -2724,7 +2733,7 @@ static void stmmac_tso_allocator(struct stmmac_priv *priv, unsigned int des,
 
                 priv->hw->desc->prepare_tso_tx_desc(desc, 0, buff_size,
                         0, 1,
-                        (last_segment) && (buff_size < TSO_MAX_BUFF_SIZE),
+                        (last_segment) && (tmp_len <= TSO_MAX_BUFF_SIZE),
                         0, 0);
 
                 tmp_len -= TSO_MAX_BUFF_SIZE;
@@ -2947,7 +2956,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         int i, csum_insertion = 0, is_jumbo = 0;
         u32 queue = skb_get_queue_mapping(skb);
         int nfrags = skb_shinfo(skb)->nr_frags;
-        unsigned int entry, first_entry;
+        int entry;
+        unsigned int first_entry;
         struct dma_desc *desc, *first;
         struct stmmac_tx_queue *tx_q;
         unsigned int enh_desc;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
index 48fb72fc423c..f4b31d69f60e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
@@ -59,7 +59,8 @@
 /* Enable Snapshot for Messages Relevant to Master */
 #define PTP_TCR_TSMSTRENA       BIT(15)
 /* Select PTP packets for Taking Snapshots */
-#define PTP_TCR_SNAPTYPSEL_1    GENMASK(17, 16)
+#define PTP_TCR_SNAPTYPSEL_1    BIT(16)
+#define PTP_GMAC4_TCR_SNAPTYPSEL_1      GENMASK(17, 16)
 /* Enable MAC address for PTP Frame Filtering */
 #define PTP_TCR_TSENMACADDR     BIT(18)
 
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index dec5d563ab19..199459bd6961 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1007,7 +1007,7 @@ static void geneve_setup(struct net_device *dev)
 
         dev->netdev_ops = &geneve_netdev_ops;
         dev->ethtool_ops = &geneve_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         SET_NETDEV_DEVTYPE(dev, &geneve_type);
 
@@ -1133,7 +1133,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
 
         /* make enough headroom for basic scenario */
         encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (!metadata && ip_tunnel_info_af(info) == AF_INET) {
                 encap_len += sizeof(struct iphdr);
                 dev->max_mtu -= sizeof(struct iphdr);
         } else {
@@ -1293,7 +1293,7 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
         if (nla_put_u32(skb, IFLA_GENEVE_ID, vni))
                 goto nla_put_failure;
 
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (rtnl_dereference(geneve->sock4)) {
                 if (nla_put_in_addr(skb, IFLA_GENEVE_REMOTE,
                                     info->key.u.ipv4.dst))
                         goto nla_put_failure;
@@ -1302,8 +1302,10 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                                !!(info->key.tun_flags & TUNNEL_CSUM)))
                         goto nla_put_failure;
 
+        }
+
 #if IS_ENABLED(CONFIG_IPV6)
-        } else {
+        if (rtnl_dereference(geneve->sock6)) {
                 if (nla_put_in6_addr(skb, IFLA_GENEVE_REMOTE6,
                                      &info->key.u.ipv6.dst))
                         goto nla_put_failure;
@@ -1315,8 +1317,8 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                 if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_RX,
                                !geneve->use_udp6_rx_checksums))
                         goto nla_put_failure;
-#endif
         }
+#endif
 
         if (nla_put_u8(skb, IFLA_GENEVE_TTL, info->key.ttl) ||
             nla_put_u8(skb, IFLA_GENEVE_TOS, info->key.tos) ||
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 4fea1b3dfbb4..ca110cd2a4e4 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -611,7 +611,7 @@ static const struct net_device_ops gtp_netdev_ops = {
 static void gtp_link_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &gtp_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 
         dev->hard_header_len = 0;
         dev->addr_len = 0;
@@ -873,7 +873,7 @@ static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 
         /* Check if there's an existing gtpX device to configure */
         dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
-        if (dev->netdev_ops == &gtp_netdev_ops)
+        if (dev && dev->netdev_ops == &gtp_netdev_ops)
                 gtp = netdev_priv(dev);
 
         put_net(net);
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 922bf440e9f1..021a8ec411ab 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -311,7 +311,7 @@ static void sp_setup(struct net_device *dev)
 {
         /* Finish setting up the DEVICE info. */
         dev->netdev_ops         = &sp_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->mtu                = SIXP_MTU;
         dev->hard_header_len    = AX25_MAX_HEADER_LEN;
         dev->header_ops         = &ax25_header_ops;
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index f62e7f325cf9..78a6414c5fd9 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -476,7 +476,7 @@ static const struct net_device_ops bpq_netdev_ops = {
 static void bpq_setup(struct net_device *dev)
 {
         dev->netdev_ops      = &bpq_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
 
         memcpy(dev->broadcast, &ax25_bcast, AX25_ADDR_LEN);
         memcpy(dev->dev_addr,  &ax25_defaddr, AX25_ADDR_LEN);
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c1d078..97e3bc60c3e7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case HDLCDRVCTL_CALIBRATE:
                 if(!capable(CAP_SYS_RAWIO))
                         return -EPERM;
+                if (s->par.bitrate <= 0)
+                        return -EINVAL;
                 if (bi.data.calibrate > INT_MAX / s->par.bitrate)
                         return -EINVAL;
                 s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 262b2ea576a3..6066f1bcaf2d 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -171,6 +171,8 @@ struct rndis_device {
         spinlock_t request_lock;
         struct list_head req_list;
 
+        struct work_struct mcast_work;
+
         u8 hw_mac_adr[ETH_ALEN];
         u8 rss_key[NETVSC_HASH_KEYLEN];
         u16 ind_table[ITAB_NUM];
@@ -201,6 +203,7 @@ int rndis_filter_open(struct netvsc_device *nvdev);
 int rndis_filter_close(struct netvsc_device *nvdev);
 int rndis_filter_device_add(struct hv_device *dev,
                             struct netvsc_device_info *info);
+void rndis_filter_update(struct netvsc_device *nvdev);
 void rndis_filter_device_remove(struct hv_device *dev,
                                 struct netvsc_device *nvdev);
 int rndis_filter_set_rss_param(struct rndis_device *rdev,
@@ -211,7 +214,6 @@ int rndis_filter_receive(struct net_device *ndev,
                          struct vmbus_channel *channel,
                          void *data, u32 buflen);
 
-int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter);
 int rndis_filter_set_device_mac(struct net_device *ndev, char *mac);
 
 void netvsc_switch_datapath(struct net_device *nv_dev, bool vf);
@@ -696,7 +698,6 @@ struct net_device_context {
         /* list protection */
         spinlock_t lock;
 
-        struct work_struct work;
         u32 msg_enable; /* debug level */
 
         u32 tx_checksum_mask;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 4421a6d00375..82d6c022ca85 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -56,37 +56,12 @@ static int debug = -1;
 module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
-static void do_set_multicast(struct work_struct *w)
-{
-        struct net_device_context *ndevctx =
-                container_of(w, struct net_device_context, work);
-        struct hv_device *device_obj = ndevctx->device_ctx;
-        struct net_device *ndev = hv_get_drvdata(device_obj);
-        struct netvsc_device *nvdev = rcu_dereference(ndevctx->nvdev);
-        struct rndis_device *rdev;
-
-        if (!nvdev)
-                return;
-
-        rdev = nvdev->extension;
-        if (rdev == NULL)
-                return;
-
-        if (ndev->flags & IFF_PROMISC)
-                rndis_filter_set_packet_filter(rdev,
-                        NDIS_PACKET_TYPE_PROMISCUOUS);
-        else
-                rndis_filter_set_packet_filter(rdev,
-                        NDIS_PACKET_TYPE_BROADCAST |
-                        NDIS_PACKET_TYPE_ALL_MULTICAST |
-                        NDIS_PACKET_TYPE_DIRECTED);
-}
-
 static void netvsc_set_multicast_list(struct net_device *net)
 {
         struct net_device_context *net_device_ctx = netdev_priv(net);
+        struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
 
-        schedule_work(&net_device_ctx->work);
+        rndis_filter_update(nvdev);
 }
 
 static int netvsc_open(struct net_device *net)
@@ -123,8 +98,6 @@ static int netvsc_close(struct net_device *net)
 
         netif_tx_disable(net);
 
-        /* Make sure netvsc_set_multicast_list doesn't re-enable filter! */
-        cancel_work_sync(&net_device_ctx->work);
         ret = rndis_filter_close(nvdev);
         if (ret != 0) {
                 netdev_err(net, "unable to close device (ret %d).\n", ret);
@@ -1028,7 +1001,7 @@ static const struct {
 static int netvsc_get_sset_count(struct net_device *dev, int string_set)
 {
         struct net_device_context *ndc = netdev_priv(dev);
-        struct netvsc_device *nvdev = rcu_dereference(ndc->nvdev);
+        struct netvsc_device *nvdev = rtnl_dereference(ndc->nvdev);
 
         if (!nvdev)
                 return -ENODEV;
@@ -1158,11 +1131,22 @@ netvsc_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info,
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-static void netvsc_poll_controller(struct net_device *net)
+static void netvsc_poll_controller(struct net_device *dev)
 {
-        /* As netvsc_start_xmit() works synchronous we don't have to
-         * trigger anything here.
-         */
+        struct net_device_context *ndc = netdev_priv(dev);
+        struct netvsc_device *ndev;
+        int i;
+
+        rcu_read_lock();
+        ndev = rcu_dereference(ndc->nvdev);
+        if (ndev) {
+                for (i = 0; i < ndev->num_chn; i++) {
+                        struct netvsc_channel *nvchan = &ndev->chan_table[i];
+
+                        napi_schedule(&nvchan->napi);
+                }
+        }
+        rcu_read_unlock();
 }
 #endif
 
@@ -1552,7 +1536,6 @@ static int netvsc_probe(struct hv_device *dev,
         hv_set_drvdata(dev, net);
 
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
-        INIT_WORK(&net_device_ctx->work, do_set_multicast);
 
         spin_lock_init(&net_device_ctx->lock);
         INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
@@ -1622,7 +1605,6 @@ static int netvsc_remove(struct hv_device *dev)
         netif_device_detach(net);
 
         cancel_delayed_work_sync(&ndev_ctx->dwork);
-        cancel_work_sync(&ndev_ctx->work);
 
         /*
          * Call to the vsc driver to let it know that the device is being
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index f9d5b0b8209a..cb79cd081f42 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -31,6 +31,7 @@
 
 #include "hyperv_net.h"
 
+static void rndis_set_multicast(struct work_struct *w);
 
 #define RNDIS_EXT_LEN PAGE_SIZE
 struct rndis_request {
@@ -76,6 +77,7 @@ static struct rndis_device *get_rndis_device(void)
         spin_lock_init(&device->request_lock);
 
         INIT_LIST_HEAD(&device->req_list);
+        INIT_WORK(&device->mcast_work, rndis_set_multicast);
 
         device->state = RNDIS_DEV_UNINITIALIZED;
 
@@ -815,7 +817,8 @@ static int rndis_filter_query_link_speed(struct rndis_device *dev)
         return ret;
 }
 
-int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter)
+static int rndis_filter_set_packet_filter(struct rndis_device *dev,
+                                          u32 new_filter)
 {
         struct rndis_request *request;
         struct rndis_set_request *set;
@@ -846,6 +849,28 @@ int rndis_filter_set_packet_filter(struct rndis_device *dev, u32 new_filter)
         return ret;
 }
 
+static void rndis_set_multicast(struct work_struct *w)
+{
+        struct rndis_device *rdev
+                = container_of(w, struct rndis_device, mcast_work);
+
+        if (rdev->ndev->flags & IFF_PROMISC)
+                rndis_filter_set_packet_filter(rdev,
+                                               NDIS_PACKET_TYPE_PROMISCUOUS);
+        else
+                rndis_filter_set_packet_filter(rdev,
+                                               NDIS_PACKET_TYPE_BROADCAST |
+                                               NDIS_PACKET_TYPE_ALL_MULTICAST |
+                                               NDIS_PACKET_TYPE_DIRECTED);
+}
+
+void rndis_filter_update(struct netvsc_device *nvdev)
+{
+        struct rndis_device *rdev = nvdev->extension;
+
+        schedule_work(&rdev->mcast_work);
+}
+
 static int rndis_filter_init_device(struct rndis_device *dev)
 {
         struct rndis_request *request;
@@ -973,6 +998,9 @@ static int rndis_filter_close_device(struct rndis_device *dev)
         if (dev->state != RNDIS_DEV_DATAINITIALIZED)
                 return 0;
 
+        /* Make sure rndis_set_multicast doesn't re-enable filter! */
+        cancel_work_sync(&dev->mcast_work);
+
         ret = rndis_filter_set_packet_filter(dev, 0);
         if (ret == -ENODEV)
                 ret = 0;
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 312fce7302d3..144ea5ae8ab4 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -207,7 +207,6 @@ static void ifb_dev_free(struct net_device *dev)
                 __skb_queue_purge(&txp->tq);
         }
         kfree(dp->tx_private);
-        free_netdev(dev);
 }
 
 static void ifb_setup(struct net_device *dev)
@@ -230,7 +229,8 @@ static void ifb_setup(struct net_device *dev)
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         netif_keep_dst(dev);
         eth_hw_addr_random(dev);
-        dev->destructor = ifb_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ifb_dev_free;
 }
 
 static netdev_tx_t ifb_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 618ed88fad0f..7c7680c8f0e3 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -632,7 +632,7 @@ void ipvlan_link_setup(struct net_device *dev)
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->priv_flags |= IFF_UNICAST_FLT | IFF_NO_QUEUE;
         dev->netdev_ops = &ipvlan_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->header_ops = &ipvlan_header_ops;
         dev->ethtool_ops = &ipvlan_ethtool_ops;
 }
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 224f65cb576b..30612497643c 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -159,7 +159,6 @@ static void loopback_dev_free(struct net_device *dev)
 {
         dev_net(dev)->loopback_dev = NULL;
         free_percpu(dev->lstats);
-        free_netdev(dev);
 }
 
 static const struct net_device_ops loopback_ops = {
@@ -196,7 +195,8 @@ static void loopback_setup(struct net_device *dev)
         dev->ethtool_ops        = &loopback_ethtool_ops;
         dev->header_ops         = &eth_header_ops;
         dev->netdev_ops         = &loopback_ops;
-        dev->destructor         = loopback_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = loopback_dev_free;
 }
 
 /* Setup and register the loopback device. */
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index cdc347be68f2..79411675f0e6 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -2996,7 +2996,6 @@ static void macsec_free_netdev(struct net_device *dev)
         free_percpu(macsec->secy.tx_sc.stats);
 
         dev_put(real_dev);
-        free_netdev(dev);
 }
 
 static void macsec_setup(struct net_device *dev)
@@ -3006,7 +3005,8 @@ static void macsec_setup(struct net_device *dev)
         dev->max_mtu = ETH_MAX_MTU;
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->netdev_ops = &macsec_netdev_ops;
-        dev->destructor = macsec_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = macsec_free_netdev;
         SET_NETDEV_DEVTYPE(dev, &macsec_type);
 
         eth_zero_addr(dev->broadcast);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 346ad2ff3998..67bf7ebae5c6 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1092,7 +1092,7 @@ void macvlan_common_setup(struct net_device *dev)
         netif_keep_dst(dev);
         dev->priv_flags        |= IFF_UNICAST_FLT;
         dev->netdev_ops         = &macvlan_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &macvlan_hard_header_ops;
         dev->ethtool_ops        = &macvlan_ethtool_ops;
 }
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 06ee6395117f..0e27920c2b6b 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -358,7 +358,7 @@ static ssize_t enabled_store(struct config_item *item,
                 if (err)
                         goto out_unlock;
 
-                pr_info("netconsole: network logging started\n");
+                pr_info("network logging started\n");
         } else {        /* false */
                 /* We need to disable the netconsole before cleaning it up
                  * otherwise we might end up in write_msg() with
diff --git a/drivers/net/nlmon.c b/drivers/net/nlmon.c
index b91603835d26..c4b3362da4a2 100644
--- a/drivers/net/nlmon.c
+++ b/drivers/net/nlmon.c
@@ -113,7 +113,7 @@ static void nlmon_setup(struct net_device *dev)
 
         dev->netdev_ops = &nlmon_ops;
         dev->ethtool_ops = &nlmon_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST |
                         NETIF_F_HIGHDMA | NETIF_F_LLTX;
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 60ffc9da6a28..3ab6c58d4be6 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -108,7 +108,7 @@ config MDIO_MOXART
 config MDIO_OCTEON
         tristate "Octeon and some ThunderX SOCs MDIO buses"
         depends on 64BIT
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && OF_MDIO
         select MDIO_CAVIUM
         help
           This module provides a driver for the Octeon and ThunderX MDIO
@@ -127,6 +127,7 @@ config MDIO_THUNDER
         tristate "ThunderX SOCs MDIO buses"
         depends on 64BIT
         depends on PCI
+        depends on !(MDIO_DEVICE=y && PHYLIB=m)
         select MDIO_CAVIUM
         help
           This driver supports the MDIO interfaces found on Cavium
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 272b051a0199..57297ba23987 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -255,34 +255,6 @@ static int marvell_config_aneg(struct phy_device *phydev)
 {
         int err;
 
-        /* The Marvell PHY has an errata which requires
-         * that certain registers get written in order
-         * to restart autonegotiation */
-        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
-
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x1f);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x200c);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x5);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x100);
-        if (err < 0)
-                return err;
-
         err = marvell_set_polarity(phydev, phydev->mdix_ctrl);
         if (err < 0)
                 return err;
@@ -316,6 +288,42 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1101_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* This Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation
+         */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x1f);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x200c);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x5);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x100);
+        if (err < 0)
+                return err;
+
+        return marvell_config_aneg(phydev);
+}
+
 static int m88e1111_config_aneg(struct phy_device *phydev)
 {
         int err;
@@ -1119,8 +1127,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
                 if (adv < 0)
                         return adv;
 
-                lpa &= adv;
-
                 if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
                         phydev->duplex = DUPLEX_FULL;
                 else
@@ -1892,7 +1898,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &marvell_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1101_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 8e73f5f36e71..f99c21f78b63 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -658,6 +658,18 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
         return 0;
 }
 
+static int mdio_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        int rc;
+
+        /* Some devices have extra OF data and an OF-style MODALIAS */
+        rc = of_device_uevent_modalias(dev, env);
+        if (rc != -ENODEV)
+                return rc;
+
+        return 0;
+}
+
 #ifdef CONFIG_PM
 static int mdio_bus_suspend(struct device *dev)
 {
@@ -708,6 +720,7 @@ static const struct dev_pm_ops mdio_bus_pm_ops = {
 struct bus_type mdio_bus_type = {
         .name           = "mdio_bus",
         .match          = mdio_bus_match,
+        .uevent         = mdio_uevent,
         .pm             = MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6a5fd18f062c..b9252b8d81ff 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -268,23 +268,12 @@ out:
         return ret;
 }
 
-static int kszphy_config_init(struct phy_device *phydev)
+/* Some config bits need to be set again on resume, handle them here. */
+static int kszphy_config_reset(struct phy_device *phydev)
 {
         struct kszphy_priv *priv = phydev->priv;
-        const struct kszphy_type *type;
         int ret;
 
-        if (!priv)
-                return 0;
-
-        type = priv->type;
-
-        if (type->has_broadcast_disable)
-                kszphy_broadcast_disable(phydev);
-
-        if (type->has_nand_tree_disable)
-                kszphy_nand_tree_disable(phydev);
-
         if (priv->rmii_ref_clk_sel) {
                 ret = kszphy_rmii_clk_sel(phydev, priv->rmii_ref_clk_sel_val);
                 if (ret) {
@@ -295,11 +284,30 @@ static int kszphy_config_init(struct phy_device *phydev)
         }
 
         if (priv->led_mode >= 0)
-                kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
+                kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
 
         return 0;
 }
 
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        struct kszphy_priv *priv = phydev->priv;
+        const struct kszphy_type *type;
+
+        if (!priv)
+                return 0;
+
+        type = priv->type;
+
+        if (type->has_broadcast_disable)
+                kszphy_broadcast_disable(phydev);
+
+        if (type->has_nand_tree_disable)
+                kszphy_nand_tree_disable(phydev);
+
+        return kszphy_config_reset(phydev);
+}
+
 static int ksz8041_config_init(struct phy_device *phydev)
 {
         struct device_node *of_node = phydev->mdio.dev.of_node;
@@ -700,8 +708,14 @@ static int kszphy_suspend(struct phy_device *phydev)
 
 static int kszphy_resume(struct phy_device *phydev)
 {
+        int ret;
+
         genphy_resume(phydev);
 
+        ret = kszphy_config_reset(phydev);
+        if (ret)
+                return ret;
+
         /* Enable PHY Interrupts */
         if (phy_interrupt_is_valid(phydev)) {
                 phydev->interrupts = PHY_INTERRUPT_ENABLED;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 82ab8fb82587..eebb0e1c70ff 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -54,6 +54,8 @@ static const char *phy_speed_to_str(int speed)
                 return "5Gbps";
         case SPEED_10000:
                 return "10Gbps";
+        case SPEED_14000:
+                return "14Gbps";
         case SPEED_20000:
                 return "20Gbps";
         case SPEED_25000:
@@ -241,7 +243,7 @@ static const struct phy_setting settings[] = {
  * phy_lookup_setting - lookup a PHY setting
  * @speed: speed to match
  * @duplex: duplex to match
- * @feature: allowed link modes
+ * @features: allowed link modes
  * @exact: an exact match is required
  *
  * Search the settings array for a setting that matches the speed and
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 1da31dc47f86..74b907206aa7 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -629,7 +629,7 @@ static void sl_uninit(struct net_device *dev)
 static void sl_free_netdev(struct net_device *dev)
 {
         int i = dev->base_addr;
-        free_netdev(dev);
+
         slip_devs[i] = NULL;
 }
 
@@ -651,7 +651,8 @@ static const struct net_device_ops sl_netdev_ops = {
 static void sl_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &sl_netdev_ops;
-        dev->destructor         = sl_free_netdev;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = sl_free_netdev;
 
         dev->hard_header_len    = 0;
         dev->addr_len           = 0;
@@ -1369,8 +1370,6 @@ static void __exit slip_exit(void)
                 if (sl->tty) {
                         printk(KERN_ERR "%s: tty discipline still running\n",
                                dev->name);
-                        /* Intentionally leak the control block. */
-                        dev->destructor = NULL;
                 }
 
                 unregister_netdev(dev);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 6c5d5ef46f75..fba8c136aa7c 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1643,7 +1643,6 @@ static void team_destructor(struct net_device *dev)
         struct team *team = netdev_priv(dev);
 
         free_percpu(team->pcpu_stats);
-        free_netdev(dev);
 }
 
 static int team_open(struct net_device *dev)
@@ -2079,7 +2078,8 @@ static void team_setup(struct net_device *dev)
 
         dev->netdev_ops = &team_netdev_ops;
         dev->ethtool_ops = &team_ethtool_ops;
-        dev->destructor = team_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = team_destructor;
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->priv_flags |= IFF_TEAM;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index bbd707b9ef7a..9ee7d4275640 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1560,7 +1560,6 @@ static void tun_free_netdev(struct net_device *dev)
         free_percpu(tun->pcpu_stats);
         tun_flow_uninit(tun);
         security_tun_dev_free_security(tun->security);
-        free_netdev(dev);
 }
 
 static void tun_setup(struct net_device *dev)
@@ -1571,7 +1570,8 @@ static void tun_setup(struct net_device *dev)
         tun->group = INVALID_GID;
 
         dev->ethtool_ops = &tun_ethtool_ops;
-        dev->destructor = tun_free_netdev;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = tun_free_netdev;
         /* We prefer our own queue length */
         dev->tx_queue_len = TUN_READQ_SIZE;
 }
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index eb52de8205f0..c7a350bbaaa7 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -298,7 +298,7 @@ static void usbpn_setup(struct net_device *dev)
         dev->addr_len           = 1;
         dev->tx_queue_len       = 3;
 
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /*
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index f3ae88fdf332..8ab281b478f2 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -310,6 +310,26 @@ skip:
                 return -ENODEV;
         }
 
+        return 0;
+
+bad_desc:
+        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+
+
+/* like usbnet_generic_cdc_bind() but handles filter initialization
+ * correctly
+ */
+int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int rv;
+
+        rv = usbnet_generic_cdc_bind(dev, intf);
+        if (rv < 0)
+                goto bail_out;
+
         /* Some devices don't initialise properly. In particular
          * the packet filter is not reset. There are devices that
          * don't do reset all the way. So the packet filter should
@@ -317,13 +337,10 @@ skip:
          */
         usbnet_cdc_update_filter(dev);
 
-        return 0;
-
-bad_desc:
-        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
-        return -ENODEV;
+bail_out:
+        return rv;
 }
-EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
 
 void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
@@ -417,7 +434,7 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data)
                         < sizeof(struct cdc_state)));
 
-        status = usbnet_generic_cdc_bind(dev, intf);
+        status = usbnet_ether_cdc_bind(dev, intf);
         if (status < 0)
                 return status;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8f923a147fa9..32a22f4e8356 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -123,7 +123,7 @@ static void qmimux_setup(struct net_device *dev)
         dev->addr_len        = 0;
         dev->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
         dev->netdev_ops      = &qmimux_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
 }
 
 static struct net_device *qmimux_find_dev(struct usbnet *dev, u8 mux_id)
@@ -1192,6 +1192,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9063, 8)},    /* Sierra Wireless EM7305 */
+        {QMI_FIXED_INTF(0x1199, 0x9063, 10)},   /* Sierra Wireless EM7305 */
         {QMI_FIXED_INTF(0x1199, 0x9071, 8)},    /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
@@ -1206,6 +1208,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},    /* Telit ME910 */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
+        {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)},    /* Telewell TW-3G HSPA+ */
+        {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)},    /* Telewell TW-3G HSPA+ */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index ddc62cb69be8..1a419a45e2a2 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -4368,6 +4368,8 @@ static u8 rtl_get_version(struct usb_interface *intf)
                 break;
         }
 
+        dev_dbg(&intf->dev, "Detected version 0x%04x\n", version);
+
         return version;
 }
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 38f0f03a29c8..0156fe8cac17 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -222,7 +222,6 @@ static int veth_dev_init(struct net_device *dev)
 static void veth_dev_free(struct net_device *dev)
 {
         free_percpu(dev->vstats);
-        free_netdev(dev);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -317,7 +316,8 @@ static void veth_setup(struct net_device *dev)
                                NETIF_F_HW_VLAN_STAG_TX |
                                NETIF_F_HW_VLAN_CTAG_RX |
                                NETIF_F_HW_VLAN_STAG_RX);
-        dev->destructor = veth_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = veth_dev_free;
         dev->max_mtu = ETH_MAX_MTU;
 
         dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9320d96a1632..a871f45ecc79 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -869,7 +869,7 @@ static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
         unsigned int len;
 
         len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
-                                rq->min_buf_len - hdr_len, PAGE_SIZE - hdr_len);
+                                rq->min_buf_len, PAGE_SIZE - hdr_len);
         return ALIGN(len, L1_CACHE_BYTES);
 }
 
@@ -1989,6 +1989,7 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_poll_controller = virtnet_netpoll,
 #endif
         .ndo_xdp                = virtnet_xdp,
+        .ndo_features_check     = passthru_features_check,
 };
 
 static void virtnet_config_changed_work(struct work_struct *work)
@@ -2143,7 +2144,8 @@ static unsigned int mergeable_min_buf_len(struct virtnet_info *vi, struct virtqu
         unsigned int buf_len = hdr_len + ETH_HLEN + VLAN_HLEN + packet_len;
         unsigned int min_buf_len = DIV_ROUND_UP(buf_len, rq_size);
 
-        return max(min_buf_len, hdr_len);
+        return max(max(min_buf_len, hdr_len) - hdr_len,
+                   (unsigned int)GOOD_PACKET_LEN);
 }
 
 static int virtnet_find_vqs(struct virtnet_info *vi)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index db882493875c..022c0b5f9844 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -36,12 +36,14 @@
 #include <net/addrconf.h>
 #include <net/l3mdev.h>
 #include <net/fib_rules.h>
+#include <net/netns/generic.h>
 
 #define DRV_NAME        "vrf"
 #define DRV_VERSION     "1.0"
 
 #define FIB_RULE_PREF  1000       /* default preference for FIB rules */
-static bool add_fib_rules = true;
+
+static unsigned int vrf_net_id;
 
 struct net_vrf {
         struct rtable __rcu     *rth;
@@ -1348,7 +1350,7 @@ static void vrf_setup(struct net_device *dev)
         dev->netdev_ops = &vrf_netdev_ops;
         dev->l3mdev_ops = &vrf_l3mdev_ops;
         dev->ethtool_ops = &vrf_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         /* Fill in device structure with ethernet-generic values. */
         eth_hw_addr_random(dev);
@@ -1394,6 +1396,8 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
                        struct nlattr *tb[], struct nlattr *data[])
 {
         struct net_vrf *vrf = netdev_priv(dev);
+        bool *add_fib_rules;
+        struct net *net;
         int err;
 
         if (!data || !data[IFLA_VRF_TABLE])
@@ -1409,13 +1413,15 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto out;
 
-        if (add_fib_rules) {
+        net = dev_net(dev);
+        add_fib_rules = net_generic(net, vrf_net_id);
+        if (*add_fib_rules) {
                 err = vrf_add_fib_rules(dev);
                 if (err) {
                         unregister_netdevice(dev);
                         goto out;
                 }
-                add_fib_rules = false;
+                *add_fib_rules = false;
         }
 
 out:
@@ -1498,16 +1504,38 @@ static struct notifier_block vrf_notifier_block __read_mostly = {
         .notifier_call = vrf_device_event,
 };
 
+/* Initialize per network namespace state */
+static int __net_init vrf_netns_init(struct net *net)
+{
+        bool *add_fib_rules = net_generic(net, vrf_net_id);
+
+        *add_fib_rules = true;
+
+        return 0;
+}
+
+static struct pernet_operations vrf_net_ops __net_initdata = {
+        .init = vrf_netns_init,
+        .id   = &vrf_net_id,
+        .size = sizeof(bool),
+};
+
 static int __init vrf_init_module(void)
 {
         int rc;
 
         register_netdevice_notifier(&vrf_notifier_block);
 
-        rc = rtnl_link_register(&vrf_link_ops);
+        rc = register_pernet_subsys(&vrf_net_ops);
         if (rc < 0)
                 goto error;
 
+        rc = rtnl_link_register(&vrf_link_ops);
+        if (rc < 0) {
+                unregister_pernet_subsys(&vrf_net_ops);
+                goto error;
+        }
+
         return 0;
 
 error:
diff --git a/drivers/net/vsockmon.c b/drivers/net/vsockmon.c
index 7f0136f2dd9d..c28bdce14fd5 100644
--- a/drivers/net/vsockmon.c
+++ b/drivers/net/vsockmon.c
@@ -135,7 +135,7 @@ static void vsockmon_setup(struct net_device *dev)
 
         dev->netdev_ops = &vsockmon_ops;
         dev->ethtool_ops = &vsockmon_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST |
                         NETIF_F_HIGHDMA | NETIF_F_LLTX;
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 328b4712683c..5fa798a5c9a6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -59,6 +59,8 @@ static const u8 all_zeros_mac[ETH_ALEN + 2];
 
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
 /* per-network namespace private data for this module */
 struct vxlan_net {
         struct list_head  vxlan_list;
@@ -740,6 +742,22 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
         call_rcu(&f->rcu, vxlan_fdb_free);
 }
 
+static void vxlan_dst_free(struct rcu_head *head)
+{
+        struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
+
+        dst_cache_destroy(&rd->dst_cache);
+        kfree(rd);
+}
+
+static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                                  struct vxlan_rdst *rd)
+{
+        list_del_rcu(&rd->list);
+        vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
+        call_rcu(&rd->rcu, vxlan_dst_free);
+}
+
 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
                            union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
                            __be32 *vni, u32 *ifindex)
@@ -864,9 +882,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
          * otherwise destroy the fdb entry
          */
         if (rd && !list_is_singular(&f->remotes)) {
-                list_del_rcu(&rd->list);
-                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
-                kfree_rcu(rd, rcu);
+                vxlan_fdb_dst_destroy(vxlan, f, rd);
                 goto out;
         }
 
@@ -1067,6 +1083,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
         rcu_assign_pointer(vxlan->vn4_sock, NULL);
         synchronize_net();
 
+        vxlan_vs_del_dev(vxlan);
+
         if (__vxlan_sock_release_prep(sock4)) {
                 udp_tunnel_sock_release(sock4->sock);
                 kfree(sock4);
@@ -2342,6 +2360,15 @@ static void vxlan_cleanup(unsigned long arg)
         mod_timer(&vxlan->age_timer, next_timer);
 }
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+        spin_lock(&vn->sock_lock);
+        hlist_del_init_rcu(&vxlan->hlist);
+        spin_unlock(&vn->sock_lock);
+}
+
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
@@ -2584,7 +2611,7 @@ static void vxlan_setup(struct net_device *dev)
         eth_hw_addr_random(dev);
         ether_setup(dev);
 
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         SET_NETDEV_DEVTYPE(dev, &vxlan_type);
 
         dev->features   |= NETIF_F_LLTX;
@@ -3286,15 +3313,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
         vxlan_flush(vxlan, true);
 
-        spin_lock(&vn->sock_lock);
-        if (!hlist_unhashed(&vxlan->hlist))
-                hlist_del_rcu(&vxlan->hlist);
-        spin_unlock(&vn->sock_lock);
-
         gro_cells_destroy(&vxlan->gro_cells);
         list_del(&vxlan->next);
         unregister_netdevice_queue(dev, head);
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 65ee2a6f248c..a0d76f70c428 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -475,7 +475,7 @@ static void dlci_setup(struct net_device *dev)
         dev->flags              = 0;
         dev->header_ops         = &dlci_header_ops;
         dev->netdev_ops         = &dlci_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 
         dlp->receive            = dlci_receive;
 
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index eb915281197e..78596e42a3f3 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -1106,7 +1106,7 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
                 return -EIO;
         }
 
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         *get_dev_p(pvc, type) = dev;
         if (!used) {
                 state(hdlc)->dce_changed = 1;
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 9df9ed62beff..63f749078a1f 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -306,7 +306,7 @@ static const struct net_device_ops lapbeth_netdev_ops = {
 static void lapbeth_setup(struct net_device *dev)
 {
         dev->netdev_ops      = &lapbeth_netdev_ops;
-        dev->destructor      = free_netdev;
+        dev->needs_free_netdev = true;
         dev->type            = ARPHRD_X25;
         dev->hard_header_len = 3;
         dev->mtu             = 1000;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 91ee542de3d7..b90c77ef792e 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -1287,7 +1287,7 @@ void init_netdev(struct net_device *dev)
         struct ath6kl *ar = ath6kl_priv(dev);
 
         dev->netdev_ops = &ath6kl_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
 
         dev->needed_headroom = ETH_HLEN;
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index d5e993dc9b23..517a315e259b 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1271,6 +1271,8 @@ static int wcn36xx_remove(struct platform_device *pdev)
         qcom_smem_state_put(wcn->tx_enable_state);
         qcom_smem_state_put(wcn->tx_rings_empty_state);
 
+        rpmsg_destroy_ept(wcn->smd_channel);
+
         iounmap(wcn->dxe_base);
         iounmap(wcn->ccu_base);
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index cd1d6730eab7..617199c0e5a0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5225,7 +5225,6 @@ void brcmf_cfg80211_free_netdev(struct net_device *ndev)
 
         if (vif)
                 brcmf_free_vif(vif);
-        free_netdev(ndev);
 }
 
 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index a3d82368f1a9..511d190c6cca 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -624,7 +624,8 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
                 if (!ndev)
                         return ERR_PTR(-ENOMEM);
 
-                ndev->destructor = brcmf_cfg80211_free_netdev;
+                ndev->needs_free_netdev = true;
+                ndev->priv_destructor = brcmf_cfg80211_free_netdev;
                 ifp = netdev_priv(ndev);
                 ifp->ndev = ndev;
                 /* store mapping ifidx to bsscfgidx */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index fc64b8913aa6..e03450059b06 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3422,7 +3422,7 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                 /* otherwise, set txglomalign */
                 value = sdiodev->settings->bus.sdio.sd_sgentry_align;
                 /* SDIO ADMA requires at least 32 bit alignment */
-                value = max_t(u32, value, 4);
+                value = max_t(u32, value, ALIGNMENT);
                 err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
                                            sizeof(u32));
         }
diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
index 1b7e125a28e2..6a13303af2b7 100644
--- a/drivers/net/wireless/cisco/airo.c
+++ b/drivers/net/wireless/cisco/airo.c
@@ -3066,7 +3066,7 @@ static int airo_thread(void *data) {
                 if (ai->jobs) {
                         locked = down_interruptible(&ai->sem);
                 } else {
-                        wait_queue_t wait;
+                        wait_queue_entry_t wait;
 
                         init_waitqueue_entry(&wait, current);
                         add_wait_queue(&ai->thr_wait, &wait);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
index 3b3e076571d6..45e2efc70d19 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
@@ -79,8 +79,8 @@
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   17
 #define IWL7265_UCODE_API_MIN   17
-#define IWL7265D_UCODE_API_MIN  17
-#define IWL3168_UCODE_API_MIN   20
+#define IWL7265D_UCODE_API_MIN  22
+#define IWL3168_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index b9718c0cf174..89137717c1fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -74,8 +74,8 @@
 #define IWL8265_UCODE_API_MAX   30
 
 /* Lowest firmware API version supported */
-#define IWL8000_UCODE_API_MIN   17
-#define IWL8265_UCODE_API_MIN   20
+#define IWL8000_UCODE_API_MIN   22
+#define IWL8265_UCODE_API_MIN   22
 
 /* NVM versions */
 #define IWL8000_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 306bc967742e..77efbb78e867 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -370,6 +370,7 @@
 #define MON_DMARB_RD_DATA_ADDR          (0xa03c5c)
 
 #define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
 
 /* enable the ID buf for read */
 #define WFPM_PS_CTL_CLR                 0xA0300C
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
index 1b7d265ffb0a..a10c6aae9ab9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
@@ -307,6 +307,11 @@ enum {
 /* Bit 1-3: LQ command color. Used to match responses to LQ commands */
 #define LQ_FLAG_COLOR_POS               1
 #define LQ_FLAG_COLOR_MSK               (7 << LQ_FLAG_COLOR_POS)
+#define LQ_FLAG_COLOR_GET(_f)           (((_f) & LQ_FLAG_COLOR_MSK) >>\
+                                         LQ_FLAG_COLOR_POS)
+#define LQ_FLAGS_COLOR_INC(_c)          ((((_c) + 1) << LQ_FLAG_COLOR_POS) &\
+                                         LQ_FLAG_COLOR_MSK)
+#define LQ_FLAG_COLOR_SET(_f, _c)       ((_c) | ((_f) & ~LQ_FLAG_COLOR_MSK))
 
 /* Bit 4-5: Tx RTS BW Signalling
  * (0) No RTS BW signalling
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
index 81b98915b1a4..1360ebfdc51b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
@@ -519,8 +519,11 @@ struct agg_tx_status {
  * bit-7 invalid rate indication
  */
 #define TX_RES_INIT_RATE_INDEX_MSK 0x0f
+#define TX_RES_RATE_TABLE_COLOR_POS 4
 #define TX_RES_RATE_TABLE_COLOR_MSK 0x70
 #define TX_RES_INV_RATE_INDEX_MSK 0x80
+#define TX_RES_RATE_TABLE_COL_GET(_f) (((_f) & TX_RES_RATE_TABLE_COLOR_MSK) >>\
+                                       TX_RES_RATE_TABLE_COLOR_POS)
 
 #define IWL_MVM_TX_RES_GET_TID(_ra_tid) ((_ra_tid) & 0x0f)
 #define IWL_MVM_TX_RES_GET_RA(_ra_tid) ((_ra_tid) >> 4)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 7b86a4f1b574..c8712e6eea74 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -1002,14 +1002,6 @@ int iwl_mvm_fw_dbg_collect_trig(struct iwl_mvm *mvm,
         return 0;
 }
 
-static inline void iwl_mvm_restart_early_start(struct iwl_mvm *mvm)
-{
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
-                iwl_clear_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
-        else
-                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 1);
-}
-
 int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
 {
         u8 *ptr;
@@ -1023,10 +1015,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         /* EARLY START - firmware's configuration is hard coded */
         if ((!mvm->fw->dbg_conf_tlv[conf_id] ||
              !mvm->fw->dbg_conf_tlv[conf_id]->num_of_hcmds) &&
-            conf_id == FW_DBG_START_FROM_ALIVE) {
-                iwl_mvm_restart_early_start(mvm);
+            conf_id == FW_DBG_START_FROM_ALIVE)
                 return 0;
-        }
 
         if (!mvm->fw->dbg_conf_tlv[conf_id])
                 return -EINVAL;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 0f1831b41915..fd2fc46e2fe5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1040,7 +1040,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
                 struct iwl_mac_beacon_cmd_v6 beacon_cmd_v6;
                 struct iwl_mac_beacon_cmd_v7 beacon_cmd;
         } u = {};
-        struct iwl_mac_beacon_cmd beacon_cmd;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
         struct ieee80211_tx_info *info;
         u32 beacon_skb_len;
         u32 rate, tx_flags;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4e74a6b90e70..52f8d7a6a7dc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1730,8 +1730,11 @@ int iwl_mvm_find_free_queue(struct iwl_mvm *mvm, u8 sta_id, u8 minq, u8 maxq);
  */
 static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 {
+        u32 cmd_queue = iwl_mvm_is_dqa_supported(mvm) ? IWL_MVM_DQA_CMD_QUEUE :
+                IWL_MVM_CMD_QUEUE;
+
         return ((BIT(mvm->cfg->base_params->num_of_queues) - 1) &
-                ~BIT(IWL_MVM_CMD_QUEUE));
+                ~BIT(cmd_queue));
 }
 
 static inline
@@ -1753,6 +1756,7 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
         if (!iwl_mvm_has_new_tx_api(mvm))
                 iwl_free_fw_paging(mvm);
         mvm->ucode_loaded = false;
+        mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_trans_stop_device(mvm->trans);
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 9ffff6ed8133..3da5ec40aaea 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1149,21 +1149,37 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
 
         mutex_lock(&mvm->mutex);
 
-        /* stop recording */
         if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                /* stop recording */
                 iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+
+                iwl_mvm_fw_error_dump(mvm);
+
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv)
+                        iwl_clear_bits_prph(mvm->trans,
+                                            MON_BUFF_SAMPLE_CTL, 0x100);
         } else {
+                u32 in_sample = iwl_read_prph(mvm->trans, DBGC_IN_SAMPLE);
+                u32 out_ctrl = iwl_read_prph(mvm->trans, DBGC_OUT_CTRL);
+
+                /* stop recording */
                 iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
-                /* wait before we collect the data till the DBGC stop */
                 udelay(100);
-        }
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+                /* wait before we collect the data till the DBGC stop */
+                udelay(500);
 
-        iwl_mvm_fw_error_dump(mvm);
+                iwl_mvm_fw_error_dump(mvm);
 
-        /* start recording again if the firmware is not crashed */
-        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
-                     mvm->fw->dbg_dest_tlv &&
-                     iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv) {
+                        iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, in_sample);
+                        iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, out_ctrl);
+                }
+        }
 
         mutex_unlock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 7788eefcd2bd..aa785cf3cf68 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2,7 +2,7 @@
  *
  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016 Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -1083,34 +1083,6 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
                 rs_get_lower_rate_in_column(lq_sta, rate);
 }
 
-/* Check if both rates are identical
- * allow_ant_mismatch enables matching a SISO rate on ANT_A or ANT_B
- * with a rate indicating STBC/BFER and ANT_AB.
- */
-static inline bool rs_rate_equal(struct rs_rate *a,
-                                 struct rs_rate *b,
-                                 bool allow_ant_mismatch)
-
-{
-        bool ant_match = (a->ant == b->ant) && (a->stbc == b->stbc) &&
-                (a->bfer == b->bfer);
-
-        if (allow_ant_mismatch) {
-                if (a->stbc || a->bfer) {
-                        WARN_ONCE(a->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  a->stbc, a->bfer, a->ant);
-                        ant_match |= (b->ant == ANT_A || b->ant == ANT_B);
-                } else if (b->stbc || b->bfer) {
-                        WARN_ONCE(b->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  b->stbc, b->bfer, b->ant);
-                        ant_match |= (a->ant == ANT_A || a->ant == ANT_B);
-                }
-        }
-
-        return (a->type == b->type) && (a->bw == b->bw) && (a->sgi == b->sgi) &&
-                (a->ldpc == b->ldpc) && (a->index == b->index) && ant_match;
-}
-
 /* Check if both rates share the same column */
 static inline bool rs_rate_column_match(struct rs_rate *a,
                                         struct rs_rate *b)
@@ -1182,12 +1154,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         u32 lq_hwrate;
         struct rs_rate lq_rate, tx_resp_rate;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        u8 reduced_txp = (uintptr_t)info->status.status_driver_data[0];
+        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
+        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
+        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
         u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta;
-        bool allow_ant_mismatch = fw_has_api(&mvm->fw->ucode_capa,
-                                             IWL_UCODE_TLV_API_LQ_SS_PARAMS);
 
         /* Treat uninitialized rate scaling data same as non-existing. */
         if (!lq_sta) {
@@ -1262,10 +1234,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
 
         /* Here we actually compare this rate to the latest LQ command */
-        if (!rs_rate_equal(&tx_resp_rate, &lq_rate, allow_ant_mismatch)) {
+        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
                 IWL_DEBUG_RATE(mvm,
-                               "initial tx resp rate 0x%x does not match 0x%x\n",
-                               tx_resp_hwrate, lq_hwrate);
+                               "tx resp color 0x%x does not match 0x%x\n",
+                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
 
                 /*
                  * Since rates mis-match, the last LQ command may have failed.
@@ -3326,6 +3298,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         u8 valid_tx_ant = 0;
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
         bool toggle_ant = false;
+        u32 color;
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
@@ -3380,6 +3353,9 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
                                  num_rates, num_retries, valid_tx_ant,
                                  toggle_ant);
 
+        /* update the color of the LQ command (as a counter at bits 1-3) */
+        color = LQ_FLAGS_COLOR_INC(LQ_FLAG_COLOR_GET(lq_cmd->flags));
+        lq_cmd->flags = LQ_FLAG_COLOR_SET(lq_cmd->flags, color);
 }
 
 struct rs_bfer_active_iter_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
index ee207f2c0a90..3abde1cb0303 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -2,6 +2,7 @@
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -357,6 +358,20 @@ struct iwl_lq_sta {
         } pers;
 };
 
+/* ieee80211_tx_info's status_driver_data[0] is packed with lq color and txp
+ * Note, it's iwlmvm <-> mac80211 interface.
+ * bits 0-7: reduced tx power
+ * bits 8-10: LQ command's color
+ */
+#define RS_DRV_DATA_TXP_MSK 0xff
+#define RS_DRV_DATA_LQ_COLOR_POS 8
+#define RS_DRV_DATA_LQ_COLOR_MSK (7 << RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_LQ_COLOR_GET(_f) (((_f) & RS_DRV_DATA_LQ_COLOR_MSK) >>\
+                                      RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_PACK(_c, _p) ((void *)(uintptr_t)\
+                                  (((uintptr_t)_p) |\
+                                   ((_c) << RS_DRV_DATA_LQ_COLOR_POS)))
+
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           enum nl80211_band band, bool init);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index f5c786ddc526..614d67810d05 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2120,7 +2120,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (!iwl_mvm_is_dqa_supported(mvm))
                 return 0;
 
-        if (WARN_ON(vif->type != NL80211_IFTYPE_AP))
+        if (WARN_ON(vif->type != NL80211_IFTYPE_AP &&
+                    vif->type != NL80211_IFTYPE_ADHOC))
                 return -ENOTSUPP;
 
         /*
@@ -2155,6 +2156,16 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 mvmvif->cab_queue = queue;
         } else if (!fw_has_api(&mvm->fw->ucode_capa,
                                IWL_UCODE_TLV_API_STA_TYPE)) {
+                /*
+                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+                 * invalid, so make sure we use the queue we want.
+                 * Note that this is done here as we want to avoid making DQA
+                 * changes in mac80211 layer.
+                 */
+                if (vif->type == NL80211_IFTYPE_ADHOC) {
+                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                        mvmvif->cab_queue = vif->cab_queue;
+                }
                 iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                    &cfg, timeout);
         }
@@ -3321,18 +3332,15 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
 
         /* Get the station from the mvm local station table */
         mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
-        if (!mvm_sta) {
-                IWL_ERR(mvm, "Failed to find station\n");
-                return -EINVAL;
-        }
-        sta_id = mvm_sta->sta_id;
+        if (mvm_sta)
+                sta_id = mvm_sta->sta_id;
 
         IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
                       keyconf->keyidx, sta_id);
 
-        if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+        if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))
                 return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
 
         if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 2716cb5483bf..ad62b67dceb2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -313,6 +313,7 @@ enum iwl_mvm_agg_state {
  *      This is basically (last acked packet++).
  * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
  *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @lq_color: the color of the LQ command as it appears in tx response.
  * @amsdu_in_ampdu_allowed: true if A-MSDU in A-MPDU is allowed.
  * @state: state of the BA agreement establishment / tear down.
  * @txq_id: Tx queue used by the BA session / DQA
@@ -331,6 +332,7 @@ struct iwl_mvm_tid_data {
         u16 next_reclaimed;
         /* The rest is Tx AGG related */
         u32 rate_n_flags;
+        u8 lq_color;
         bool amsdu_in_ampdu_allowed;
         enum iwl_mvm_agg_state state;
         u16 txq_id;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index f9cbd197246f..506d58104e1c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -790,11 +790,13 @@ static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
         struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
         int ret;
 
-        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
-                return -EIO;
-
         mutex_lock(&mvm->mutex);
 
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto unlock;
+        }
+
         if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
                 ret = -EINVAL;
                 goto unlock;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index bcaceb64a6e8..f21901cd4a4f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1323,6 +1323,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct sk_buff_head skbs;
         u8 skb_freed = 0;
+        u8 lq_color;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
 
@@ -1405,8 +1406,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                 info->status.tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
                 BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
+                lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
                 info->status.status_driver_data[0] =
-                                (void *)(uintptr_t)tx_resp->reduced_tpc;
+                        RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);
 
                 ieee80211_tx_status(mvm->hw, skb);
         }
@@ -1638,6 +1640,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
                         le32_to_cpu(tx_resp->initial_rate);
                 mvmsta->tid_data[tid].tx_time =
                         le16_to_cpu(tx_resp->wireless_media_time);
+                mvmsta->tid_data[tid].lq_color =
+                        (tx_resp->tlc_info & TX_RES_RATE_TABLE_COLOR_MSK) >>
+                        TX_RES_RATE_TABLE_COLOR_POS;
         }
 
         rcu_read_unlock();
@@ -1707,6 +1712,11 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
         iwl_mvm_check_ratid_empty(mvm, sta, tid);
 
         freed = 0;
+
+        /* pack lq color from tid_data along the reduced txp */
+        ba_info->status.status_driver_data[0] =
+                RS_DRV_DATA_PACK(tid_data->lq_color,
+                                 ba_info->status.status_driver_data[0]);
         ba_info->status.status_driver_data[1] = (void *)(uintptr_t)rate;
 
         skb_queue_walk(&reclaimed_skbs, skb) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 70acf850a9f1..93cbc7a69bcd 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2803,7 +2803,8 @@ static struct iwl_trans_dump_data
 #ifdef CONFIG_PM_SLEEP
 static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 return iwl_pci_fw_enter_d0i3(trans);
 
         return 0;
@@ -2811,7 +2812,8 @@ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_resume(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                 iwl_pci_fw_exit_d0i3(trans);
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..9c9bfbbabdf1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -906,7 +906,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
 
         if (WARN_ON(iwl_rx_packet_payload_len(hcmd.resp_pkt) != sizeof(*rsp))) {
                 ret = -EINVAL;
-                goto error;
+                goto error_free_resp;
         }
 
         rsp = (void *)hcmd.resp_pkt->data;
@@ -915,13 +915,13 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
         if (qid > ARRAY_SIZE(trans_pcie->txq)) {
                 WARN_ONCE(1, "queue index %d unsupported", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         if (test_and_set_bit(qid, trans_pcie->queue_used)) {
                 WARN_ONCE(1, "queue %d already used", qid);
                 ret = -EIO;
-                goto error;
+                goto error_free_resp;
         }
 
         txq->id = qid;
@@ -934,8 +934,11 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
                            (txq->write_ptr) | (qid << 16));
         IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d\n", qid);
 
+        iwl_free_resp(&hcmd);
         return qid;
 
+error_free_resp:
+        iwl_free_resp(&hcmd);
 error:
         iwl_pcie_gen2_txq_free_memory(trans, txq);
         return ret;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
index b2c6b065b542..ff153ce29539 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_ioctl.c
@@ -2544,7 +2544,7 @@ static int prism2_ioctl_priv_prism2_param(struct net_device *dev,
                         ret = -EINVAL;
                 }
                 if (local->iw_mode == IW_MODE_MASTER) {
-                        wait_queue_t __wait;
+                        wait_queue_entry_t __wait;
                         init_waitqueue_entry(&__wait, current);
                         add_wait_queue(&local->hostscan_wq, &__wait);
                         set_current_state(TASK_INTERRUPTIBLE);
diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c
index 544fc09dcb62..1372b20f931e 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_main.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_main.c
@@ -73,7 +73,7 @@ struct net_device * hostap_add_interface(struct local_info *local,
         dev->mem_end = mdev->mem_end;
 
         hostap_setup_dev(dev, local, type);
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
 
         sprintf(dev->name, "%s%s", prefix, name);
         if (!rtnl_locked)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 002b25cff5b6..c854a557998b 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2861,7 +2861,7 @@ static const struct net_device_ops hwsim_netdev_ops = {
 static void hwsim_mon_setup(struct net_device *dev)
 {
         dev->netdev_ops = &hwsim_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         ether_setup(dev);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->type = ARPHRD_IEEE80211_RADIOTAP;
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c
index e3500203715c..dde065d0d5c1 100644
--- a/drivers/net/wireless/marvell/libertas/main.c
+++ b/drivers/net/wireless/marvell/libertas/main.c
@@ -453,7 +453,7 @@ static int lbs_thread(void *data)
 {
         struct net_device *dev = data;
         struct lbs_private *priv = dev->ml_priv;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         lbs_deb_enter(LBS_DEB_THREAD);
 
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index dd87b9ff64c3..39b6b5e3f6e0 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -1280,7 +1280,7 @@ void mwifiex_init_priv_params(struct mwifiex_private *priv,
                               struct net_device *dev)
 {
         dev->netdev_ops = &mwifiex_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         /* Initialize private structure */
         priv->current_key_index = 0;
         priv->media_connected = false;
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index c00238491673..7b3b6fd63d7d 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -2878,7 +2878,7 @@ static const struct intel_ntb_reg skx_reg = {
         .link_is_up             = xeon_link_is_up,
         .db_ioread              = skx_db_ioread,
         .db_iowrite             = skx_db_iowrite,
-        .db_size                = sizeof(u64),
+        .db_size                = sizeof(u32),
         .ntb_ctl                = SKX_NTBCNTL_OFFSET,
         .mw_bar                 = {2, 4},
 };
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 02ca45fdd892..10e5bf460139 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -177,14 +177,12 @@ struct ntb_transport_qp {
         u64 rx_err_ver;
         u64 rx_memcpy;
         u64 rx_async;
-        u64 dma_rx_prep_err;
         u64 tx_bytes;
         u64 tx_pkts;
         u64 tx_ring_full;
         u64 tx_err_no_buf;
         u64 tx_memcpy;
         u64 tx_async;
-        u64 dma_tx_prep_err;
 };
 
 struct ntb_transport_mw {
@@ -254,8 +252,6 @@ enum {
 #define QP_TO_MW(nt, qp)        ((qp) % nt->mw_count)
 #define NTB_QP_DEF_NUM_ENTRIES  100
 #define NTB_LINK_DOWN_TIMEOUT   10
-#define DMA_RETRIES             20
-#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 
 static void ntb_transport_rxc_db(unsigned long data);
 static const struct ntb_ctx_ops ntb_transport_ops;
@@ -516,12 +512,6 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "free tx - \t%u\n",
                                ntb_transport_tx_free_entry(qp));
-        out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "DMA tx prep err - \t%llu\n",
-                               qp->dma_tx_prep_err);
-        out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "DMA rx prep err - \t%llu\n",
-                               qp->dma_rx_prep_err);
 
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "\n");
@@ -623,7 +613,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
         if (!mw->virt_addr)
                 return -ENOMEM;
 
-        if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
+        if (mw_num < qp_count % mw_count)
                 num_qps_mw = qp_count / mw_count + 1;
         else
                 num_qps_mw = qp_count / mw_count;
@@ -768,8 +758,6 @@ static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
         qp->tx_err_no_buf = 0;
         qp->tx_memcpy = 0;
         qp->tx_async = 0;
-        qp->dma_tx_prep_err = 0;
-        qp->dma_rx_prep_err = 0;
 }
 
 static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
@@ -1000,7 +988,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
         qp->event_handler = NULL;
         ntb_qp_link_down_reset(qp);
 
-        if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
+        if (mw_num < qp_count % mw_count)
                 num_qps_mw = qp_count / mw_count + 1;
         else
                 num_qps_mw = qp_count / mw_count;
@@ -1128,8 +1116,8 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         qp_count = ilog2(qp_bitmap);
         if (max_num_clients && max_num_clients < qp_count)
                 qp_count = max_num_clients;
-        else if (mw_count < qp_count)
-                qp_count = mw_count;
+        else if (nt->mw_count < qp_count)
+                qp_count = nt->mw_count;
 
         qp_bitmap &= BIT_ULL(qp_count) - 1;
 
@@ -1317,7 +1305,6 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
         struct dmaengine_unmap_data *unmap;
         dma_cookie_t cookie;
         void *buf = entry->buf;
-        int retries = 0;
 
         len = entry->len;
         device = chan->device;
@@ -1346,22 +1333,11 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
 
         unmap->from_cnt = 1;
 
-        for (retries = 0; retries < DMA_RETRIES; retries++) {
-                txd = device->device_prep_dma_memcpy(chan,
-                                                     unmap->addr[1],
-                                                     unmap->addr[0], len,
-                                                     DMA_PREP_INTERRUPT);
-                if (txd)
-                        break;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(DMA_OUT_RESOURCE_TO);
-        }
-
-        if (!txd) {
-                qp->dma_rx_prep_err++;
+        txd = device->device_prep_dma_memcpy(chan, unmap->addr[1],
+                                             unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
+        if (!txd)
                 goto err_get_unmap;
-        }
 
         txd->callback_result = ntb_rx_copy_callback;
         txd->callback_param = entry;
@@ -1606,7 +1582,6 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
         struct dmaengine_unmap_data *unmap;
         dma_addr_t dest;
         dma_cookie_t cookie;
-        int retries = 0;
 
         device = chan->device;
         dest = qp->tx_mw_phys + qp->tx_max_frame * entry->tx_index;
@@ -1628,21 +1603,10 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
 
         unmap->to_cnt = 1;
 
-        for (retries = 0; retries < DMA_RETRIES; retries++) {
-                txd = device->device_prep_dma_memcpy(chan, dest,
-                                                     unmap->addr[0], len,
-                                                     DMA_PREP_INTERRUPT);
-                if (txd)
-                        break;
-
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(DMA_OUT_RESOURCE_TO);
-        }
-
-        if (!txd) {
-                qp->dma_tx_prep_err++;
+        txd = device->device_prep_dma_memcpy(chan, dest, unmap->addr[0], len,
+                                             DMA_PREP_INTERRUPT);
+        if (!txd)
                 goto err_get_unmap;
-        }
 
         txd->callback_result = ntb_tx_copy_callback;
         txd->callback_param = entry;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 434e1d474f33..5cab2831ce99 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -90,11 +90,11 @@ MODULE_PARM_DESC(max_mw_size, "Limit size of large memory windows");
 
 static unsigned int seg_order = 19; /* 512K */
 module_param(seg_order, uint, 0644);
-MODULE_PARM_DESC(seg_order, "size order [n^2] of buffer segment for testing");
+MODULE_PARM_DESC(seg_order, "size order [2^n] of buffer segment for testing");
 
 static unsigned int run_order = 32; /* 4G */
 module_param(run_order, uint, 0644);
-MODULE_PARM_DESC(run_order, "size order [n^2] of total data to transfer");
+MODULE_PARM_DESC(run_order, "size order [2^n] of total data to transfer");
 
 static bool use_dma; /* default to 0 */
 module_param(use_dma, bool, 0644);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d5e0906262ea..903d5813023a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(max_retries, "max number of retries a command may have");
 static int nvme_char_major;
 module_param(nvme_char_major, int, 0);
 
-static unsigned long default_ps_max_latency_us = 25000;
+static unsigned long default_ps_max_latency_us = 100000;
 module_param(default_ps_max_latency_us, ulong, 0644);
 MODULE_PARM_DESC(default_ps_max_latency_us,
                  "max power saving latency for new devices; use PM QOS to change per device");
@@ -925,6 +925,29 @@ static int nvme_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 }
 
 #ifdef CONFIG_BLK_DEV_INTEGRITY
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+        struct nvme_ns *ns = disk->private_data;
+        u16 old_ms = ns->ms;
+        u8 pi_type = 0;
+
+        ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms);
+        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+
+        /* PI implementation requires metadata equal t10 pi tuple size */
+        if (ns->ms == sizeof(struct t10_pi_tuple))
+                pi_type = id->dps & NVME_NS_DPS_PI_MASK;
+
+        if (blk_get_integrity(disk) &&
+            (ns->pi_type != pi_type || ns->ms != old_ms ||
+             bs != queue_logical_block_size(disk->queue) ||
+             (ns->ms && ns->ext)))
+                blk_integrity_unregister(disk);
+
+        ns->pi_type = pi_type;
+}
+
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
         struct blk_integrity integrity;
@@ -951,6 +974,10 @@ static void nvme_init_integrity(struct nvme_ns *ns)
         blk_queue_max_integrity_segments(ns->queue, 1);
 }
 #else
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+}
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
 }
@@ -997,37 +1024,22 @@ static int nvme_revalidate_ns(struct nvme_ns *ns, struct nvme_id_ns **id)
 static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
 {
         struct nvme_ns *ns = disk->private_data;
-        u8 lbaf, pi_type;
-        u16 old_ms;
-        unsigned short bs;
-
-        old_ms = ns->ms;
-        lbaf = id->flbas & NVME_NS_FLBAS_LBA_MASK;
-        ns->lba_shift = id->lbaf[lbaf].ds;
-        ns->ms = le16_to_cpu(id->lbaf[lbaf].ms);
-        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+        u16 bs;
 
         /*
          * If identify namespace failed, use default 512 byte block size so
          * block layer can use before failing read/write for 0 capacity.
          */
+        ns->lba_shift = id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ds;
         if (ns->lba_shift == 0)
                 ns->lba_shift = 9;
         bs = 1 << ns->lba_shift;
-        /* XXX: PI implementation requires metadata equal t10 pi tuple size */
-        pi_type = ns->ms == sizeof(struct t10_pi_tuple) ?
-                                        id->dps & NVME_NS_DPS_PI_MASK : 0;
 
         blk_mq_freeze_queue(disk->queue);
-        if (blk_get_integrity(disk) && (ns->pi_type != pi_type ||
-                                ns->ms != old_ms ||
-                                bs != queue_logical_block_size(disk->queue) ||
-                                (ns->ms && ns->ext)))
-                blk_integrity_unregister(disk);
 
-        ns->pi_type = pi_type;
+        if (ns->ctrl->ops->flags & NVME_F_METADATA_SUPPORTED)
+                nvme_prep_integrity(disk, id, bs);
         blk_queue_logical_block_size(ns->queue, bs);
-
         if (ns->ms && !blk_get_integrity(disk) && !ns->ext)
                 nvme_init_integrity(ns);
         if (ns->ms && !(ns->ms == 8 && ns->pi_type) && !blk_get_integrity(disk))
@@ -1330,7 +1342,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
          * transitioning between power states.  Therefore, when running
          * in any given state, we will enter the next lower-power
          * non-operational state after waiting 50 * (enlat + exlat)
-         * microseconds, as long as that state's total latency is under
+         * microseconds, as long as that state's exit latency is under
          * the requested maximum latency.
          *
          * We will not autonomously enter any non-operational state for
@@ -1375,7 +1387,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                  * lowest-power state, not the number of states.
                  */
                 for (state = (int)ctrl->npss; state >= 0; state--) {
-                        u64 total_latency_us, transition_ms;
+                        u64 total_latency_us, exit_latency_us, transition_ms;
 
                         if (target)
                                 table->entries[state] = target;
@@ -1396,12 +1408,15 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                               NVME_PS_FLAGS_NON_OP_STATE))
                                 continue;
 
-                        total_latency_us =
-                                (u64)le32_to_cpu(ctrl->psd[state].entry_lat) +
-                                + le32_to_cpu(ctrl->psd[state].exit_lat);
-                        if (total_latency_us > ctrl->ps_max_latency_us)
+                        exit_latency_us =
+                                (u64)le32_to_cpu(ctrl->psd[state].exit_lat);
+                        if (exit_latency_us > ctrl->ps_max_latency_us)
                                 continue;
 
+                        total_latency_us =
+                                exit_latency_us +
+                                le32_to_cpu(ctrl->psd[state].entry_lat);
+
                         /*
                          * This state is good.  Use it as the APST idle
                          * target for higher power states.
@@ -1605,7 +1620,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
         }
         memcpy(ctrl->psd, id->psd, sizeof(ctrl->psd));
 
-        if (ctrl->ops->is_fabrics) {
+        if (ctrl->ops->flags & NVME_F_FABRICS) {
                 ctrl->icdoff = le16_to_cpu(id->icdoff);
                 ctrl->ioccsz = le32_to_cpu(id->ioccsz);
                 ctrl->iorcsz = le32_to_cpu(id->iorcsz);
@@ -2098,7 +2113,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 if (ns->ndev)
                         nvme_nvm_unregister_sysfs(ns);
                 del_gendisk(ns->disk);
-                blk_mq_abort_requeue_list(ns->queue);
                 blk_cleanup_queue(ns->queue);
         }
 
@@ -2427,6 +2441,10 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
         struct nvme_ns *ns;
 
         mutex_lock(&ctrl->namespaces_mutex);
+
+        /* Forcibly start all queues to avoid having stuck requests */
+        blk_mq_start_hw_queues(ctrl->admin_q);
+
         list_for_each_entry(ns, &ctrl->namespaces, list) {
                 /*
                  * Revalidating a dead namespace sets capacity to 0. This will
@@ -2436,8 +2454,16 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
                         continue;
                 revalidate_disk(ns->disk);
                 blk_set_queue_dying(ns->queue);
-                blk_mq_abort_requeue_list(ns->queue);
-                blk_mq_start_stopped_hw_queues(ns->queue, true);
+
+                /*
+                 * Forcibly start all queues to avoid having stuck requests.
+                 * Note that we must ensure the queues are not stopped
+                 * when the final removal happens.
+                 */
+                blk_mq_start_hw_queues(ns->queue);
+
+                /* draining requests in requeue list */
+                blk_mq_kick_requeue_list(ns->queue);
         }
         mutex_unlock(&ctrl->namespaces_mutex);
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index dca7165fabcf..92964cef0f4b 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -45,8 +45,6 @@ enum nvme_fc_queue_flags {
 
 #define NVMEFC_QUEUE_DELAY      3               /* ms units */
 
-#define NVME_FC_MAX_CONNECT_ATTEMPTS    1
-
 struct nvme_fc_queue {
         struct nvme_fc_ctrl     *ctrl;
         struct device           *dev;
@@ -165,8 +163,6 @@ struct nvme_fc_ctrl {
         struct work_struct      delete_work;
         struct work_struct      reset_work;
         struct delayed_work     connect_work;
-        int                     reconnect_delay;
-        int                     connect_attempts;
 
         struct kref             ref;
         u32                     flags;
@@ -1143,6 +1139,7 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 /* *********************** NVME Ctrl Routines **************************** */
 
 static void __nvme_fc_final_op_cleanup(struct request *rq);
+static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
 nvme_fc_reinit_request(void *data, struct request *rq)
@@ -1269,7 +1266,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         struct nvme_command *sqe = &op->cmd_iu.sqe;
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
-        bool complete_rq;
+        bool complete_rq, terminate_assoc = true;
 
         /*
          * WARNING:
@@ -1298,6 +1295,14 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * fabricate a CQE, the following fields will not be set as they
          * are not referenced:
          *      cqe.sqid,  cqe.sqhd,  cqe.command_id
+         *
+         * Failure or error of an individual i/o, in a transport
+         * detected fashion unrelated to the nvme completion status,
+         * potentially cause the initiator and target sides to get out
+         * of sync on SQ head/tail (aka outstanding io count allowed).
+         * Per FC-NVME spec, failure of an individual command requires
+         * the connection to be terminated, which in turn requires the
+         * association to be terminated.
          */
 
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
@@ -1363,6 +1368,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                 goto done;
         }
 
+        terminate_assoc = false;
+
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
@@ -1370,19 +1377,23 @@ done:
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
-                return;
+                goto check_error;
         }
 
         complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
         if (!complete_rq) {
                 if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
-                        status = cpu_to_le16(NVME_SC_ABORT_REQ);
+                        status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
                         if (blk_queue_dying(rq->q))
-                                status |= cpu_to_le16(NVME_SC_DNR);
+                                status |= cpu_to_le16(NVME_SC_DNR << 1);
                 }
                 nvme_end_request(rq, status, result);
         } else
                 __nvme_fc_final_op_cleanup(rq);
+
+check_error:
+        if (terminate_assoc)
+                nvme_fc_error_recovery(ctrl, "transport detected io error");
 }
 
 static int
@@ -1751,7 +1762,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
         dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: transport association error detected: %s\n",
                 ctrl->cnum, errmsg);
-        dev_info(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: resetting controller\n", ctrl->cnum);
 
         /* stop the queues on error, cleanup is in reset thread */
@@ -2195,9 +2206,6 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl)
         if (!opts->nr_io_queues)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
@@ -2268,9 +2276,6 @@ nvme_fc_reinit_io_queues(struct nvme_fc_ctrl *ctrl)
         if (ctrl->queue_count == 1)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "Recreating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         ret = blk_mq_reinit_tagset(&ctrl->tag_set);
@@ -2306,7 +2311,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         int ret;
         bool changed;
 
-        ctrl->connect_attempts++;
+        ++ctrl->ctrl.opts->nr_reconnects;
 
         /*
          * Create the admin queue
@@ -2403,9 +2408,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
         WARN_ON_ONCE(!changed);
 
-        ctrl->connect_attempts = 0;
-
-        kref_get(&ctrl->ctrl.kref);
+        ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
                 nvme_start_queues(&ctrl->ctrl);
@@ -2536,26 +2539,32 @@ nvme_fc_delete_ctrl_work(struct work_struct *work)
 
         /*
          * tear down the controller
-         * This will result in the last reference on the nvme ctrl to
-         * expire, calling the transport nvme_fc_nvme_ctrl_freed() callback.
-         * From there, the transport will tear down it's logical queues and
-         * association.
+         * After the last reference on the nvme ctrl is removed,
+         * the transport nvme_fc_nvme_ctrl_freed() callback will be
+         * invoked. From there, the transport will tear down it's
+         * logical queues and association.
          */
         nvme_uninit_ctrl(&ctrl->ctrl);
 
         nvme_put_ctrl(&ctrl->ctrl);
 }
 
-static int
-__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+static bool
+__nvme_fc_schedule_delete_work(struct nvme_fc_ctrl *ctrl)
 {
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return -EBUSY;
+                return true;
 
         if (!queue_work(nvme_fc_wq, &ctrl->delete_work))
-                return -EBUSY;
+                return true;
 
-        return 0;
+        return false;
+}
+
+static int
+__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+{
+        return __nvme_fc_schedule_delete_work(ctrl) ? -EBUSY : 0;
 }
 
 /*
@@ -2581,6 +2590,35 @@ nvme_fc_del_nvme_ctrl(struct nvme_ctrl *nctrl)
 }
 
 static void
+nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+{
+        /* If we are resetting/deleting then do nothing */
+        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+                WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
+                        ctrl->ctrl.state == NVME_CTRL_LIVE);
+                return;
+        }
+
+        dev_info(ctrl->ctrl.device,
+                "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
+                ctrl->cnum, status);
+
+        if (nvmf_should_reconnect(&ctrl->ctrl)) {
+                dev_info(ctrl->ctrl.device,
+                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
+                        ctrl->cnum, ctrl->ctrl.opts->reconnect_delay);
+                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
+                                ctrl->ctrl.opts->reconnect_delay * HZ);
+        } else {
+                dev_warn(ctrl->ctrl.device,
+                                "NVME-FC{%d}: Max reconnect attempts (%d) "
+                                "reached. Removing controller\n",
+                                ctrl->cnum, ctrl->ctrl.opts->nr_reconnects);
+                WARN_ON(__nvme_fc_schedule_delete_work(ctrl));
+        }
+}
+
+static void
 nvme_fc_reset_ctrl_work(struct work_struct *work)
 {
         struct nvme_fc_ctrl *ctrl =
@@ -2591,34 +2629,9 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         nvme_fc_delete_association(ctrl);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reset complete\n", ctrl->cnum);
 }
@@ -2632,7 +2645,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
-        dev_warn(ctrl->ctrl.device,
+        dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: admin requested controller reset\n", ctrl->cnum);
 
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
@@ -2649,7 +2662,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
@@ -2671,34 +2684,9 @@ nvme_fc_connect_ctrl_work(struct work_struct *work)
                                 struct nvme_fc_ctrl, connect_work);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reconnect complete\n",
                         ctrl->cnum);
@@ -2755,7 +2743,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         INIT_WORK(&ctrl->delete_work, nvme_fc_delete_ctrl_work);
         INIT_WORK(&ctrl->reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
-        ctrl->reconnect_delay = opts->reconnect_delay;
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -2835,6 +2822,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 return ERR_PTR(ret);
         }
 
+        kref_get(&ctrl->ctrl.kref);
+
         dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: new ctrl: NQN \"%s\"\n",
                 ctrl->cnum, ctrl->ctrl.opts->subsysnqn);
@@ -2971,7 +2960,7 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts)
 static struct nvmf_transport_ops nvme_fc_transport = {
         .name           = "fc",
         .required_opts  = NVMF_OPT_TRADDR | NVMF_OPT_HOST_TRADDR,
-        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY,
+        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY | NVMF_OPT_CTRL_LOSS_TMO,
         .create_ctrl    = nvme_fc_create_ctrl,
 };
 
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 29c708ca9621..9d6a070d4391 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -208,7 +208,9 @@ struct nvme_ns {
 struct nvme_ctrl_ops {
         const char *name;
         struct module *module;
-        bool is_fabrics;
+        unsigned int flags;
+#define NVME_F_FABRICS                  (1 << 0)
+#define NVME_F_METADATA_SUPPORTED       (1 << 1)
         int (*reg_read32)(struct nvme_ctrl *ctrl, u32 off, u32 *val);
         int (*reg_write32)(struct nvme_ctrl *ctrl, u32 off, u32 val);
         int (*reg_read64)(struct nvme_ctrl *ctrl, u32 off, u64 *val);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 4c2ff2bb26bc..951042a375d6 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -263,7 +263,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
         c.dbbuf.prp2 = cpu_to_le64(dev->dbbuf_eis_dma_addr);
 
         if (nvme_submit_sync_cmd(dev->ctrl.admin_q, &c, NULL, 0)) {
-                dev_warn(dev->dev, "unable to set dbbuf\n");
+                dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
                 /* Free memory and continue on */
                 nvme_dbbuf_dma_free(dev);
         }
@@ -1367,7 +1367,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO);
 
         /* If there is a reset ongoing, we shouldn't reset again. */
-        if (work_busy(&dev->reset_work))
+        if (dev->ctrl.state == NVME_CTRL_RESETTING)
                 return false;
 
         /* We shouldn't reset unless the controller is on fatal error state
@@ -1394,11 +1394,11 @@ static void nvme_warn_reset(struct nvme_dev *dev, u32 csts)
         result = pci_read_config_word(to_pci_dev(dev->dev), PCI_STATUS,
                                       &pci_status);
         if (result == PCIBIOS_SUCCESSFUL)
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS=0x%hx\n",
                          csts, pci_status);
         else
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS read failed (%d)\n",
                          csts, result);
 }
@@ -1740,8 +1740,8 @@ static int nvme_pci_enable(struct nvme_dev *dev)
          */
         if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
                 dev->q_depth = 2;
-                dev_warn(dev->dev, "detected Apple NVMe controller, set "
-                        "queue depth=%u to work around controller resets\n",
+                dev_warn(dev->ctrl.device, "detected Apple NVMe controller, "
+                        "set queue depth=%u to work around controller resets\n",
                         dev->q_depth);
         }
 
@@ -1759,7 +1759,7 @@ static int nvme_pci_enable(struct nvme_dev *dev)
                 if (dev->cmbsz) {
                         if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                     &dev_attr_cmb.attr, NULL))
-                                dev_warn(dev->dev,
+                                dev_warn(dev->ctrl.device,
                                          "failed to add sysfs attribute for CMB\n");
                 }
         }
@@ -1903,7 +1903,7 @@ static void nvme_reset_work(struct work_struct *work)
         bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
         int result = -ENODEV;
 
-        if (WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING))
+        if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
                 goto out;
 
         /*
@@ -1913,9 +1913,6 @@ static void nvme_reset_work(struct work_struct *work)
         if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                 nvme_dev_disable(dev, false);
 
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
-                goto out;
-
         result = nvme_pci_enable(dev);
         if (result)
                 goto out;
@@ -2009,8 +2006,8 @@ static int nvme_reset(struct nvme_dev *dev)
 {
         if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
                 return -ENODEV;
-        if (work_busy(&dev->reset_work))
-                return -ENODEV;
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
+                return -EBUSY;
         if (!queue_work(nvme_workq, &dev->reset_work))
                 return -EBUSY;
         return 0;
@@ -2047,6 +2044,7 @@ static int nvme_pci_reset_ctrl(struct nvme_ctrl *ctrl)
 static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = {
         .name                   = "pcie",
         .module                 = THIS_MODULE,
+        .flags                  = NVME_F_METADATA_SUPPORTED,
         .reg_read32             = nvme_pci_reg_read32,
         .reg_write32            = nvme_pci_reg_write32,
         .reg_read64             = nvme_pci_reg_read64,
@@ -2135,6 +2133,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (result)
                 goto release_pools;
 
+        nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING);
         dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
 
         queue_work(nvme_workq, &dev->reset_work);
@@ -2178,6 +2177,7 @@ static void nvme_remove(struct pci_dev *pdev)
 
         nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
 
+        cancel_work_sync(&dev->reset_work);
         pci_set_drvdata(pdev, NULL);
 
         if (!pci_device_is_present(pdev)) {
@@ -2293,6 +2293,8 @@ static const struct pci_device_id nvme_id_table[] = {
         { PCI_VDEVICE(INTEL, 0x0a54),
                 .driver_data = NVME_QUIRK_STRIPE_SIZE |
                                 NVME_QUIRK_DEALLOCATE_ZEROES, },
+        { PCI_VDEVICE(INTEL, 0xf1a5),   /* Intel 600P/P3100 */
+                .driver_data = NVME_QUIRK_NO_DEEPEST_PS },
         { PCI_VDEVICE(INTEL, 0x5845),   /* Qemu emulated controller */
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index dd1c6deef82f..24397d306d53 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -753,28 +753,26 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         if (ret)
                 goto requeue;
 
-        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
-
         ret = nvmf_connect_admin_queue(&ctrl->ctrl);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
 
         ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (ret)
-                goto stop_admin_q;
+                goto requeue;
 
         nvme_start_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 ret = nvme_rdma_init_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
 
                 ret = nvme_rdma_connect_io_queues(ctrl);
                 if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -782,7 +780,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
-                nvme_start_queues(&ctrl->ctrl);
                 nvme_queue_scan(&ctrl->ctrl);
                 nvme_queue_async_events(&ctrl->ctrl);
         }
@@ -791,8 +788,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
 
         return;
 
-stop_admin_q:
-        blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
 requeue:
         dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
                         ctrl->ctrl.opts->nr_reconnects);
@@ -823,6 +818,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                 nvme_cancel_request, &ctrl->ctrl);
 
+        /*
+         * queues are not a live anymore, so restart the queues to fail fast
+         * new IO
+         */
+        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
+        nvme_start_queues(&ctrl->ctrl);
+
         nvme_rdma_reconnect_or_remove(ctrl);
 }
 
@@ -1038,6 +1040,19 @@ static void nvme_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
                 nvme_rdma_wr_error(cq, wc, "SEND");
 }
 
+static inline int nvme_rdma_queue_sig_limit(struct nvme_rdma_queue *queue)
+{
+        int sig_limit;
+
+        /*
+         * We signal completion every queue depth/2 and also handle the
+         * degenerated case of a  device with queue_depth=1, where we
+         * would need to signal every message.
+         */
+        sig_limit = max(queue->queue_size / 2, 1);
+        return (++queue->sig_count % sig_limit) == 0;
+}
+
 static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
                 struct nvme_rdma_qe *qe, struct ib_sge *sge, u32 num_sge,
                 struct ib_send_wr *first, bool flush)
@@ -1065,9 +1080,6 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * Would have been way to obvious to handle this in hardware or
          * at least the RDMA stack..
          *
-         * This messy and racy code sniplet is copy and pasted from the iSER
-         * initiator, and the magic '32' comes from there as well.
-         *
          * Always signal the flushes. The magic request used for the flush
          * sequencer is not allocated in our driver's tagset and it's
          * triggered to be freed by blk_cleanup_queue(). So we need to
@@ -1075,7 +1087,7 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * embedded in request's payload, is not freed when __ib_process_cq()
          * calls wr_cqe->done().
          */
-        if ((++queue->sig_count % 32) == 0 || flush)
+        if (nvme_rdma_queue_sig_limit(queue) || flush)
                 wr.send_flags |= IB_SEND_SIGNALED;
 
         if (first)
@@ -1423,7 +1435,7 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
 /*
  * We cannot accept any other command until the Connect command has completed.
  */
-static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+static inline int nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
                 struct request *rq)
 {
         if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
@@ -1431,11 +1443,22 @@ static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
 
                 if (!blk_rq_is_passthrough(rq) ||
                     cmd->common.opcode != nvme_fabrics_command ||
-                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
-                        return false;
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect) {
+                        /*
+                         * reconnecting state means transport disruption, which
+                         * can take a long time and even might fail permanently,
+                         * so we can't let incoming I/O be requeued forever.
+                         * fail it fast to allow upper layers a chance to
+                         * failover.
+                         */
+                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING)
+                                return -EIO;
+                        else
+                                return -EAGAIN;
+                }
         }
 
-        return true;
+        return 0;
 }
 
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1453,8 +1476,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         WARN_ON_ONCE(rq->tag < 0);
 
-        if (!nvme_rdma_queue_is_ready(queue, rq))
-                return BLK_MQ_RQ_QUEUE_BUSY;
+        ret = nvme_rdma_queue_is_ready(queue, rq);
+        if (unlikely(ret))
+                goto err;
 
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
@@ -1782,7 +1806,7 @@ static int nvme_rdma_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
         .name                   = "rdma",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index feb497134aee..e503cfff0337 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -558,7 +558,7 @@ static int nvme_loop_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
         .name                   = "loop",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 9416d052cb89..28c38c756f92 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -144,8 +144,8 @@ int of_dma_configure(struct device *dev, struct device_node *np)
                 coherent ? " " : " not ");
 
         iommu = of_iommu_configure(dev, np);
-        if (IS_ERR(iommu))
-                return PTR_ERR(iommu);
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
 
         dev_dbg(dev, "device is%sbehind an iommu\n",
                 iommu ? " " : " not ");
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 71fecc2debfc..703a42118ffc 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -523,7 +523,7 @@ static int __init of_platform_default_populate_init(void)
 arch_initcall_sync(of_platform_default_populate_init);
 #endif
 
-static int of_platform_device_destroy(struct device *dev, void *data)
+int of_platform_device_destroy(struct device *dev, void *data)
 {
         /* Do not touch devices not populated from the device tree */
         if (!dev->of_node || !of_node_check_flag(dev->of_node, OF_POPULATED))
@@ -544,6 +544,7 @@ static int of_platform_device_destroy(struct device *dev, void *data)
         of_node_clear_flag(dev->of_node, OF_POPULATED_BUS);
         return 0;
 }
+EXPORT_SYMBOL_GPL(of_platform_device_destroy);
 
 /**
  * of_platform_depopulate() - Remove devices populated from device tree
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index 74cf5fffb1e1..c80e37a69305 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -896,7 +896,7 @@ int pci_read_config_byte(const struct pci_dev *dev, int where, u8 *val)
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_byte(dev->bus, dev->devfn, where, val);
 }
@@ -906,7 +906,7 @@ int pci_read_config_word(const struct pci_dev *dev, int where, u16 *val)
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_word(dev->bus, dev->devfn, where, val);
 }
@@ -917,7 +917,7 @@ int pci_read_config_dword(const struct pci_dev *dev, int where,
 {
         if (pci_dev_is_disconnected(dev)) {
                 *val = ~0;
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         }
         return pci_bus_read_config_dword(dev->bus, dev->devfn, where, val);
 }
@@ -926,7 +926,7 @@ EXPORT_SYMBOL(pci_read_config_dword);
 int pci_write_config_byte(const struct pci_dev *dev, int where, u8 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_byte(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_byte);
@@ -934,7 +934,7 @@ EXPORT_SYMBOL(pci_write_config_byte);
 int pci_write_config_word(const struct pci_dev *dev, int where, u16 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_word(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_word);
@@ -943,7 +943,7 @@ int pci_write_config_dword(const struct pci_dev *dev, int where,
                                          u32 val)
 {
         if (pci_dev_is_disconnected(dev))
-                return -ENODEV;
+                return PCIBIOS_DEVICE_NOT_FOUND;
         return pci_bus_write_config_dword(dev->bus, dev->devfn, where, val);
 }
 EXPORT_SYMBOL(pci_write_config_dword);
diff --git a/drivers/pci/dwc/pci-imx6.c b/drivers/pci/dwc/pci-imx6.c
index a98cba55c7f0..19a289b8cc94 100644
--- a/drivers/pci/dwc/pci-imx6.c
+++ b/drivers/pci/dwc/pci-imx6.c
@@ -252,7 +252,34 @@ static void imx6_pcie_reset_phy(struct imx6_pcie *imx6_pcie)
 static int imx6q_pcie_abort_handler(unsigned long addr,
                 unsigned int fsr, struct pt_regs *regs)
 {
-        return 0;
+        unsigned long pc = instruction_pointer(regs);
+        unsigned long instr = *(unsigned long *)pc;
+        int reg = (instr >> 12) & 15;
+
+        /*
+         * If the instruction being executed was a read,
+         * make it look like it read all-ones.
+         */
+        if ((instr & 0x0c100000) == 0x04100000) {
+                unsigned long val;
+
+                if (instr & 0x00400000)
+                        val = 255;
+                else
+                        val = -1;
+
+                regs->uregs[reg] = val;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        if ((instr & 0x0e100090) == 0x00100090) {
+                regs->uregs[reg] = -1;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        return 1;
 }
 
 static void imx6_pcie_assert_core_reset(struct imx6_pcie *imx6_pcie)
@@ -819,8 +846,8 @@ static int __init imx6_pcie_init(void)
          * we can install the handler here without risking it
          * accessing some uninitialized driver state.
          */
-        hook_fault_code(16 + 6, imx6q_pcie_abort_handler, SIGBUS, 0,
-                        "imprecise external abort");
+        hook_fault_code(8, imx6q_pcie_abort_handler, SIGBUS, 0,
+                        "external abort on non-linefetch");
 
         return platform_driver_register(&imx6_pcie_driver);
 }
diff --git a/drivers/pci/endpoint/Kconfig b/drivers/pci/endpoint/Kconfig
index c23f146fb5a6..c09623ca8c3b 100644
--- a/drivers/pci/endpoint/Kconfig
+++ b/drivers/pci/endpoint/Kconfig
@@ -6,6 +6,7 @@ menu "PCI Endpoint"
 
 config PCI_ENDPOINT
         bool "PCI Endpoint Support"
+        depends on HAS_DMA
         help
            Enable this configuration option to support configurable PCI
            endpoint. This should be enabled if the platform has a PCI
diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
index 175edad42d2f..2942066607e0 100644
--- a/drivers/pci/endpoint/functions/Kconfig
+++ b/drivers/pci/endpoint/functions/Kconfig
@@ -5,6 +5,7 @@
 config PCI_EPF_TEST
         tristate "PCI Endpoint Test driver"
         depends on PCI_ENDPOINT
+        select CRC32
         help
            Enable this configuration option to enable the test driver
            for PCI Endpoint.
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b01bd5bba8e6..563901cd9c06 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2144,7 +2144,8 @@ bool pci_dev_keep_suspended(struct pci_dev *pci_dev)
 
         if (!pm_runtime_suspended(dev)
             || pci_target_state(pci_dev) != pci_dev->current_state
-            || platform_pci_need_resume(pci_dev))
+            || platform_pci_need_resume(pci_dev)
+            || (pci_dev->dev_flags & PCI_DEV_FLAGS_NEEDS_RESUME))
                 return false;
 
         /*
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index cc6e085008fb..f6a63406c76e 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1291,7 +1291,6 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
         cdev = &stdev->cdev;
         cdev_init(cdev, &switchtec_fops);
         cdev->owner = THIS_MODULE;
-        cdev->kobj.parent = &dev->kobj;
 
         return stdev;
 
@@ -1442,12 +1441,15 @@ static int switchtec_init_pci(struct switchtec_dev *stdev,
         stdev->mmio_sys_info = stdev->mmio + SWITCHTEC_GAS_SYS_INFO_OFFSET;
         stdev->mmio_flash_info = stdev->mmio + SWITCHTEC_GAS_FLASH_INFO_OFFSET;
         stdev->mmio_ntb = stdev->mmio + SWITCHTEC_GAS_NTB_OFFSET;
-        stdev->partition = ioread8(&stdev->mmio_ntb->partition_id);
+        stdev->partition = ioread8(&stdev->mmio_sys_info->partition_id);
         stdev->partition_count = ioread8(&stdev->mmio_ntb->partition_count);
         stdev->mmio_part_cfg_all = stdev->mmio + SWITCHTEC_GAS_PART_CFG_OFFSET;
         stdev->mmio_part_cfg = &stdev->mmio_part_cfg_all[stdev->partition];
         stdev->mmio_pff_csr = stdev->mmio + SWITCHTEC_GAS_PFF_CSR_OFFSET;
 
+        if (stdev->partition_count < 1)
+                stdev->partition_count = 1;
+
         init_pff(stdev);
 
         pci_set_drvdata(pdev, stdev);
@@ -1479,11 +1481,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
                   SWITCHTEC_EVENT_EN_IRQ,
                   &stdev->mmio_part_cfg->mrpc_comp_hdr);
 
-        rc = cdev_add(&stdev->cdev, stdev->dev.devt, 1);
-        if (rc)
-                goto err_put;
-
-        rc = device_add(&stdev->dev);
+        rc = cdev_device_add(&stdev->cdev, &stdev->dev);
         if (rc)
                 goto err_devadd;
 
@@ -1492,7 +1490,6 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
         return 0;
 
 err_devadd:
-        cdev_del(&stdev->cdev);
         stdev_kill(stdev);
 err_put:
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
@@ -1506,8 +1503,7 @@ static void switchtec_pci_remove(struct pci_dev *pdev)
 
         pci_set_drvdata(pdev, NULL);
 
-        device_del(&stdev->dev);
-        cdev_del(&stdev->cdev);
+        cdev_device_del(&stdev->cdev, &stdev->dev);
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
         dev_info(&stdev->dev, "unregistered.\n");
 
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index 34c862f213c7..0a9b78705ee8 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -29,6 +29,17 @@ static int arm_pmu_acpi_register_irq(int cpu)
                 return -EINVAL;
 
         gsi = gicc->performance_interrupt;
+
+        /*
+         * Per the ACPI spec, the MADT cannot describe a PMU that doesn't
+         * have an interrupt. QEMU advertises this by using a GSI of zero,
+         * which is not known to be valid on any hardware despite being
+         * valid per the spec. Take the pragmatic approach and reject a
+         * GSI of zero for now.
+         */
+        if (!gsi)
+                return 0;
+
         if (gicc->flags & ACPI_MADT_PERFORMANCE_IRQ_MODE)
                 trigger = ACPI_EDGE_SENSITIVE;
         else
diff --git a/drivers/phy/phy-qcom-qmp.c b/drivers/phy/phy-qcom-qmp.c
index 727e23be7cac..78ca62897784 100644
--- a/drivers/phy/phy-qcom-qmp.c
+++ b/drivers/phy/phy-qcom-qmp.c
@@ -844,7 +844,7 @@ static int qcom_qmp_phy_vreg_init(struct device *dev)
         int num = qmp->cfg->num_vregs;
         int i;
 
-        qmp->vregs = devm_kcalloc(dev, num, sizeof(qmp->vregs), GFP_KERNEL);
+        qmp->vregs = devm_kcalloc(dev, num, sizeof(*qmp->vregs), GFP_KERNEL);
         if (!qmp->vregs)
                 return -ENOMEM;
 
@@ -983,16 +983,16 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id)
          * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
          */
         qphy->tx = of_iomap(np, 0);
-        if (IS_ERR(qphy->tx))
-                return PTR_ERR(qphy->tx);
+        if (!qphy->tx)
+                return -ENOMEM;
 
         qphy->rx = of_iomap(np, 1);
-        if (IS_ERR(qphy->rx))
-                return PTR_ERR(qphy->rx);
+        if (!qphy->rx)
+                return -ENOMEM;
 
         qphy->pcs = of_iomap(np, 2);
-        if (IS_ERR(qphy->pcs))
-                return PTR_ERR(qphy->pcs);
+        if (!qphy->pcs)
+                return -ENOMEM;
 
         /*
          * Get PHY's Pipe clock, if any. USB3 and PCIe are PIPE3
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 1653cbda6a82..bd459a93b0e7 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -680,30 +680,16 @@ EXPORT_SYMBOL_GPL(pinctrl_generic_remove_group);
  * pinctrl_generic_free_groups() - removes all pin groups
  * @pctldev: pin controller device
  *
- * Note that the caller must take care of locking.
+ * Note that the caller must take care of locking. The pinctrl groups
+ * are allocated with devm_kzalloc() so no need to free them here.
  */
 static void pinctrl_generic_free_groups(struct pinctrl_dev *pctldev)
 {
         struct radix_tree_iter iter;
-        struct group_desc *group;
-        unsigned long *indices;
         void **slot;
-        int i = 0;
-
-        indices = devm_kzalloc(pctldev->dev, sizeof(*indices) *
-                               pctldev->num_groups, GFP_KERNEL);
-        if (!indices)
-                return;
 
         radix_tree_for_each_slot(slot, &pctldev->pin_group_tree, &iter, 0)
-                indices[i++] = iter.index;
-
-        for (i = 0; i < pctldev->num_groups; i++) {
-                group = radix_tree_lookup(&pctldev->pin_group_tree,
-                                          indices[i]);
-                radix_tree_delete(&pctldev->pin_group_tree, indices[i]);
-                devm_kfree(pctldev->dev, group);
-        }
+                radix_tree_delete(&pctldev->pin_group_tree, iter.index);
 
         pctldev->num_groups = 0;
 }
diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c
index 41b5b07d5a2b..6852010a6d70 100644
--- a/drivers/pinctrl/freescale/pinctrl-mxs.c
+++ b/drivers/pinctrl/freescale/pinctrl-mxs.c
@@ -194,6 +194,16 @@ static int mxs_pinctrl_get_func_groups(struct pinctrl_dev *pctldev,
         return 0;
 }
 
+static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg)
+{
+        u32 tmp;
+
+        tmp = readl(reg);
+        tmp &= ~(mask << shift);
+        tmp |= value << shift;
+        writel(tmp, reg);
+}
+
 static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
                                unsigned group)
 {
@@ -211,8 +221,7 @@ static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
                 reg += bank * 0x20 + pin / 16 * 0x10;
                 shift = pin % 16 * 2;
 
-                writel(0x3 << shift, reg + CLR);
-                writel(g->muxsel[i] << shift, reg + SET);
+                mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg);
         }
 
         return 0;
@@ -279,8 +288,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
                         /* mA */
                         if (config & MA_PRESENT) {
                                 shift = pin % 8 * 4;
-                                writel(0x3 << shift, reg + CLR);
-                                writel(ma << shift, reg + SET);
+                                mxs_pinctrl_rmwl(ma, 0x3, shift, reg);
                         }
 
                         /* vol */
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 2debba62fac9..20f1b4493994 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,15 +1539,29 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
  * is not listed below.
  */
 static const struct dmi_system_id chv_no_valid_mask[] = {
+        /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
         {
-                /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
-                .ident = "Acer Chromebook (CYAN)",
+                .ident = "Intel_Strago based Chromebooks (All models)",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
-                        DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+                        DMI_MATCH(DMI_PRODUCT_FAMILY, "Intel_Strago"),
                 },
-        }
+        },
+        {
+                .ident = "Acer Chromebook R11 (Cyan)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Cyan"),
+                },
+        },
+        {
+                .ident = "Samsung Chromebook 3 (Celes)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
+                },
+        },
+        {}
 };
 
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c
index 0d6b7f4b82af..720a19fd38d2 100644
--- a/drivers/pinctrl/pinconf-generic.c
+++ b/drivers/pinctrl/pinconf-generic.c
@@ -35,7 +35,6 @@ static const struct pin_config_item conf_items[] = {
         PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT,
                                 "input bias pull to pin specific state", NULL, false),
         PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false),
-        PCONFDUMP(PIN_CONFIG_BIDIRECTIONAL, "bi-directional pin operations", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false),
         PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false),
@@ -161,7 +160,6 @@ static const struct pinconf_generic_params dt_params[] = {
         { "bias-pull-up", PIN_CONFIG_BIAS_PULL_UP, 1 },
         { "bias-pull-pin-default", PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, 1 },
         { "bias-pull-down", PIN_CONFIG_BIAS_PULL_DOWN, 1 },
-        { "bi-directional", PIN_CONFIG_BIDIRECTIONAL, 1 },
         { "drive-open-drain", PIN_CONFIG_DRIVE_OPEN_DRAIN, 0 },
         { "drive-open-source", PIN_CONFIG_DRIVE_OPEN_SOURCE, 0 },
         { "drive-push-pull", PIN_CONFIG_DRIVE_PUSH_PULL, 0 },
@@ -174,7 +172,6 @@ static const struct pinconf_generic_params dt_params[] = {
         { "input-schmitt-enable", PIN_CONFIG_INPUT_SCHMITT_ENABLE, 1 },
         { "low-power-disable", PIN_CONFIG_LOW_POWER_MODE, 0 },
         { "low-power-enable", PIN_CONFIG_LOW_POWER_MODE, 1 },
-        { "output-enable", PIN_CONFIG_OUTPUT, 1, },
         { "output-high", PIN_CONFIG_OUTPUT, 1, },
         { "output-low", PIN_CONFIG_OUTPUT, 0, },
         { "power-source", PIN_CONFIG_POWER_SOURCE, 0 },
diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
index 9fd6d9087dc5..16b3ae5e4f44 100644
--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -826,30 +826,17 @@ EXPORT_SYMBOL_GPL(pinmux_generic_remove_function);
  * pinmux_generic_free_functions() - removes all functions
  * @pctldev: pin controller device
  *
- * Note that the caller must take care of locking.
+ * Note that the caller must take care of locking. The pinctrl
+ * functions are allocated with devm_kzalloc() so no need to free
+ * them here.
  */
 void pinmux_generic_free_functions(struct pinctrl_dev *pctldev)
 {
         struct radix_tree_iter iter;
-        struct function_desc *function;
-        unsigned long *indices;
         void **slot;
-        int i = 0;
-
-        indices = devm_kzalloc(pctldev->dev, sizeof(*indices) *
-                               pctldev->num_functions, GFP_KERNEL);
-        if (!indices)
-                return;
 
         radix_tree_for_each_slot(slot, &pctldev->pin_function_tree, &iter, 0)
-                indices[i++] = iter.index;
-
-        for (i = 0; i < pctldev->num_functions; i++) {
-                function = radix_tree_lookup(&pctldev->pin_function_tree,
-                                             indices[i]);
-                radix_tree_delete(&pctldev->pin_function_tree, indices[i]);
-                devm_kfree(pctldev->dev, function);
-        }
+                radix_tree_delete(&pctldev->pin_function_tree, iter.index);
 
         pctldev->num_functions = 0;
 }
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
index 9aec1d2232dd..6624499eae72 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
@@ -394,7 +394,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 18),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x3, "owa")),          /* DOUT */
+                  SUNXI_FUNCTION(0x3, "spdif")),        /* DOUT */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 19),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out")),
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 2de1e603bd2b..5f3672153b12 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -704,7 +704,7 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
                 /* Reallocate the array */
                 u32 new_capacity = 2 * dev->pipes_capacity;
                 struct goldfish_pipe **pipes =
-                        kcalloc(new_capacity, sizeof(*pipes), GFP_KERNEL);
+                        kcalloc(new_capacity, sizeof(*pipes), GFP_ATOMIC);
                 if (!pipes)
                         return -ENOMEM;
                 memcpy(pipes, dev->pipes, sizeof(*pipes) * dev->pipes_capacity);
diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c
index ef29f18b1951..4cc2f4ea0a25 100644
--- a/drivers/platform/x86/intel_telemetry_debugfs.c
+++ b/drivers/platform/x86/intel_telemetry_debugfs.c
@@ -97,11 +97,9 @@
         } \
 }
 
-#ifdef CONFIG_PM_SLEEP
 static u8 suspend_prep_ok;
 static u32 suspend_shlw_ctr_temp, suspend_deep_ctr_temp;
 static u64 suspend_shlw_res_temp, suspend_deep_res_temp;
-#endif
 
 struct telemetry_susp_stats {
         u32 shlw_swake_ctr;
@@ -807,7 +805,6 @@ static const struct file_operations telem_ioss_trc_verb_ops = {
         .release        = single_release,
 };
 
-#ifdef CONFIG_PM_SLEEP
 static int pm_suspend_prep_cb(void)
 {
         struct telemetry_evtlog evtlog[TELEM_MAX_OS_ALLOCATED_EVENTS];
@@ -937,7 +934,6 @@ static int pm_notification(struct notifier_block *this,
 static struct notifier_block pm_notifier = {
         .notifier_call = pm_notification,
 };
-#endif /* CONFIG_PM_SLEEP */
 
 static int __init telemetry_debugfs_init(void)
 {
@@ -960,14 +956,13 @@ static int __init telemetry_debugfs_init(void)
         if (err < 0)
                 return -EINVAL;
 
-
-#ifdef CONFIG_PM_SLEEP
         register_pm_notifier(&pm_notifier);
-#endif /* CONFIG_PM_SLEEP */
 
         debugfs_conf->telemetry_dbg_dir = debugfs_create_dir("telemetry", NULL);
-        if (!debugfs_conf->telemetry_dbg_dir)
-                return -ENOMEM;
+        if (!debugfs_conf->telemetry_dbg_dir) {
+                err = -ENOMEM;
+                goto out_pm;
+        }
 
         f = debugfs_create_file("pss_info", S_IFREG | S_IRUGO,
                                 debugfs_conf->telemetry_dbg_dir, NULL,
@@ -1014,6 +1009,8 @@ static int __init telemetry_debugfs_init(void)
 out:
         debugfs_remove_recursive(debugfs_conf->telemetry_dbg_dir);
         debugfs_conf->telemetry_dbg_dir = NULL;
+out_pm:
+        unregister_pm_notifier(&pm_notifier);
 
         return err;
 }
@@ -1022,6 +1019,7 @@ static void __exit telemetry_debugfs_exit(void)
 {
         debugfs_remove_recursive(debugfs_conf->telemetry_dbg_dir);
         debugfs_conf->telemetry_dbg_dir = NULL;
+        unregister_pm_notifier(&pm_notifier);
 }
 
 late_initcall(telemetry_debugfs_init);
diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index 35ce53edabf9..d5e5229308f2 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c
@@ -155,3 +155,5 @@ static int __init hi6220_reset_init(void)
 }
 
 postcore_initcall(hi6220_reset_init);
+
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c
index 6b54f6c24c5f..80931114c899 100644
--- a/drivers/rtc/rtc-imxdi.c
+++ b/drivers/rtc/rtc-imxdi.c
@@ -709,7 +709,7 @@ static irqreturn_t dryice_irq(int irq, void *dev_id)
                 /*If the write wait queue is empty then there is no pending
                   operations. It means the interrupt is for DryIce -Security.
                   IRQ must be returned as none.*/
-                if (list_empty_careful(&imxdi->write_wait.task_list))
+                if (list_empty_careful(&imxdi->write_wait.head))
                         return rc;
 
                 /* DSR_WCF clears itself on DSR read */
diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
index e72abbc18ee3..a66a317f3e4f 100644
--- a/drivers/s390/cio/vfio_ccw_ops.c
+++ b/drivers/s390/cio/vfio_ccw_ops.c
@@ -70,14 +70,14 @@ static ssize_t name_show(struct kobject *kobj, struct device *dev, char *buf)
 {
         return sprintf(buf, "I/O subchannel (Non-QDIO)\n");
 }
-MDEV_TYPE_ATTR_RO(name);
+static MDEV_TYPE_ATTR_RO(name);
 
 static ssize_t device_api_show(struct kobject *kobj, struct device *dev,
                                char *buf)
 {
         return sprintf(buf, "%s\n", VFIO_DEVICE_API_CCW_STRING);
 }
-MDEV_TYPE_ATTR_RO(device_api);
+static MDEV_TYPE_ATTR_RO(device_api);
 
 static ssize_t available_instances_show(struct kobject *kobj,
                                         struct device *dev, char *buf)
@@ -86,7 +86,7 @@ static ssize_t available_instances_show(struct kobject *kobj,
 
         return sprintf(buf, "%d\n", atomic_read(&private->avail));
 }
-MDEV_TYPE_ATTR_RO(available_instances);
+static MDEV_TYPE_ATTR_RO(available_instances);
 
 static struct attribute *mdev_types_attrs[] = {
         &mdev_type_attr_name.attr,
@@ -100,7 +100,7 @@ static struct attribute_group mdev_type_group = {
         .attrs = mdev_types_attrs,
 };
 
-struct attribute_group *mdev_type_groups[] = {
+static struct attribute_group *mdev_type_groups[] = {
         &mdev_type_group,
         NULL,
 };
@@ -152,7 +152,7 @@ static int vfio_ccw_mdev_open(struct mdev_device *mdev)
                                       &events, &private->nb);
 }
 
-void vfio_ccw_mdev_release(struct mdev_device *mdev)
+static void vfio_ccw_mdev_release(struct mdev_device *mdev)
 {
         struct vfio_ccw_private *private =
                 dev_get_drvdata(mdev_parent_dev(mdev));
@@ -233,7 +233,7 @@ static int vfio_ccw_mdev_get_region_info(struct vfio_region_info *info,
         }
 }
 
-int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
+static int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
 {
         if (info->index != VFIO_CCW_IO_IRQ_INDEX)
                 return -EINVAL;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 9be4596d8a08..ea099910b4e9 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -668,10 +668,28 @@ static int ap_device_probe(struct device *dev)
         struct ap_driver *ap_drv = to_ap_drv(dev->driver);
         int rc;
 
+        /* Add queue/card to list of active queues/cards */
+        spin_lock_bh(&ap_list_lock);
+        if (is_card_dev(dev))
+                list_add(&to_ap_card(dev)->list, &ap_card_list);
+        else
+                list_add(&to_ap_queue(dev)->list,
+                         &to_ap_queue(dev)->card->queues);
+        spin_unlock_bh(&ap_list_lock);
+
         ap_dev->drv = ap_drv;
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (rc)
+
+        if (rc) {
+                spin_lock_bh(&ap_list_lock);
+                if (is_card_dev(dev))
+                        list_del_init(&to_ap_card(dev)->list);
+                else
+                        list_del_init(&to_ap_queue(dev)->list);
+                spin_unlock_bh(&ap_list_lock);
                 ap_dev->drv = NULL;
+        }
+
         return rc;
 }
 
@@ -680,14 +698,17 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (ap_drv->remove)
+                ap_drv->remove(ap_dev);
+
+        /* Remove queue/card from list of active queues/cards */
         spin_lock_bh(&ap_list_lock);
         if (is_card_dev(dev))
                 list_del_init(&to_ap_card(dev)->list);
         else
                 list_del_init(&to_ap_queue(dev)->list);
         spin_unlock_bh(&ap_list_lock);
-        if (ap_drv->remove)
-                ap_drv->remove(ap_dev);
+
         return 0;
 }
 
@@ -1056,10 +1077,6 @@ static void ap_scan_bus(struct work_struct *unused)
                                 }
                                 /* get it and thus adjust reference counter */
                                 get_device(&ac->ap_dev.device);
-                                /* Add card device to card list */
-                                spin_lock_bh(&ap_list_lock);
-                                list_add(&ac->list, &ap_card_list);
-                                spin_unlock_bh(&ap_list_lock);
                         }
                         /* now create the new queue device */
                         aq = ap_queue_create(qid, type);
@@ -1070,10 +1087,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Add queue device to card queue list */
-                        spin_lock_bh(&ap_list_lock);
-                        list_add(&aq->list, &ac->queues);
-                        spin_unlock_bh(&ap_list_lock);
                         /* Start with a device reset */
                         spin_lock_bh(&aq->lock);
                         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
@@ -1081,9 +1094,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
-                                spin_lock_bh(&ap_list_lock);
-                                list_del_init(&aq->list);
-                                spin_unlock_bh(&ap_list_lock);
                                 put_device(&aq->ap_dev.device);
                                 continue;
                         }
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index cfa161ccc74e..836efac96813 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -160,7 +160,14 @@ static struct device_type ap_card_type = {
 
 static void ap_card_device_release(struct device *dev)
 {
-        kfree(to_ap_card(dev));
+        struct ap_card *ac = to_ap_card(dev);
+
+        if (!list_empty(&ac->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&ac->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(ac);
 }
 
 struct ap_card *ap_card_create(int id, int queue_depth, int device_type,
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 480c58a63769..0f1a5d02acb0 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -584,7 +584,14 @@ static struct device_type ap_queue_type = {
 
 static void ap_queue_device_release(struct device *dev)
 {
-        kfree(to_ap_queue(dev));
+        struct ap_queue *aq = to_ap_queue(dev);
+
+        if (!list_empty(&aq->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&aq->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(aq);
 }
 
 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index dba94b486f05..fa732bd86729 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -1954,7 +1954,6 @@ static void netiucv_free_netdevice(struct net_device *dev)
                 privptr->conn = NULL; privptr->fsm = NULL;
                 /* privptr gets freed by free_netdev() */
         }
-        free_netdev(dev);
 }
 
 /**
@@ -1972,7 +1971,8 @@ static void netiucv_setup_netdevice(struct net_device *dev)
         dev->mtu                 = NETIUCV_MTU_DEFAULT;
         dev->min_mtu             = 576;
         dev->max_mtu             = NETIUCV_MTU_MAX;
-        dev->destructor          = netiucv_free_netdevice;
+        dev->needs_free_netdev   = true;
+        dev->priv_destructor     = netiucv_free_netdevice;
         dev->hard_header_len     = NETIUCV_HDRLEN;
         dev->addr_len            = 0;
         dev->type                = ARPHRD_SLIP;
diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
index 4fc8ed5fe067..1f424e40afdf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc.h
+++ b/drivers/scsi/bnx2fc/bnx2fc.h
@@ -191,6 +191,7 @@ struct bnx2fc_hba {
         struct bnx2fc_cmd_mgr *cmd_mgr;
         spinlock_t hba_lock;
         struct mutex hba_mutex;
+        struct mutex hba_stats_mutex;
         unsigned long adapter_state;
                 #define ADAPTER_STATE_UP                0
                 #define ADAPTER_STATE_GOING_DOWN        1
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 93b5a0012417..902722dc4ce3 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -663,15 +663,17 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
         if (!fw_stats)
                 return NULL;
 
+        mutex_lock(&hba->hba_stats_mutex);
+
         bnx2fc_stats = fc_get_host_stats(shost);
 
         init_completion(&hba->stat_req_done);
         if (bnx2fc_send_stat_req(hba))
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ));
         if (!rc) {
                 BNX2FC_HBA_DBG(lport, "FW stat req timed out\n");
-                return bnx2fc_stats;
+                goto unlock_stats_mutex;
         }
         BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt);
         bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt;
@@ -693,6 +695,9 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
 
         memcpy(&hba->prev_stats, hba->stats_buffer,
                sizeof(struct fcoe_statistics_params));
+
+unlock_stats_mutex:
+        mutex_unlock(&hba->hba_stats_mutex);
         return bnx2fc_stats;
 }
 
@@ -1340,6 +1345,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic)
         }
         spin_lock_init(&hba->hba_lock);
         mutex_init(&hba->hba_mutex);
+        mutex_init(&hba->hba_stats_mutex);
 
         hba->cnic = cnic;
 
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 622bdabc8894..dab195f04da7 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
                 goto bye;
         }
 
-        mempool_free(mbp, hw->mb_mempool);
         if (finicsum != cfcsum) {
                 csio_warn(hw,
                       "Config File checksum mismatch: csum=%#x, computed=%#x\n",
@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
         rv = csio_hw_validate_caps(hw, mbp);
         if (rv != 0)
                 goto bye;
+
+        mempool_free(mbp, hw->mb_mempool);
+        mbp = NULL;
+
         /*
          * Note that we're operating with parameters
          * not supplied by the driver, rather than from hard-wired
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 1076c1578322..0aae094ab91c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1595,7 +1595,6 @@ static void release_offload_resources(struct cxgbi_sock *csk)
                 cxgbi_sock_put(csk);
         }
         csk->dst = NULL;
-        csk->cdev = NULL;
 }
 
 static int init_act_open(struct cxgbi_sock *csk)
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index bd7d39ecbd24..e4c83b7c96a8 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -867,7 +867,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         log_debug(1 << CXGBI_DBG_SOCK, "csk 0x%p,%u,0x%lx,%u.\n",
                 csk, (csk)->state, (csk)->flags, (csk)->tid);
         spin_lock_bh(&csk->lock);
-        dst_confirm(csk->dst);
+        if (csk->dst)
+                dst_confirm(csk->dst);
         data_lost = skb_queue_len(&csk->receive_queue);
         __skb_queue_purge(&csk->receive_queue);
 
@@ -882,7 +883,8 @@ static void need_active_close(struct cxgbi_sock *csk)
         }
 
         if (close_req) {
-                if (data_lost)
+                if (!cxgbi_sock_flag(csk, CTPF_LOGOUT_RSP_RCVD) ||
+                    data_lost)
                         csk->cdev->csk_send_abort_req(csk);
                 else
                         csk->cdev->csk_send_close_req(csk);
@@ -1186,9 +1188,10 @@ static int cxgbi_sock_send_pdus(struct cxgbi_sock *csk, struct sk_buff *skb)
                                 cxgbi_ulp_extra_len(cxgbi_skcb_ulp_mode(skb));
                 skb = next;
         }
-done:
+
         if (likely(skb_queue_len(&csk->write_queue)))
                 cdev->csk_push_tx_frames(csk, 1);
+done:
         spin_unlock_bh(&csk->lock);
         return copied;
 
@@ -1568,9 +1571,12 @@ static inline int read_pdu_skb(struct iscsi_conn *conn,
         }
 }
 
-static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
+static int
+skb_read_pdu_bhs(struct cxgbi_sock *csk, struct iscsi_conn *conn,
+                 struct sk_buff *skb)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+        int err;
 
         log_debug(1 << CXGBI_DBG_PDU_RX,
                 "conn 0x%p, skb 0x%p, len %u, flag 0x%lx.\n",
@@ -1608,7 +1614,16 @@ static int skb_read_pdu_bhs(struct iscsi_conn *conn, struct sk_buff *skb)
                 }
         }
 
-        return read_pdu_skb(conn, skb, 0, 0);
+        err = read_pdu_skb(conn, skb, 0, 0);
+        if (likely(err >= 0)) {
+                struct iscsi_hdr *hdr = (struct iscsi_hdr *)skb->data;
+                u8 opcode = hdr->opcode & ISCSI_OPCODE_MASK;
+
+                if (unlikely(opcode == ISCSI_OP_LOGOUT_RSP))
+                        cxgbi_sock_set_flag(csk, CTPF_LOGOUT_RSP_RCVD);
+        }
+
+        return err;
 }
 
 static int skb_read_pdu_data(struct iscsi_conn *conn, struct sk_buff *lskb,
@@ -1713,7 +1728,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                         cxgbi_skcb_rx_pdulen(skb));
 
                 if (cxgbi_skcb_test_flag(skb, SKCBF_RX_COALESCED)) {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("coalesced bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1731,7 +1746,7 @@ void cxgbi_conn_pdu_ready(struct cxgbi_sock *csk)
                                         cxgbi_skcb_flags(skb),
                                         cxgbi_skcb_rx_pdulen(skb));
                 } else {
-                        err = skb_read_pdu_bhs(conn, skb);
+                        err = skb_read_pdu_bhs(csk, conn, skb);
                         if (err < 0) {
                                 pr_err("bhs, csk 0x%p, skb 0x%p,%u, "
                                         "f 0x%lx, plen %u.\n",
@@ -1873,6 +1888,11 @@ int cxgbi_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
         tcp_task->dd_data = tdata;
         task->hdr = NULL;
 
+        if (tdata->skb) {
+                kfree_skb(tdata->skb);
+                tdata->skb = NULL;
+        }
+
         if (SKB_MAX_HEAD(cdev->skb_tx_rsvd) > (512 * MAX_SKB_FRAGS) &&
             (opcode == ISCSI_OP_SCSI_DATA_OUT ||
              (opcode == ISCSI_OP_SCSI_CMD &&
@@ -1890,6 +1910,7 @@ int cxgbi_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
                 return -ENOMEM;
         }
 
+        skb_get(tdata->skb);
         skb_reserve(tdata->skb, cdev->skb_tx_rsvd);
         task->hdr = (struct iscsi_hdr *)tdata->skb->data;
         task->hdr_max = SKB_TX_ISCSI_PDU_HEADER_MAX; /* BHS + AHS */
@@ -2035,9 +2056,9 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
         unsigned int datalen;
         int err;
 
-        if (!skb) {
+        if (!skb || cxgbi_skcb_test_flag(skb, SKCBF_TX_DONE)) {
                 log_debug(1 << CXGBI_DBG_ISCSI | 1 << CXGBI_DBG_PDU_TX,
-                        "task 0x%p, skb NULL.\n", task);
+                        "task 0x%p, skb 0x%p\n", task, skb);
                 return 0;
         }
 
@@ -2050,7 +2071,6 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
         }
 
         datalen = skb->data_len;
-        tdata->skb = NULL;
 
         /* write ppod first if using ofldq to write ppod */
         if (ttinfo->flags & CXGBI_PPOD_INFO_FLAG_VALID) {
@@ -2078,6 +2098,7 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                         pdulen += ISCSI_DIGEST_SIZE;
 
                 task->conn->txdata_octets += pdulen;
+                cxgbi_skcb_set_flag(skb, SKCBF_TX_DONE);
                 return 0;
         }
 
@@ -2086,7 +2107,6 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                         "task 0x%p, skb 0x%p, len %u/%u, %d EAGAIN.\n",
                         task, skb, skb->len, skb->data_len, err);
                 /* reset skb to send when we are called again */
-                tdata->skb = skb;
                 return err;
         }
 
@@ -2094,7 +2114,8 @@ int cxgbi_conn_xmit_pdu(struct iscsi_task *task)
                 "itt 0x%x, skb 0x%p, len %u/%u, xmit err %d.\n",
                 task->itt, skb, skb->len, skb->data_len, err);
 
-        kfree_skb(skb);
+        __kfree_skb(tdata->skb);
+        tdata->skb = NULL;
 
         iscsi_conn_printk(KERN_ERR, task->conn, "xmit err %d.\n", err);
         iscsi_conn_failure(task->conn, ISCSI_ERR_XMIT_FAILED);
@@ -2113,8 +2134,10 @@ void cxgbi_cleanup_task(struct iscsi_task *task)
 
         tcp_task->dd_data = NULL;
         /*  never reached the xmit task callout */
-        if (tdata->skb)
-                __kfree_skb(tdata->skb);
+        if (tdata->skb) {
+                kfree_skb(tdata->skb);
+                tdata->skb = NULL;
+        }
 
         task_release_itt(task, task->hdr_itt);
         memset(tdata, 0, sizeof(*tdata));
@@ -2714,6 +2737,9 @@ EXPORT_SYMBOL_GPL(cxgbi_attr_is_visible);
 static int __init libcxgbi_init_module(void)
 {
         pr_info("%s", version);
+
+        BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, cb) <
+                     sizeof(struct cxgbi_skb_cb));
         return 0;
 }
 
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 18e0ea83d361..37f07aaab1e4 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -187,6 +187,7 @@ enum cxgbi_sock_flags {
         CTPF_HAS_ATID,          /* reserved atid */
         CTPF_HAS_TID,           /* reserved hw tid */
         CTPF_OFFLOAD_DOWN,      /* offload function off */
+        CTPF_LOGOUT_RSP_RCVD,   /* received logout response */
 };
 
 struct cxgbi_skb_rx_cb {
@@ -195,7 +196,8 @@ struct cxgbi_skb_rx_cb {
 };
 
 struct cxgbi_skb_tx_cb {
-        void *l2t;
+        void *handle;
+        void *arp_err_handler;
         struct sk_buff *wr_next;
 };
 
@@ -203,6 +205,7 @@ enum cxgbi_skcb_flags {
         SKCBF_TX_NEED_HDR,      /* packet needs a header */
         SKCBF_TX_MEM_WRITE,     /* memory write */
         SKCBF_TX_FLAG_COMPL,    /* wr completion flag */
+        SKCBF_TX_DONE,          /* skb tx done */
         SKCBF_RX_COALESCED,     /* received whole pdu */
         SKCBF_RX_HDR,           /* received pdu header */
         SKCBF_RX_DATA,          /* received pdu payload */
@@ -215,13 +218,13 @@ enum cxgbi_skcb_flags {
 };
 
 struct cxgbi_skb_cb {
-        unsigned char ulp_mode;
-        unsigned long flags;
-        unsigned int seq;
         union {
                 struct cxgbi_skb_rx_cb rx;
                 struct cxgbi_skb_tx_cb tx;
         };
+        unsigned char ulp_mode;
+        unsigned long flags;
+        unsigned int seq;
 };
 
 #define CXGBI_SKB_CB(skb)       ((struct cxgbi_skb_cb *)&((skb)->cb[0]))
@@ -374,11 +377,9 @@ static inline void cxgbi_sock_enqueue_wr(struct cxgbi_sock *csk,
         cxgbi_skcb_tx_wr_next(skb) = NULL;
         /*
          * We want to take an extra reference since both us and the driver
-         * need to free the packet before it's really freed. We know there's
-         * just one user currently so we use atomic_set rather than skb_get
-         * to avoid the atomic op.
+         * need to free the packet before it's really freed.
          */
-        atomic_set(&skb->users, 2);
+        skb_get(skb);
 
         if (!csk->wr_pending_head)
                 csk->wr_pending_head = skb;
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 3cbab8710e58..2ceff585f189 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -265,18 +265,16 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
                                       struct list_head *list,
                                       unsigned char *cdb)
 {
-        struct scsi_device *sdev = ctlr->ms_sdev;
-        struct rdac_dh_data *h = sdev->handler_data;
         struct rdac_mode_common *common;
         unsigned data_size;
         struct rdac_queue_data *qdata;
         u8 *lun_table;
 
-        if (h->ctlr->use_ms10) {
+        if (ctlr->use_ms10) {
                 struct rdac_pg_expanded *rdac_pg;
 
                 data_size = sizeof(struct rdac_pg_expanded);
-                rdac_pg = &h->ctlr->mode_select.expanded;
+                rdac_pg = &ctlr->mode_select.expanded;
                 memset(rdac_pg, 0, data_size);
                 common = &rdac_pg->common;
                 rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER + 0x40;
@@ -288,7 +286,7 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
                 struct rdac_pg_legacy *rdac_pg;
 
                 data_size = sizeof(struct rdac_pg_legacy);
-                rdac_pg = &h->ctlr->mode_select.legacy;
+                rdac_pg = &ctlr->mode_select.legacy;
                 memset(rdac_pg, 0, data_size);
                 common = &rdac_pg->common;
                 rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER;
@@ -304,7 +302,7 @@ static unsigned int rdac_failover_get(struct rdac_controller *ctlr,
         }
 
         /* Prepare the command. */
-        if (h->ctlr->use_ms10) {
+        if (ctlr->use_ms10) {
                 cdb[0] = MODE_SELECT_10;
                 cdb[7] = data_size >> 8;
                 cdb[8] = data_size & 0xff;
diff --git a/drivers/scsi/dpt/dpti_i2o.h b/drivers/scsi/dpt/dpti_i2o.h
index bd9e31e16249..16fc380b5512 100644
--- a/drivers/scsi/dpt/dpti_i2o.h
+++ b/drivers/scsi/dpt/dpti_i2o.h
@@ -48,7 +48,7 @@
 #include <linux/wait.h>
 typedef wait_queue_head_t adpt_wait_queue_head_t;
 #define ADPT_DECLARE_WAIT_QUEUE_HEAD(wait) DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait)
-typedef wait_queue_t adpt_wait_queue_t;
+typedef wait_queue_entry_t adpt_wait_queue_entry_t;
 
 /*
  * message structures
diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
index d390325c99ec..abf6026645dd 100644
--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
@@ -1170,6 +1170,8 @@ static struct ibmvscsis_cmd *ibmvscsis_get_free_cmd(struct scsi_info *vscsi)
                 cmd = list_first_entry_or_null(&vscsi->free_cmd,
                                                struct ibmvscsis_cmd, list);
                 if (cmd) {
+                        if (cmd->abort_cmd)
+                                cmd->abort_cmd = NULL;
                         cmd->flags &= ~(DELAY_SEND);
                         list_del(&cmd->list);
                         cmd->iue = iue;
@@ -1774,6 +1776,7 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
                                 if (cmd->abort_cmd) {
                                         retry = true;
                                         cmd->abort_cmd->flags &= ~(DELAY_SEND);
+                                        cmd->abort_cmd = NULL;
                                 }
 
                                 /*
@@ -1788,6 +1791,25 @@ static void ibmvscsis_send_messages(struct scsi_info *vscsi)
                                         list_del(&cmd->list);
                                         ibmvscsis_free_cmd_resources(vscsi,
                                                                      cmd);
+                                        /*
+                                         * With a successfully aborted op
+                                         * through LIO we want to increment the
+                                         * the vscsi credit so that when we dont
+                                         * send a rsp to the original scsi abort
+                                         * op (h_send_crq), but the tm rsp to
+                                         * the abort is sent, the credit is
+                                         * correctly sent with the abort tm rsp.
+                                         * We would need 1 for the abort tm rsp
+                                         * and 1 credit for the aborted scsi op.
+                                         * Thus we need to increment here.
+                                         * Also we want to increment the credit
+                                         * here because we want to make sure
+                                         * cmd is actually released first
+                                         * otherwise the client will think it
+                                         * it can send a new cmd, and we could
+                                         * find ourselves short of cmd elements.
+                                         */
+                                        vscsi->credit += 1;
                                 } else {
                                         iue = cmd->iue;
 
@@ -2962,10 +2984,7 @@ static long srp_build_response(struct scsi_info *vscsi,
 
         rsp->opcode = SRP_RSP;
 
-        if (vscsi->credit > 0 && vscsi->state == SRP_PROCESSING)
-                rsp->req_lim_delta = cpu_to_be32(vscsi->credit);
-        else
-                rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
+        rsp->req_lim_delta = cpu_to_be32(1 + vscsi->credit);
         rsp->tag = cmd->rsp.tag;
         rsp->flags = 0;
 
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 3419e1bcdff6..67621308eb9c 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -301,13 +301,13 @@ static uint32_t ips_statupd_copperhead_memio(ips_ha_t *);
 static uint32_t ips_statupd_morpheus(ips_ha_t *);
 static ips_scb_t *ips_getscb(ips_ha_t *);
 static void ips_putq_scb_head(ips_scb_queue_t *, ips_scb_t *);
-static void ips_putq_wait_tail(ips_wait_queue_t *, struct scsi_cmnd *);
+static void ips_putq_wait_tail(ips_wait_queue_entry_t *, struct scsi_cmnd *);
 static void ips_putq_copp_tail(ips_copp_queue_t *,
                                       ips_copp_wait_item_t *);
 static ips_scb_t *ips_removeq_scb_head(ips_scb_queue_t *);
 static ips_scb_t *ips_removeq_scb(ips_scb_queue_t *, ips_scb_t *);
-static struct scsi_cmnd *ips_removeq_wait_head(ips_wait_queue_t *);
-static struct scsi_cmnd *ips_removeq_wait(ips_wait_queue_t *,
+static struct scsi_cmnd *ips_removeq_wait_head(ips_wait_queue_entry_t *);
+static struct scsi_cmnd *ips_removeq_wait(ips_wait_queue_entry_t *,
                                           struct scsi_cmnd *);
 static ips_copp_wait_item_t *ips_removeq_copp(ips_copp_queue_t *,
                                                      ips_copp_wait_item_t *);
@@ -2871,7 +2871,7 @@ ips_removeq_scb(ips_scb_queue_t * queue, ips_scb_t * item)
 /* ASSUMED to be called from within the HA lock                             */
 /*                                                                          */
 /****************************************************************************/
-static void ips_putq_wait_tail(ips_wait_queue_t *queue, struct scsi_cmnd *item)
+static void ips_putq_wait_tail(ips_wait_queue_entry_t *queue, struct scsi_cmnd *item)
 {
         METHOD_TRACE("ips_putq_wait_tail", 1);
 
@@ -2902,7 +2902,7 @@ static void ips_putq_wait_tail(ips_wait_queue_t *queue, struct scsi_cmnd *item)
 /* ASSUMED to be called from within the HA lock                             */
 /*                                                                          */
 /****************************************************************************/
-static struct scsi_cmnd *ips_removeq_wait_head(ips_wait_queue_t *queue)
+static struct scsi_cmnd *ips_removeq_wait_head(ips_wait_queue_entry_t *queue)
 {
         struct scsi_cmnd *item;
 
@@ -2936,7 +2936,7 @@ static struct scsi_cmnd *ips_removeq_wait_head(ips_wait_queue_t *queue)
 /* ASSUMED to be called from within the HA lock                             */
 /*                                                                          */
 /****************************************************************************/
-static struct scsi_cmnd *ips_removeq_wait(ips_wait_queue_t *queue,
+static struct scsi_cmnd *ips_removeq_wait(ips_wait_queue_entry_t *queue,
                                           struct scsi_cmnd *item)
 {
         struct scsi_cmnd *p;
diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
index b782bb60baf0..366be3b2f9b4 100644
--- a/drivers/scsi/ips.h
+++ b/drivers/scsi/ips.h
@@ -989,7 +989,7 @@ typedef struct ips_wait_queue {
         struct scsi_cmnd *head;
         struct scsi_cmnd *tail;
         int count;
-} ips_wait_queue_t;
+} ips_wait_queue_entry_t;
 
 typedef struct ips_copp_wait_item {
         struct scsi_cmnd *scsi_cmd;
@@ -1035,7 +1035,7 @@ typedef struct ips_ha {
    ips_stat_t         sp;                 /* Status packer pointer      */
    struct ips_scb    *scbs;               /* Array of all CCBS          */
    struct ips_scb    *scb_freelist;       /* SCB free list              */
-   ips_wait_queue_t   scb_waitlist;       /* Pending SCB list           */
+   ips_wait_queue_entry_t   scb_waitlist;       /* Pending SCB list           */
    ips_copp_queue_t   copp_waitlist;      /* Pending PT list            */
    ips_scb_queue_t    scb_activelist;     /* Active SCB list            */
    IPS_IO_CMD        *dummy;              /* dummy command              */
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index b44c3136eb51..520325867e2b 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -1422,7 +1422,7 @@ static void fc_rport_recv_rtv_req(struct fc_rport_priv *rdata,
         fp = fc_frame_alloc(lport, sizeof(*rtv));
         if (!fp) {
                 rjt_data.reason = ELS_RJT_UNAB;
-                rjt_data.reason = ELS_EXPL_INSUF_RES;
+                rjt_data.explan = ELS_EXPL_INSUF_RES;
                 fc_seq_els_rsp_send(in_fp, ELS_LS_RJT, &rjt_data);
                 goto drop;
         }
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 6d7840b096e6..f2c0ba6ced78 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -141,6 +141,13 @@ struct lpfc_dmabuf {
         uint32_t   buffer_tag;  /* used for tagged queue ring */
 };
 
+struct lpfc_nvmet_ctxbuf {
+        struct list_head list;
+        struct lpfc_nvmet_rcv_ctx *context;
+        struct lpfc_iocbq *iocbq;
+        struct lpfc_sglq *sglq;
+};
+
 struct lpfc_dma_pool {
         struct lpfc_dmabuf   *elements;
         uint32_t    max_count;
@@ -163,9 +170,7 @@ struct rqb_dmabuf {
         struct lpfc_dmabuf dbuf;
         uint16_t total_size;
         uint16_t bytes_recv;
-        void *context;
-        struct lpfc_iocbq *iocbq;
-        struct lpfc_sglq *sglq;
+        uint16_t idx;
         struct lpfc_queue *hrq;   /* ptr to associated Header RQ */
         struct lpfc_queue *drq;   /* ptr to associated Data RQ */
 };
@@ -670,6 +675,8 @@ struct lpfc_hba {
                                         /* INIT_LINK mailbox command */
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
+#define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
+#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
@@ -777,7 +784,6 @@ struct lpfc_hba {
         uint32_t cfg_nvme_oas;
         uint32_t cfg_nvme_io_channel;
         uint32_t cfg_nvmet_mrq;
-        uint32_t cfg_nvmet_mrq_post;
         uint32_t cfg_enable_nvmet;
         uint32_t cfg_nvme_enable_fb;
         uint32_t cfg_nvmet_fb_size;
@@ -943,6 +949,7 @@ struct lpfc_hba {
         struct pci_pool *lpfc_mbuf_pool;
         struct pci_pool *lpfc_hrb_pool; /* header receive buffer pool */
         struct pci_pool *lpfc_drb_pool; /* data receive buffer pool */
+        struct pci_pool *lpfc_nvmet_drb_pool; /* data receive buffer pool */
         struct pci_pool *lpfc_hbq_pool; /* SLI3 hbq buffer pool */
         struct pci_pool *txrdy_payload_pool;
         struct lpfc_dma_pool lpfc_mbuf_safety_pool;
@@ -1228,7 +1235,11 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
 static inline struct lpfc_sli_ring *
 lpfc_phba_elsring(struct lpfc_hba *phba)
 {
-        if (phba->sli_rev == LPFC_SLI_REV4)
-                return phba->sli4_hba.els_wq->pring;
+        if (phba->sli_rev == LPFC_SLI_REV4) {
+                if (phba->sli4_hba.els_wq)
+                        return phba->sli4_hba.els_wq->pring;
+                else
+                        return NULL;
+        }
         return &phba->sli.sli3_ring[LPFC_ELS_RING];
 }
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4830370bfab1..bb2d9e238225 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -60,9 +60,9 @@
 #define LPFC_MIN_DEVLOSS_TMO    1
 #define LPFC_MAX_DEVLOSS_TMO    255
 
-#define LPFC_DEF_MRQ_POST       256
-#define LPFC_MIN_MRQ_POST       32
-#define LPFC_MAX_MRQ_POST       512
+#define LPFC_DEF_MRQ_POST       512
+#define LPFC_MIN_MRQ_POST       512
+#define LPFC_MAX_MRQ_POST       2048
 
 /*
  * Write key size should be multiple of 4. If write key is changed
@@ -205,8 +205,9 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Release %08x Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
                 if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
@@ -218,15 +219,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                 }
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x\n",
+                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x "
+                                "drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_read),
                                 atomic_read(&tgtp->xmt_fcp_read_rsp),
                                 atomic_read(&tgtp->xmt_fcp_write),
-                                atomic_read(&tgtp->xmt_fcp_rsp));
-
-                len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_rsp),
                                 atomic_read(&tgtp->xmt_fcp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
@@ -236,10 +234,22 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "IO_CTX: %08x outstanding %08x total %x",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
 
                 len +=  snprintf(buf+len, PAGE_SIZE-len, "\n");
                 return len;
@@ -3312,14 +3322,6 @@ LPFC_ATTR_R(nvmet_mrq,
             "Specify number of RQ pairs for processing NVMET cmds");
 
 /*
- * lpfc_nvmet_mrq_post: Specify number buffers to post on every MRQ
- *
- */
-LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
-            LPFC_MIN_MRQ_POST, LPFC_MAX_MRQ_POST,
-            "Specify number of buffers to post on every MRQ");
-
-/*
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
@@ -5154,7 +5156,6 @@ struct device_attribute *lpfc_hba_attrs[] = {
         &dev_attr_lpfc_suppress_rsp,
         &dev_attr_lpfc_nvme_io_channel,
         &dev_attr_lpfc_nvmet_mrq,
-        &dev_attr_lpfc_nvmet_mrq_post,
         &dev_attr_lpfc_nvme_enable_fb,
         &dev_attr_lpfc_nvmet_fb_size,
         &dev_attr_lpfc_enable_bg,
@@ -6194,7 +6195,6 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
 
         lpfc_enable_fc4_type_init(phba, lpfc_enable_fc4_type);
         lpfc_nvmet_mrq_init(phba, lpfc_nvmet_mrq);
-        lpfc_nvmet_mrq_post_init(phba, lpfc_nvmet_mrq_post);
 
         /* Initialize first burst. Target vs Initiator are different. */
         lpfc_nvme_enable_fb_init(phba, lpfc_nvme_enable_fb);
@@ -6291,7 +6291,6 @@ lpfc_nvme_mod_param_dep(struct lpfc_hba *phba)
                 /* Not NVME Target mode.  Turn off Target parameters. */
                 phba->nvmet_support = 0;
                 phba->cfg_nvmet_mrq = 0;
-                phba->cfg_nvmet_mrq_post = 0;
                 phba->cfg_nvmet_fb_size = 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 1c55408ac718..da669dce12fe 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -75,6 +75,10 @@ void lpfc_init_vpi_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_cancel_all_vport_retry_delay_timer(struct lpfc_hba *);
 void lpfc_retry_pport_discovery(struct lpfc_hba *);
 void lpfc_release_rpi(struct lpfc_hba *, struct lpfc_vport *, uint16_t);
+int lpfc_init_iocb_list(struct lpfc_hba *phba, int cnt);
+void lpfc_free_iocb_list(struct lpfc_hba *phba);
+int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                        struct lpfc_queue *drq, int count, int idx);
 
 void lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_mbx_cmpl_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *);
@@ -123,7 +127,7 @@ int lpfc_disc_state_machine(struct lpfc_vport *, struct lpfc_nodelist *, void *,
 void lpfc_do_scr_ns_plogi(struct lpfc_hba *, struct lpfc_vport *);
 int lpfc_check_sparm(struct lpfc_vport *, struct lpfc_nodelist *,
                      struct serv_parm *, uint32_t, int);
-int lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
+void lpfc_els_abort(struct lpfc_hba *, struct lpfc_nodelist *);
 void lpfc_more_plogi(struct lpfc_vport *);
 void lpfc_more_adisc(struct lpfc_vport *);
 void lpfc_end_rscn(struct lpfc_vport *);
@@ -246,16 +250,14 @@ struct hbq_dmabuf *lpfc_sli4_rb_alloc(struct lpfc_hba *);
 void lpfc_sli4_rb_free(struct lpfc_hba *, struct hbq_dmabuf *);
 struct rqb_dmabuf *lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba);
 void lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab);
-void lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                        struct lpfc_dmabuf *mp);
+void lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba,
+                            struct lpfc_nvmet_ctxbuf *ctxp);
 int lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
                                struct fc_frame_header *fc_hdr);
 void lpfc_sli4_build_dflt_fcf_record(struct lpfc_hba *, struct fcf_record *,
                         uint16_t);
 int lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
                      struct lpfc_rqe *hrqe, struct lpfc_rqe *drqe);
-int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq,
-                        struct lpfc_queue *dq, int count);
 int lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq);
 void lpfc_unregister_fcf(struct lpfc_hba *);
 void lpfc_unregister_fcf_rescan(struct lpfc_hba *);
@@ -271,6 +273,7 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *, uint16_t);
 void lpfc_sli4_clear_fcf_rr_bmask(struct lpfc_hba *);
 
 int lpfc_mem_alloc(struct lpfc_hba *, int align);
+int lpfc_nvmet_mem_alloc(struct lpfc_hba *phba);
 int lpfc_mem_alloc_active_rrq_pool_s4(struct lpfc_hba *);
 void lpfc_mem_free(struct lpfc_hba *);
 void lpfc_mem_free_all(struct lpfc_hba *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index c7962dae4dab..24ce96dcc94d 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -978,9 +978,10 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                                          ndlp, did, ndlp->nlp_fc4_type,
                                          FC_TYPE_FCP, FC_TYPE_NVME);
                         ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
+
+                        lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
+                        lpfc_issue_els_prli(vport, ndlp, 0);
                 }
-                lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
-                lpfc_issue_els_prli(vport, ndlp, 0);
         } else
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_DISCOVERY,
                                  "3065 GFT_ID failed x%08x\n", irsp->ulpStatus);
@@ -2092,6 +2093,7 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
 
         ae->un.AttrTypes[3] = 0x02; /* Type 1 - ELS */
         ae->un.AttrTypes[2] = 0x01; /* Type 8 - FCP */
+        ae->un.AttrTypes[6] = 0x01; /* Type 40 - NVME */
         ae->un.AttrTypes[7] = 0x01; /* Type 32 - CT */
         size = FOURBYTES + 32;
         ad->AttrLen = cpu_to_be16(size);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index fce549a91911..4bcb92c844ca 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -798,21 +798,22 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                 atomic_read(&tgtp->xmt_fcp_rsp));
 
                 len += snprintf(buf + len, size - len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
-                                atomic_read(&tgtp->xmt_fcp_drop));
-
-                len += snprintf(buf + len, size - len,
                                 "FCP Rsp Cmpl: %08x err %08x drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_rsp_cmpl),
                                 atomic_read(&tgtp->xmt_fcp_rsp_error),
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf + len, size - len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, size - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
 
                 len +=  snprintf(buf + len, size - len, "\n");
 
@@ -841,6 +842,12 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                         }
                         spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 }
+
+                len += snprintf(buf + len, size - len,
+                                "IO_CTX: %08x  outstanding %08x total %08x\n",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
         } else {
                 if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME))
                         return len;
@@ -1959,6 +1966,7 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -1967,19 +1975,22 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
 
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return nbytes;
 }
@@ -3070,11 +3081,11 @@ __lpfc_idiag_print_wq(struct lpfc_queue *qp, char *wqtype,
                         qp->assoc_qid, qp->q_cnt_1,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len,
                         LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
         return len;
@@ -3121,11 +3132,11 @@ __lpfc_idiag_print_cq(struct lpfc_queue *qp, char *cqtype,
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\tCQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\tCQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
 
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
@@ -3143,20 +3154,20 @@ __lpfc_idiag_print_rqpair(struct lpfc_queue *qp, struct lpfc_queue *datqp,
                         "\t\t%s RQ info: ", rqtype);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
                         "AssocCQID[%02d]: RQ-STAT[nopost:x%x nobuf:x%x "
-                        "trunc:x%x rcv:x%llx]\n",
+                        "posted:x%x rcv:x%llx]\n",
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         datqp->queue_id, datqp->entry_count,
                         datqp->entry_size, datqp->host_index,
-                        datqp->hba_index);
+                        datqp->hba_index, datqp->entry_repost);
         return len;
 }
 
@@ -3242,10 +3253,10 @@ __lpfc_idiag_print_eq(struct lpfc_queue *qp, char *eqtype,
                         eqtype, qp->q_cnt_1, qp->q_cnt_2, qp->q_cnt_3,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "EQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "EQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
         return len;
@@ -5855,8 +5866,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport)
                         atomic_dec(&lpfc_debugfs_hba_count);
                 }
 
-                debugfs_remove(lpfc_debugfs_root); /* lpfc */
-                lpfc_debugfs_root = NULL;
+                if (atomic_read(&lpfc_debugfs_hba_count) == 0) {
+                        debugfs_remove(lpfc_debugfs_root); /* lpfc */
+                        lpfc_debugfs_root = NULL;
+                }
         }
 #endif
         return;
diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index 9d5a379f4b15..094c97b9e5f7 100644
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -90,6 +90,7 @@ struct lpfc_nodelist {
 #define NLP_FCP_INITIATOR  0x10                 /* entry is an FCP Initiator */
 #define NLP_NVME_TARGET    0x20                 /* entry is a NVME Target */
 #define NLP_NVME_INITIATOR 0x40                 /* entry is a NVME Initiator */
+#define NLP_NVME_DISCOVERY 0x80                 /* entry has NVME disc srvc */
 
         uint16_t        nlp_fc4_type;           /* FC types node supports. */
                                                 /* Assigned from GID_FF, only
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 67827e397431..8e532b39ae93 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1047,6 +1047,13 @@ stop_rr_fcf_flogi:
                                  irsp->ulpStatus, irsp->un.ulpWord[4],
                                  irsp->ulpTimeout);
 
+
+                /* If this is not a loop open failure, bail out */
+                if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT &&
+                      ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) ==
+                                        IOERR_LOOP_OPEN_FAILURE)))
+                        goto flogifail;
+
                 /* FLOGI failed, so there is no fabric */
                 spin_lock_irq(shost->host_lock);
                 vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP);
@@ -2077,16 +2084,19 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 
         if (irsp->ulpStatus) {
                 /* Check for retry */
+                ndlp->fc4_prli_sent--;
                 if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
                         /* ELS command is being retried */
-                        ndlp->fc4_prli_sent--;
                         goto out;
                 }
+
                 /* PRLI failed */
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
-                                 "2754 PRLI failure DID:%06X Status:x%x/x%x\n",
+                                 "2754 PRLI failure DID:%06X Status:x%x/x%x, "
+                                 "data: x%x\n",
                                  ndlp->nlp_DID, irsp->ulpStatus,
-                                 irsp->un.ulpWord[4]);
+                                 irsp->un.ulpWord[4], ndlp->fc4_prli_sent);
+
                 /* Do not call DSM for lpfc_els_abort'ed ELS cmds */
                 if (lpfc_error_lost_link(irsp))
                         goto out;
@@ -7441,6 +7451,13 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)
          */
         spin_lock_irq(&phba->hbalock);
         pring = lpfc_phba_elsring(phba);
+
+        /* Bail out if we've no ELS wq, like in PCI error recovery case. */
+        if (unlikely(!pring)) {
+                spin_unlock_irq(&phba->hbalock);
+                return;
+        }
+
         if (phba->sli_rev == LPFC_SLI_REV4)
                 spin_lock(&pring->ring_lock);
 
@@ -8667,7 +8684,8 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                 lpfc_do_scr_ns_plogi(phba, vport);
         goto out;
 fdisc_failed:
-        if (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS)
+        if (vport->fc_vport &&
+            (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS))
                 lpfc_vport_set_state(vport, FC_VPORT_FAILED);
         /* Cancel discovery timer */
         lpfc_can_disctmo(vport);
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 0482c5580331..3ffcd9215ca8 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -693,15 +693,16 @@ lpfc_work_done(struct lpfc_hba *phba)
         pring = lpfc_phba_elsring(phba);
         status = (ha_copy & (HA_RXMASK  << (4*LPFC_ELS_RING)));
         status >>= (4*LPFC_ELS_RING);
-        if ((status & HA_RXMASK) ||
-            (pring->flag & LPFC_DEFERRED_RING_EVENT) ||
-            (phba->hba_flag & HBA_SP_QUEUE_EVT)) {
+        if (pring && (status & HA_RXMASK ||
+                      pring->flag & LPFC_DEFERRED_RING_EVENT ||
+                      phba->hba_flag & HBA_SP_QUEUE_EVT)) {
                 if (pring->flag & LPFC_STOP_IOCB_EVENT) {
                         pring->flag |= LPFC_DEFERRED_RING_EVENT;
                         /* Set the lpfc data pending flag */
                         set_bit(LPFC_DATA_READY, &phba->data_flags);
                 } else {
-                        if (phba->link_state >= LPFC_LINK_UP) {
+                        if (phba->link_state >= LPFC_LINK_UP ||
+                            phba->link_flag & LS_MDS_LOOPBACK) {
                                 pring->flag &= ~LPFC_DEFERRED_RING_EVENT;
                                 lpfc_sli_handle_slow_ring_event(phba, pring,
                                                                 (status &
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index 1d12f2be36bc..e0a5fce416ae 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -1356,6 +1356,7 @@ struct lpfc_mbx_wq_destroy {
 
 #define LPFC_HDR_BUF_SIZE 128
 #define LPFC_DATA_BUF_SIZE 2048
+#define LPFC_NVMET_DATA_BUF_SIZE 128
 struct rq_context {
         uint32_t word0;
 #define lpfc_rq_context_rqe_count_SHIFT 16      /* Version 0 Only */
@@ -4420,6 +4421,19 @@ struct fcp_treceive64_wqe {
 };
 #define TXRDY_PAYLOAD_LEN      12
 
+#define CMD_SEND_FRAME  0xE1
+
+struct send_frame_wqe {
+        struct ulp_bde64 bde;          /* words 0-2 */
+        uint32_t frame_len;            /* word 3 */
+        uint32_t fc_hdr_wd0;           /* word 4 */
+        uint32_t fc_hdr_wd1;           /* word 5 */
+        struct wqe_common wqe_com;     /* words 6-11 */
+        uint32_t fc_hdr_wd2;           /* word 12 */
+        uint32_t fc_hdr_wd3;           /* word 13 */
+        uint32_t fc_hdr_wd4;           /* word 14 */
+        uint32_t fc_hdr_wd5;           /* word 15 */
+};
 
 union lpfc_wqe {
         uint32_t words[16];
@@ -4438,7 +4452,7 @@ union lpfc_wqe {
         struct fcp_trsp64_wqe fcp_trsp;
         struct fcp_tsend64_wqe fcp_tsend;
         struct fcp_treceive64_wqe fcp_treceive;
-
+        struct send_frame_wqe send_frame;
 };
 
 union lpfc_wqe128 {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 4b1eb98c228d..9add9473cae5 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1099,7 +1099,7 @@ lpfc_hba_down_post_s4(struct lpfc_hba *phba)
 
                 list_for_each_entry_safe(ctxp, ctxp_next, &nvmet_aborts, list) {
                         ctxp->flag &= ~(LPFC_NVMET_XBUSY | LPFC_NVMET_ABORT_OP);
-                        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
                 }
         }
 
@@ -3381,7 +3381,7 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
 {
         struct lpfc_sglq *sglq_entry = NULL, *sglq_entry_next = NULL;
         uint16_t i, lxri, xri_cnt, els_xri_cnt;
-        uint16_t nvmet_xri_cnt, tot_cnt;
+        uint16_t nvmet_xri_cnt;
         LIST_HEAD(nvmet_sgl_list);
         int rc;
 
@@ -3389,15 +3389,9 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
          * update on pci function's nvmet xri-sgl list
          */
         els_xri_cnt = lpfc_sli4_get_els_iocb_cnt(phba);
-        nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-        tot_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
-        if (nvmet_xri_cnt > tot_cnt) {
-                phba->cfg_nvmet_mrq_post = tot_cnt / phba->cfg_nvmet_mrq;
-                nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-                                "6301 NVMET post-sgl count changed to %d\n",
-                                phba->cfg_nvmet_mrq_post);
-        }
+
+        /* For NVMET, ALL remaining XRIs are dedicated for IO processing */
+        nvmet_xri_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
 
         if (nvmet_xri_cnt > phba->sli4_hba.nvmet_xri_cnt) {
                 /* els xri-sgl expanded */
@@ -4546,6 +4540,19 @@ lpfc_sli4_async_fc_evt(struct lpfc_hba *phba, struct lpfc_acqe_fc_la *acqe_fc)
         pmb->vport = phba->pport;
 
         if (phba->sli4_hba.link_state.status != LPFC_FC_LA_TYPE_LINK_UP) {
+                phba->link_flag &= ~(LS_MDS_LINK_DOWN | LS_MDS_LOOPBACK);
+
+                switch (phba->sli4_hba.link_state.status) {
+                case LPFC_FC_LA_TYPE_MDS_LINK_DOWN:
+                        phba->link_flag |= LS_MDS_LINK_DOWN;
+                        break;
+                case LPFC_FC_LA_TYPE_MDS_LOOPBACK:
+                        phba->link_flag |= LS_MDS_LOOPBACK;
+                        break;
+                default:
+                        break;
+                }
+
                 /* Parse and translate status field */
                 mb = &pmb->u.mb;
                 mb->mbxStatus = lpfc_sli4_parse_latt_fault(phba,
@@ -5830,6 +5837,9 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 spin_lock_init(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvme_buf_list);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_io_wait_list);
+
                 /* Fast-path XRI aborted CQ Event work queue list */
                 INIT_LIST_HEAD(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
         }
@@ -5837,6 +5847,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
         /* This abort list used by worker thread */
         spin_lock_init(&phba->sli4_hba.sgl_list_lock);
         spin_lock_init(&phba->sli4_hba.nvmet_io_lock);
+        spin_lock_init(&phba->sli4_hba.nvmet_io_wait_lock);
 
         /*
          * Initialize driver internal slow-path work queues
@@ -5951,16 +5962,21 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
 #if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+                                if (lpfc_nvmet_mem_alloc(phba))
+                                        break;
+
+                                phba->nvmet_support = 1; /* a match */
+
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
-                                phba->nvmet_support = 1; /* a match */
 #else
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6021 Can't enable NVME Target."
                                                 " NVME_TARGET_FC infrastructure"
                                                 " is not in kernel\n");
 #endif
+                                break;
                         }
                 }
         }
@@ -6269,7 +6285,7 @@ lpfc_unset_driver_resource_phase2(struct lpfc_hba *phba)
  *
  * This routine is invoked to free the driver's IOCB list and memory.
  **/
-static void
+void
 lpfc_free_iocb_list(struct lpfc_hba *phba)
 {
         struct lpfc_iocbq *iocbq_entry = NULL, *iocbq_next = NULL;
@@ -6297,7 +6313,7 @@ lpfc_free_iocb_list(struct lpfc_hba *phba)
  *      0 - successful
  *      other values - error
  **/
-static int
+int
 lpfc_init_iocb_list(struct lpfc_hba *phba, int iocb_count)
 {
         struct lpfc_iocbq *iocbq_entry = NULL;
@@ -6525,7 +6541,6 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         uint16_t rpi_limit, curr_rpi_range;
         struct lpfc_dmabuf *dmabuf;
         struct lpfc_rpi_hdr *rpi_hdr;
-        uint32_t rpi_count;
 
         /*
          * If the SLI4 port supports extents, posting the rpi header isn't
@@ -6538,8 +6553,7 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
                 return NULL;
 
         /* The limit on the logical index is just the max_rpi count. */
-        rpi_limit = phba->sli4_hba.max_cfg_param.rpi_base +
-        phba->sli4_hba.max_cfg_param.max_rpi - 1;
+        rpi_limit = phba->sli4_hba.max_cfg_param.max_rpi;
 
         spin_lock_irq(&phba->hbalock);
         /*
@@ -6550,18 +6564,10 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         curr_rpi_range = phba->sli4_hba.next_rpi;
         spin_unlock_irq(&phba->hbalock);
 
-        /*
-         * The port has a limited number of rpis. The increment here
-         * is LPFC_RPI_HDR_COUNT - 1 to account for the starting value
-         * and to allow the full max_rpi range per port.
-         */
-        if ((curr_rpi_range + (LPFC_RPI_HDR_COUNT - 1)) > rpi_limit)
-                rpi_count = rpi_limit - curr_rpi_range;
-        else
-                rpi_count = LPFC_RPI_HDR_COUNT;
-
-        if (!rpi_count)
+        /* Reached full RPI range */
+        if (curr_rpi_range == rpi_limit)
                 return NULL;
+
         /*
          * First allocate the protocol header region for the port.  The
          * port expects a 4KB DMA-mapped memory region that is 4K aligned.
@@ -6595,13 +6601,9 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
 
         /* The rpi_hdr stores the logical index only. */
         rpi_hdr->start_rpi = curr_rpi_range;
+        rpi_hdr->next_rpi = phba->sli4_hba.next_rpi + LPFC_RPI_HDR_COUNT;
         list_add_tail(&rpi_hdr->list, &phba->sli4_hba.lpfc_rpi_hdr_list);
 
-        /*
-         * The next_rpi stores the next logical module-64 rpi value used
-         * to post physical rpis in subsequent rpi postings.
-         */
-        phba->sli4_hba.next_rpi += rpi_count;
         spin_unlock_irq(&phba->hbalock);
         return rpi_hdr;
 
@@ -8172,7 +8174,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for header */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3146 Failed allocate "
@@ -8194,7 +8196,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for data */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3156 Failed allocate "
@@ -8326,46 +8328,6 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
 }
 
 int
-lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
-                    struct lpfc_queue *drq, int count)
-{
-        int rc, i;
-        struct lpfc_rqe hrqe;
-        struct lpfc_rqe drqe;
-        struct lpfc_rqb *rqbp;
-        struct rqb_dmabuf *rqb_buffer;
-        LIST_HEAD(rqb_buf_list);
-
-        rqbp = hrq->rqbp;
-        for (i = 0; i < count; i++) {
-                rqb_buffer = (rqbp->rqb_alloc_buffer)(phba);
-                if (!rqb_buffer)
-                        break;
-                rqb_buffer->hrq = hrq;
-                rqb_buffer->drq = drq;
-                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
-        }
-        while (!list_empty(&rqb_buf_list)) {
-                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
-                                 hbuf.list);
-
-                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
-                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
-                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
-                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
-                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
-                if (rc < 0) {
-                        (rqbp->rqb_free_buffer)(phba, rqb_buffer);
-                } else {
-                        list_add_tail(&rqb_buffer->hbuf.list,
-                                      &rqbp->rqb_buffer_list);
-                        rqbp->buffer_count++;
-                }
-        }
-        return 1;
-}
-
-int
 lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *rq)
 {
         struct lpfc_rqb *rqbp;
@@ -8784,9 +8746,6 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
                 goto out_destroy;
         }
 
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.hdr_rq, LPFC_ELS_HBQ);
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.dat_rq, LPFC_ELS_HBQ);
-
         rc = lpfc_rq_create(phba, phba->sli4_hba.hdr_rq, phba->sli4_hba.dat_rq,
                             phba->sli4_hba.els_cq, LPFC_USOL);
         if (rc) {
@@ -11110,7 +11069,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         struct lpfc_hba   *phba;
         struct lpfc_vport *vport = NULL;
         struct Scsi_Host  *shost = NULL;
-        int error, cnt;
+        int error;
         uint32_t cfg_mode, intr_mode;
 
         /* Allocate memory for HBA structure */
@@ -11144,22 +11103,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_unset_pci_mem_s4;
         }
 
-        cnt = phba->cfg_iocb_cnt * 1024;
-        if (phba->nvmet_support)
-                cnt += phba->cfg_nvmet_mrq_post * phba->cfg_nvmet_mrq;
-
-        /* Initialize and populate the iocb list per host */
-        lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
-                        "2821 initialize iocb list %d total %d\n",
-                        phba->cfg_iocb_cnt, cnt);
-        error = lpfc_init_iocb_list(phba, cnt);
-
-        if (error) {
-                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                "1413 Failed to initialize iocb list.\n");
-                goto out_unset_driver_resource_s4;
-        }
-
         INIT_LIST_HEAD(&phba->active_rrq_list);
         INIT_LIST_HEAD(&phba->fcf.fcf_pri_list);
 
@@ -11168,7 +11111,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                 "1414 Failed to set up driver resource.\n");
-                goto out_free_iocb_list;
+                goto out_unset_driver_resource_s4;
         }
 
         /* Get the default values for Model Name and Description */
@@ -11268,8 +11211,6 @@ out_destroy_shost:
         lpfc_destroy_shost(phba);
 out_unset_driver_resource:
         lpfc_unset_driver_resource_phase2(phba);
-out_free_iocb_list:
-        lpfc_free_iocb_list(phba);
 out_unset_driver_resource_s4:
         lpfc_sli4_driver_resource_unset(phba);
 out_unset_pci_mem_s4:
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 5986c7957199..fcc05a1517c2 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -214,6 +214,21 @@ fail_free_drb_pool:
         return -ENOMEM;
 }
 
+int
+lpfc_nvmet_mem_alloc(struct lpfc_hba *phba)
+{
+        phba->lpfc_nvmet_drb_pool =
+                pci_pool_create("lpfc_nvmet_drb_pool",
+                                phba->pcidev, LPFC_NVMET_DATA_BUF_SIZE,
+                                SGL_ALIGN_SZ, 0);
+        if (!phba->lpfc_nvmet_drb_pool) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6024 Can't enable NVME Target - no memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
 /**
  * lpfc_mem_free - Frees memory allocated by lpfc_mem_alloc
  * @phba: HBA to free memory for
@@ -232,6 +247,9 @@ lpfc_mem_free(struct lpfc_hba *phba)
 
         /* Free HBQ pools */
         lpfc_sli_hbqbuf_free_all(phba);
+        if (phba->lpfc_nvmet_drb_pool)
+                pci_pool_destroy(phba->lpfc_nvmet_drb_pool);
+        phba->lpfc_nvmet_drb_pool = NULL;
         if (phba->lpfc_drb_pool)
                 pci_pool_destroy(phba->lpfc_drb_pool);
         phba->lpfc_drb_pool = NULL;
@@ -611,8 +629,6 @@ struct rqb_dmabuf *
 lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 {
         struct rqb_dmabuf *dma_buf;
-        struct lpfc_iocbq *nvmewqe;
-        union lpfc_wqe128 *wqe;
 
         dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
         if (!dma_buf)
@@ -624,69 +640,15 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
-                                            &dma_buf->dbuf.phys);
+        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_nvmet_drb_pool,
+                                            GFP_KERNEL, &dma_buf->dbuf.phys);
         if (!dma_buf->dbuf.virt) {
                 pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
                               dma_buf->hbuf.phys);
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->total_size = LPFC_DATA_BUF_SIZE;
-
-        dma_buf->context = kzalloc(sizeof(struct lpfc_nvmet_rcv_ctx),
-                                   GFP_KERNEL);
-        if (!dma_buf->context) {
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                return NULL;
-        }
-
-        dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
-        if (!dma_buf->iocbq) {
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "2621 Ran out of nvmet iocb/WQEs\n");
-                return NULL;
-        }
-        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
-        nvmewqe = dma_buf->iocbq;
-        wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
-        /* Initialize WQE */
-        memset(wqe, 0, sizeof(union lpfc_wqe));
-        /* Word 7 */
-        bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
-        bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
-        bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
-        /* Word 10 */
-        bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
-        bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
-        bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
-
-        dma_buf->iocbq->context1 = NULL;
-        spin_lock(&phba->sli4_hba.sgl_list_lock);
-        dma_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, dma_buf->iocbq);
-        spin_unlock(&phba->sli4_hba.sgl_list_lock);
-        if (!dma_buf->sglq) {
-                lpfc_sli_release_iocbq(phba, dma_buf->iocbq);
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "6132 Ran out of nvmet XRIs\n");
-                return NULL;
-        }
+        dma_buf->total_size = LPFC_NVMET_DATA_BUF_SIZE;
         return dma_buf;
 }
 
@@ -705,20 +667,9 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 void
 lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab)
 {
-        unsigned long flags;
-
-        __lpfc_clear_active_sglq(phba, dmab->sglq->sli4_lxritag);
-        dmab->sglq->state = SGL_FREED;
-        dmab->sglq->ndlp = NULL;
-
-        spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
-        list_add_tail(&dmab->sglq->list, &phba->sli4_hba.lpfc_nvmet_sgl_list);
-        spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, flags);
-
-        lpfc_sli_release_iocbq(phba, dmab->iocbq);
-        kfree(dmab->context);
         pci_pool_free(phba->lpfc_hrb_pool, dmab->hbuf.virt, dmab->hbuf.phys);
-        pci_pool_free(phba->lpfc_drb_pool, dmab->dbuf.virt, dmab->dbuf.phys);
+        pci_pool_free(phba->lpfc_nvmet_drb_pool,
+                      dmab->dbuf.virt, dmab->dbuf.phys);
         kfree(dmab);
 }
 
@@ -803,6 +754,11 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
         rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
         if (rc < 0) {
                 (rqbp->rqb_free_buffer)(phba, rqb_entry);
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6409 Cannot post to RQ %d: %x %x\n",
+                                rqb_entry->hrq->queue_id,
+                                rqb_entry->hrq->host_index,
+                                rqb_entry->hrq->hba_index);
         } else {
                 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                 rqbp->buffer_count++;
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8777c2d5f50d..f74cb0142fd4 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -206,7 +206,7 @@ lpfc_check_elscmpl_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
  * associated with a LPFC_NODELIST entry. This
  * routine effectively results in a "software abort".
  */
-int
+void
 lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 {
         LIST_HEAD(abort_list);
@@ -215,6 +215,10 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 
         pring = lpfc_phba_elsring(phba);
 
+        /* In case of error recovery path, we might have a NULL pring here */
+        if (!pring)
+                return;
+
         /* Abort outstanding I/O on NPort <nlp_DID> */
         lpfc_printf_vlog(ndlp->vport, KERN_INFO, LOG_DISCOVERY,
                          "2819 Abort outstanding I/O on NPort x%x "
@@ -273,7 +277,6 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
                               IOSTAT_LOCAL_REJECT, IOERR_SLI_ABORTED);
 
         lpfc_cancel_retry_delay_tmo(phba->pport, ndlp);
-        return 0;
 }
 
 static int
@@ -1944,7 +1947,13 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 
                 /* Target driver cannot solicit NVME FB. */
                 if (bf_get_be32(prli_tgt, nvpr)) {
+                        /* Complete the nvme target roles.  The transport
+                         * needs to know if the rport is capable of
+                         * discovery in addition to its role.
+                         */
                         ndlp->nlp_type |= NLP_NVME_TARGET;
+                        if (bf_get_be32(prli_disc, nvpr))
+                                ndlp->nlp_type |= NLP_NVME_DISCOVERY;
                         if ((bf_get_be32(prli_fba, nvpr) == 1) &&
                             (bf_get_be32(prli_fb_sz, nvpr) > 0) &&
                             (phba->cfg_nvme_enable_fb) &&
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 0488580eea12..518b15e6f222 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -142,7 +142,7 @@ out:
 }
 
 /**
- * lpfc_nvmet_rq_post - Repost a NVMET RQ DMA buffer and clean up context
+ * lpfc_nvmet_ctxbuf_post - Repost a NVMET RQ DMA buffer and clean up context
  * @phba: HBA buffer is associated with
  * @ctxp: context to clean up
  * @mp: Buffer to free
@@ -155,24 +155,113 @@ out:
  * Returns: None
  **/
 void
-lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                   struct lpfc_dmabuf *mp)
+lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf)
 {
-        if (ctxp) {
-                if (ctxp->flag)
-                        lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
-                                "6314 rq_post ctx xri x%x flag x%x\n",
-                                ctxp->oxid, ctxp->flag);
-
-                if (ctxp->txrdy) {
-                        pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
-                                      ctxp->txrdy_phys);
-                        ctxp->txrdy = NULL;
-                        ctxp->txrdy_phys = 0;
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+        struct lpfc_nvmet_rcv_ctx *ctxp = ctx_buf->context;
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct fc_frame_header *fc_hdr;
+        struct rqb_dmabuf *nvmebuf;
+        struct lpfc_dmabuf *hbufp;
+        uint32_t *payload;
+        uint32_t size, oxid, sid, rc;
+        unsigned long iflag;
+
+        if (ctxp->txrdy) {
+                pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
+                              ctxp->txrdy_phys);
+                ctxp->txrdy = NULL;
+                ctxp->txrdy_phys = 0;
+        }
+        ctxp->state = LPFC_NVMET_STE_FREE;
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+        if (phba->sli4_hba.nvmet_io_wait_cnt) {
+                hbufp = &nvmebuf->hbuf;
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_io_wait_list,
+                                 nvmebuf, struct rqb_dmabuf,
+                                 hbuf.list);
+                phba->sli4_hba.nvmet_io_wait_cnt--;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
+                oxid = be16_to_cpu(fc_hdr->fh_ox_id);
+                tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+                payload = (uint32_t *)(nvmebuf->dbuf.virt);
+                size = nvmebuf->bytes_recv;
+                sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+                ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
+                memset(ctxp, 0, sizeof(ctxp->ctx));
+                ctxp->wqeq = NULL;
+                ctxp->txrdy = NULL;
+                ctxp->offset = 0;
+                ctxp->phba = phba;
+                ctxp->size = size;
+                ctxp->oxid = oxid;
+                ctxp->sid = sid;
+                ctxp->state = LPFC_NVMET_STE_RCV;
+                ctxp->entry_cnt = 1;
+                ctxp->flag = 0;
+                ctxp->ctxbuf = ctx_buf;
+                spin_lock_init(&ctxp->ctxlock);
+
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+                if (phba->ktime_on) {
+                        ctxp->ts_cmd_nvme = ktime_get_ns();
+                        ctxp->ts_isr_cmd = ctxp->ts_cmd_nvme;
+                        ctxp->ts_nvme_data = 0;
+                        ctxp->ts_data_wqput = 0;
+                        ctxp->ts_isr_data = 0;
+                        ctxp->ts_data_nvme = 0;
+                        ctxp->ts_nvme_status = 0;
+                        ctxp->ts_status_wqput = 0;
+                        ctxp->ts_isr_status = 0;
+                        ctxp->ts_status_nvme = 0;
                 }
-                ctxp->state = LPFC_NVMET_STE_FREE;
+#endif
+                atomic_inc(&tgtp->rcv_fcp_cmd_in);
+                /*
+                 * The calling sequence should be:
+                 * nvmet_fc_rcv_fcp_req->lpfc_nvmet_xmt_fcp_op/cmp- req->done
+                 * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+                 * When we return from nvmet_fc_rcv_fcp_req, all relevant info
+                 * the NVME command / FC header is stored.
+                 * A buffer has already been reposted for this IO, so just free
+                 * the nvmebuf.
+                 */
+                rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
+                                          payload, size);
+
+                /* Process FCP command */
+                if (rc == 0) {
+                        atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                        nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                        return;
+                }
+
+                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
+                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
+                                "2582 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                                ctxp->oxid, rc,
+                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                atomic_read(&tgtp->xmt_fcp_release));
+
+                lpfc_nvmet_defer_release(phba, ctxp);
+                lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                return;
         }
-        lpfc_rq_buf_free(phba, mp);
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        list_add_tail(&ctx_buf->list,
+                      &phba->sli4_hba.lpfc_nvmet_ctx_list);
+        phba->sli4_hba.nvmet_ctx_cnt++;
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
+#endif
 }
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -502,6 +591,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
                                 "6150 LS Drop IO x%x: Prep\n",
                                 ctxp->oxid);
                 lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+                atomic_inc(&nvmep->xmt_ls_abort);
                 lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp,
                                                 ctxp->sid, ctxp->oxid);
                 return -ENOMEM;
@@ -545,6 +635,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
         lpfc_nlp_put(nvmewqeq->context1);
 
         lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+        atomic_inc(&nvmep->xmt_ls_abort);
         lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp, ctxp->sid, ctxp->oxid);
         return -ENXIO;
 }
@@ -612,9 +703,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmeio_data(phba, "NVMET FCP CMND: xri x%x op x%x len x%x\n",
                          ctxp->oxid, rsp->op, rsp->rsplen);
 
+        ctxp->flag |= LPFC_NVMET_IO_INP;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, nvmewqeq);
         if (rc == WQE_SUCCESS) {
-                ctxp->flag |= LPFC_NVMET_IO_INP;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
                 if (!phba->ktime_on)
                         return 0;
@@ -692,6 +783,7 @@ static void
 lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
                            struct nvmefc_tgt_fcp_req *rsp)
 {
+        struct lpfc_nvmet_tgtport *lpfc_nvmep = tgtport->private;
         struct lpfc_nvmet_rcv_ctx *ctxp =
                 container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
         struct lpfc_hba *phba = ctxp->phba;
@@ -707,13 +799,15 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         }
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
 
-        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid,
-                         ctxp->state, 0);
+        lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d abt %d\n", ctxp->oxid,
+                         ctxp->state, aborting);
+
+        atomic_inc(&lpfc_nvmep->xmt_fcp_release);
 
         if (aborting)
                 return;
 
-        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
 
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
@@ -734,17 +828,128 @@ static struct nvmet_fc_target_template lpfc_tgttemplate = {
         .target_priv_sz = sizeof(struct lpfc_nvmet_tgtport),
 };
 
+void
+lpfc_nvmet_cleanup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf, *next_ctx_buf;
+        unsigned long flags;
+
+        list_for_each_entry_safe(
+                ctx_buf, next_ctx_buf,
+                &phba->sli4_hba.lpfc_nvmet_ctx_list, list) {
+                spin_lock_irqsave(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                list_del_init(&ctx_buf->list);
+                spin_unlock_irqrestore(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                __lpfc_clear_active_sglq(phba,
+                                         ctx_buf->sglq->sli4_lxritag);
+                ctx_buf->sglq->state = SGL_FREED;
+                ctx_buf->sglq->ndlp = NULL;
+
+                spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
+                list_add_tail(&ctx_buf->sglq->list,
+                              &phba->sli4_hba.lpfc_nvmet_sgl_list);
+                spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+                                       flags);
+
+                lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                kfree(ctx_buf->context);
+        }
+}
+
+int
+lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
+        struct lpfc_iocbq *nvmewqe;
+        union lpfc_wqe128 *wqe;
+        int i;
+
+        lpfc_printf_log(phba, KERN_INFO, LOG_NVME,
+                        "6403 Allocate NVMET resources for %d XRIs\n",
+                        phba->sli4_hba.nvmet_xri_cnt);
+
+        /* For all nvmet xris, allocate resources needed to process a
+         * received command on a per xri basis.
+         */
+        for (i = 0; i < phba->sli4_hba.nvmet_xri_cnt; i++) {
+                ctx_buf = kzalloc(sizeof(*ctx_buf), GFP_KERNEL);
+                if (!ctx_buf) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6404 Ran out of memory for NVMET\n");
+                        return -ENOMEM;
+                }
+
+                ctx_buf->context = kzalloc(sizeof(*ctx_buf->context),
+                                           GFP_KERNEL);
+                if (!ctx_buf->context) {
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6405 Ran out of NVMET "
+                                        "context memory\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->context->ctxbuf = ctx_buf;
+
+                ctx_buf->iocbq = lpfc_sli_get_iocbq(phba);
+                if (!ctx_buf->iocbq) {
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6406 Ran out of NVMET iocb/WQEs\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
+                nvmewqe = ctx_buf->iocbq;
+                wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
+                /* Initialize WQE */
+                memset(wqe, 0, sizeof(union lpfc_wqe));
+                /* Word 7 */
+                bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
+                bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
+                bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
+                /* Word 10 */
+                bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
+                bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
+                bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
+
+                ctx_buf->iocbq->context1 = NULL;
+                spin_lock(&phba->sli4_hba.sgl_list_lock);
+                ctx_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, ctx_buf->iocbq);
+                spin_unlock(&phba->sli4_hba.sgl_list_lock);
+                if (!ctx_buf->sglq) {
+                        lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6407 Ran out of NVMET XRIs\n");
+                        return -ENOMEM;
+                }
+                spin_lock(&phba->sli4_hba.nvmet_io_lock);
+                list_add_tail(&ctx_buf->list,
+                              &phba->sli4_hba.lpfc_nvmet_ctx_list);
+                spin_unlock(&phba->sli4_hba.nvmet_io_lock);
+        }
+        phba->sli4_hba.nvmet_ctx_cnt = phba->sli4_hba.nvmet_xri_cnt;
+        return 0;
+}
+
 int
 lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
 {
         struct lpfc_vport  *vport = phba->pport;
         struct lpfc_nvmet_tgtport *tgtp;
         struct nvmet_fc_port_info pinfo;
-        int error = 0;
+        int error;
 
         if (phba->targetport)
                 return 0;
 
+        error = lpfc_nvmet_setup_io_context(phba);
+        if (error)
+                return error;
+
         memset(&pinfo, 0, sizeof(struct nvmet_fc_port_info));
         pinfo.node_name = wwn_to_u64(vport->fc_nodename.u.wwn);
         pinfo.port_name = wwn_to_u64(vport->fc_portname.u.wwn);
@@ -772,13 +977,16 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                                              &phba->pcidev->dev,
                                              &phba->targetport);
 #else
-        error = -ENOMEM;
+        error = -ENOENT;
 #endif
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
                                 "6025 Cannot register NVME targetport "
                                 "x%x\n", error);
                 phba->targetport = NULL;
+
+                lpfc_nvmet_cleanup_io_context(phba);
+
         } else {
                 tgtp = (struct lpfc_nvmet_tgtport *)
                         phba->targetport->private;
@@ -795,6 +1003,7 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -802,18 +1011,21 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return error;
 }
@@ -864,7 +1076,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 /* Check if we already received a free context call
@@ -885,7 +1097,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                     (ndlp->nlp_state == NLP_STE_UNMAPPED_NODE ||
                      ndlp->nlp_state == NLP_STE_MAPPED_NODE)) {
                         lpfc_set_rrq_active(phba, ndlp,
-                                ctxp->rqb_buffer->sglq->sli4_lxritag,
+                                ctxp->ctxbuf->sglq->sli4_lxritag,
                                 rxid, 1);
                         lpfc_sli4_abts_err_handler(phba, ndlp, axri);
                 }
@@ -894,8 +1106,8 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                                 "6318 XB aborted %x flg x%x (%x)\n",
                                 ctxp->oxid, ctxp->flag, released);
                 if (released)
-                        lpfc_nvmet_rq_post(phba, ctxp,
-                                           &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
+
                 if (rrq_empty)
                         lpfc_worker_wake_up(phba);
                 return;
@@ -923,7 +1135,7 @@ lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
@@ -975,6 +1187,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                 init_completion(&tgtp->tport_unreg_done);
                 nvmet_fc_unregister_targetport(phba->targetport);
                 wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                lpfc_nvmet_cleanup_io_context(phba);
         }
         phba->targetport = NULL;
 #endif
@@ -1010,6 +1223,7 @@ lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
@@ -1104,39 +1318,71 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
         uint32_t *payload;
-        uint32_t size, oxid, sid, rc;
+        uint32_t size, oxid, sid, rc, qno;
+        unsigned long iflag;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint32_t id;
 #endif
 
+        ctx_buf = NULL;
         if (!nvmebuf || !phba->targetport) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6157 FCP Drop IO\n");
+                                "6157 NVMET FCP Drop IO\n");
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        if (phba->sli4_hba.nvmet_ctx_cnt) {
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_ctx_list,
+                                 ctx_buf, struct lpfc_nvmet_ctxbuf, list);
+                phba->sli4_hba.nvmet_ctx_cnt--;
+        }
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
 
-        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        payload = (uint32_t *)(nvmebuf->dbuf.virt);
         fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
-        size = nvmebuf->bytes_recv;
         oxid = be16_to_cpu(fc_hdr->fh_ox_id);
-        sid = sli4_sid_from_fc_hdr(fc_hdr);
+        size = nvmebuf->bytes_recv;
 
-        ctxp = (struct lpfc_nvmet_rcv_ctx *)nvmebuf->context;
-        if (ctxp == NULL) {
-                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6158 FCP Drop IO x%x: Alloc\n",
-                                oxid);
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-                /* Cannot send ABTS without context */
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
+                id = smp_processor_id();
+                if (id < LPFC_CHECK_CPU_CNT)
+                        phba->cpucheck_rcv_io[id]++;
+        }
+#endif
+
+        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
+                         oxid, size, smp_processor_id());
+
+        if (!ctx_buf) {
+                /* Queue this NVME IO to process later */
+                spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+                list_add_tail(&nvmebuf->hbuf.list,
+                              &phba->sli4_hba.lpfc_nvmet_io_wait_list);
+                phba->sli4_hba.nvmet_io_wait_cnt++;
+                phba->sli4_hba.nvmet_io_wait_total++;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                /* Post a brand new DMA buffer to RQ */
+                qno = nvmebuf->idx;
+                lpfc_post_rq_buffer(
+                        phba, phba->sli4_hba.nvmet_mrq_hdr[qno],
+                        phba->sli4_hba.nvmet_mrq_data[qno], 1, qno);
                 return;
         }
+
+        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+        payload = (uint32_t *)(nvmebuf->dbuf.virt);
+        sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+        ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
         memset(ctxp, 0, sizeof(ctxp->ctx));
         ctxp->wqeq = NULL;
         ctxp->txrdy = NULL;
@@ -1146,9 +1392,9 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         ctxp->oxid = oxid;
         ctxp->sid = sid;
         ctxp->state = LPFC_NVMET_STE_RCV;
-        ctxp->rqb_buffer = nvmebuf;
         ctxp->entry_cnt = 1;
         ctxp->flag = 0;
+        ctxp->ctxbuf = ctx_buf;
         spin_lock_init(&ctxp->ctxlock);
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -1164,22 +1410,16 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                 ctxp->ts_isr_status = 0;
                 ctxp->ts_status_nvme = 0;
         }
-
-        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
-                id = smp_processor_id();
-                if (id < LPFC_CHECK_CPU_CNT)
-                        phba->cpucheck_rcv_io[id]++;
-        }
 #endif
 
-        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
-                         oxid, size, smp_processor_id());
-
         atomic_inc(&tgtp->rcv_fcp_cmd_in);
         /*
          * The calling sequence should be:
          * nvmet_fc_rcv_fcp_req -> lpfc_nvmet_xmt_fcp_op/cmp -> req->done
          * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+         * When we return from nvmet_fc_rcv_fcp_req, all relevant info in
+         * the NVME command / FC header is stored, so we are free to repost
+         * the buffer.
          */
         rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
                                   payload, size);
@@ -1187,26 +1427,32 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         /* Process FCP command */
         if (rc == 0) {
                 atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                        "6159 FCP Drop IO x%x: err x%x\n",
-                        ctxp->oxid, rc);
+                        "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                        ctxp->oxid, rc,
+                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                        atomic_read(&tgtp->xmt_fcp_release));
 dropit:
         lpfc_nvmeio_data(phba, "NVMET FCP DROP: xri x%x sz %d from %06x\n",
                          oxid, size, sid);
         if (oxid) {
+                lpfc_nvmet_defer_release(phba, ctxp);
                 lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
-        if (nvmebuf) {
-                nvmebuf->iocbq->hba_wqidx = 0;
-                /* We assume a rcv'ed cmd ALWAYs fits into 1 buffer */
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-        }
+        if (ctx_buf)
+                lpfc_nvmet_ctxbuf_post(phba, ctx_buf);
+
+        if (nvmebuf)
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
 #endif
 }
 
@@ -1258,7 +1504,7 @@ lpfc_nvmet_unsol_fcp_event(struct lpfc_hba *phba,
                            uint64_t isr_timestamp)
 {
         if (phba->nvmet_support == 0) {
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf);
                 return;
         }
         lpfc_nvmet_unsol_fcp_buffer(phba, pring, nvmebuf,
@@ -1459,7 +1705,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
         nvmewqe = ctxp->wqeq;
         if (nvmewqe == NULL) {
                 /* Allocate buffer for  command wqe */
-                nvmewqe = ctxp->rqb_buffer->iocbq;
+                nvmewqe = ctxp->ctxbuf->iocbq;
                 if (nvmewqe == NULL) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                         "6110 lpfc_nvmet_prep_fcp_wqe: No "
@@ -1486,7 +1732,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
                 return NULL;
         }
 
-        sgl  = (struct sli4_sge *)ctxp->rqb_buffer->sglq->sgl;
+        sgl  = (struct sli4_sge *)ctxp->ctxbuf->sglq->sgl;
         switch (rsp->op) {
         case NVMET_FCOP_READDATA:
         case NVMET_FCOP_READDATA_RSP:
@@ -1811,7 +2057,8 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         ctxp->state = LPFC_NVMET_STE_DONE;
 
@@ -1826,6 +2073,7 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
                         "6165 ABORT cmpl: xri x%x flg x%x (%d) "
@@ -1834,15 +2082,16 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
 
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+        /* This is the iocbq for the abort, not the command */
         lpfc_sli_release_iocbq(phba, cmdwqe);
 
         /* Since iaab/iaar are NOT set, there is no work left.
@@ -1876,7 +2125,8 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         if (!ctxp) {
                 /* if context is clear, related io alrady complete */
@@ -1906,6 +2156,7 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6316 ABTS cmpl xri x%x flg x%x (%x) "
@@ -1913,15 +2164,15 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         ctxp->oxid, ctxp->flag, released,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
+
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
-
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
         /* Since iaab/iaar are NOT set, there is no work left.
          * For LPFC_NVMET_XBUSY, lpfc_sli4_nvmet_xri_aborted
@@ -1952,7 +2203,7 @@ lpfc_nvmet_xmt_ls_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        atomic_inc(&tgtp->xmt_ls_abort_cmpl);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6083 Abort cmpl: ctx %p WCQE: %08x %08x %08x %08x\n",
@@ -1983,10 +2234,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
                         sid, xri, ctxp->wqeq->sli4_xritag);
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
-                ctxp->wqeq->hba_wqidx = 0;
-        }
 
         ndlp = lpfc_findnode_did(phba->pport, sid);
         if (!ndlp || !NLP_CHK_NODE_ACT(ndlp) ||
@@ -2082,7 +2329,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2103,6 +2350,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Issue ABTS for this WQE based on iotag */
         ctxp->abort_wqeq = lpfc_sli_get_iocbq(phba);
         if (!ctxp->abort_wqeq) {
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6161 ABORT failed: No wqeqs: "
                                 "xri: x%x\n", ctxp->oxid);
@@ -2127,6 +2375,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* driver queued commands are in process of being flushed */
         if (phba->hba_flag & HBA_NVME_IOQ_FLUSH) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6163 Driver in reset cleanup - flushing "
                                 "NVME Req now. hba_flag x%x oxid x%x\n",
@@ -2139,6 +2388,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Outstanding abort is in progress */
         if (abts_wqeq->iocb_flag & LPFC_DRIVER_ABORTED) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6164 Outstanding NVME I/O Abort Request "
                                 "still pending on oxid x%x\n",
@@ -2189,9 +2439,12 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         abts_wqeq->context2 = ctxp;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
-        if (rc == WQE_SUCCESS)
+        if (rc == WQE_SUCCESS) {
+                atomic_inc(&tgtp->xmt_abort_sol);
                 return 0;
+        }
 
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         lpfc_sli_release_iocbq(phba, abts_wqeq);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
@@ -2214,7 +2467,7 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2230,11 +2483,11 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
                 return 0;
         }
 
 aerr:
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         atomic_inc(&tgtp->xmt_abort_rsp_error);
         lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
@@ -2269,6 +2522,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         }
         abts_wqeq = ctxp->wqeq;
         wqe_abts = &abts_wqeq->wqe;
+
         lpfc_nvmet_unsol_issue_abort(phba, ctxp, sid, xri);
 
         spin_lock_irqsave(&phba->hbalock, flags);
@@ -2278,7 +2532,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_ELS_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
+                atomic_inc(&tgtp->xmt_abort_unsol);
                 return 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 128759fe6650..6eb2f5d8d4ed 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -22,6 +22,7 @@
  ********************************************************************/
 
 #define LPFC_NVMET_DEFAULT_SEGS         (64 + 1)        /* 256K IOs */
+#define LPFC_NVMET_RQE_DEF_COUNT        512
 #define LPFC_NVMET_SUCCESS_LEN  12
 
 /* Used for NVME Target */
@@ -34,6 +35,7 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_ls_req_out;
         atomic_t rcv_ls_req_drop;
         atomic_t xmt_ls_abort;
+        atomic_t xmt_ls_abort_cmpl;
 
         /* Stats counters - lpfc_nvmet_xmt_ls_rsp */
         atomic_t xmt_ls_rsp;
@@ -47,9 +49,9 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_fcp_cmd_in;
         atomic_t rcv_fcp_cmd_out;
         atomic_t rcv_fcp_cmd_drop;
+        atomic_t xmt_fcp_release;
 
         /* Stats counters - lpfc_nvmet_xmt_fcp_op */
-        atomic_t xmt_fcp_abort;
         atomic_t xmt_fcp_drop;
         atomic_t xmt_fcp_read_rsp;
         atomic_t xmt_fcp_read;
@@ -62,12 +64,13 @@ struct lpfc_nvmet_tgtport {
         atomic_t xmt_fcp_rsp_drop;
 
 
-        /* Stats counters - lpfc_nvmet_unsol_issue_abort */
+        /* Stats counters - lpfc_nvmet_xmt_fcp_abort */
+        atomic_t xmt_fcp_abort;
+        atomic_t xmt_fcp_abort_cmpl;
+        atomic_t xmt_abort_sol;
+        atomic_t xmt_abort_unsol;
         atomic_t xmt_abort_rsp;
         atomic_t xmt_abort_rsp_error;
-
-        /* Stats counters - lpfc_nvmet_xmt_abort_cmp */
-        atomic_t xmt_abort_cmpl;
 };
 
 struct lpfc_nvmet_rcv_ctx {
@@ -103,6 +106,7 @@ struct lpfc_nvmet_rcv_ctx {
 #define LPFC_NVMET_CTX_RLS              0x8  /* ctx free requested */
 #define LPFC_NVMET_ABTS_RCV             0x10  /* ABTS received on exchange */
         struct rqb_dmabuf *rqb_buffer;
+        struct lpfc_nvmet_ctxbuf *ctxbuf;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint64_t ts_isr_cmd;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 2a4fc00dfa9b..d6b184839bc2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -74,6 +74,8 @@ static struct lpfc_iocbq *lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *,
                                                          struct lpfc_iocbq *);
 static void lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *,
                                       struct hbq_dmabuf *);
+static void lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                                          struct hbq_dmabuf *dmabuf);
 static int lpfc_sli4_fp_handle_cqe(struct lpfc_hba *, struct lpfc_queue *,
                                     struct lpfc_cqe *);
 static int lpfc_sli4_post_sgl_list(struct lpfc_hba *, struct list_head *,
@@ -479,22 +481,23 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
         if (unlikely(!hq) || unlikely(!dq))
                 return -ENOMEM;
         put_index = hq->host_index;
-        temp_hrqe = hq->qe[hq->host_index].rqe;
+        temp_hrqe = hq->qe[put_index].rqe;
         temp_drqe = dq->qe[dq->host_index].rqe;
 
         if (hq->type != LPFC_HRQ || dq->type != LPFC_DRQ)
                 return -EINVAL;
-        if (hq->host_index != dq->host_index)
+        if (put_index != dq->host_index)
                 return -EINVAL;
         /* If the host has not yet processed the next entry then we are done */
-        if (((hq->host_index + 1) % hq->entry_count) == hq->hba_index)
+        if (((put_index + 1) % hq->entry_count) == hq->hba_index)
                 return -EBUSY;
         lpfc_sli_pcimem_bcopy(hrqe, temp_hrqe, hq->entry_size);
         lpfc_sli_pcimem_bcopy(drqe, temp_drqe, dq->entry_size);
 
         /* Update the host index to point to the next slot */
-        hq->host_index = ((hq->host_index + 1) % hq->entry_count);
+        hq->host_index = ((put_index + 1) % hq->entry_count);
         dq->host_index = ((dq->host_index + 1) % dq->entry_count);
+        hq->RQ_buf_posted++;
 
         /* Ring The Header Receive Queue Doorbell */
         if (!(hq->host_index % hq->entry_repost)) {
@@ -5906,7 +5909,7 @@ lpfc_set_features(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox,
                 bf_set(lpfc_mbx_set_feature_mds,
                        &mbox->u.mqe.un.set_feature, 1);
                 bf_set(lpfc_mbx_set_feature_mds_deep_loopbk,
-                       &mbox->u.mqe.un.set_feature, 0);
+                       &mbox->u.mqe.un.set_feature, 1);
                 mbox->u.mqe.un.set_feature.feature = LPFC_SET_MDS_DIAGS;
                 mbox->u.mqe.un.set_feature.param_len = 8;
                 break;
@@ -6512,6 +6515,50 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
                  (phba->hba_flag & HBA_FCOE_MODE) ? "FCoE" : "FC");
 }
 
+int
+lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                    struct lpfc_queue *drq, int count, int idx)
+{
+        int rc, i;
+        struct lpfc_rqe hrqe;
+        struct lpfc_rqe drqe;
+        struct lpfc_rqb *rqbp;
+        struct rqb_dmabuf *rqb_buffer;
+        LIST_HEAD(rqb_buf_list);
+
+        rqbp = hrq->rqbp;
+        for (i = 0; i < count; i++) {
+                /* IF RQ is already full, don't bother */
+                if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+                        break;
+                rqb_buffer = rqbp->rqb_alloc_buffer(phba);
+                if (!rqb_buffer)
+                        break;
+                rqb_buffer->hrq = hrq;
+                rqb_buffer->drq = drq;
+                rqb_buffer->idx = idx;
+                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
+        }
+        while (!list_empty(&rqb_buf_list)) {
+                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
+                                 hbuf.list);
+
+                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
+                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
+                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
+                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
+                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
+                if (rc < 0) {
+                        rqbp->rqb_free_buffer(phba, rqb_buffer);
+                } else {
+                        list_add_tail(&rqb_buffer->hbuf.list,
+                                      &rqbp->rqb_buffer_list);
+                        rqbp->buffer_count++;
+                }
+        }
+        return 1;
+}
+
 /**
  * lpfc_sli4_hba_setup - SLI4 device initialization PCI function
  * @phba: Pointer to HBA context object.
@@ -6524,7 +6571,7 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
 int
 lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 {
-        int rc, i;
+        int rc, i, cnt;
         LPFC_MBOXQ_t *mboxq;
         struct lpfc_mqe *mqe;
         uint8_t *vpd;
@@ -6875,6 +6922,21 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                         goto out_destroy_queue;
                 }
                 phba->sli4_hba.nvmet_xri_cnt = rc;
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* We need 1 iocbq for every SGL, for IO processing */
+                cnt += phba->sli4_hba.nvmet_xri_cnt;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2821 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "1413 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
+
                 lpfc_nvmet_create_targetport(phba);
         } else {
                 /* update host scsi xri-sgl sizes and mappings */
@@ -6894,28 +6956,34 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                                         "and mapping: %d\n", rc);
                         goto out_destroy_queue;
                 }
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2820 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "6301 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
         }
 
         if (phba->nvmet_support && phba->cfg_nvmet_mrq) {
-
                 /* Post initial buffers to all RQs created */
                 for (i = 0; i < phba->cfg_nvmet_mrq; i++) {
                         rqbp = phba->sli4_hba.nvmet_mrq_hdr[i]->rqbp;
                         INIT_LIST_HEAD(&rqbp->rqb_buffer_list);
                         rqbp->rqb_alloc_buffer = lpfc_sli4_nvmet_alloc;
                         rqbp->rqb_free_buffer = lpfc_sli4_nvmet_free;
-                        rqbp->entry_count = 256;
+                        rqbp->entry_count = LPFC_NVMET_RQE_DEF_COUNT;
                         rqbp->buffer_count = 0;
 
-                        /* Divide by 4 and round down to multiple of 16 */
-                        rc = (phba->cfg_nvmet_mrq_post >> 2) & 0xfff8;
-                        phba->sli4_hba.nvmet_mrq_hdr[i]->entry_repost = rc;
-                        phba->sli4_hba.nvmet_mrq_data[i]->entry_repost = rc;
-
                         lpfc_post_rq_buffer(
                                 phba, phba->sli4_hba.nvmet_mrq_hdr[i],
                                 phba->sli4_hba.nvmet_mrq_data[i],
-                                phba->cfg_nvmet_mrq_post);
+                                LPFC_NVMET_RQE_DEF_COUNT, i);
                 }
         }
 
@@ -7082,6 +7150,7 @@ out_unset_queue:
         /* Unset all the queues set up in this routine when error out */
         lpfc_sli4_queue_unset(phba);
 out_destroy_queue:
+        lpfc_free_iocb_list(phba);
         lpfc_sli4_queue_destroy(phba);
 out_stop_timers:
         lpfc_stop_hba_timers(phba);
@@ -8621,8 +8690,11 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 memset(wqe, 0, sizeof(union lpfc_wqe128));
         /* Some of the fields are in the right position already */
         memcpy(wqe, &iocbq->iocb, sizeof(union lpfc_wqe));
-        wqe->generic.wqe_com.word7 = 0; /* The ct field has moved so reset */
-        wqe->generic.wqe_com.word10 = 0;
+        if (iocbq->iocb.ulpCommand != CMD_SEND_FRAME) {
+                /* The ct field has moved so reset */
+                wqe->generic.wqe_com.word7 = 0;
+                wqe->generic.wqe_com.word10 = 0;
+        }
 
         abort_tag = (uint32_t) iocbq->iotag;
         xritag = iocbq->sli4_xritag;
@@ -9116,6 +9188,10 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 }
 
                 break;
+        case CMD_SEND_FRAME:
+                bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag);
+                bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag);
+                return 0;
         case CMD_XRI_ABORTED_CX:
         case CMD_CREATE_XRI_CR: /* Do we expect to use this? */
         case CMD_IOCB_FCP_IBIDIR64_CR: /* bidirectional xfer */
@@ -12788,6 +12864,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         struct fc_frame_header *fc_hdr;
         struct lpfc_queue *hrq = phba->sli4_hba.hdr_rq;
         struct lpfc_queue *drq = phba->sli4_hba.dat_rq;
+        struct lpfc_nvmet_tgtport *tgtp;
         struct hbq_dmabuf *dma_buf;
         uint32_t status, rq_id;
         unsigned long iflags;
@@ -12808,7 +12885,6 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "2537 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12819,6 +12895,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                         goto out;
                 }
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 memcpy(&dma_buf->cq_event.cqe.rcqe_cmpl, rcqe, sizeof(*rcqe));
 
                 /* If a NVME LS event (type 0x28), treat it as Fast path */
@@ -12832,8 +12909,21 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 workposted = true;
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6402 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12951,7 +13041,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                 while ((cqe = lpfc_sli4_cq_get(cq))) {
                         workposted |= lpfc_sli4_sp_handle_mcqe(phba, cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                         cq->CQ_mbox++;
                 }
                 break;
@@ -12965,7 +13055,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                                 workposted |= lpfc_sli4_sp_handle_cqe(phba, cq,
                                                                       cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                 }
 
                 /* Track the max number of CQEs processed in 1 EQ */
@@ -13135,6 +13225,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         struct lpfc_queue *drq;
         struct rqb_dmabuf *dma_buf;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_tgtport *tgtp;
         uint32_t status, rq_id;
         unsigned long iflags;
         uint32_t fctl, idx;
@@ -13165,8 +13256,6 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "6126 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
-                break;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -13178,6 +13267,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
                 }
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 fc_hdr = (struct fc_frame_header *)dma_buf->hbuf.virt;
 
                 /* Just some basic sanity checks on FCP Command frame */
@@ -13200,14 +13290,23 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
 drop:
                 lpfc_in_buf_free(phba, &dma_buf->dbuf);
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6401 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
-                spin_lock_irqsave(&phba->hbalock, iflags);
-                phba->hba_flag |= HBA_POST_RECEIVE_BUFFER;
-                spin_unlock_irqrestore(&phba->hbalock, iflags);
-                workposted = true;
                 break;
         }
 out:
@@ -13361,7 +13460,7 @@ process_cq:
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13452,7 +13551,7 @@ lpfc_sli4_fof_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe)
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13534,7 +13633,7 @@ lpfc_sli4_fof_intr_handler(int irq, void *dev_id)
         while ((eqe = lpfc_sli4_eq_get(eq))) {
                 lpfc_sli4_fof_handle_eqe(phba, eqe);
                 if (!(++ecount % eq->entry_repost))
-                        lpfc_sli4_eq_release(eq, LPFC_QUEUE_NOARM);
+                        break;
                 eq->EQ_processed++;
         }
 
@@ -13651,7 +13750,7 @@ lpfc_sli4_hba_intr_handler(int irq, void *dev_id)
 
                 lpfc_sli4_hba_handle_eqe(phba, eqe, hba_eqidx);
                 if (!(++ecount % fpeq->entry_repost))
-                        lpfc_sli4_eq_release(fpeq, LPFC_QUEUE_NOARM);
+                        break;
                 fpeq->EQ_processed++;
         }
 
@@ -13832,17 +13931,10 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t entry_size,
         }
         queue->entry_size = entry_size;
         queue->entry_count = entry_count;
-
-        /*
-         * entry_repost is calculated based on the number of entries in the
-         * queue. This works out except for RQs. If buffers are NOT initially
-         * posted for every RQE, entry_repost should be adjusted accordingly.
-         */
-        queue->entry_repost = (entry_count >> 3);
-        if (queue->entry_repost < LPFC_QUEUE_MIN_REPOST)
-                queue->entry_repost = LPFC_QUEUE_MIN_REPOST;
         queue->phba = phba;
 
+        /* entry_repost will be set during q creation */
+
         return queue;
 out_fail:
         lpfc_sli4_queue_free(queue);
@@ -14073,6 +14165,7 @@ lpfc_eq_create(struct lpfc_hba *phba, struct lpfc_queue *eq, uint32_t imax)
                 status = -ENXIO;
         eq->host_index = 0;
         eq->hba_index = 0;
+        eq->entry_repost = LPFC_EQ_REPOST;
 
         mempool_free(mbox, phba->mbox_mem_pool);
         return status;
@@ -14146,9 +14239,9 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         default:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "0361 Unsupported CQ count: "
-                                "entry cnt %d sz %d pg cnt %d repost %d\n",
+                                "entry cnt %d sz %d pg cnt %d\n",
                                 cq->entry_count, cq->entry_size,
-                                cq->page_count, cq->entry_repost);
+                                cq->page_count);
                 if (cq->entry_count < 256) {
                         status = -EINVAL;
                         goto out;
@@ -14201,6 +14294,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         cq->assoc_qid = eq->queue_id;
         cq->host_index = 0;
         cq->hba_index = 0;
+        cq->entry_repost = LPFC_CQ_REPOST;
 
 out:
         mempool_free(mbox, phba->mbox_mem_pool);
@@ -14392,6 +14486,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                 cq->assoc_qid = eq->queue_id;
                 cq->host_index = 0;
                 cq->hba_index = 0;
+                cq->entry_repost = LPFC_CQ_REPOST;
 
                 rc = 0;
                 list_for_each_entry(dmabuf, &cq->page_list, list) {
@@ -14640,6 +14735,7 @@ lpfc_mq_create(struct lpfc_hba *phba, struct lpfc_queue *mq,
         mq->subtype = subtype;
         mq->host_index = 0;
         mq->hba_index = 0;
+        mq->entry_repost = LPFC_MQ_REPOST;
 
         /* link the mq onto the parent cq child list */
         list_add_tail(&mq->list, &cq->child_list);
@@ -14865,34 +14961,6 @@ out:
 }
 
 /**
- * lpfc_rq_adjust_repost - Adjust entry_repost for an RQ
- * @phba: HBA structure that indicates port to create a queue on.
- * @rq:   The queue structure to use for the receive queue.
- * @qno:  The associated HBQ number
- *
- *
- * For SLI4 we need to adjust the RQ repost value based on
- * the number of buffers that are initially posted to the RQ.
- */
-void
-lpfc_rq_adjust_repost(struct lpfc_hba *phba, struct lpfc_queue *rq, int qno)
-{
-        uint32_t cnt;
-
-        /* sanity check on queue memory */
-        if (!rq)
-                return;
-        cnt = lpfc_hbq_defs[qno]->entry_count;
-
-        /* Recalc repost for RQs based on buffers initially posted */
-        cnt = (cnt >> 3);
-        if (cnt < LPFC_QUEUE_MIN_REPOST)
-                cnt = LPFC_QUEUE_MIN_REPOST;
-
-        rq->entry_repost = cnt;
-}
-
-/**
  * lpfc_rq_create - Create a Receive Queue on the HBA
  * @phba: HBA structure that indicates port to create a queue on.
  * @hrq: The queue structure to use to create the header receive queue.
@@ -15077,6 +15145,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         hrq->subtype = subtype;
         hrq->host_index = 0;
         hrq->hba_index = 0;
+        hrq->entry_repost = LPFC_RQ_REPOST;
 
         /* now create the data queue */
         lpfc_sli4_config(phba, mbox, LPFC_MBOX_SUBSYSTEM_FCOE,
@@ -15087,7 +15156,12 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         if (phba->sli4_hba.pc_sli4_params.rqv == LPFC_Q_CREATE_VERSION_1) {
                 bf_set(lpfc_rq_context_rqe_count_1,
                        &rq_create->u.request.context, hrq->entry_count);
-                rq_create->u.request.context.buffer_size = LPFC_DATA_BUF_SIZE;
+                if (subtype == LPFC_NVMET)
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_NVMET_DATA_BUF_SIZE;
+                else
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_DATA_BUF_SIZE;
                 bf_set(lpfc_rq_context_rqe_size, &rq_create->u.request.context,
                        LPFC_RQE_SIZE_8);
                 bf_set(lpfc_rq_context_page_size, &rq_create->u.request.context,
@@ -15124,8 +15198,14 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                LPFC_RQ_RING_SIZE_4096);
                         break;
                 }
-                bf_set(lpfc_rq_context_buf_size, &rq_create->u.request.context,
-                       LPFC_DATA_BUF_SIZE);
+                if (subtype == LPFC_NVMET)
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_NVMET_DATA_BUF_SIZE);
+                else
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_DATA_BUF_SIZE);
         }
         bf_set(lpfc_rq_context_cq_id, &rq_create->u.request.context,
                cq->queue_id);
@@ -15158,6 +15238,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         drq->subtype = subtype;
         drq->host_index = 0;
         drq->hba_index = 0;
+        drq->entry_repost = LPFC_RQ_REPOST;
 
         /* link the header and data RQs onto the parent cq child list */
         list_add_tail(&hrq->list, &cq->child_list);
@@ -15270,7 +15351,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                                cq->queue_id);
                         bf_set(lpfc_rq_context_data_size,
                                &rq_create->u.request.context,
-                               LPFC_DATA_BUF_SIZE);
+                               LPFC_NVMET_DATA_BUF_SIZE);
                         bf_set(lpfc_rq_context_hdr_size,
                                &rq_create->u.request.context,
                                LPFC_HDR_BUF_SIZE);
@@ -15315,6 +15396,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 hrq->subtype = subtype;
                 hrq->host_index = 0;
                 hrq->hba_index = 0;
+                hrq->entry_repost = LPFC_RQ_REPOST;
 
                 drq->db_format = LPFC_DB_RING_FORMAT;
                 drq->db_regaddr = phba->sli4_hba.RQDBregaddr;
@@ -15323,6 +15405,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 drq->subtype = subtype;
                 drq->host_index = 0;
                 drq->hba_index = 0;
+                drq->entry_repost = LPFC_RQ_REPOST;
 
                 list_add_tail(&hrq->list, &cq->child_list);
                 list_add_tail(&drq->list, &cq->child_list);
@@ -16063,6 +16146,8 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         struct fc_vft_header *fc_vft_hdr;
         uint32_t *header = (uint32_t *) fc_hdr;
 
+#define FC_RCTL_MDS_DIAGS       0xF4
+
         switch (fc_hdr->fh_r_ctl) {
         case FC_RCTL_DD_UNCAT:          /* uncategorized information */
         case FC_RCTL_DD_SOL_DATA:       /* solicited data */
@@ -16090,6 +16175,7 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         case FC_RCTL_F_BSY:     /* fabric busy to data frame */
         case FC_RCTL_F_BSYL:    /* fabric busy to link control frame */
         case FC_RCTL_LCR:       /* link credit reset */
+        case FC_RCTL_MDS_DIAGS: /* MDS Diagnostics */
         case FC_RCTL_END:       /* end */
                 break;
         case FC_RCTL_VFTH:      /* Virtual Fabric tagging Header */
@@ -16099,12 +16185,16 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         default:
                 goto drop;
         }
+
+#define FC_TYPE_VENDOR_UNIQUE   0xFF
+
         switch (fc_hdr->fh_type) {
         case FC_TYPE_BLS:
         case FC_TYPE_ELS:
         case FC_TYPE_FCP:
         case FC_TYPE_CT:
         case FC_TYPE_NVME:
+        case FC_TYPE_VENDOR_UNIQUE:
                 break;
         case FC_TYPE_IP:
         case FC_TYPE_ILS:
@@ -16115,12 +16205,14 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
                         "2538 Received frame rctl:%s (x%x), type:%s (x%x), "
                         "frame Data:%08x %08x %08x %08x %08x %08x %08x\n",
+                        (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS) ? "MDS Diags" :
                         lpfc_rctl_names[fc_hdr->fh_r_ctl], fc_hdr->fh_r_ctl,
-                        lpfc_type_names[fc_hdr->fh_type], fc_hdr->fh_type,
-                        be32_to_cpu(header[0]), be32_to_cpu(header[1]),
-                        be32_to_cpu(header[2]), be32_to_cpu(header[3]),
-                        be32_to_cpu(header[4]), be32_to_cpu(header[5]),
-                        be32_to_cpu(header[6]));
+                        (fc_hdr->fh_type == FC_TYPE_VENDOR_UNIQUE) ?
+                        "Vendor Unique" : lpfc_type_names[fc_hdr->fh_type],
+                        fc_hdr->fh_type, be32_to_cpu(header[0]),
+                        be32_to_cpu(header[1]), be32_to_cpu(header[2]),
+                        be32_to_cpu(header[3]), be32_to_cpu(header[4]),
+                        be32_to_cpu(header[5]), be32_to_cpu(header[6]));
         return 0;
 drop:
         lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
@@ -16926,6 +17018,96 @@ lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,
         lpfc_sli_release_iocbq(phba, iocbq);
 }
 
+static void
+lpfc_sli4_mds_loopback_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+                            struct lpfc_iocbq *rspiocb)
+{
+        struct lpfc_dmabuf *pcmd = cmdiocb->context2;
+
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, cmdiocb);
+}
+
+static void
+lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                              struct hbq_dmabuf *dmabuf)
+{
+        struct fc_frame_header *fc_hdr;
+        struct lpfc_hba *phba = vport->phba;
+        struct lpfc_iocbq *iocbq = NULL;
+        union  lpfc_wqe *wqe;
+        struct lpfc_dmabuf *pcmd = NULL;
+        uint32_t frame_len;
+        int rc;
+
+        fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+        frame_len = bf_get(lpfc_rcqe_length, &dmabuf->cq_event.cqe.rcqe_cmpl);
+
+        /* Send the received frame back */
+        iocbq = lpfc_sli_get_iocbq(phba);
+        if (!iocbq)
+                goto exit;
+
+        /* Allocate buffer for command payload */
+        pcmd = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+        if (pcmd)
+                pcmd->virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
+                                            &pcmd->phys);
+        if (!pcmd || !pcmd->virt)
+                goto exit;
+
+        INIT_LIST_HEAD(&pcmd->list);
+
+        /* copyin the payload */
+        memcpy(pcmd->virt, dmabuf->dbuf.virt, frame_len);
+
+        /* fill in BDE's for command */
+        iocbq->iocb.un.xseq64.bdl.addrHigh = putPaddrHigh(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.addrLow = putPaddrLow(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.bdeFlags = BUFF_TYPE_BDE_64;
+        iocbq->iocb.un.xseq64.bdl.bdeSize = frame_len;
+
+        iocbq->context2 = pcmd;
+        iocbq->vport = vport;
+        iocbq->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK;
+        iocbq->iocb_flag |= LPFC_USE_FCPWQIDX;
+
+        /*
+         * Setup rest of the iocb as though it were a WQE
+         * Build the SEND_FRAME WQE
+         */
+        wqe = (union lpfc_wqe *)&iocbq->iocb;
+
+        wqe->send_frame.frame_len = frame_len;
+        wqe->send_frame.fc_hdr_wd0 = be32_to_cpu(*((uint32_t *)fc_hdr));
+        wqe->send_frame.fc_hdr_wd1 = be32_to_cpu(*((uint32_t *)fc_hdr + 1));
+        wqe->send_frame.fc_hdr_wd2 = be32_to_cpu(*((uint32_t *)fc_hdr + 2));
+        wqe->send_frame.fc_hdr_wd3 = be32_to_cpu(*((uint32_t *)fc_hdr + 3));
+        wqe->send_frame.fc_hdr_wd4 = be32_to_cpu(*((uint32_t *)fc_hdr + 4));
+        wqe->send_frame.fc_hdr_wd5 = be32_to_cpu(*((uint32_t *)fc_hdr + 5));
+
+        iocbq->iocb.ulpCommand = CMD_SEND_FRAME;
+        iocbq->iocb.ulpLe = 1;
+        iocbq->iocb_cmpl = lpfc_sli4_mds_loopback_cmpl;
+        rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocbq, 0);
+        if (rc == IOCB_ERROR)
+                goto exit;
+
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+        return;
+
+exit:
+        lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+                        "2023 Unable to process MDS loopback frame\n");
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, iocbq);
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+}
+
 /**
  * lpfc_sli4_handle_received_buffer - Handle received buffers from firmware
  * @phba: Pointer to HBA context object.
@@ -16964,6 +17146,13 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
                 fcfi = bf_get(lpfc_rcqe_fcf_id,
                               &dmabuf->cq_event.cqe.rcqe_cmpl);
 
+        if (fc_hdr->fh_r_ctl == 0xF4 && fc_hdr->fh_type == 0xFF) {
+                vport = phba->pport;
+                /* Handle MDS Loopback frames */
+                lpfc_sli4_handle_mds_loopback(vport, dmabuf);
+                return;
+        }
+
         /* d_id this frame is directed to */
         did = sli4_did_from_fc_hdr(fc_hdr);
 
@@ -17137,6 +17326,14 @@ lpfc_sli4_post_rpi_hdr(struct lpfc_hba *phba, struct lpfc_rpi_hdr *rpi_page)
                                 "status x%x add_status x%x, mbx status x%x\n",
                                 shdr_status, shdr_add_status, rc);
                 rc = -ENXIO;
+        } else {
+                /*
+                 * The next_rpi stores the next logical module-64 rpi value used
+                 * to post physical rpis in subsequent rpi postings.
+                 */
+                spin_lock_irq(&phba->hbalock);
+                phba->sli4_hba.next_rpi = rpi_page->next_rpi;
+                spin_unlock_irq(&phba->hbalock);
         }
         return rc;
 }
@@ -18717,7 +18914,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phba, uint32_t ring_number,
 
                 spin_lock_irqsave(&pring->ring_lock, iflags);
                 ctxp = pwqe->context2;
-                sglq = ctxp->rqb_buffer->sglq;
+                sglq = ctxp->ctxbuf->sglq;
                 if (pwqe->sli4_xritag ==  NO_XRI) {
                         pwqe->sli4_lxritag = sglq->sli4_lxritag;
                         pwqe->sli4_xritag = sglq->sli4_xritag;
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index da46471337c8..cf863db27700 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -24,7 +24,6 @@
 #define LPFC_XRI_EXCH_BUSY_WAIT_TMO             10000
 #define LPFC_XRI_EXCH_BUSY_WAIT_T1              10
 #define LPFC_XRI_EXCH_BUSY_WAIT_T2              30000
-#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32
 #define LPFC_RPI_LOW_WATER_MARK                 10
 
 #define LPFC_UNREG_FCF                          1
@@ -155,7 +154,11 @@ struct lpfc_queue {
         uint32_t entry_count;   /* Number of entries to support on the queue */
         uint32_t entry_size;    /* Size of each queue entry. */
         uint32_t entry_repost;  /* Count of entries before doorbell is rung */
-#define LPFC_QUEUE_MIN_REPOST   8
+#define LPFC_EQ_REPOST          8
+#define LPFC_MQ_REPOST          8
+#define LPFC_CQ_REPOST          64
+#define LPFC_RQ_REPOST          64
+#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32  /* For WQs */
         uint32_t queue_id;      /* Queue ID assigned by the hardware */
         uint32_t assoc_qid;     /* Queue ID associated with, for CQ/WQ/MQ */
         uint32_t page_count;    /* Number of pages allocated for this queue */
@@ -195,7 +198,7 @@ struct lpfc_queue {
 /* defines for RQ stats */
 #define RQ_no_posted_buf        q_cnt_1
 #define RQ_no_buf_found         q_cnt_2
-#define RQ_buf_trunc            q_cnt_3
+#define RQ_buf_posted           q_cnt_3
 #define RQ_rcv_buf              q_cnt_4
 
         uint64_t isr_timestamp;
@@ -617,12 +620,17 @@ struct lpfc_sli4_hba {
         uint16_t scsi_xri_start;
         uint16_t els_xri_cnt;
         uint16_t nvmet_xri_cnt;
+        uint16_t nvmet_ctx_cnt;
+        uint16_t nvmet_io_wait_cnt;
+        uint16_t nvmet_io_wait_total;
         struct list_head lpfc_els_sgl_list;
         struct list_head lpfc_abts_els_sgl_list;
         struct list_head lpfc_nvmet_sgl_list;
         struct list_head lpfc_abts_nvmet_ctx_list;
         struct list_head lpfc_abts_scsi_buf_list;
         struct list_head lpfc_abts_nvme_buf_list;
+        struct list_head lpfc_nvmet_ctx_list;
+        struct list_head lpfc_nvmet_io_wait_list;
         struct lpfc_sglq **lpfc_sglq_active_list;
         struct list_head lpfc_rpi_hdr_list;
         unsigned long *rpi_bmask;
@@ -654,6 +662,7 @@ struct lpfc_sli4_hba {
         spinlock_t abts_scsi_buf_list_lock; /* list of aborted SCSI IOs */
         spinlock_t sgl_list_lock; /* list of aborted els IOs */
         spinlock_t nvmet_io_lock;
+        spinlock_t nvmet_io_wait_lock; /* IOs waiting for ctx resources */
         uint32_t physical_port;
 
         /* CPU to vector mapping information */
@@ -661,8 +670,6 @@ struct lpfc_sli4_hba {
         uint16_t num_online_cpu;
         uint16_t num_present_cpu;
         uint16_t curr_disp_cpu;
-
-        uint16_t nvmet_mrq_post_idx;
 };
 
 enum lpfc_sge_type {
@@ -698,6 +705,7 @@ struct lpfc_rpi_hdr {
         struct lpfc_dmabuf *dmabuf;
         uint32_t page_count;
         uint32_t start_rpi;
+        uint16_t next_rpi;
 };
 
 struct lpfc_rsrc_blks {
@@ -762,7 +770,6 @@ int lpfc_rq_create(struct lpfc_hba *, struct lpfc_queue *,
 int lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                         struct lpfc_queue **drqp, struct lpfc_queue **cqp,
                         uint32_t subtype);
-void lpfc_rq_adjust_repost(struct lpfc_hba *, struct lpfc_queue *, int);
 int lpfc_eq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_cq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_mq_destroy(struct lpfc_hba *, struct lpfc_queue *);
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 1c26dc67151b..c2653244221c 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -20,7 +20,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "11.2.0.12"
+#define LPFC_DRIVER_VERSION "11.2.0.14"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index 5ca3e8c28a3f..32632c9b2276 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -38,7 +38,7 @@ struct qedi_endpoint;
 #define QEDI_MAX_ISCSI_TASK             4096
 #define QEDI_MAX_TASK_NUM               0x0FFF
 #define QEDI_MAX_ISCSI_CONNS_PER_HBA    1024
-#define QEDI_ISCSI_MAX_BDS_PER_CMD      256     /* Firmware max BDs is 256 */
+#define QEDI_ISCSI_MAX_BDS_PER_CMD      255     /* Firmware max BDs is 255 */
 #define MAX_OUSTANDING_TASKS_PER_CON    1024
 
 #define QEDI_MAX_BD_LEN         0xffff
@@ -63,6 +63,7 @@ struct qedi_endpoint;
 #define QEDI_PAGE_MASK          (~((QEDI_PAGE_SIZE) - 1))
 
 #define QEDI_PAGE_SIZE          4096
+#define QEDI_HW_DMA_BOUNDARY    0xfff
 #define QEDI_PATH_HANDLE        0xFE0000000UL
 
 struct qedi_uio_ctrl {
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index d6978cbc56f0..8bc7ee1a8ca8 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -1494,6 +1494,8 @@ static int qedi_send_iscsi_tmf(struct qedi_conn *qedi_conn,
         tmf_hdr = (struct iscsi_tm *)mtask->hdr;
         qedi_cmd = (struct qedi_cmd *)mtask->dd_data;
         ep = qedi_conn->ep;
+        if (!ep)
+                return -ENODEV;
 
         tid = qedi_get_task_idx(qedi);
         if (tid == -1)
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index 3548d46f9b27..87f0af358b33 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -59,6 +59,7 @@ struct scsi_host_template qedi_host_template = {
         .this_id = -1,
         .sg_tablesize = QEDI_ISCSI_MAX_BDS_PER_CMD,
         .max_sectors = 0xffff,
+        .dma_boundary = QEDI_HW_DMA_BOUNDARY,
         .cmd_per_lun = 128,
         .use_clustering = ENABLE_CLUSTERING,
         .shost_attrs = qedi_shost_attrs,
@@ -1223,8 +1224,12 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
 
         iscsi_cid = (u32)path_data->handle;
         qedi_ep = qedi->ep_tbl[iscsi_cid];
-        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_CONN,
+        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                   "iscsi_cid=0x%x, qedi_ep=%p\n", iscsi_cid, qedi_ep);
+        if (!qedi_ep) {
+                ret = -EINVAL;
+                goto set_path_exit;
+        }
 
         if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
                 QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 92775a8b74b1..09a294634bc7 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -151,6 +151,11 @@ static int qedi_uio_close(struct uio_info *uinfo, struct inode *inode)
 
 static void __qedi_free_uio_rings(struct qedi_uio_dev *udev)
 {
+        if (udev->uctrl) {
+                free_page((unsigned long)udev->uctrl);
+                udev->uctrl = NULL;
+        }
+
         if (udev->ll2_ring) {
                 free_page((unsigned long)udev->ll2_ring);
                 udev->ll2_ring = NULL;
@@ -169,7 +174,6 @@ static void __qedi_free_uio(struct qedi_uio_dev *udev)
         __qedi_free_uio_rings(udev);
 
         pci_dev_put(udev->pdev);
-        kfree(udev->uctrl);
         kfree(udev);
 }
 
@@ -208,6 +212,11 @@ static int __qedi_alloc_uio_rings(struct qedi_uio_dev *udev)
         if (udev->ll2_ring || udev->ll2_buf)
                 return rc;
 
+        /* Memory for control area.  */
+        udev->uctrl = (void *)get_zeroed_page(GFP_KERNEL);
+        if (!udev->uctrl)
+                return -ENOMEM;
+
         /* Allocating memory for LL2 ring  */
         udev->ll2_ring_size = QEDI_PAGE_SIZE;
         udev->ll2_ring = (void *)get_zeroed_page(GFP_KERNEL | __GFP_COMP);
@@ -237,7 +246,6 @@ exit_alloc_ring:
 static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
 {
         struct qedi_uio_dev *udev = NULL;
-        struct qedi_uio_ctrl *uctrl = NULL;
         int rc = 0;
 
         list_for_each_entry(udev, &qedi_udev_list, list) {
@@ -258,21 +266,14 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
                 goto err_udev;
         }
 
-        uctrl = kzalloc(sizeof(*uctrl), GFP_KERNEL);
-        if (!uctrl) {
-                rc = -ENOMEM;
-                goto err_uctrl;
-        }
-
         udev->uio_dev = -1;
 
         udev->qedi = qedi;
         udev->pdev = qedi->pdev;
-        udev->uctrl = uctrl;
 
         rc = __qedi_alloc_uio_rings(udev);
         if (rc)
-                goto err_uio_rings;
+                goto err_uctrl;
 
         list_add(&udev->list, &qedi_udev_list);
 
@@ -283,8 +284,6 @@ static int qedi_alloc_uio_rings(struct qedi_ctx *qedi)
         udev->rx_pkt = udev->ll2_buf + LL2_SINGLE_BUF_SIZE;
         return 0;
 
- err_uio_rings:
-        kfree(uctrl);
  err_uctrl:
         kfree(udev);
  err_udev:
@@ -828,6 +827,8 @@ static int qedi_set_iscsi_pf_param(struct qedi_ctx *qedi)
         qedi->pf_params.iscsi_pf_params.num_uhq_pages_in_ring = num_sq_pages;
         qedi->pf_params.iscsi_pf_params.num_queues = qedi->num_queues;
         qedi->pf_params.iscsi_pf_params.debug_mode = qedi_fw_debug;
+        qedi->pf_params.iscsi_pf_params.two_msl_timer = 4000;
+        qedi->pf_params.iscsi_pf_params.max_fin_rt = 2;
 
         for (log_page_size = 0 ; log_page_size < 32 ; log_page_size++) {
                 if ((1 << log_page_size) == PAGE_SIZE)
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 16d1cd50feed..ca3420de5a01 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -730,6 +730,8 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
                 return -EIO;
         }
 
+        memset(&elreq, 0, sizeof(elreq));
+
         elreq.req_sg_cnt = dma_map_sg(&ha->pdev->dev,
                 bsg_job->request_payload.sg_list, bsg_job->request_payload.sg_cnt,
                 DMA_TO_DEVICE);
@@ -795,10 +797,9 @@ qla2x00_process_loopback(struct bsg_job *bsg_job)
 
         if (atomic_read(&vha->loop_state) == LOOP_READY &&
             (ha->current_topology == ISP_CFG_F ||
-            ((IS_QLA81XX(ha) || IS_QLA8031(ha) || IS_QLA8044(ha)) &&
-            le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE
-            && req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
-                elreq.options == EXTERNAL_LOOPBACK) {
+            (le32_to_cpu(*(uint32_t *)req_data) == ELS_OPCODE_BYTE &&
+             req_data_len == MAX_ELS_FRAME_PAYLOAD)) &&
+            elreq.options == EXTERNAL_LOOPBACK) {
                 type = "FC_BSG_HST_VENDOR_ECHO_DIAG";
                 ql_dbg(ql_dbg_user, vha, 0x701e,
                     "BSG request type: %s.\n", type);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 51b4179469d1..88748a6ab73f 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -1131,7 +1131,7 @@ qla24xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
@@ -2090,7 +2090,7 @@ qla83xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 
         /* Mailbox registers. */
         mbx_reg = &reg->mailbox0;
-        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, dmp_reg++)
+        for (cnt = 0; cnt < sizeof(fw->mailbox_reg) / 2; cnt++, mbx_reg++)
                 fw->mailbox_reg[cnt] = htons(RD_REG_WORD(mbx_reg));
 
         /* Transfer sequence registers. */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index ae119018dfaa..eddbc1218a39 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -3425,6 +3425,7 @@ struct qla_hw_data {
         uint8_t         max_req_queues;
         uint8_t         max_rsp_queues;
         uint8_t         max_qpairs;
+        uint8_t         num_qpairs;
         struct qla_qpair *base_qpair;
         struct qla_npiv_entry *npiv_info;
         uint16_t        nvram_npiv_size;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 034743309ada..0391fc317003 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -7543,12 +7543,13 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, int v
                 /* Assign available que pair id */
                 mutex_lock(&ha->mq_lock);
                 qpair_id = find_first_zero_bit(ha->qpair_qid_map, ha->max_qpairs);
-                if (qpair_id >= ha->max_qpairs) {
+                if (ha->num_qpairs >= ha->max_qpairs) {
                         mutex_unlock(&ha->mq_lock);
                         ql_log(ql_log_warn, vha, 0x0183,
                             "No resources to create additional q pair.\n");
                         goto fail_qid_map;
                 }
+                ha->num_qpairs++;
                 set_bit(qpair_id, ha->qpair_qid_map);
                 ha->queue_pair_map[qpair_id] = qpair;
                 qpair->id = qpair_id;
@@ -7635,6 +7636,7 @@ fail_rsp:
 fail_msix:
         ha->queue_pair_map[qpair_id] = NULL;
         clear_bit(qpair_id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         mutex_unlock(&ha->mq_lock);
 fail_qid_map:
         kfree(qpair);
@@ -7660,6 +7662,7 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair)
         mutex_lock(&ha->mq_lock);
         ha->queue_pair_map[qpair->id] = NULL;
         clear_bit(qpair->id, ha->qpair_qid_map);
+        ha->num_qpairs--;
         list_del(&qpair->qp_list_elem);
         if (list_empty(&vha->qp_list))
                 vha->flags.qpairs_available = 0;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 66df6cec59da..c61a6a871c8e 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -129,28 +129,16 @@ qla2x00_clear_loop_id(fc_port_t *fcport) {
 }
 
 static inline void
-qla2x00_clean_dsd_pool(struct qla_hw_data *ha, srb_t *sp,
-        struct qla_tgt_cmd *tc)
+qla2x00_clean_dsd_pool(struct qla_hw_data *ha, struct crc_context *ctx)
 {
-        struct dsd_dma *dsd_ptr, *tdsd_ptr;
-        struct crc_context *ctx;
-
-        if (sp)
-                ctx = (struct crc_context *)GET_CMD_CTX_SP(sp);
-        else if (tc)
-                ctx = (struct crc_context *)tc->ctx;
-        else {
-                BUG();
-                return;
-        }
+        struct dsd_dma *dsd, *tdsd;
 
         /* clean up allocated prev pool */
-        list_for_each_entry_safe(dsd_ptr, tdsd_ptr,
-            &ctx->dsd_list, list) {
-                dma_pool_free(ha->dl_dma_pool, dsd_ptr->dsd_addr,
-                    dsd_ptr->dsd_list_dma);
-                list_del(&dsd_ptr->list);
-                kfree(dsd_ptr);
+        list_for_each_entry_safe(dsd, tdsd, &ctx->dsd_list, list) {
+                dma_pool_free(ha->dl_dma_pool, dsd->dsd_addr,
+                    dsd->dsd_list_dma);
+                list_del(&dsd->list);
+                kfree(dsd);
         }
         INIT_LIST_HEAD(&ctx->dsd_list);
 }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index aac03504d9a3..2572121b765b 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3282,7 +3282,7 @@ msix_register_fail:
         }
 
         /* Enable MSI-X vector for response queue update for queue 0 */
-        if (IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
+        if (IS_QLA25XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha)) {
                 if (ha->msixbase && ha->mqiobase &&
                     (ha->max_rsp_queues > 1 || ha->max_req_queues > 1 ||
                      ql2xmqsupport))
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index a113ab3592a7..cba1fc5e8be9 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -3676,15 +3676,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                                 qlt_update_host_map(vha, id);
                         }
 
-                        fc_host_port_name(vha->host) =
-                            wwn_to_u64(vha->port_name);
-
-                        if (qla_ini_mode_enabled(vha))
-                                ql_dbg(ql_dbg_mbx, vha, 0x1018,
-                                    "FA-WWN portname %016llx (%x)\n",
-                                    fc_host_port_name(vha->host),
-                                    rptid_entry->vp_status);
-
                         set_bit(REGISTER_FC4_NEEDED, &vha->dpc_flags);
                         set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
                 } else {
@@ -4821,9 +4812,9 @@ qla2x00_echo_test(scsi_qla_host_t *vha, struct msg_echo_lb *mreq,
 
         memset(mcp->mb, 0 , sizeof(mcp->mb));
         mcp->mb[0] = MBC_DIAGNOSTIC_ECHO;
-        mcp->mb[1] = mreq->options | BIT_6;     /* BIT_6 specifies 64bit address */
+        /* BIT_6 specifies 64bit address */
+        mcp->mb[1] = mreq->options | BIT_15 | BIT_6;
         if (IS_CNA_CAPABLE(ha)) {
-                mcp->mb[1] |= BIT_15;
                 mcp->mb[2] = vha->fcoe_fcf_idx;
         }
         mcp->mb[16] = LSW(mreq->rcv_dma);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1c7957903283..79f050256c55 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -630,29 +630,34 @@ qla2x00_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx0, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
+                struct ct6_dsd *ctx1 = ctx;
 
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
-                        ctx1->fcp_cmnd_dma);
+                    ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
                 ha->gbl_dsd_inuse -= ctx1->dsd_use_cnt;
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
 
+end:
         CMD_SP(cmd) = NULL;
         qla2x00_rel_sp(sp);
 }
@@ -699,21 +704,24 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 sp->flags &= ~SRB_CRC_PROT_DMA_VALID;
         }
 
+        if (!ctx)
+                goto end;
+
         if (sp->flags & SRB_CRC_CTX_DSD_VALID) {
                 /* List assured to be having elements */
-                qla2x00_clean_dsd_pool(ha, sp, NULL);
+                qla2x00_clean_dsd_pool(ha, ctx);
                 sp->flags &= ~SRB_CRC_CTX_DSD_VALID;
         }
 
         if (sp->flags & SRB_CRC_CTX_DMA_VALID) {
-                dma_pool_free(ha->dl_dma_pool, ctx,
-                    ((struct crc_context *)ctx)->crc_ctx_dma);
+                struct crc_context *ctx0 = ctx;
+
+                dma_pool_free(ha->dl_dma_pool, ctx, ctx0->crc_ctx_dma);
                 sp->flags &= ~SRB_CRC_CTX_DMA_VALID;
         }
 
         if (sp->flags & SRB_FCP_CMND_DMA_VALID) {
-                struct ct6_dsd *ctx1 = (struct ct6_dsd *)ctx;
-
+                struct ct6_dsd *ctx1 = ctx;
                 dma_pool_free(ha->fcp_cmnd_dma_pool, ctx1->fcp_cmnd,
                     ctx1->fcp_cmnd_dma);
                 list_splice(&ctx1->dsd_list, &ha->gbl_dsd_list);
@@ -721,7 +729,7 @@ qla2xxx_qpair_sp_free_dma(void *ptr)
                 ha->gbl_dsd_avail += ctx1->dsd_use_cnt;
                 mempool_free(ctx1, ha->ctx_mempool);
         }
-
+end:
         CMD_SP(cmd) = NULL;
         qla2xxx_rel_qpair_sp(sp->qpair, sp);
 }
@@ -1632,7 +1640,7 @@ qla2x00_loop_reset(scsi_qla_host_t *vha)
 void
 qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
 {
-        int que, cnt;
+        int que, cnt, status;
         unsigned long flags;
         srb_t *sp;
         struct qla_hw_data *ha = vha->hw;
@@ -1662,8 +1670,12 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                          */
                                         sp_get(sp);
                                         spin_unlock_irqrestore(&ha->hardware_lock, flags);
-                                        qla2xxx_eh_abort(GET_CMD_SP(sp));
+                                        status = qla2xxx_eh_abort(GET_CMD_SP(sp));
                                         spin_lock_irqsave(&ha->hardware_lock, flags);
+                                        /* Get rid of extra reference if immediate exit
+                                         * from ql2xxx_eh_abort */
+                                        if (status == FAILED && (qla2x00_isp_reg_stat(ha)))
+                                                atomic_dec(&sp->ref_count);
                                 }
                                 req->outstanding_cmds[cnt] = NULL;
                                 sp->done(sp, res);
@@ -2623,10 +2635,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         if (mem_only) {
                 if (pci_enable_device_mem(pdev))
-                        goto probe_out;
+                        return ret;
         } else {
                 if (pci_enable_device(pdev))
-                        goto probe_out;
+                        return ret;
         }
 
         /* This may fail but that's ok */
@@ -2636,7 +2648,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         if (!ha) {
                 ql_log_pci(ql_log_fatal, pdev, 0x0009,
                     "Unable to allocate memory for ha.\n");
-                goto probe_out;
+                goto disable_device;
         }
         ql_dbg_pci(ql_dbg_init, pdev, 0x000a,
             "Memory allocated for ha=%p.\n", ha);
@@ -3254,7 +3266,7 @@ iospace_config_failed:
         pci_release_selected_regions(ha->pdev, ha->bars);
         kfree(ha);
 
-probe_out:
+disable_device:
         pci_disable_device(pdev);
         return ret;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 0e03ca2ab3e5..e766d8412384 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -2245,11 +2245,13 @@ static void qlt_unmap_sg(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd)
                 pci_unmap_sg(ha->pdev, cmd->prot_sg, cmd->prot_sg_cnt,
                         cmd->dma_data_direction);
 
+        if (!cmd->ctx)
+                return;
+
         if (cmd->ctx_dsd_alloced)
-                qla2x00_clean_dsd_pool(ha, NULL, cmd);
+                qla2x00_clean_dsd_pool(ha, cmd->ctx);
 
-        if (cmd->ctx)
-                dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
+        dma_pool_free(ha->dl_dma_pool, cmd->ctx, cmd->ctx->crc_ctx_dma);
 }
 
 static int qlt_check_reserve_free_req(struct scsi_qla_host *vha,
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 8a58ef3adab4..c197972a3e2d 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -371,7 +371,7 @@ qla27xx_fwdt_entry_t262(struct scsi_qla_host *vha,
                 goto done;
         }
 
-        if (end <= start || start == 0 || end == 0) {
+        if (end < start || start == 0 || end == 0) {
                 ql_dbg(ql_dbg_misc, vha, 0xd023,
                     "%s: unusable range (start=%x end=%x)\n", __func__,
                     ent->t262.end_addr, ent->t262.start_addr);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 17249c3650fe..dc095a292c61 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -1404,7 +1404,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
         arr[5] = (int)have_dif_prot;    /* PROTECT bit */
         if (sdebug_vpd_use_hostno == 0)
-                arr[5] = 0x10; /* claim: implicit TGPS */
+                arr[5] |= 0x10; /* claim: implicit TPGS */
         arr[6] = 0x10; /* claim: MultiP */
         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index e31f1cc90b81..99e16ac479e3 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1851,7 +1851,7 @@ static int scsi_mq_prep_fn(struct request *req)
 
         /* zero out the cmd, except for the embedded scsi_request */
         memset((char *)cmd + sizeof(cmd->req), 0,
-                sizeof(*cmd) - sizeof(cmd->req));
+                sizeof(*cmd) - sizeof(cmd->req) + shost->hostt->cmd_size);
 
         req->special = cmd;
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f9d1432d7cc5..b6bb4e0ce0e3 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -827,21 +827,32 @@ static int sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd)
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
         u64 sector = blk_rq_pos(rq) >> (ilog2(sdp->sector_size) - 9);
         u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+        int ret;
 
         if (!(rq->cmd_flags & REQ_NOUNMAP)) {
                 switch (sdkp->zeroing_mode) {
                 case SD_ZERO_WS16_UNMAP:
-                        return sd_setup_write_same16_cmnd(cmd, true);
+                        ret = sd_setup_write_same16_cmnd(cmd, true);
+                        goto out;
                 case SD_ZERO_WS10_UNMAP:
-                        return sd_setup_write_same10_cmnd(cmd, true);
+                        ret = sd_setup_write_same10_cmnd(cmd, true);
+                        goto out;
                 }
         }
 
         if (sdp->no_write_same)
                 return BLKPREP_INVALID;
+
         if (sdkp->ws16 || sector > 0xffffffff || nr_sectors > 0xffff)
-                return sd_setup_write_same16_cmnd(cmd, false);
-        return sd_setup_write_same10_cmnd(cmd, false);
+                ret = sd_setup_write_same16_cmnd(cmd, false);
+        else
+                ret = sd_setup_write_same10_cmnd(cmd, false);
+
+out:
+        if (sd_is_zoned(sdkp) && ret == BLKPREP_OK)
+                return sd_zbc_write_lock_zone(cmd);
+
+        return ret;
 }
 
 static void sd_config_write_same(struct scsi_disk *sdkp)
@@ -948,6 +959,10 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         rq->__data_len = sdp->sector_size;
         ret = scsi_init_io(cmd);
         rq->__data_len = nr_bytes;
+
+        if (sd_is_zoned(sdkp) && ret != BLKPREP_OK)
+                sd_zbc_write_unlock_zone(cmd);
+
         return ret;
 }
 
@@ -1567,17 +1582,21 @@ out:
         return retval;
 }
 
-static int sd_sync_cache(struct scsi_disk *sdkp)
+static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
 {
         int retries, res;
         struct scsi_device *sdp = sdkp->device;
         const int timeout = sdp->request_queue->rq_timeout
                 * SD_FLUSH_TIMEOUT_MULTIPLIER;
-        struct scsi_sense_hdr sshdr;
+        struct scsi_sense_hdr my_sshdr;
 
         if (!scsi_device_online(sdp))
                 return -ENODEV;
 
+        /* caller might not be interested in sense, but we need it */
+        if (!sshdr)
+                sshdr = &my_sshdr;
+
         for (retries = 3; retries > 0; --retries) {
                 unsigned char cmd[10] = { 0 };
 
@@ -1586,7 +1605,7 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                  * Leave the rest of the command zero to indicate
                  * flush everything.
                  */
-                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr,
+                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, sshdr,
                                 timeout, SD_MAX_RETRIES, 0, RQF_PM, NULL);
                 if (res == 0)
                         break;
@@ -1596,11 +1615,12 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                 sd_print_result(sdkp, "Synchronize Cache(10) failed", res);
 
                 if (driver_byte(res) & DRIVER_SENSE)
-                        sd_print_sense_hdr(sdkp, &sshdr);
+                        sd_print_sense_hdr(sdkp, sshdr);
+
                 /* we need to evaluate the error return  */
-                if (scsi_sense_valid(&sshdr) &&
-                        (sshdr.asc == 0x3a ||   /* medium not present */
-                         sshdr.asc == 0x20))    /* invalid command */
+                if (scsi_sense_valid(sshdr) &&
+                        (sshdr->asc == 0x3a ||  /* medium not present */
+                         sshdr->asc == 0x20))   /* invalid command */
                                 /* this is no error here */
                                 return 0;
 
@@ -3444,7 +3464,7 @@ static void sd_shutdown(struct device *dev)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                sd_sync_cache(sdkp);
+                sd_sync_cache(sdkp, NULL);
         }
 
         if (system_state != SYSTEM_RESTART && sdkp->device->manage_start_stop) {
@@ -3456,6 +3476,7 @@ static void sd_shutdown(struct device *dev)
 static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 {
         struct scsi_disk *sdkp = dev_get_drvdata(dev);
+        struct scsi_sense_hdr sshdr;
         int ret = 0;
 
         if (!sdkp)      /* E.g.: runtime suspend following sd_remove() */
@@ -3463,12 +3484,23 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                ret = sd_sync_cache(sdkp);
+                ret = sd_sync_cache(sdkp, &sshdr);
+
                 if (ret) {
                         /* ignore OFFLINE device */
                         if (ret == -ENODEV)
-                                ret = 0;
-                        goto done;
+                                return 0;
+
+                        if (!scsi_sense_valid(&sshdr) ||
+                            sshdr.sense_key != ILLEGAL_REQUEST)
+                                return ret;
+
+                        /*
+                         * sshdr.sense_key == ILLEGAL_REQUEST means this drive
+                         * doesn't support sync. There's not much to do and
+                         * suspend shouldn't fail.
+                         */
+                         ret = 0;
                 }
         }
 
@@ -3480,7 +3512,6 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
                         ret = 0;
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0a38ba01b7b4..82c33a6edbea 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
                         resp->done = 2; /* guard against other readers */
-                        break;
+                        write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+                        return resp;
                 }
         }
         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
-        return resp;
+        return NULL;
 }
 
 /* always adds to end of list */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index abc7e87937cc..ffe8d8608818 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7698,6 +7698,12 @@ static inline void ufshcd_add_sysfs_nodes(struct ufs_hba *hba)
         ufshcd_add_spm_lvl_sysfs_nodes(hba);
 }
 
+static inline void ufshcd_remove_sysfs_nodes(struct ufs_hba *hba)
+{
+        device_remove_file(hba->dev, &hba->rpm_lvl_attr);
+        device_remove_file(hba->dev, &hba->spm_lvl_attr);
+}
+
 /**
  * ufshcd_shutdown - shutdown routine
  * @hba: per adapter instance
@@ -7735,6 +7741,7 @@ EXPORT_SYMBOL(ufshcd_shutdown);
  */
 void ufshcd_remove(struct ufs_hba *hba)
 {
+        ufshcd_remove_sysfs_nodes(hba);
         scsi_remove_host(hba->host);
         /* disable interrupts */
         ufshcd_disable_intr(hba, hba->intr_mask);
diff --git a/drivers/staging/ccree/Kconfig b/drivers/staging/ccree/Kconfig
index ae627049c499..4be87f503e3b 100644
--- a/drivers/staging/ccree/Kconfig
+++ b/drivers/staging/ccree/Kconfig
@@ -1,6 +1,6 @@
 config CRYPTO_DEV_CCREE
         tristate "Support for ARM TrustZone CryptoCell C7XX family of Crypto accelerators"
-        depends on CRYPTO_HW && OF && HAS_DMA
+        depends on CRYPTO && CRYPTO_HW && OF && HAS_DMA
         default n
         select CRYPTO_HASH
         select CRYPTO_BLKCIPHER
diff --git a/drivers/staging/ccree/ssi_buffer_mgr.c b/drivers/staging/ccree/ssi_buffer_mgr.c
index 038e2ff5e545..6471d3d2d375 100644
--- a/drivers/staging/ccree/ssi_buffer_mgr.c
+++ b/drivers/staging/ccree/ssi_buffer_mgr.c
@@ -216,7 +216,8 @@ void ssi_buffer_mgr_copy_scatterlist_portion(
         uint32_t nents, lbytes;
 
         nents = ssi_buffer_mgr_get_sgl_nents(sg, end, &lbytes, NULL);
-        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip), 0, (direct == SSI_SG_TO_BUF));
+        sg_copy_buffer(sg, nents, (void *)dest, (end - to_skip + 1), to_skip,
+                       (direct == SSI_SG_TO_BUF));
 }
 
 static inline int ssi_buffer_mgr_render_buff_to_mlli(
diff --git a/drivers/staging/iio/cdc/ad7152.c b/drivers/staging/iio/cdc/ad7152.c
index dc6ecd824365..ff10d1f0a7e4 100644
--- a/drivers/staging/iio/cdc/ad7152.c
+++ b/drivers/staging/iio/cdc/ad7152.c
@@ -231,16 +231,12 @@ static int ad7152_write_raw_samp_freq(struct device *dev, int val)
         if (i >= ARRAY_SIZE(ad7152_filter_rate_table))
                 i = ARRAY_SIZE(ad7152_filter_rate_table) - 1;
 
-        mutex_lock(&chip->state_lock);
         ret = i2c_smbus_write_byte_data(chip->client,
                                         AD7152_REG_CFG2, AD7152_CFG2_OSR(i));
-        if (ret < 0) {
-                mutex_unlock(&chip->state_lock);
+        if (ret < 0)
                 return ret;
-        }
 
         chip->filter_rate_setup = i;
-        mutex_unlock(&chip->state_lock);
 
         return ret;
 }
diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
index 0db662d6abdd..85b242ec5f9b 100644
--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -3267,7 +3267,7 @@ int
 kiblnd_connd(void *arg)
 {
         spinlock_t *lock = &kiblnd_data.kib_connd_lock;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         unsigned long flags;
         struct kib_conn *conn;
         int timeout;
@@ -3521,7 +3521,7 @@ kiblnd_scheduler(void *arg)
         long id = (long)arg;
         struct kib_sched_info *sched;
         struct kib_conn *conn;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         unsigned long flags;
         struct ib_wc wc;
         int did_something;
@@ -3656,7 +3656,7 @@ kiblnd_failover_thread(void *arg)
 {
         rwlock_t *glock = &kiblnd_data.kib_global_lock;
         struct kib_dev *dev;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         unsigned long flags;
         int rc;
 
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
index 3ed3b08c122c..6b38d5a8fe92 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd_cb.c
@@ -2166,7 +2166,7 @@ ksocknal_connd(void *arg)
 {
         spinlock_t *connd_lock = &ksocknal_data.ksnd_connd_lock;
         struct ksock_connreq *cr;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         int nloops = 0;
         int cons_retry = 0;
 
@@ -2554,7 +2554,7 @@ ksocknal_check_peer_timeouts(int idx)
 int
 ksocknal_reaper(void *arg)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct ksock_conn *conn;
         struct ksock_sched *sched;
         struct list_head enomem_conns;
diff --git a/drivers/staging/lustre/lnet/libcfs/debug.c b/drivers/staging/lustre/lnet/libcfs/debug.c
index c56e9922cd5b..49deb448b044 100644
--- a/drivers/staging/lustre/lnet/libcfs/debug.c
+++ b/drivers/staging/lustre/lnet/libcfs/debug.c
@@ -361,7 +361,7 @@ static int libcfs_debug_dumplog_thread(void *arg)
 
 void libcfs_debug_dumplog(void)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct task_struct *dumper;
 
         /* we're being careful to ensure that the kernel thread is
diff --git a/drivers/staging/lustre/lnet/libcfs/tracefile.c b/drivers/staging/lustre/lnet/libcfs/tracefile.c
index 9599b7441feb..27082d2f7938 100644
--- a/drivers/staging/lustre/lnet/libcfs/tracefile.c
+++ b/drivers/staging/lustre/lnet/libcfs/tracefile.c
@@ -990,7 +990,7 @@ static int tracefiled(void *arg)
         complete(&tctl->tctl_start);
 
         while (1) {
-                wait_queue_t __wait;
+                wait_queue_entry_t __wait;
 
                 pc.pc_want_daemon_pages = 0;
                 collect_pages(&pc);
diff --git a/drivers/staging/lustre/lnet/lnet/lib-eq.c b/drivers/staging/lustre/lnet/lnet/lib-eq.c
index ce4b83584e17..9ebba4ef5f90 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-eq.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-eq.c
@@ -312,7 +312,7 @@ __must_hold(&the_lnet.ln_eq_wait_lock)
 {
         int tms = *timeout_ms;
         int wait;
-        wait_queue_t wl;
+        wait_queue_entry_t wl;
         unsigned long now;
 
         if (!tms)
diff --git a/drivers/staging/lustre/lnet/lnet/lib-socket.c b/drivers/staging/lustre/lnet/lnet/lib-socket.c
index 9fca8d225ee0..f075706bba6d 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@ -516,7 +516,7 @@ lnet_sock_listen(struct socket **sockp, __u32 local_ip, int local_port,
 int
 lnet_sock_accept(struct socket **newsockp, struct socket *sock)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct socket *newsock;
         int rc;
 
diff --git a/drivers/staging/lustre/lustre/fid/fid_request.c b/drivers/staging/lustre/lustre/fid/fid_request.c
index 999f250ceed0..bf31bc200d27 100644
--- a/drivers/staging/lustre/lustre/fid/fid_request.c
+++ b/drivers/staging/lustre/lustre/fid/fid_request.c
@@ -192,7 +192,7 @@ static int seq_client_alloc_seq(const struct lu_env *env,
 }
 
 static int seq_fid_alloc_prep(struct lu_client_seq *seq,
-                              wait_queue_t *link)
+                              wait_queue_entry_t *link)
 {
         if (seq->lcs_update) {
                 add_wait_queue(&seq->lcs_waitq, link);
@@ -223,7 +223,7 @@ static void seq_fid_alloc_fini(struct lu_client_seq *seq)
 int seq_client_alloc_fid(const struct lu_env *env,
                          struct lu_client_seq *seq, struct lu_fid *fid)
 {
-        wait_queue_t link;
+        wait_queue_entry_t link;
         int rc;
 
         LASSERT(seq);
@@ -290,7 +290,7 @@ EXPORT_SYMBOL(seq_client_alloc_fid);
  */
 void seq_client_flush(struct lu_client_seq *seq)
 {
-        wait_queue_t link;
+        wait_queue_entry_t link;
 
         LASSERT(seq);
         init_waitqueue_entry(&link, current);
diff --git a/drivers/staging/lustre/lustre/include/lustre_lib.h b/drivers/staging/lustre/lustre/include/lustre_lib.h
index b04d613846ee..f24970da8323 100644
--- a/drivers/staging/lustre/lustre/include/lustre_lib.h
+++ b/drivers/staging/lustre/lustre/include/lustre_lib.h
@@ -201,7 +201,7 @@ struct l_wait_info {
                            sigmask(SIGALRM))
 
 /**
- * wait_queue_t of Linux (version < 2.6.34) is a FIFO list for exclusively
+ * wait_queue_entry_t of Linux (version < 2.6.34) is a FIFO list for exclusively
  * waiting threads, which is not always desirable because all threads will
  * be waken up again and again, even user only needs a few of them to be
  * active most time. This is not good for performance because cache can
@@ -228,7 +228,7 @@ struct l_wait_info {
  */
 #define __l_wait_event(wq, condition, info, ret, l_add_wait)               \
 do {                                                                       \
-        wait_queue_t __wait;                                             \
+        wait_queue_entry_t __wait;                                               \
         long __timeout = info->lwi_timeout;                       \
         sigset_t   __blocked;                                         \
         int   __allow_intr = info->lwi_allow_intr;                           \
diff --git a/drivers/staging/lustre/lustre/llite/lcommon_cl.c b/drivers/staging/lustre/lustre/llite/lcommon_cl.c
index 8af611033e12..96515b839436 100644
--- a/drivers/staging/lustre/lustre/llite/lcommon_cl.c
+++ b/drivers/staging/lustre/lustre/llite/lcommon_cl.c
@@ -207,7 +207,7 @@ int cl_file_inode_init(struct inode *inode, struct lustre_md *md)
 static void cl_object_put_last(struct lu_env *env, struct cl_object *obj)
 {
         struct lu_object_header *header = obj->co_lu.lo_header;
-        wait_queue_t       waiter;
+        wait_queue_entry_t         waiter;
 
         if (unlikely(atomic_read(&header->loh_ref) != 1)) {
                 struct lu_site *site = obj->co_lu.lo_dev->ld_site;
diff --git a/drivers/staging/lustre/lustre/lov/lov_cl_internal.h b/drivers/staging/lustre/lustre/lov/lov_cl_internal.h
index 391c632365ae..e889d3a7de9c 100644
--- a/drivers/staging/lustre/lustre/lov/lov_cl_internal.h
+++ b/drivers/staging/lustre/lustre/lov/lov_cl_internal.h
@@ -370,7 +370,7 @@ struct lov_thread_info {
         struct ost_lvb    lti_lvb;
         struct cl_2queue        lti_cl2q;
         struct cl_page_list     lti_plist;
-        wait_queue_t      lti_waiter;
+        wait_queue_entry_t        lti_waiter;
         struct cl_attr          lti_attr;
 };
 
diff --git a/drivers/staging/lustre/lustre/lov/lov_object.c b/drivers/staging/lustre/lustre/lov/lov_object.c
index ab3ecfeeadc8..eddabbe31e5c 100644
--- a/drivers/staging/lustre/lustre/lov/lov_object.c
+++ b/drivers/staging/lustre/lustre/lov/lov_object.c
@@ -371,7 +371,7 @@ static void lov_subobject_kill(const struct lu_env *env, struct lov_object *lov,
         struct lov_layout_raid0 *r0;
         struct lu_site    *site;
         struct lu_site_bkt_data *bkt;
-        wait_queue_t      *waiter;
+        wait_queue_entry_t        *waiter;
 
         r0  = &lov->u.raid0;
         LASSERT(r0->lo_sub[idx] == los);
diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c
index 2e1bd47337fd..e6727cefde05 100644
--- a/drivers/staging/lustre/lustre/lov/lov_pack.c
+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c
@@ -293,18 +293,10 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
         size_t lmmk_size;
         size_t lum_size;
         int rc;
-        mm_segment_t seg;
 
         if (!lsm)
                 return -ENODATA;
 
-        /*
-         * "Switch to kernel segment" to allow copying from kernel space by
-         * copy_{to,from}_user().
-         */
-        seg = get_fs();
-        set_fs(KERNEL_DS);
-
         if (lsm->lsm_magic != LOV_MAGIC_V1 && lsm->lsm_magic != LOV_MAGIC_V3) {
                 CERROR("bad LSM MAGIC: 0x%08X != 0x%08X nor 0x%08X\n",
                        lsm->lsm_magic, LOV_MAGIC_V1, LOV_MAGIC_V3);
@@ -406,6 +398,5 @@ int lov_getstripe(struct lov_object *obj, struct lov_stripe_md *lsm,
 out_free:
         kvfree(lmmk);
 out:
-        set_fs(seg);
         return rc;
 }
diff --git a/drivers/staging/lustre/lustre/obdclass/lu_object.c b/drivers/staging/lustre/lustre/obdclass/lu_object.c
index abcf951208d2..76ae600ae2c8 100644
--- a/drivers/staging/lustre/lustre/obdclass/lu_object.c
+++ b/drivers/staging/lustre/lustre/obdclass/lu_object.c
@@ -556,7 +556,7 @@ EXPORT_SYMBOL(lu_object_print);
 static struct lu_object *htable_lookup(struct lu_site *s,
                                        struct cfs_hash_bd *bd,
                                        const struct lu_fid *f,
-                                       wait_queue_t *waiter,
+                                       wait_queue_entry_t *waiter,
                                        __u64 *version)
 {
         struct lu_site_bkt_data *bkt;
@@ -670,7 +670,7 @@ static struct lu_object *lu_object_find_try(const struct lu_env *env,
                                             struct lu_device *dev,
                                             const struct lu_fid *f,
                                             const struct lu_object_conf *conf,
-                                            wait_queue_t *waiter)
+                                            wait_queue_entry_t *waiter)
 {
         struct lu_object      *o;
         struct lu_object      *shadow;
@@ -750,7 +750,7 @@ struct lu_object *lu_object_find_at(const struct lu_env *env,
 {
         struct lu_site_bkt_data *bkt;
         struct lu_object        *obj;
-        wait_queue_t       wait;
+        wait_queue_entry_t         wait;
 
         while (1) {
                 obj = lu_object_find_try(env, dev, f, conf, &wait);
diff --git a/drivers/staging/media/atomisp/i2c/Makefile b/drivers/staging/media/atomisp/i2c/Makefile
index 8ea01904c0ea..466517c7c8e6 100644
--- a/drivers/staging/media/atomisp/i2c/Makefile
+++ b/drivers/staging/media/atomisp/i2c/Makefile
@@ -19,5 +19,3 @@ obj-$(CONFIG_VIDEO_AP1302)     += ap1302.o
 
 obj-$(CONFIG_VIDEO_LM3554) += lm3554.o
 
-ccflags-y += -Werror
-
diff --git a/drivers/staging/media/atomisp/i2c/imx/Makefile b/drivers/staging/media/atomisp/i2c/imx/Makefile
index 1d7f7ab94cac..6b13a3a66e49 100644
--- a/drivers/staging/media/atomisp/i2c/imx/Makefile
+++ b/drivers/staging/media/atomisp/i2c/imx/Makefile
@@ -4,5 +4,3 @@ imx1x5-objs := imx.o drv201.o ad5816g.o dw9714.o dw9719.o dw9718.o vcm.o otp.o o
 
 ov8858_driver-objs := ../ov8858.o dw9718.o vcm.o
 obj-$(CONFIG_VIDEO_OV8858)     += ov8858_driver.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/i2c/ov5693/Makefile b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
index fceb9e9b881b..c9c0e1245858 100644
--- a/drivers/staging/media/atomisp/i2c/ov5693/Makefile
+++ b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
@@ -1,3 +1 @@
 obj-$(CONFIG_VIDEO_OV5693) += ov5693.o
-
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
index 3fa7c1c1479f..f126a89a08e9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile
+++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
@@ -351,5 +351,5 @@ DEFINES := -DHRT_HW -DHRT_ISP_CSS_CUSTOM_HOST -DHRT_USE_VIR_ADDRS -D__HOST__
 DEFINES += -DATOMISP_POSTFIX=\"css2400b0_v21\" -DISP2400B0
 DEFINES += -DSYSTEM_hive_isp_css_2400_system -DISP2400
 
-ccflags-y += $(INCLUDES) $(DEFINES) -fno-common -Werror
+ccflags-y += $(INCLUDES) $(DEFINES) -fno-common
 
diff --git a/drivers/staging/rtl8188eu/os_dep/mon.c b/drivers/staging/rtl8188eu/os_dep/mon.c
index cfe37eb026d6..859d0d6051cd 100644
--- a/drivers/staging/rtl8188eu/os_dep/mon.c
+++ b/drivers/staging/rtl8188eu/os_dep/mon.c
@@ -152,7 +152,7 @@ static const struct net_device_ops mon_netdev_ops = {
 static void mon_setup(struct net_device *dev)
 {
         dev->netdev_ops = &mon_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         ether_setup(dev);
         dev->priv_flags |= IFF_NO_QUEUE;
         dev->type = ARPHRD_IEEE80211;
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 36c3189fc4b7..bd4352fe2de3 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -2667,7 +2667,8 @@ static int rtw_cfg80211_add_monitor_if (struct adapter *padapter, char *name, st
         mon_ndev->type = ARPHRD_IEEE80211_RADIOTAP;
         strncpy(mon_ndev->name, name, IFNAMSIZ);
         mon_ndev->name[IFNAMSIZ - 1] = 0;
-        mon_ndev->destructor = rtw_ndev_destructor;
+        mon_ndev->needs_free_netdev = true;
+        mon_ndev->priv_destructor = rtw_ndev_destructor;
 
         mon_ndev->netdev_ops = &rtw_cfg80211_monitor_if_ops;
 
diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
index f83cfc76505c..021589913681 100644
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -1207,8 +1207,6 @@ void rtw_ndev_destructor(struct net_device *ndev)
 
         if (ndev->ieee80211_ptr)
                 kfree((u8 *)ndev->ieee80211_ptr);
-
-        free_netdev(ndev);
 }
 
 void rtw_dev_unload(struct adapter *padapter)
diff --git a/drivers/staging/rtl8723bs/os_dep/osdep_service.c b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
index 02db59e8b593..aa16d1ab955b 100644
--- a/drivers/staging/rtl8723bs/os_dep/osdep_service.c
+++ b/drivers/staging/rtl8723bs/os_dep/osdep_service.c
@@ -160,7 +160,7 @@ static int isFileReadable(char *path)
                 oldfs = get_fs(); set_fs(get_ds());
 
                 if (1!=readFile(fp, &buf, 1))
-                        ret = PTR_ERR(fp);
+                        ret = -EINVAL;
 
                 set_fs(oldfs);
                 filp_close(fp, NULL);
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 26a9bcd5ee6a..0d8f81591bed 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3790,6 +3790,8 @@ int iscsi_target_tx_thread(void *arg)
 {
         int ret = 0;
         struct iscsi_conn *conn = arg;
+        bool conn_freed = false;
+
         /*
          * Allow ourselves to be interrupted by SIGINT so that a
          * connection recovery / failure event can be triggered externally.
@@ -3815,12 +3817,14 @@ get_immediate:
                         goto transport_err;
 
                 ret = iscsit_handle_response_queue(conn);
-                if (ret == 1)
+                if (ret == 1) {
                         goto get_immediate;
-                else if (ret == -ECONNRESET)
+                } else if (ret == -ECONNRESET) {
+                        conn_freed = true;
                         goto out;
-                else if (ret < 0)
+                } else if (ret < 0) {
                         goto transport_err;
+                }
         }
 
 transport_err:
@@ -3830,8 +3834,13 @@ transport_err:
          * responsible for cleaning up the early connection failure.
          */
         if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
-                iscsit_take_action_for_connection_exit(conn);
+                iscsit_take_action_for_connection_exit(conn, &conn_freed);
 out:
+        if (!conn_freed) {
+                while (!kthread_should_stop()) {
+                        msleep(100);
+                }
+        }
         return 0;
 }
 
@@ -4004,6 +4013,7 @@ int iscsi_target_rx_thread(void *arg)
 {
         int rc;
         struct iscsi_conn *conn = arg;
+        bool conn_freed = false;
 
         /*
          * Allow ourselves to be interrupted by SIGINT so that a
@@ -4016,7 +4026,7 @@ int iscsi_target_rx_thread(void *arg)
          */
         rc = wait_for_completion_interruptible(&conn->rx_login_comp);
         if (rc < 0 || iscsi_target_check_conn_state(conn))
-                return 0;
+                goto out;
 
         if (!conn->conn_transport->iscsit_get_rx_pdu)
                 return 0;
@@ -4025,7 +4035,15 @@ int iscsi_target_rx_thread(void *arg)
 
         if (!signal_pending(current))
                 atomic_set(&conn->transport_failed, 1);
-        iscsit_take_action_for_connection_exit(conn);
+        iscsit_take_action_for_connection_exit(conn, &conn_freed);
+
+out:
+        if (!conn_freed) {
+                while (!kthread_should_stop()) {
+                        msleep(100);
+                }
+        }
+
         return 0;
 }
 
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 9a96e17bf7cd..7fe2aa73cff6 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -930,8 +930,10 @@ static void iscsit_handle_connection_cleanup(struct iscsi_conn *conn)
         }
 }
 
-void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed)
 {
+        *conn_freed = false;
+
         spin_lock_bh(&conn->state_lock);
         if (atomic_read(&conn->connection_exit)) {
                 spin_unlock_bh(&conn->state_lock);
@@ -942,6 +944,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
         if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
                 spin_unlock_bh(&conn->state_lock);
                 iscsit_close_connection(conn);
+                *conn_freed = true;
                 return;
         }
 
@@ -955,4 +958,5 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
         spin_unlock_bh(&conn->state_lock);
 
         iscsit_handle_connection_cleanup(conn);
+        *conn_freed = true;
 }
diff --git a/drivers/target/iscsi/iscsi_target_erl0.h b/drivers/target/iscsi/iscsi_target_erl0.h
index 60e69e2af6ed..3822d9cd1230 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.h
+++ b/drivers/target/iscsi/iscsi_target_erl0.h
@@ -15,6 +15,6 @@ extern int iscsit_stop_time2retain_timer(struct iscsi_session *);
 extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *);
 extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
 extern void iscsit_fall_back_to_erl0(struct iscsi_session *);
-extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *);
+extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *);
 
 #endif   /*** ISCSI_TARGET_ERL0_H ***/
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 66238477137b..92b96b51d506 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1464,5 +1464,9 @@ int iscsi_target_login_thread(void *arg)
                         break;
         }
 
+        while (!kthread_should_stop()) {
+                msleep(100);
+        }
+
         return 0;
 }
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index 7ccc9c1cbfd1..6f88b31242b0 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -493,14 +493,60 @@ static void iscsi_target_restore_sock_callbacks(struct iscsi_conn *conn)
 
 static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *);
 
-static bool iscsi_target_sk_state_check(struct sock *sk)
+static bool __iscsi_target_sk_check_close(struct sock *sk)
 {
         if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) {
-                pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE,"
+                pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE,"
                         "returning FALSE\n");
-                return false;
+                return true;
         }
-        return true;
+        return false;
+}
+
+static bool iscsi_target_sk_check_close(struct iscsi_conn *conn)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                read_lock_bh(&sk->sk_callback_lock);
+                state = (__iscsi_target_sk_check_close(sk) ||
+                         test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
+}
+
+static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                read_lock_bh(&sk->sk_callback_lock);
+                state = test_bit(flag, &conn->login_flags);
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
+}
+
+static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag)
+{
+        bool state = false;
+
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+
+                write_lock_bh(&sk->sk_callback_lock);
+                state = (__iscsi_target_sk_check_close(sk) ||
+                         test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+                if (!state)
+                        clear_bit(flag, &conn->login_flags);
+                write_unlock_bh(&sk->sk_callback_lock);
+        }
+        return state;
 }
 
 static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
@@ -540,6 +586,20 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
 
         pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n",
                         conn, current->comm, current->pid);
+        /*
+         * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready()
+         * before initial PDU processing in iscsi_target_start_negotiation()
+         * has completed, go ahead and retry until it's cleared.
+         *
+         * Otherwise if the TCP connection drops while this is occuring,
+         * iscsi_target_start_negotiation() will detect the failure, call
+         * cancel_delayed_work_sync(&conn->login_work), and cleanup the
+         * remaining iscsi connection resources from iscsi_np process context.
+         */
+        if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) {
+                schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10));
+                return;
+        }
 
         spin_lock(&tpg->tpg_state_lock);
         state = (tpg->tpg_state == TPG_STATE_ACTIVE);
@@ -547,26 +607,12 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
 
         if (!state) {
                 pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
-                return;
+                goto err;
         }
 
-        if (conn->sock) {
-                struct sock *sk = conn->sock->sk;
-
-                read_lock_bh(&sk->sk_callback_lock);
-                state = iscsi_target_sk_state_check(sk);
-                read_unlock_bh(&sk->sk_callback_lock);
-
-                if (!state) {
-                        pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
-                        iscsi_target_restore_sock_callbacks(conn);
-                        iscsi_target_login_drop(conn, login);
-                        iscsit_deaccess_np(np, tpg, tpg_np);
-                        return;
-                }
+        if (iscsi_target_sk_check_close(conn)) {
+                pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
+                goto err;
         }
 
         conn->login_kworker = current;
@@ -584,34 +630,29 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
         flush_signals(current);
         conn->login_kworker = NULL;
 
-        if (rc < 0) {
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
-                return;
-        }
+        if (rc < 0)
+                goto err;
 
         pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n",
                         conn, current->comm, current->pid);
 
         rc = iscsi_target_do_login(conn, login);
         if (rc < 0) {
-                iscsi_target_restore_sock_callbacks(conn);
-                iscsi_target_login_drop(conn, login);
-                iscsit_deaccess_np(np, tpg, tpg_np);
+                goto err;
         } else if (!rc) {
-                if (conn->sock) {
-                        struct sock *sk = conn->sock->sk;
-
-                        write_lock_bh(&sk->sk_callback_lock);
-                        clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags);
-                        write_unlock_bh(&sk->sk_callback_lock);
-                }
+                if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE))
+                        goto err;
         } else if (rc == 1) {
                 iscsi_target_nego_release(conn);
                 iscsi_post_login_handler(np, conn, zero_tsih);
                 iscsit_deaccess_np(np, tpg, tpg_np);
         }
+        return;
+
+err:
+        iscsi_target_restore_sock_callbacks(conn);
+        iscsi_target_login_drop(conn, login);
+        iscsit_deaccess_np(np, tpg, tpg_np);
 }
 
 static void iscsi_target_do_cleanup(struct work_struct *work)
@@ -659,31 +700,54 @@ static void iscsi_target_sk_state_change(struct sock *sk)
                 orig_state_change(sk);
                 return;
         }
+        state = __iscsi_target_sk_check_close(sk);
+        pr_debug("__iscsi_target_sk_close_change: state: %d\n", state);
+
         if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
                 pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change"
                          " conn: %p\n", conn);
+                if (state)
+                        set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
                 write_unlock_bh(&sk->sk_callback_lock);
                 orig_state_change(sk);
                 return;
         }
-        if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
+        if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
                 pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n",
                          conn);
                 write_unlock_bh(&sk->sk_callback_lock);
                 orig_state_change(sk);
                 return;
         }
+        /*
+         * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED,
+         * but only queue conn->login_work -> iscsi_target_do_login_rx()
+         * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared.
+         *
+         * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close()
+         * will detect the dropped TCP connection from delayed workqueue context.
+         *
+         * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial
+         * iscsi_target_start_negotiation() is running, iscsi_target_do_login()
+         * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation()
+         * via iscsi_target_sk_check_and_clear() is responsible for detecting the
+         * dropped TCP connection in iscsi_np process context, and cleaning up
+         * the remaining iscsi connection resources.
+         */
+        if (state) {
+                pr_debug("iscsi_target_sk_state_change got failed state\n");
+                set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
+                state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
+                write_unlock_bh(&sk->sk_callback_lock);
 
-        state = iscsi_target_sk_state_check(sk);
-        write_unlock_bh(&sk->sk_callback_lock);
-
-        pr_debug("iscsi_target_sk_state_change: state: %d\n", state);
+                orig_state_change(sk);
 
-        if (!state) {
-                pr_debug("iscsi_target_sk_state_change got failed state\n");
-                schedule_delayed_work(&conn->login_cleanup_work, 0);
+                if (!state)
+                        schedule_delayed_work(&conn->login_work, 0);
                 return;
         }
+        write_unlock_bh(&sk->sk_callback_lock);
+
         orig_state_change(sk);
 }
 
@@ -946,6 +1010,15 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
                         if (iscsi_target_handle_csg_one(conn, login) < 0)
                                 return -1;
                         if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) {
+                                /*
+                                 * Check to make sure the TCP connection has not
+                                 * dropped asynchronously while session reinstatement
+                                 * was occuring in this kthread context, before
+                                 * transitioning to full feature phase operation.
+                                 */
+                                if (iscsi_target_sk_check_close(conn))
+                                        return -1;
+
                                 login->tsih = conn->sess->tsih;
                                 login->login_complete = 1;
                                 iscsi_target_restore_sock_callbacks(conn);
@@ -972,21 +1045,6 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
                 break;
         }
 
-        if (conn->sock) {
-                struct sock *sk = conn->sock->sk;
-                bool state;
-
-                read_lock_bh(&sk->sk_callback_lock);
-                state = iscsi_target_sk_state_check(sk);
-                read_unlock_bh(&sk->sk_callback_lock);
-
-                if (!state) {
-                        pr_debug("iscsi_target_do_login() failed state for"
-                                 " conn: %p\n", conn);
-                        return -1;
-                }
-        }
-
         return 0;
 }
 
@@ -1255,10 +1313,22 @@ int iscsi_target_start_negotiation(
 
                 write_lock_bh(&sk->sk_callback_lock);
                 set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+                set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
                 write_unlock_bh(&sk->sk_callback_lock);
         }
-
+        /*
+         * If iscsi_target_do_login returns zero to signal more PDU
+         * exchanges are required to complete the login, go ahead and
+         * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection
+         * is still active.
+         *
+         * Otherwise if TCP connection dropped asynchronously, go ahead
+         * and perform connection cleanup now.
+         */
         ret = iscsi_target_do_login(conn, login);
+        if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU))
+                ret = -1;
+
         if (ret < 0) {
                 cancel_delayed_work_sync(&conn->login_work);
                 cancel_delayed_work_sync(&conn->login_cleanup_work);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 37f57357d4a0..6025935036c9 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1160,15 +1160,28 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
         if (cmd->unknown_data_length) {
                 cmd->data_length = size;
         } else if (size != cmd->data_length) {
-                pr_warn("TARGET_CORE[%s]: Expected Transfer Length:"
+                pr_warn_ratelimited("TARGET_CORE[%s]: Expected Transfer Length:"
                         " %u does not match SCSI CDB Length: %u for SAM Opcode:"
                         " 0x%02x\n", cmd->se_tfo->get_fabric_name(),
                                 cmd->data_length, size, cmd->t_task_cdb[0]);
 
-                if (cmd->data_direction == DMA_TO_DEVICE &&
-                    cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
-                        pr_err("Rejecting underflow/overflow WRITE data\n");
-                        return TCM_INVALID_CDB_FIELD;
+                if (cmd->data_direction == DMA_TO_DEVICE) {
+                        if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
+                                pr_err_ratelimited("Rejecting underflow/overflow"
+                                                   " for WRITE data CDB\n");
+                                return TCM_INVALID_CDB_FIELD;
+                        }
+                        /*
+                         * Some fabric drivers like iscsi-target still expect to
+                         * always reject overflow writes.  Reject this case until
+                         * full fabric driver level support for overflow writes
+                         * is introduced tree-wide.
+                         */
+                        if (size > cmd->data_length) {
+                                pr_err_ratelimited("Rejecting overflow for"
+                                                   " WRITE control CDB\n");
+                                return TCM_INVALID_CDB_FIELD;
+                        }
                 }
                 /*
                  * Reject READ_* or WRITE_* with overflow/underflow for
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 9045837f748b..beb5f098f32d 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -97,7 +97,7 @@ struct tcmu_hba {
 
 struct tcmu_dev {
         struct list_head node;
-
+        struct kref kref;
         struct se_device se_dev;
 
         char *name;
@@ -969,6 +969,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
         udev = kzalloc(sizeof(struct tcmu_dev), GFP_KERNEL);
         if (!udev)
                 return NULL;
+        kref_init(&udev->kref);
 
         udev->name = kstrdup(name, GFP_KERNEL);
         if (!udev->name) {
@@ -1145,6 +1146,24 @@ static int tcmu_open(struct uio_info *info, struct inode *inode)
         return 0;
 }
 
+static void tcmu_dev_call_rcu(struct rcu_head *p)
+{
+        struct se_device *dev = container_of(p, struct se_device, rcu_head);
+        struct tcmu_dev *udev = TCMU_DEV(dev);
+
+        kfree(udev->uio_info.name);
+        kfree(udev->name);
+        kfree(udev);
+}
+
+static void tcmu_dev_kref_release(struct kref *kref)
+{
+        struct tcmu_dev *udev = container_of(kref, struct tcmu_dev, kref);
+        struct se_device *dev = &udev->se_dev;
+
+        call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
+}
+
 static int tcmu_release(struct uio_info *info, struct inode *inode)
 {
         struct tcmu_dev *udev = container_of(info, struct tcmu_dev, uio_info);
@@ -1152,7 +1171,8 @@ static int tcmu_release(struct uio_info *info, struct inode *inode)
         clear_bit(TCMU_DEV_BIT_OPEN, &udev->flags);
 
         pr_debug("close\n");
-
+        /* release ref from configure */
+        kref_put(&udev->kref, tcmu_dev_kref_release);
         return 0;
 }
 
@@ -1272,6 +1292,12 @@ static int tcmu_configure_device(struct se_device *dev)
                 dev->dev_attrib.hw_max_sectors = 128;
         dev->dev_attrib.hw_queue_depth = 128;
 
+        /*
+         * Get a ref incase userspace does a close on the uio device before
+         * LIO has initiated tcmu_free_device.
+         */
+        kref_get(&udev->kref);
+
         ret = tcmu_netlink_event(TCMU_CMD_ADDED_DEVICE, udev->uio_info.name,
                                  udev->uio_info.uio_dev->minor);
         if (ret)
@@ -1284,11 +1310,13 @@ static int tcmu_configure_device(struct se_device *dev)
         return 0;
 
 err_netlink:
+        kref_put(&udev->kref, tcmu_dev_kref_release);
         uio_unregister_device(&udev->uio_info);
 err_register:
         vfree(udev->mb_addr);
 err_vzalloc:
         kfree(info->name);
+        info->name = NULL;
 
         return ret;
 }
@@ -1302,14 +1330,6 @@ static int tcmu_check_and_free_pending_cmd(struct tcmu_cmd *cmd)
         return -EINVAL;
 }
 
-static void tcmu_dev_call_rcu(struct rcu_head *p)
-{
-        struct se_device *dev = container_of(p, struct se_device, rcu_head);
-        struct tcmu_dev *udev = TCMU_DEV(dev);
-
-        kfree(udev);
-}
-
 static bool tcmu_dev_configured(struct tcmu_dev *udev)
 {
         return udev->uio_info.uio_dev ? true : false;
@@ -1364,10 +1384,10 @@ static void tcmu_free_device(struct se_device *dev)
                                    udev->uio_info.uio_dev->minor);
 
                 uio_unregister_device(&udev->uio_info);
-                kfree(udev->uio_info.name);
-                kfree(udev->name);
         }
-        call_rcu(&dev->rcu_head, tcmu_dev_call_rcu);
+
+        /* release ref from init */
+        kref_put(&udev->kref, tcmu_dev_kref_release);
 }
 
 enum {
diff --git a/drivers/thermal/broadcom/Kconfig b/drivers/thermal/broadcom/Kconfig
index ab08af4654ef..42c098e86f84 100644
--- a/drivers/thermal/broadcom/Kconfig
+++ b/drivers/thermal/broadcom/Kconfig
@@ -9,8 +9,9 @@ config BCM2835_THERMAL
 config BCM_NS_THERMAL
         tristate "Northstar thermal driver"
         depends on ARCH_BCM_IPROC || COMPILE_TEST
+        default y if ARCH_BCM_IPROC
         help
-          Northstar is a family of SoCs that includes e.g. BCM4708, BCM47081,
-          BCM4709 and BCM47094. It contains DMU (Device Management Unit) block
-          with a thermal sensor that allows checking CPU temperature. This
-          driver provides support for it.
+          Support for the Northstar and Northstar Plus family of SoCs (e.g.
+          BCM4708, BCM4709, BCM5301x, BCM95852X, etc). It contains DMU (Device
+          Management Unit) block with a thermal sensor that allows checking CPU
+          temperature.
diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c
index 644ba526d9ea..4362a69ac88d 100644
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -195,7 +195,6 @@ static struct thermal_zone_of_device_ops tmu_tz_ops = {
 static int qoriq_tmu_probe(struct platform_device *pdev)
 {
         int ret;
-        const struct thermal_trip *trip;
         struct qoriq_tmu_data *data;
         struct device_node *np = pdev->dev.of_node;
         u32 site = 0;
@@ -243,8 +242,6 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
                 goto err_tmu;
         }
 
-        trip = of_thermal_get_trip_points(data->tz);
-
         /* Enable monitoring */
         site |= 0x1 << (15 - data->sensor_id);
         tmu_write(data, site | TMR_ME | TMR_ALPF, &data->regs->tmr);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index b21b9cc2c8d6..5a51c740e372 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -359,7 +359,7 @@ static DECLARE_DELAYED_WORK(thermal_emergency_poweroff_work,
  * This may be called from any critical situation to trigger a system shutdown
  * after a known period of time. By default this is not scheduled.
  */
-void thermal_emergency_poweroff(void)
+static void thermal_emergency_poweroff(void)
 {
         int poweroff_delay_ms = CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS;
         /*
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index ba9c302454fb..696ab3046b87 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1010,7 +1010,7 @@ ti_bandgap_force_single_read(struct ti_bandgap *bgp, int id)
 }
 
 /**
- * ti_bandgap_set_continous_mode() - One time enabling of continuous mode
+ * ti_bandgap_set_continuous_mode() - One time enabling of continuous mode
  * @bgp: pointer to struct ti_bandgap
  *
  * Call this function only if HAS(MODE_CONFIG) is set. As this driver may
@@ -1214,22 +1214,18 @@ static struct ti_bandgap *ti_bandgap_build(struct platform_device *pdev)
         }
 
         bgp = devm_kzalloc(&pdev->dev, sizeof(*bgp), GFP_KERNEL);
-        if (!bgp) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        if (!bgp)
                 return ERR_PTR(-ENOMEM);
-        }
 
         of_id = of_match_device(of_ti_bandgap_match, &pdev->dev);
         if (of_id)
                 bgp->conf = of_id->data;
 
         /* register shadow for context save and restore */
-        bgp->regval = devm_kzalloc(&pdev->dev, sizeof(*bgp->regval) *
-                                   bgp->conf->sensor_count, GFP_KERNEL);
-        if (!bgp->regval) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        bgp->regval = devm_kcalloc(&pdev->dev, bgp->conf->sensor_count,
+                                   sizeof(*bgp->regval), GFP_KERNEL);
+        if (!bgp->regval)
                 return ERR_PTR(-ENOMEM);
-        }
 
         i = 0;
         do {
diff --git a/drivers/tty/ehv_bytechan.c b/drivers/tty/ehv_bytechan.c
index 7ac9bcdf1e61..61fe8d6fd24e 100644
--- a/drivers/tty/ehv_bytechan.c
+++ b/drivers/tty/ehv_bytechan.c
@@ -764,7 +764,7 @@ static int __init ehv_bc_init(void)
         ehv_bc_driver = alloc_tty_driver(count);
         if (!ehv_bc_driver) {
                 ret = -ENOMEM;
-                goto error;
+                goto err_free_bcs;
         }
 
         ehv_bc_driver->driver_name = "ehv-bc";
@@ -778,24 +778,23 @@ static int __init ehv_bc_init(void)
         ret = tty_register_driver(ehv_bc_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register tty driver (ret=%i)\n", ret);
-                goto error;
+                goto err_put_tty_driver;
         }
 
         ret = platform_driver_register(&ehv_bc_tty_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register platform driver (ret=%i)\n",
                        ret);
-                goto error;
+                goto err_deregister_tty_driver;
         }
 
         return 0;
 
-error:
-        if (ehv_bc_driver) {
-                tty_unregister_driver(ehv_bc_driver);
-                put_tty_driver(ehv_bc_driver);
-        }
-
+err_deregister_tty_driver:
+        tty_unregister_driver(ehv_bc_driver);
+err_put_tty_driver:
+        put_tty_driver(ehv_bc_driver);
+err_free_bcs:
         kfree(bcs);
 
         return ret;
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index 433de5ea9b02..f71b47334149 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -122,6 +122,18 @@ void serdev_device_write_wakeup(struct serdev_device *serdev)
 }
 EXPORT_SYMBOL_GPL(serdev_device_write_wakeup);
 
+int serdev_device_write_buf(struct serdev_device *serdev,
+                            const unsigned char *buf, size_t count)
+{
+        struct serdev_controller *ctrl = serdev->ctrl;
+
+        if (!ctrl || !ctrl->ops->write_buf)
+                return -EINVAL;
+
+        return ctrl->ops->write_buf(ctrl, buf, count);
+}
+EXPORT_SYMBOL_GPL(serdev_device_write_buf);
+
 int serdev_device_write(struct serdev_device *serdev,
                         const unsigned char *buf, size_t count,
                         unsigned long timeout)
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index 487c88f6aa0e..d0a021c93986 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -102,9 +102,6 @@ static int ttyport_open(struct serdev_controller *ctrl)
                 return PTR_ERR(tty);
         serport->tty = tty;
 
-        serport->port->client_ops = &client_ops;
-        serport->port->client_data = ctrl;
-
         if (tty->ops->open)
                 tty->ops->open(serport->tty, NULL);
         else
@@ -215,6 +212,7 @@ struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx)
 {
+        const struct tty_port_client_operations *old_ops;
         struct serdev_controller *ctrl;
         struct serport *serport;
         int ret;
@@ -233,28 +231,37 @@ struct device *serdev_tty_port_register(struct tty_port *port,
 
         ctrl->ops = &ctrl_ops;
 
+        old_ops = port->client_ops;
+        port->client_ops = &client_ops;
+        port->client_data = ctrl;
+
         ret = serdev_controller_add(ctrl);
         if (ret)
-                goto err_controller_put;
+                goto err_reset_data;
 
         dev_info(&ctrl->dev, "tty port %s%d registered\n", drv->name, idx);
         return &ctrl->dev;
 
-err_controller_put:
+err_reset_data:
+        port->client_data = NULL;
+        port->client_ops = old_ops;
         serdev_controller_put(ctrl);
+
         return ERR_PTR(ret);
 }
 
-void serdev_tty_port_unregister(struct tty_port *port)
+int serdev_tty_port_unregister(struct tty_port *port)
 {
         struct serdev_controller *ctrl = port->client_data;
         struct serport *serport = serdev_controller_get_drvdata(ctrl);
 
         if (!serport)
-                return;
+                return -ENODEV;
 
         serdev_controller_remove(ctrl);
         port->client_ops = NULL;
         port->client_data = NULL;
         serdev_controller_put(ctrl);
+
+        return 0;
 }
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 09a65a3ec7f7..68fd045a7025 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -47,6 +47,7 @@
 /*
  * These are definitions for the Exar XR17V35X and XR17(C|D)15X
  */
+#define UART_EXAR_INT0          0x80
 #define UART_EXAR_SLEEP         0x8b    /* Sleep mode */
 #define UART_EXAR_DVID          0x8d    /* Device identification */
 
@@ -1337,7 +1338,7 @@ out_lock:
         /*
          * Check if the device is a Fintek F81216A
          */
-        if (port->type == PORT_16550A)
+        if (port->type == PORT_16550A && port->iotype == UPIO_PORT)
                 fintek_8250_probe(up);
 
         if (up->capabilities != old_capabilities) {
@@ -1869,17 +1870,13 @@ static int serial8250_default_handle_irq(struct uart_port *port)
 static int exar_handle_irq(struct uart_port *port)
 {
         unsigned int iir = serial_port_in(port, UART_IIR);
-        int ret;
+        int ret = 0;
 
-        ret = serial8250_handle_irq(port, iir);
+        if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) &&
+            serial_port_in(port, UART_EXAR_INT0) != 0)
+                ret = 1;
 
-        if ((port->type == PORT_XR17V35X) ||
-           (port->type == PORT_XR17D15X)) {
-                serial_port_in(port, 0x80);
-                serial_port_in(port, 0x81);
-                serial_port_in(port, 0x82);
-                serial_port_in(port, 0x83);
-        }
+        ret |= serial8250_handle_irq(port, iir);
 
         return ret;
 }
@@ -2177,6 +2174,8 @@ int serial8250_do_startup(struct uart_port *port)
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
 
         /*
          * At this point, there's no way the LSR could still be 0xff;
@@ -2335,6 +2334,8 @@ dont_test_tx_en:
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
         up->lsr_saved_flags = 0;
         up->msr_saved_flags = 0;
 
diff --git a/drivers/tty/serial/altera_jtaguart.c b/drivers/tty/serial/altera_jtaguart.c
index 18e3f8342b85..0475f5d261ce 100644
--- a/drivers/tty/serial/altera_jtaguart.c
+++ b/drivers/tty/serial/altera_jtaguart.c
@@ -478,6 +478,7 @@ static int altera_jtaguart_remove(struct platform_device *pdev)
 
         port = &altera_jtaguart_ports[i].port;
         uart_remove_one_port(&altera_jtaguart_driver, port);
+        iounmap(port->membase);
 
         return 0;
 }
diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index 46d3438a0d27..3e4b717670d7 100644
--- a/drivers/tty/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
@@ -615,6 +615,7 @@ static int altera_uart_remove(struct platform_device *pdev)
         if (port) {
                 uart_remove_one_port(&altera_uart_driver, port);
                 port->mapbase = 0;
+                iounmap(port->membase);
         }
 
         return 0;
diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
index ebd8569f9ad5..9fff25be87f9 100644
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -27,6 +27,7 @@
 #define UARTn_FRAME             0x04
 #define UARTn_FRAME_DATABITS__MASK      0x000f
 #define UARTn_FRAME_DATABITS(n)         ((n) - 3)
+#define UARTn_FRAME_PARITY__MASK        0x0300
 #define UARTn_FRAME_PARITY_NONE         0x0000
 #define UARTn_FRAME_PARITY_EVEN         0x0200
 #define UARTn_FRAME_PARITY_ODD          0x0300
@@ -572,12 +573,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port,
                         16 * (4 + (clkdiv >> 6)));
 
         frame = efm32_uart_read32(efm_port, UARTn_FRAME);
-        if (frame & UARTn_FRAME_PARITY_ODD)
+        switch (frame & UARTn_FRAME_PARITY__MASK) {
+        case UARTn_FRAME_PARITY_ODD:
                 *parity = 'o';
-        else if (frame & UARTn_FRAME_PARITY_EVEN)
+                break;
+        case UARTn_FRAME_PARITY_EVEN:
                 *parity = 'e';
-        else
+                break;
+        default:
                 *parity = 'n';
+        }
 
         *bits = (frame & UARTn_FRAME_DATABITS__MASK) -
                         UARTn_FRAME_DATABITS(4) + 4;
diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index 157883653256..f190a84a0246 100644
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1382,9 +1382,9 @@ static struct spi_driver ifx_spi_driver = {
 static void __exit ifx_spi_exit(void)
 {
         /* unregister */
+        spi_unregister_driver(&ifx_spi_driver);
         tty_unregister_driver(tty_drv);
         put_tty_driver(tty_drv);
-        spi_unregister_driver(&ifx_spi_driver);
         unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
 }
 
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 33509b4beaec..bbefddd92bfe 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2184,7 +2184,9 @@ static int serial_imx_probe(struct platform_device *pdev)
                  * and DCD (when they are outputs) or enables the respective
                  * irqs. So set this bit early, i.e. before requesting irqs.
                  */
-                writel(UFCR_DCEDTE, sport->port.membase + UFCR);
+                reg = readl(sport->port.membase + UFCR);
+                if (!(reg & UFCR_DCEDTE))
+                        writel(reg | UFCR_DCEDTE, sport->port.membase + UFCR);
 
                 /*
                  * Disable UCR3_RI and UCR3_DCD irqs. They are also not
@@ -2195,7 +2197,15 @@ static int serial_imx_probe(struct platform_device *pdev)
                        sport->port.membase + UCR3);
 
         } else {
-                writel(0, sport->port.membase + UFCR);
+                unsigned long ucr3 = UCR3_DSR;
+
+                reg = readl(sport->port.membase + UFCR);
+                if (reg & UFCR_DCEDTE)
+                        writel(reg & ~UFCR_DCEDTE, sport->port.membase + UFCR);
+
+                if (!is_imx1_uart(sport))
+                        ucr3 |= IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP;
+                writel(ucr3, sport->port.membase + UCR3);
         }
 
         clk_disable_unprepare(sport->clk_ipg);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 0f45b7884a2c..13bfd5dcffce 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2083,7 +2083,7 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
         mutex_lock(&port->mutex);
 
         tty_dev = device_find_child(uport->dev, &match, serial_match_port);
-        if (device_may_wakeup(tty_dev)) {
+        if (tty_dev && device_may_wakeup(tty_dev)) {
                 if (!enable_irq_wake(uport->irq))
                         uport->irq_wake = 1;
                 put_device(tty_dev);
@@ -2782,7 +2782,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
          * Register the port whether it's detected or not.  This allows
          * setserial to be used to alter this port's parameters.
          */
-        tty_dev = tty_port_register_device_attr(port, drv->tty_driver,
+        tty_dev = tty_port_register_device_attr_serdev(port, drv->tty_driver,
                         uport->line, uport->dev, port, uport->tty_groups);
         if (likely(!IS_ERR(tty_dev))) {
                 device_set_wakeup_capable(tty_dev, 1);
@@ -2845,7 +2845,7 @@ int uart_remove_one_port(struct uart_driver *drv, struct uart_port *uport)
         /*
          * Remove the devices from the tty layer
          */
-        tty_unregister_device(drv->tty_driver, uport->line);
+        tty_port_unregister_device(port, drv->tty_driver, uport->line);
 
         tty = tty_port_tty_get(port);
         if (tty) {
diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 31885f20fc15..cc047de72e2a 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -184,7 +184,7 @@ static void hdlcdev_exit(struct slgt_info *info);
 struct cond_wait {
         struct cond_wait *next;
         wait_queue_head_t q;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         unsigned int data;
 };
 static void init_cond_wait(struct cond_wait *w, unsigned int data);
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 1d21a9c1d33e..6b137194069f 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -129,19 +129,85 @@ struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp)
 {
+        tty_port_link_device(port, driver, index);
+        return tty_register_device_attr(driver, index, device, drvdata,
+                        attr_grp);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+
+/**
+ * tty_port_register_device_attr_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ * @drvdata: driver data for the device
+ * @attr_grp: attribute group for the device
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp)
+{
         struct device *dev;
 
         tty_port_link_device(port, driver, index);
 
         dev = serdev_tty_port_register(port, device, driver, index);
-        if (PTR_ERR(dev) != -ENODEV)
+        if (PTR_ERR(dev) != -ENODEV) {
                 /* Skip creating cdev if we registered a serdev device */
                 return dev;
+        }
 
         return tty_register_device_attr(driver, index, device, drvdata,
                         attr_grp);
 }
-EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr_serdev);
+
+/**
+ * tty_port_register_device_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device)
+{
+        return tty_port_register_device_attr_serdev(port, driver, index,
+                        device, NULL, NULL);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_serdev);
+
+/**
+ * tty_port_unregister_device - deregister a tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ *
+ * If a tty or serdev device is registered with a call to
+ * tty_port_register_device_serdev() then this function must be called when
+ * the device is gone.
+ */
+void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index)
+{
+        int ret;
+
+        ret = serdev_tty_port_unregister(port);
+        if (ret == 0)
+                return;
+
+        tty_unregister_device(driver, index);
+}
+EXPORT_SYMBOL_GPL(tty_port_unregister_device);
 
 int tty_port_alloc_xmit_buf(struct tty_port *port)
 {
@@ -189,9 +255,6 @@ static void tty_port_destructor(struct kref *kref)
         /* check if last port ref was dropped before tty release */
         if (WARN_ON(port->itty))
                 return;
-
-        serdev_tty_port_unregister(port);
-
         if (port->xmit_buf)
                 free_page((unsigned long)port->xmit_buf);
         tty_port_destroy(port);
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 9e217b1361ea..fe4fe2440729 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -843,7 +843,10 @@ static ssize_t ci_role_show(struct device *dev, struct device_attribute *attr,
 {
         struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-        return sprintf(buf, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                return sprintf(buf, "%s\n", ci_role(ci)->name);
+
+        return 0;
 }
 
 static ssize_t ci_role_store(struct device *dev,
diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c
index 6d23eede4d8c..1c31e8a08810 100644
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -294,7 +294,8 @@ static int ci_role_show(struct seq_file *s, void *data)
 {
         struct ci_hdrc *ci = s->private;
 
-        seq_printf(s, "%s\n", ci_role(ci)->name);
+        if (ci->role != CI_ROLE_END)
+                seq_printf(s, "%s\n", ci_role(ci)->name);
 
         return 0;
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 56d2d3213076..d68b125796f9 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1993,6 +1993,7 @@ static void udc_id_switch_for_host(struct ci_hdrc *ci)
 int ci_hdrc_gadget_init(struct ci_hdrc *ci)
 {
         struct ci_role_driver *rdrv;
+        int ret;
 
         if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC))
                 return -ENXIO;
@@ -2005,7 +2006,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *ci)
         rdrv->stop      = udc_id_switch_for_host;
         rdrv->irq       = udc_irq;
         rdrv->name      = "gadget";
-        ci->roles[CI_ROLE_GADGET] = rdrv;
 
-        return udc_start(ci);
+        ret = udc_start(ci);
+        if (!ret)
+                ci->roles[CI_ROLE_GADGET] = rdrv;
+
+        return ret;
 }
diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
index e77a4ed4f021..9f4a0185dd60 100644
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -108,6 +108,8 @@ struct imx_usbmisc {
         const struct usbmisc_ops *ops;
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data);
+
 static int usbmisc_imx25_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
@@ -242,10 +244,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
-                        writel(val, reg);
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H2_INT60CKOFF;
+                                writel(val, reg);
+                        }
+
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH2_CTRL_OFFSET;
@@ -267,10 +274,15 @@ static int usbmisc_imx53_init(struct imx_usbmisc_data *data)
                         val = readl(reg) | MX53_USB_UHx_CTRL_WAKE_UP_EN
                                 | MX53_USB_UHx_CTRL_ULPI_INT_EN;
                         writel(val, reg);
-                        /* Disable internal 60Mhz clock */
-                        reg = usbmisc->base + MX53_USB_CLKONOFF_CTRL_OFFSET;
-                        val = readl(reg) | MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
-                        writel(val, reg);
+
+                        if (is_imx53_usbmisc(data)) {
+                                /* Disable internal 60Mhz clock */
+                                reg = usbmisc->base +
+                                        MX53_USB_CLKONOFF_CTRL_OFFSET;
+                                val = readl(reg) |
+                                        MX53_USB_CLKONOFF_CTRL_H3_INT60CKOFF;
+                                writel(val, reg);
+                        }
                 }
                 if (data->disable_oc) {
                         reg = usbmisc->base + MX53_USB_UH3_CTRL_OFFSET;
@@ -456,6 +468,10 @@ static const struct usbmisc_ops imx27_usbmisc_ops = {
         .init = usbmisc_imx27_init,
 };
 
+static const struct usbmisc_ops imx51_usbmisc_ops = {
+        .init = usbmisc_imx53_init,
+};
+
 static const struct usbmisc_ops imx53_usbmisc_ops = {
         .init = usbmisc_imx53_init,
 };
@@ -479,6 +495,13 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = {
         .set_wakeup = usbmisc_imx7d_set_wakeup,
 };
 
+static inline bool is_imx53_usbmisc(struct imx_usbmisc_data *data)
+{
+        struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
+
+        return usbmisc->ops == &imx53_usbmisc_ops;
+}
+
 int imx_usbmisc_init(struct imx_usbmisc_data *data)
 {
         struct imx_usbmisc *usbmisc;
@@ -536,7 +559,7 @@ static const struct of_device_id usbmisc_imx_dt_ids[] = {
         },
         {
                 .compatible = "fsl,imx51-usbmisc",
-                .data = &imx53_usbmisc_ops,
+                .data = &imx51_usbmisc_ops,
         },
         {
                 .compatible = "fsl,imx53-usbmisc",
diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
index 9cd8722f24f6..a3ffe97170ff 100644
--- a/drivers/usb/dwc2/params.c
+++ b/drivers/usb/dwc2/params.c
@@ -144,6 +144,8 @@ const struct of_device_id dwc2_of_match_table[] = {
         { .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
         { .compatible = "snps,dwc2" },
         { .compatible = "samsung,s3c6400-hsotg" },
+        { .compatible = "amlogic,meson8-usb",
+          .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson8b-usb",
           .data = dwc2_set_amlogic_params },
         { .compatible = "amlogic,meson-gxbb-usb",
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 49d685ad0da9..45b554032332 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -315,6 +315,9 @@ void usb_remove_function(struct usb_configuration *c, struct usb_function *f)
         list_del(&f->list);
         if (f->unbind)
                 f->unbind(c, f);
+
+        if (f->bind_deactivated)
+                usb_function_activate(f);
 }
 EXPORT_SYMBOL_GPL(usb_remove_function);
 
@@ -956,12 +959,8 @@ static void remove_config(struct usb_composite_dev *cdev,
 
                 f = list_first_entry(&config->functions,
                                 struct usb_function, list);
-                list_del(&f->list);
-                if (f->unbind) {
-                        DBG(cdev, "unbind function '%s'/%p\n", f->name, f);
-                        f->unbind(config, f);
-                        /* may free memory for "f" */
-                }
+
+                usb_remove_function(config, f);
         }
         list_del(&config->list);
         if (config->unbind) {
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 4c8aacc232c0..74d57d6994da 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -396,7 +396,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 /* Caller must hold fsg->lock */
 static void wakeup_thread(struct fsg_common *common)
 {
-        smp_wmb();      /* ensure the write of bh->state is complete */
+        /*
+         * Ensure the reading of thread_wakeup_needed
+         * and the writing of bh->state are completed
+         */
+        smp_mb();
         /* Tell the main thread that something has happened */
         common->thread_wakeup_needed = 1;
         if (common->thread_task)
@@ -627,7 +631,12 @@ static int sleep_thread(struct fsg_common *common, bool can_freeze)
         }
         __set_current_state(TASK_RUNNING);
         common->thread_wakeup_needed = 0;
-        smp_rmb();      /* ensure the latest bh->state is visible */
+
+        /*
+         * Ensure the writing of thread_wakeup_needed
+         * and the reading of bh->state are completed
+         */
+        smp_mb();
         return rc;
 }
 
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b4058f0000e4..6a1ce6a55158 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -281,7 +281,7 @@ static void pn_net_setup(struct net_device *dev)
         dev->tx_queue_len       = 1;
 
         dev->netdev_ops         = &pn_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->header_ops         = &phonet_header_ops;
 }
 
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index b9ca0a26cbd9..684900fcfe24 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1183,8 +1183,10 @@ dev_release (struct inode *inode, struct file *fd)
 
         /* closing ep0 === shutdown all */
 
-        if (dev->gadget_registered)
+        if (dev->gadget_registered) {
                 usb_gadget_unregister_driver (&gadgetfs_driver);
+                dev->gadget_registered = false;
+        }
 
         /* at this point "good" hardware has disconnected the
          * device from USB; the host won't see it any more.
@@ -1677,9 +1679,10 @@ static void
 gadgetfs_suspend (struct usb_gadget *gadget)
 {
         struct dev_data         *dev = get_gadget_data (gadget);
+        unsigned long           flags;
 
         INFO (dev, "suspended from state %d\n", dev->state);
-        spin_lock (&dev->lock);
+        spin_lock_irqsave(&dev->lock, flags);
         switch (dev->state) {
         case STATE_DEV_SETUP:           // VERY odd... host died??
         case STATE_DEV_CONNECTED:
@@ -1690,7 +1693,7 @@ gadgetfs_suspend (struct usb_gadget *gadget)
         default:
                 break;
         }
-        spin_unlock (&dev->lock);
+        spin_unlock_irqrestore(&dev->lock, flags);
 }
 
 static struct usb_gadget_driver gadgetfs_driver = {
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index ccabb51cb98d..7635fd7cc328 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -442,23 +442,16 @@ static void set_link_state(struct dummy_hcd *dum_hcd)
                 /* Report reset and disconnect events to the driver */
                 if (dum->driver && (disconnect || reset)) {
                         stop_activity(dum);
-                        spin_unlock(&dum->lock);
                         if (reset)
                                 usb_gadget_udc_reset(&dum->gadget, dum->driver);
                         else
                                 dum->driver->disconnect(&dum->gadget);
-                        spin_lock(&dum->lock);
                 }
         } else if (dum_hcd->active != dum_hcd->old_active) {
-                if (dum_hcd->old_active && dum->driver->suspend) {
-                        spin_unlock(&dum->lock);
+                if (dum_hcd->old_active && dum->driver->suspend)
                         dum->driver->suspend(&dum->gadget);
-                        spin_lock(&dum->lock);
-                } else if (!dum_hcd->old_active &&  dum->driver->resume) {
-                        spin_unlock(&dum->lock);
+                else if (!dum_hcd->old_active &&  dum->driver->resume)
                         dum->driver->resume(&dum->gadget);
-                        spin_lock(&dum->lock);
-                }
         }
 
         dum_hcd->old_status = dum_hcd->port_status;
@@ -983,7 +976,9 @@ static int dummy_udc_stop(struct usb_gadget *g)
         struct dummy_hcd        *dum_hcd = gadget_to_dummy_hcd(g);
         struct dummy            *dum = dum_hcd->dum;
 
+        spin_lock_irq(&dum->lock);
         dum->driver = NULL;
+        spin_unlock_irq(&dum->lock);
 
         return 0;
 }
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 6cf07857eaca..f2cbd7f8005e 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -2470,11 +2470,8 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver)
                 nuke(&dev->ep[i]);
 
         /* report disconnect; the driver is already quiesced */
-        if (driver) {
-                spin_unlock(&dev->lock);
+        if (driver)
                 driver->disconnect(&dev->gadget);
-                spin_lock(&dev->lock);
-        }
 
         usb_reinit(dev);
 }
@@ -3348,8 +3345,6 @@ next_endpoints:
                 BIT(PCI_RETRY_ABORT_INTERRUPT))
 
 static void handle_stat1_irqs(struct net2280 *dev, u32 stat)
-__releases(dev->lock)
-__acquires(dev->lock)
 {
         struct net2280_ep       *ep;
         u32                     tmp, num, mask, scratch;
@@ -3390,14 +3385,12 @@ __acquires(dev->lock)
                         if (disconnect || reset) {
                                 stop_activity(dev, dev->driver);
                                 ep0_start(dev);
-                                spin_unlock(&dev->lock);
                                 if (reset)
                                         usb_gadget_udc_reset
                                                 (&dev->gadget, dev->driver);
                                 else
                                         (dev->driver->disconnect)
                                                 (&dev->gadget);
-                                spin_lock(&dev->lock);
                                 return;
                         }
                 }
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 5a2d845fb1a6..cd4c88529721 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -623,7 +623,6 @@ static void renesas_usb3_stop_controller(struct renesas_usb3 *usb3)
 {
         usb3_disconnect(usb3);
         usb3_write(usb3, 0, USB3_P0_INT_ENA);
-        usb3_write(usb3, 0, USB3_PN_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_OTG_INT_ENA);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_1);
         usb3_write(usb3, 0, USB3_USB_INT_ENA_2);
@@ -1475,7 +1474,13 @@ static void usb3_request_done_pipen(struct renesas_usb3 *usb3,
                                     struct renesas_usb3_request *usb3_req,
                                     int status)
 {
-        usb3_pn_stop(usb3);
+        unsigned long flags;
+
+        spin_lock_irqsave(&usb3->lock, flags);
+        if (usb3_pn_change(usb3, usb3_ep->num))
+                usb3_pn_stop(usb3);
+        spin_unlock_irqrestore(&usb3->lock, flags);
+
         usb3_disable_pipe_irq(usb3, usb3_ep->num);
         usb3_request_done(usb3_ep, usb3_req, status);
 
@@ -1504,30 +1509,46 @@ static void usb3_irq_epc_pipen_bfrdy(struct renesas_usb3 *usb3, int num)
 {
         struct renesas_usb3_ep *usb3_ep = usb3_get_ep(usb3, num);
         struct renesas_usb3_request *usb3_req = usb3_get_request(usb3_ep);
+        bool done = false;
 
         if (!usb3_req)
                 return;
 
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num))
+                goto out;
+
         if (usb3_ep->dir_in) {
                 /* Do not stop the IN pipe here to detect LSTTR interrupt */
                 if (!usb3_write_pipe(usb3_ep, usb3_req, USB3_PN_WRITE))
                         usb3_clear_bit(usb3, PN_INT_BFRDY, USB3_PN_INT_ENA);
         } else {
                 if (!usb3_read_pipe(usb3_ep, usb3_req, USB3_PN_READ))
-                        usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
+                        done = true;
         }
+
+out:
+        /* need to unlock because usb3_request_done_pipen() locks it */
+        spin_unlock(&usb3->lock);
+
+        if (done)
+                usb3_request_done_pipen(usb3, usb3_ep, usb3_req, 0);
 }
 
 static void usb3_irq_epc_pipen(struct renesas_usb3 *usb3, int num)
 {
         u32 pn_int_sta;
 
-        if (usb3_pn_change(usb3, num) < 0)
+        spin_lock(&usb3->lock);
+        if (usb3_pn_change(usb3, num) < 0) {
+                spin_unlock(&usb3->lock);
                 return;
+        }
 
         pn_int_sta = usb3_read(usb3, USB3_PN_INT_STA);
         pn_int_sta &= usb3_read(usb3, USB3_PN_INT_ENA);
         usb3_write(usb3, pn_int_sta, USB3_PN_INT_STA);
+        spin_unlock(&usb3->lock);
         if (pn_int_sta & PN_INT_LSTTR)
                 usb3_irq_epc_pipen_lsttr(usb3, num);
         if (pn_int_sta & PN_INT_BFRDY)
@@ -1660,6 +1681,7 @@ static int usb3_disable_pipe_n(struct renesas_usb3_ep *usb3_ep)
 
         spin_lock_irqsave(&usb3->lock, flags);
         if (!usb3_pn_change(usb3, usb3_ep->num)) {
+                usb3_write(usb3, 0, USB3_PN_INT_ENA);
                 usb3_write(usb3, 0, USB3_PN_RAMMAP);
                 usb3_clear_bit(usb3, PN_CON_EN, USB3_PN_CON);
         }
@@ -1799,6 +1821,9 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
         /* hook up the driver */
         usb3->driver = driver;
 
+        pm_runtime_enable(usb3_to_dev(usb3));
+        pm_runtime_get_sync(usb3_to_dev(usb3));
+
         renesas_usb3_init_controller(usb3);
 
         return 0;
@@ -1807,14 +1832,14 @@ static int renesas_usb3_start(struct usb_gadget *gadget,
 static int renesas_usb3_stop(struct usb_gadget *gadget)
 {
         struct renesas_usb3 *usb3 = gadget_to_renesas_usb3(gadget);
-        unsigned long flags;
 
-        spin_lock_irqsave(&usb3->lock, flags);
         usb3->softconnect = false;
         usb3->gadget.speed = USB_SPEED_UNKNOWN;
         usb3->driver = NULL;
         renesas_usb3_stop_controller(usb3);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+
+        pm_runtime_put(usb3_to_dev(usb3));
+        pm_runtime_disable(usb3_to_dev(usb3));
 
         return 0;
 }
@@ -1891,9 +1916,6 @@ static int renesas_usb3_remove(struct platform_device *pdev)
 
         device_remove_file(&pdev->dev, &dev_attr_role);
 
-        pm_runtime_put(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
-
         usb_del_gadget_udc(&usb3->gadget);
 
         __renesas_usb3_ep_free_request(usb3->ep0_req);
@@ -2099,9 +2121,6 @@ static int renesas_usb3_probe(struct platform_device *pdev)
 
         usb3->workaround_for_vbus = priv->workaround_for_vbus;
 
-        pm_runtime_enable(&pdev->dev);
-        pm_runtime_get_sync(&pdev->dev);
-
         dev_info(&pdev->dev, "probed\n");
 
         return 0;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1f1687e888d6..fddf2731f798 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2119,11 +2119,12 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
 {
         u32 temp, port_offset, port_count;
         int i;
-        u8 major_revision;
+        u8 major_revision, minor_revision;
         struct xhci_hub *rhub;
 
         temp = readl(addr);
         major_revision = XHCI_EXT_PORT_MAJOR(temp);
+        minor_revision = XHCI_EXT_PORT_MINOR(temp);
 
         if (major_revision == 0x03) {
                 rhub = &xhci->usb3_rhub;
@@ -2137,7 +2138,9 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
                 return;
         }
         rhub->maj_rev = XHCI_EXT_PORT_MAJOR(temp);
-        rhub->min_rev = XHCI_EXT_PORT_MINOR(temp);
+
+        if (rhub->min_rev < minor_revision)
+                rhub->min_rev = minor_revision;
 
         /* Port offset and count in the third dword, see section 7.2 */
         temp = readl(addr + 2);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index fcf1f3f63e7a..1bcf971141c0 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -201,6 +201,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
                         pdev->device == 0x1042)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                        pdev->device == 0x1142)
+                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
 
         if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                 xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 9c7ee26ef388..bc6a9be2ccc5 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -245,6 +245,11 @@ static int dsps_check_status(struct musb *musb, void *unused)
                 dsps_mod_timer_optional(glue);
                 break;
         case OTG_STATE_A_WAIT_BCON:
+                /* keep VBUS on for host-only mode */
+                if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                        dsps_mod_timer_optional(glue);
+                        break;
+                }
                 musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
                 skip_session = 1;
                 /* fall */
diff --git a/drivers/vfio/virqfd.c b/drivers/vfio/virqfd.c
index 27c89cd5d70b..4797217e5e72 100644
--- a/drivers/vfio/virqfd.c
+++ b/drivers/vfio/virqfd.c
@@ -43,7 +43,7 @@ static void virqfd_deactivate(struct virqfd *virqfd)
         queue_work(vfio_irqfd_cleanup_wq, &virqfd->shutdown);
 }
 
-static int virqfd_wakeup(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int virqfd_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         struct virqfd *virqfd = container_of(wait, struct virqfd, wait);
         unsigned long flags = (unsigned long)key;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 042030e5a035..e4613a3c362d 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -165,7 +165,7 @@ static void vhost_poll_func(struct file *file, wait_queue_head_t *wqh,
         add_wait_queue(wqh, &poll->wait);
 }
 
-static int vhost_poll_wakeup(wait_queue_t *wait, unsigned mode, int sync,
+static int vhost_poll_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync,
                              void *key)
 {
         struct vhost_poll *poll = container_of(wait, struct vhost_poll, wait);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index f55671d53f28..f72095868b93 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -31,7 +31,7 @@ struct vhost_work {
 struct vhost_poll {
         poll_table                table;
         wait_queue_head_t        *wqh;
-        wait_queue_t              wait;
+        wait_queue_entry_t              wait;
         struct vhost_work         work;
         unsigned long             mask;
         struct vhost_dev         *dev;
diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 687ebb053438..41d7979d81c5 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1048,7 +1048,7 @@ void fb_edid_add_monspecs(unsigned char *edid, struct fb_monspecs *specs)
 
         for (i = 0; i < (128 - edid[2]) / DETAILED_TIMING_DESCRIPTION_SIZE;
              i++, block += DETAILED_TIMING_DESCRIPTION_SIZE)
-                if (PIXEL_CLOCK)
+                if (PIXEL_CLOCK != 0)
                         edt[num++] = block - edid;
 
         /* Yikes, EDID data is totally useless */
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index ec2e7e353685..449fceaf79d5 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1646,8 +1646,9 @@ static int ufx_usb_probe(struct usb_interface *interface,
         dev_dbg(dev->gdev, "%s %s - serial #%s\n",
                 usbdev->manufacturer, usbdev->product, usbdev->serial);
         dev_dbg(dev->gdev, "vid_%04x&pid_%04x&rev_%04x driver's ufx_data struct at %p\n",
-                usbdev->descriptor.idVendor, usbdev->descriptor.idProduct,
-                usbdev->descriptor.bcdDevice, dev);
+                le16_to_cpu(usbdev->descriptor.idVendor),
+                le16_to_cpu(usbdev->descriptor.idProduct),
+                le16_to_cpu(usbdev->descriptor.bcdDevice), dev);
         dev_dbg(dev->gdev, "console enable=%d\n", console);
         dev_dbg(dev->gdev, "fb_defio enable=%d\n", fb_defio);
 
diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 6a3c353de7c3..05ef657235df 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1105,8 +1105,8 @@ static int dlfb_ops_blank(int blank_mode, struct fb_info *info)
         char *bufptr;
         struct urb *urb;
 
-        pr_info("/dev/fb%d FB_BLANK mode %d --> %d\n",
-                info->node, dev->blank_mode, blank_mode);
+        pr_debug("/dev/fb%d FB_BLANK mode %d --> %d\n",
+                 info->node, dev->blank_mode, blank_mode);
 
         if ((dev->blank_mode == FB_BLANK_POWERDOWN) &&
             (blank_mode != FB_BLANK_POWERDOWN)) {
@@ -1613,8 +1613,9 @@ static int dlfb_usb_probe(struct usb_interface *interface,
         pr_info("%s %s - serial #%s\n",
                 usbdev->manufacturer, usbdev->product, usbdev->serial);
         pr_info("vid_%04x&pid_%04x&rev_%04x driver's dlfb_data struct at %p\n",
-                usbdev->descriptor.idVendor, usbdev->descriptor.idProduct,
-                usbdev->descriptor.bcdDevice, dev);
+                le16_to_cpu(usbdev->descriptor.idVendor),
+                le16_to_cpu(usbdev->descriptor.idProduct),
+                le16_to_cpu(usbdev->descriptor.bcdDevice), dev);
         pr_info("console enable=%d\n", console);
         pr_info("fb_defio enable=%d\n", fb_defio);
         pr_info("shadow enable=%d\n", shadow);
diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c
index f9718f012aae..badee04ef496 100644
--- a/drivers/video/fbdev/via/viafbdev.c
+++ b/drivers/video/fbdev/via/viafbdev.c
@@ -1630,16 +1630,14 @@ static void viafb_init_proc(struct viafb_shared *shared)
 }
 static void viafb_remove_proc(struct viafb_shared *shared)
 {
-        struct proc_dir_entry *viafb_entry = shared->proc_entry,
-                *iga1_entry = shared->iga1_proc_entry,
-                *iga2_entry = shared->iga2_proc_entry;
+        struct proc_dir_entry *viafb_entry = shared->proc_entry;
 
         if (!viafb_entry)
                 return;
 
-        remove_proc_entry("output_devices", iga2_entry);
+        remove_proc_entry("output_devices", shared->iga2_proc_entry);
         remove_proc_entry("iga2", viafb_entry);
-        remove_proc_entry("output_devices", iga1_entry);
+        remove_proc_entry("output_devices", shared->iga1_proc_entry);
         remove_proc_entry("iga1", viafb_entry);
         remove_proc_entry("supported_output_devices", viafb_entry);
 
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 408c174ef0d5..22caf808bfab 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -663,6 +663,12 @@ static int virtballoon_restore(struct virtio_device *vdev)
 }
 #endif
 
+static int virtballoon_validate(struct virtio_device *vdev)
+{
+        __virtio_clear_bit(vdev, VIRTIO_F_IOMMU_PLATFORM);
+        return 0;
+}
+
 static unsigned int features[] = {
         VIRTIO_BALLOON_F_MUST_TELL_HOST,
         VIRTIO_BALLOON_F_STATS_VQ,
@@ -675,6 +681,7 @@ static struct virtio_driver virtio_balloon_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
+        .validate =     virtballoon_validate,
         .probe =        virtballoon_probe,
         .remove =       virtballoon_remove,
         .config_changed = virtballoon_changed,
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7a92a5e1d40c..feca75b07fdd 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -362,8 +362,8 @@ static int mmap_batch_fn(void *data, int nr, void *state)
                                 st->global_error = 1;
                 }
         }
-        st->va += PAGE_SIZE * nr;
-        st->index += nr;
+        st->va += XEN_PAGE_SIZE * nr;
+        st->index += nr / XEN_PFN_PER_PAGE;
 
         return 0;
 }
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index beef981aa54f..974f5346458a 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -83,7 +83,7 @@ struct autofs_info {
 struct autofs_wait_queue {
         wait_queue_head_t queue;
         struct autofs_wait_queue *next;
-        autofs_wqt_t wait_queue_token;
+        autofs_wqt_t wait_queue_entry_token;
         /* We use the following to see what we are waiting for */
         struct qstr name;
         u32 dev;
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 24a58bf9ca72..7071895b0678 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -104,7 +104,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         size_t pktsz;
 
         pr_debug("wait id = 0x%08lx, name = %.*s, type=%d\n",
-                 (unsigned long) wq->wait_queue_token,
+                 (unsigned long) wq->wait_queue_entry_token,
                  wq->name.len, wq->name.name, type);
 
         memset(&pkt, 0, sizeof(pkt)); /* For security reasons */
@@ -120,7 +120,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
 
                 pktsz = sizeof(*mp);
 
-                mp->wait_queue_token = wq->wait_queue_token;
+                mp->wait_queue_entry_token = wq->wait_queue_entry_token;
                 mp->len = wq->name.len;
                 memcpy(mp->name, wq->name.name, wq->name.len);
                 mp->name[wq->name.len] = '\0';
@@ -133,7 +133,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
 
                 pktsz = sizeof(*ep);
 
-                ep->wait_queue_token = wq->wait_queue_token;
+                ep->wait_queue_entry_token = wq->wait_queue_entry_token;
                 ep->len = wq->name.len;
                 memcpy(ep->name, wq->name.name, wq->name.len);
                 ep->name[wq->name.len] = '\0';
@@ -153,7 +153,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
 
                 pktsz = sizeof(*packet);
 
-                packet->wait_queue_token = wq->wait_queue_token;
+                packet->wait_queue_entry_token = wq->wait_queue_entry_token;
                 packet->len = wq->name.len;
                 memcpy(packet->name, wq->name.name, wq->name.len);
                 packet->name[wq->name.len] = '\0';
@@ -428,7 +428,7 @@ int autofs4_wait(struct autofs_sb_info *sbi,
                         return -ENOMEM;
                 }
 
-                wq->wait_queue_token = autofs4_next_wait_queue;
+                wq->wait_queue_entry_token = autofs4_next_wait_queue;
                 if (++autofs4_next_wait_queue == 0)
                         autofs4_next_wait_queue = 1;
                 wq->next = sbi->queues;
@@ -461,7 +461,7 @@ int autofs4_wait(struct autofs_sb_info *sbi,
                 }
 
                 pr_debug("new wait id = 0x%08lx, name = %.*s, nfy=%d\n",
-                         (unsigned long) wq->wait_queue_token, wq->name.len,
+                         (unsigned long) wq->wait_queue_entry_token, wq->name.len,
                          wq->name.name, notify);
 
                 /*
@@ -471,7 +471,7 @@ int autofs4_wait(struct autofs_sb_info *sbi,
         } else {
                 wq->wait_ctr++;
                 pr_debug("existing wait id = 0x%08lx, name = %.*s, nfy=%d\n",
-                         (unsigned long) wq->wait_queue_token, wq->name.len,
+                         (unsigned long) wq->wait_queue_entry_token, wq->name.len,
                          wq->name.name, notify);
                 mutex_unlock(&sbi->wq_mutex);
                 kfree(qstr.name);
@@ -550,13 +550,13 @@ int autofs4_wait(struct autofs_sb_info *sbi,
 }
 
 
-int autofs4_wait_release(struct autofs_sb_info *sbi, autofs_wqt_t wait_queue_token, int status)
+int autofs4_wait_release(struct autofs_sb_info *sbi, autofs_wqt_t wait_queue_entry_token, int status)
 {
         struct autofs_wait_queue *wq, **wql;
 
         mutex_lock(&sbi->wq_mutex);
         for (wql = &sbi->queues; (wq = *wql) != NULL; wql = &wq->next) {
-                if (wq->wait_queue_token == wait_queue_token)
+                if (wq->wait_queue_entry_token == wait_queue_entry_token)
                         break;
         }
 
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 643c70d2b2e6..4f8f75d9e839 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2563,7 +2563,7 @@ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
 static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
                                                  unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
 }
 
 /*
@@ -2573,7 +2573,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
 static inline u64 btrfs_calc_trunc_metadata_size(struct btrfs_fs_info *fs_info,
                                                  unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
 }
 
 int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
index 60a750678a82..c24d615e3d7f 100644
--- a/fs/btrfs/dir-item.c
+++ b/fs/btrfs/dir-item.c
@@ -468,7 +468,7 @@ int verify_dir_item(struct btrfs_fs_info *fs_info,
 
         if (btrfs_dir_name_len(leaf, dir_item) > namelen) {
                 btrfs_crit(fs_info, "invalid dir item name len: %u",
-                       (unsigned)btrfs_dir_data_len(leaf, dir_item));
+                       (unsigned)btrfs_dir_name_len(leaf, dir_item));
                 return 1;
         }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8685d67185d0..5f678dcb20e6 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3467,10 +3467,12 @@ static int write_dev_supers(struct btrfs_device *device,
                  * we fua the first super.  The others we allow
                  * to go down lazy.
                  */
-                if (i == 0)
-                        ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_FUA, bh);
-                else
+                if (i == 0) {
+                        ret = btrfsic_submit_bh(REQ_OP_WRITE,
+                                                REQ_SYNC | REQ_FUA, bh);
+                } else {
                         ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
+                }
                 if (ret)
                         errors++;
         }
@@ -3535,7 +3537,7 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
 
         bio->bi_end_io = btrfs_end_empty_barrier;
         bio->bi_bdev = device->bdev;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH;
         init_completion(&device->flush_wait);
         bio->bi_private = &device->flush_wait;
         device->flush_bio = bio;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e390451c72e6..33d979e9ea2a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3993,6 +3993,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
                                     info->space_info_kobj, "%s",
                                     alloc_name(found->flags));
         if (ret) {
+                percpu_counter_destroy(&found->total_bytes_pinned);
                 kfree(found);
                 return ret;
         }
@@ -4844,7 +4845,7 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
         spin_unlock(&delayed_rsv->lock);
 
 commit:
-        trans = btrfs_join_transaction(fs_info->fs_root);
+        trans = btrfs_join_transaction(fs_info->extent_root);
         if (IS_ERR(trans))
                 return -ENOSPC;
 
@@ -4862,7 +4863,7 @@ static int flush_space(struct btrfs_fs_info *fs_info,
                        struct btrfs_space_info *space_info, u64 num_bytes,
                        u64 orig_bytes, int state)
 {
-        struct btrfs_root *root = fs_info->fs_root;
+        struct btrfs_root *root = fs_info->extent_root;
         struct btrfs_trans_handle *trans;
         int nr;
         int ret = 0;
@@ -5062,7 +5063,7 @@ static void priority_reclaim_metadata_space(struct btrfs_fs_info *fs_info,
         int flush_state = FLUSH_DELAYED_ITEMS_NR;
 
         spin_lock(&space_info->lock);
-        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->fs_root,
+        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->extent_root,
                                                       space_info);
         if (!to_reclaim) {
                 spin_unlock(&space_info->lock);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index d8da3edf2ac3..d3619e010005 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2458,7 +2458,7 @@ void end_extent_writepage(struct page *page, int err, u64 start, u64 end)
         if (!uptodate) {
                 ClearPageUptodate(page);
                 SetPageError(page);
-                ret = ret < 0 ? ret : -EIO;
+                ret = err < 0 ? err : -EIO;
                 mapping_set_error(page->mapping, ret);
         }
 }
@@ -4377,6 +4377,123 @@ static struct extent_map *get_extent_skip_holes(struct inode *inode,
         return NULL;
 }
 
+/*
+ * To cache previous fiemap extent
+ *
+ * Will be used for merging fiemap extent
+ */
+struct fiemap_cache {
+        u64 offset;
+        u64 phys;
+        u64 len;
+        u32 flags;
+        bool cached;
+};
+
+/*
+ * Helper to submit fiemap extent.
+ *
+ * Will try to merge current fiemap extent specified by @offset, @phys,
+ * @len and @flags with cached one.
+ * And only when we fails to merge, cached one will be submitted as
+ * fiemap extent.
+ *
+ * Return value is the same as fiemap_fill_next_extent().
+ */
+static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+                                struct fiemap_cache *cache,
+                                u64 offset, u64 phys, u64 len, u32 flags)
+{
+        int ret = 0;
+
+        if (!cache->cached)
+                goto assign;
+
+        /*
+         * Sanity check, extent_fiemap() should have ensured that new
+         * fiemap extent won't overlap with cahced one.
+         * Not recoverable.
+         *
+         * NOTE: Physical address can overlap, due to compression
+         */
+        if (cache->offset + cache->len > offset) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
+        /*
+         * Only merges fiemap extents if
+         * 1) Their logical addresses are continuous
+         *
+         * 2) Their physical addresses are continuous
+         *    So truly compressed (physical size smaller than logical size)
+         *    extents won't get merged with each other
+         *
+         * 3) Share same flags except FIEMAP_EXTENT_LAST
+         *    So regular extent won't get merged with prealloc extent
+         */
+        if (cache->offset + cache->len  == offset &&
+            cache->phys + cache->len == phys  &&
+            (cache->flags & ~FIEMAP_EXTENT_LAST) ==
+                        (flags & ~FIEMAP_EXTENT_LAST)) {
+                cache->len += len;
+                cache->flags |= flags;
+                goto try_submit_last;
+        }
+
+        /* Not mergeable, need to submit cached one */
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret)
+                return ret;
+assign:
+        cache->cached = true;
+        cache->offset = offset;
+        cache->phys = phys;
+        cache->len = len;
+        cache->flags = flags;
+try_submit_last:
+        if (cache->flags & FIEMAP_EXTENT_LAST) {
+                ret = fiemap_fill_next_extent(fieinfo, cache->offset,
+                                cache->phys, cache->len, cache->flags);
+                cache->cached = false;
+        }
+        return ret;
+}
+
+/*
+ * Sanity check for fiemap cache
+ *
+ * All fiemap cache should be submitted by emit_fiemap_extent()
+ * Iteration should be terminated either by last fiemap extent or
+ * fieinfo->fi_extents_max.
+ * So no cached fiemap should exist.
+ */
+static int check_fiemap_cache(struct btrfs_fs_info *fs_info,
+                               struct fiemap_extent_info *fieinfo,
+                               struct fiemap_cache *cache)
+{
+        int ret;
+
+        if (!cache->cached)
+                return 0;
+
+        /* Small and recoverbale problem, only to info developer */
+#ifdef CONFIG_BTRFS_DEBUG
+        WARN_ON(1);
+#endif
+        btrfs_warn(fs_info,
+                   "unhandled fiemap cache detected: offset=%llu phys=%llu len=%llu flags=0x%x",
+                   cache->offset, cache->phys, cache->len, cache->flags);
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret > 0)
+                ret = 0;
+        return ret;
+}
+
 int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 __u64 start, __u64 len, get_extent_t *get_extent)
 {
@@ -4394,6 +4511,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         struct extent_state *cached_state = NULL;
         struct btrfs_path *path;
         struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct fiemap_cache cache = { 0 };
         int end = 0;
         u64 em_start = 0;
         u64 em_len = 0;
@@ -4573,8 +4691,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                         flags |= FIEMAP_EXTENT_LAST;
                         end = 1;
                 }
-                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
-                                              em_len, flags);
+                ret = emit_fiemap_extent(fieinfo, &cache, em_start, disko,
+                                           em_len, flags);
                 if (ret) {
                         if (ret == 1)
                                 ret = 0;
@@ -4582,6 +4700,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                 }
         }
 out_free:
+        if (!ret)
+                ret = check_fiemap_cache(root->fs_info, fieinfo, &cache);
         free_extent_map(em);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/hash.c b/fs/btrfs/hash.c
index a97fdc156a03..baacc1866861 100644
--- a/fs/btrfs/hash.c
+++ b/fs/btrfs/hash.c
@@ -38,6 +38,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length)
 {
         SHASH_DESC_ON_STACK(shash, tfm);
         u32 *ctx = (u32 *)shash_desc_ctx(shash);
+        u32 retval;
         int err;
 
         shash->tfm = tfm;
@@ -47,5 +48,7 @@ u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length)
         err = crypto_shash_update(shash, address, length);
         BUG_ON(err);
 
-        return *ctx;
+        retval = *ctx;
+        barrier_data(ctx);
+        return retval;
 }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 17cbe9306faf..ef3c98c527c1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2952,7 +2952,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
 
         ret = test_range_bit(io_tree, ordered_extent->file_offset,
                         ordered_extent->file_offset + ordered_extent->len - 1,
-                        EXTENT_DEFRAG, 1, cached_state);
+                        EXTENT_DEFRAG, 0, cached_state);
         if (ret) {
                 u64 last_snapshot = btrfs_root_last_snapshot(&root->root_item);
                 if (0 && last_snapshot >= BTRFS_I(inode)->generation)
@@ -7483,8 +7483,8 @@ bool btrfs_page_exists_in_range(struct inode *inode, loff_t start, loff_t end)
         int found = false;
         void **pagep = NULL;
         struct page *page = NULL;
-        int start_idx;
-        int end_idx;
+        unsigned long start_idx;
+        unsigned long end_idx;
 
         start_idx = start >> PAGE_SHIFT;
 
diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
index 9bf90bcc56ac..bb3a02ca9da4 100644
--- a/fs/cachefiles/internal.h
+++ b/fs/cachefiles/internal.h
@@ -18,7 +18,7 @@
 
 #include <linux/fscache-cache.h>
 #include <linux/timer.h>
-#include <linux/wait.h>
+#include <linux/wait_bit.h>
 #include <linux/cred.h>
 #include <linux/workqueue.h>
 #include <linux/security.h>
@@ -97,7 +97,7 @@ struct cachefiles_cache {
  * backing file read tracking
  */
 struct cachefiles_one_read {
-        wait_queue_t                    monitor;        /* link into monitored waitqueue */
+        wait_queue_entry_t                      monitor;        /* link into monitored waitqueue */
         struct page                     *back_page;     /* backing file page we're waiting for */
         struct page                     *netfs_page;    /* netfs page we're going to fill */
         struct fscache_retrieval        *op;            /* retrieval op covering this */
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 41df8a27d7eb..3978b324cbca 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -204,7 +204,7 @@ wait_for_old_object:
                 wait_queue_head_t *wq;
 
                 signed long timeout = 60 * HZ;
-                wait_queue_t wait;
+                wait_queue_entry_t wait;
                 bool requeue;
 
                 /* if the object we're waiting for is queued for processing,
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index afbdc418966d..18d7aa61ef0f 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -21,7 +21,7 @@
  * - we use this to detect read completion of backing pages
  * - the caller holds the waitqueue lock
  */
-static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
+static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
                                   int sync, void *_key)
 {
         struct cachefiles_one_read *monitor =
@@ -48,7 +48,7 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
         }
 
         /* remove from the waitqueue */
-        list_del(&wait->task_list);
+        list_del(&wait->entry);
 
         /* move onto the action list and queue for FS-Cache thread pool */
         ASSERT(monitor->op);
diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c
index 987044bca1c2..59cb307b15fb 100644
--- a/fs/ceph/acl.c
+++ b/fs/ceph/acl.c
@@ -131,6 +131,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type)
         }
 
         if (new_mode != old_mode) {
+                newattrs.ia_ctime = current_time(inode);
                 newattrs.ia_mode = new_mode;
                 newattrs.ia_valid = ATTR_MODE;
                 ret = __ceph_setattr(inode, &newattrs);
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index e8f11fa565c5..7df550c13d7f 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -91,6 +91,10 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, u64 ino)
                 ceph_mdsc_put_request(req);
                 if (!inode)
                         return ERR_PTR(-ESTALE);
+                if (inode->i_nlink == 0) {
+                        iput(inode);
+                        return ERR_PTR(-ESTALE);
+                }
         }
 
         return d_obtain_alias(inode);
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 3fdde0b283c9..29308a80d66f 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1671,8 +1671,12 @@ static long ceph_fallocate(struct file *file, int mode,
         }
 
         size = i_size_read(inode);
-        if (!(mode & FALLOC_FL_KEEP_SIZE))
+        if (!(mode & FALLOC_FL_KEEP_SIZE)) {
                 endoff = offset + length;
+                ret = inode_newsize_ok(inode, endoff);
+                if (ret)
+                        goto unlock;
+        }
 
         if (fi->fmode & CEPH_FILE_MODE_LAZY)
                 want = CEPH_CAP_FILE_BUFFER | CEPH_CAP_FILE_LAZYIO;
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index dcce79b84406..4de6cdddf059 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -2022,7 +2022,6 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
                     attr->ia_size > inode->i_size) {
                         i_size_write(inode, attr->ia_size);
                         inode->i_blocks = calc_inode_blocks(attr->ia_size);
-                        inode->i_ctime = attr->ia_ctime;
                         ci->i_reported_size = attr->ia_size;
                         dirtied |= CEPH_CAP_FILE_EXCL;
                 } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
@@ -2044,7 +2043,6 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
                      inode->i_ctime.tv_sec, inode->i_ctime.tv_nsec,
                      attr->ia_ctime.tv_sec, attr->ia_ctime.tv_nsec,
                      only ? "ctime only" : "ignored");
-                inode->i_ctime = attr->ia_ctime;
                 if (only) {
                         /*
                          * if kernel wants to dirty ctime but nothing else,
@@ -2067,7 +2065,7 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
         if (dirtied) {
                 inode_dirty_flags = __ceph_mark_dirty_caps(ci, dirtied,
                                                            &prealloc_cf);
-                inode->i_ctime = current_time(inode);
+                inode->i_ctime = attr->ia_ctime;
         }
 
         release &= issued;
@@ -2085,6 +2083,7 @@ int __ceph_setattr(struct inode *inode, struct iattr *attr)
                 req->r_inode_drop = release;
                 req->r_args.setattr.mask = cpu_to_le32(mask);
                 req->r_num_caps = 1;
+                req->r_stamp = attr->ia_ctime;
                 err = ceph_mdsc_do_request(mdsc, NULL, req);
         }
         dout("setattr %p result=%d (%s locally, %d remote)\n", inode, err,
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index f38e56fa9712..0c05df44cc6c 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1687,7 +1687,6 @@ struct ceph_mds_request *
 ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode)
 {
         struct ceph_mds_request *req = kzalloc(sizeof(*req), GFP_NOFS);
-        struct timespec ts;
 
         if (!req)
                 return ERR_PTR(-ENOMEM);
@@ -1706,8 +1705,7 @@ ceph_mdsc_create_request(struct ceph_mds_client *mdsc, int op, int mode)
         init_completion(&req->r_safe_completion);
         INIT_LIST_HEAD(&req->r_unsafe_item);
 
-        ktime_get_real_ts(&ts);
-        req->r_stamp = timespec_trunc(ts, mdsc->fsc->sb->s_time_gran);
+        req->r_stamp = timespec_trunc(current_kernel_time(), mdsc->fsc->sb->s_time_gran);
 
         req->r_op = op;
         req->r_direct_mode = mode;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 4d1fcd76d022..a8693632235f 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -24,6 +24,7 @@
 #include <linux/pagemap.h>
 #include <linux/freezer.h>
 #include <linux/sched/signal.h>
+#include <linux/wait_bit.h>
 
 #include <asm/div64.h>
 #include "cifsfs.h"
diff --git a/fs/configfs/item.c b/fs/configfs/item.c
index 8b2a994042dd..a66f6624d899 100644
--- a/fs/configfs/item.c
+++ b/fs/configfs/item.c
@@ -138,6 +138,14 @@ struct config_item *config_item_get(struct config_item *item)
 }
 EXPORT_SYMBOL(config_item_get);
 
+struct config_item *config_item_get_unless_zero(struct config_item *item)
+{
+        if (item && kref_get_unless_zero(&item->ci_kref))
+                return item;
+        return NULL;
+}
+EXPORT_SYMBOL(config_item_get_unless_zero);
+
 static void config_item_cleanup(struct config_item *item)
 {
         struct config_item_type *t = item->ci_type;
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index a6ab012a2c6a..c8aabba502f6 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -83,14 +83,13 @@ static int create_link(struct config_item *parent_item,
         ret = -ENOMEM;
         sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL);
         if (sl) {
-                sl->sl_target = config_item_get(item);
                 spin_lock(&configfs_dirent_lock);
                 if (target_sd->s_type & CONFIGFS_USET_DROPPING) {
                         spin_unlock(&configfs_dirent_lock);
-                        config_item_put(item);
                         kfree(sl);
                         return -ENOENT;
                 }
+                sl->sl_target = config_item_get(item);
                 list_add(&sl->sl_list, &target_sd->s_links);
                 spin_unlock(&configfs_dirent_lock);
                 ret = configfs_create_link(sl, parent_item->ci_dentry,
diff --git a/fs/dax.c b/fs/dax.c
index c22eaf162f95..323ea481d4a8 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -84,7 +84,7 @@ struct exceptional_entry_key {
 };
 
 struct wait_exceptional_entry_queue {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct exceptional_entry_key key;
 };
 
@@ -108,7 +108,7 @@ static wait_queue_head_t *dax_entry_waitqueue(struct address_space *mapping,
         return wait_table + hash;
 }
 
-static int wake_exceptional_entry_func(wait_queue_t *wait, unsigned int mode,
+static int wake_exceptional_entry_func(wait_queue_entry_t *wait, unsigned int mode,
                                        int sync, void *keyp)
 {
         struct exceptional_entry_key *key = keyp;
@@ -1155,6 +1155,17 @@ static int dax_iomap_pte_fault(struct vm_fault *vmf,
         }
 
         /*
+         * It is possible, particularly with mixed reads & writes to private
+         * mappings, that we have raced with a PMD fault that overlaps with
+         * the PTE we need to set up.  If so just return and the fault will be
+         * retried.
+         */
+        if (pmd_trans_huge(*vmf->pmd) || pmd_devmap(*vmf->pmd)) {
+                vmf_ret = VM_FAULT_NOPAGE;
+                goto unlock_entry;
+        }
+
+        /*
          * Note that we don't bother to use iomap_apply here: DAX required
          * the file system block size to be equal the page size, which means
          * that we never have to deal with more than a single extent here.
@@ -1398,6 +1409,18 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf,
                 goto fallback;
 
         /*
+         * It is possible, particularly with mixed reads & writes to private
+         * mappings, that we have raced with a PTE fault that overlaps with
+         * the PMD we need to set up.  If so just return and the fault will be
+         * retried.
+         */
+        if (!pmd_none(*vmf->pmd) && !pmd_trans_huge(*vmf->pmd) &&
+                        !pmd_devmap(*vmf->pmd)) {
+                result = 0;
+                goto unlock_entry;
+        }
+
+        /*
          * Note that we don't use iomap_apply here.  We aren't doing I/O, only
          * setting up a mapping, so really we're using iomap_begin() as a way
          * to look up our filesystem block.
diff --git a/fs/dcache.c b/fs/dcache.c
index cddf39777835..a9f995f6859e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1494,7 +1494,7 @@ static void check_and_drop(void *_data)
 {
         struct detach_data *data = _data;
 
-        if (!data->mountpoint && !data->select.found)
+        if (!data->mountpoint && list_empty(&data->select.dispose))
                 __d_drop(data->select.start);
 }
 
@@ -1536,17 +1536,15 @@ void d_invalidate(struct dentry *dentry)
 
                 d_walk(dentry, &data, detach_and_collect, check_and_drop);
 
-                if (data.select.found)
+                if (!list_empty(&data.select.dispose))
                         shrink_dentry_list(&data.select.dispose);
+                else if (!data.mountpoint)
+                        return;
 
                 if (data.mountpoint) {
                         detach_mounts(data.mountpoint);
                         dput(data.mountpoint);
                 }
-
-                if (!data.mountpoint && !data.select.found)
-                        break;
-
                 cond_resched();
         }
 }
diff --git a/fs/eventfd.c b/fs/eventfd.c
index 68b9fffcb2c8..9736df2ce89d 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -191,7 +191,7 @@ static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
  * This is used to atomically remove a wait queue entry from the eventfd wait
  * queue head, and read/reset the counter value.
  */
-int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_t *wait,
+int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait,
                                   __u64 *cnt)
 {
         unsigned long flags;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 5420767c9b68..b1c8e23ddf65 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -244,7 +244,7 @@ struct eppoll_entry {
          * Wait queue item that will be linked to the target file wait
          * queue head.
          */
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         /* The wait queue head that linked the "wait" wait queue item */
         wait_queue_head_t *whead;
@@ -347,13 +347,13 @@ static inline int ep_is_linked(struct list_head *p)
         return !list_empty(p);
 }
 
-static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_entry_t *p)
 {
         return container_of(p, struct eppoll_entry, wait);
 }
 
 /* Get the "struct epitem" from a wait queue pointer */
-static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
+static inline struct epitem *ep_item_from_wait(wait_queue_entry_t *p)
 {
         return container_of(p, struct eppoll_entry, wait)->base;
 }
@@ -1078,7 +1078,7 @@ static struct epitem *ep_find(struct eventpoll *ep, struct file *file, int fd)
  * mechanism. It is called by the stored file descriptors when they
  * have events to report.
  */
-static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         int pwake = 0;
         unsigned long flags;
@@ -1094,7 +1094,7 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
                  * can't use __remove_wait_queue(). whead->lock is held by
                  * the caller.
                  */
-                list_del_init(&wait->task_list);
+                list_del_init(&wait->entry);
         }
 
         spin_lock_irqsave(&ep->lock, flags);
@@ -1699,7 +1699,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
         int res = 0, eavail, timed_out = 0;
         unsigned long flags;
         u64 slack = 0;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         ktime_t expires, *to = NULL;
 
         if (timeout > 0) {
diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
index fd389935ecd1..3ec0e46de95f 100644
--- a/fs/ext4/acl.c
+++ b/fs/ext4/acl.c
@@ -4,6 +4,7 @@
  * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de>
  */
 
+#include <linux/quotaops.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 #include "xattr.h"
@@ -232,6 +233,9 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type)
         handle_t *handle;
         int error, retries = 0;
 
+        error = dquot_initialize(inode);
+        if (error)
+                return error;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_XATTR,
                                     ext4_jbd2_credits_xattr(inode));
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 8e8046104f4d..32191548abed 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2523,7 +2523,6 @@ extern int ext4_search_dir(struct buffer_head *bh,
                            int buf_size,
                            struct inode *dir,
                            struct ext4_filename *fname,
-                           const struct qstr *d_name,
                            unsigned int offset,
                            struct ext4_dir_entry_2 **res_dir);
 extern int ext4_generic_delete_entry(handle_t *handle,
@@ -3007,7 +3006,6 @@ extern int htree_inlinedir_to_tree(struct file *dir_file,
                                    int *has_inline_data);
 extern struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                         struct ext4_filename *fname,
-                                        const struct qstr *d_name,
                                         struct ext4_dir_entry_2 **res_dir,
                                         int *has_inline_data);
 extern int ext4_delete_inline_entry(handle_t *handle,
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 2a97dff87b96..3e36508610b7 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3413,13 +3413,13 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         struct ext4_sb_info *sbi;
         struct ext4_extent_header *eh;
         struct ext4_map_blocks split_map;
-        struct ext4_extent zero_ex;
+        struct ext4_extent zero_ex1, zero_ex2;
         struct ext4_extent *ex, *abut_ex;
         ext4_lblk_t ee_block, eof_block;
         unsigned int ee_len, depth, map_len = map->m_len;
         int allocated = 0, max_zeroout = 0;
         int err = 0;
-        int split_flag = 0;
+        int split_flag = EXT4_EXT_DATA_VALID2;
 
         ext_debug("ext4_ext_convert_to_initialized: inode %lu, logical"
                 "block %llu, max_blocks %u\n", inode->i_ino,
@@ -3436,7 +3436,8 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         ex = path[depth].p_ext;
         ee_block = le32_to_cpu(ex->ee_block);
         ee_len = ext4_ext_get_actual_len(ex);
-        zero_ex.ee_len = 0;
+        zero_ex1.ee_len = 0;
+        zero_ex2.ee_len = 0;
 
         trace_ext4_ext_convert_to_initialized_enter(inode, map, ex);
 
@@ -3576,62 +3577,52 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
         if (ext4_encrypted_inode(inode))
                 max_zeroout = 0;
 
-        /* If extent is less than s_max_zeroout_kb, zeroout directly */
-        if (max_zeroout && (ee_len <= max_zeroout)) {
-                err = ext4_ext_zeroout(inode, ex);
-                if (err)
-                        goto out;
-                zero_ex.ee_block = ex->ee_block;
-                zero_ex.ee_len = cpu_to_le16(ext4_ext_get_actual_len(ex));
-                ext4_ext_store_pblock(&zero_ex, ext4_ext_pblock(ex));
-
-                err = ext4_ext_get_access(handle, inode, path + depth);
-                if (err)
-                        goto out;
-                ext4_ext_mark_initialized(ex);
-                ext4_ext_try_to_merge(handle, inode, path, ex);
-                err = ext4_ext_dirty(handle, inode, path + path->p_depth);
-                goto out;
-        }
-
         /*
-         * four cases:
+         * five cases:
          * 1. split the extent into three extents.
-         * 2. split the extent into two extents, zeroout the first half.
-         * 3. split the extent into two extents, zeroout the second half.
+         * 2. split the extent into two extents, zeroout the head of the first
+         *    extent.
+         * 3. split the extent into two extents, zeroout the tail of the second
+         *    extent.
          * 4. split the extent into two extents with out zeroout.
+         * 5. no splitting needed, just possibly zeroout the head and / or the
+         *    tail of the extent.
          */
         split_map.m_lblk = map->m_lblk;
         split_map.m_len = map->m_len;
 
-        if (max_zeroout && (allocated > map->m_len)) {
+        if (max_zeroout && (allocated > split_map.m_len)) {
                 if (allocated <= max_zeroout) {
-                        /* case 3 */
-                        zero_ex.ee_block =
-                                         cpu_to_le32(map->m_lblk);
-                        zero_ex.ee_len = cpu_to_le16(allocated);
-                        ext4_ext_store_pblock(&zero_ex,
-                                ext4_ext_pblock(ex) + map->m_lblk - ee_block);
-                        err = ext4_ext_zeroout(inode, &zero_ex);
+                        /* case 3 or 5 */
+                        zero_ex1.ee_block =
+                                 cpu_to_le32(split_map.m_lblk +
+                                             split_map.m_len);
+                        zero_ex1.ee_len =
+                                cpu_to_le16(allocated - split_map.m_len);
+                        ext4_ext_store_pblock(&zero_ex1,
+                                ext4_ext_pblock(ex) + split_map.m_lblk +
+                                split_map.m_len - ee_block);
+                        err = ext4_ext_zeroout(inode, &zero_ex1);
                         if (err)
                                 goto out;
-                        split_map.m_lblk = map->m_lblk;
                         split_map.m_len = allocated;
-                } else if (map->m_lblk - ee_block + map->m_len < max_zeroout) {
-                        /* case 2 */
-                        if (map->m_lblk != ee_block) {
-                                zero_ex.ee_block = ex->ee_block;
-                                zero_ex.ee_len = cpu_to_le16(map->m_lblk -
+                }
+                if (split_map.m_lblk - ee_block + split_map.m_len <
+                                                                max_zeroout) {
+                        /* case 2 or 5 */
+                        if (split_map.m_lblk != ee_block) {
+                                zero_ex2.ee_block = ex->ee_block;
+                                zero_ex2.ee_len = cpu_to_le16(split_map.m_lblk -
                                                         ee_block);
-                                ext4_ext_store_pblock(&zero_ex,
+                                ext4_ext_store_pblock(&zero_ex2,
                                                       ext4_ext_pblock(ex));
-                                err = ext4_ext_zeroout(inode, &zero_ex);
+                                err = ext4_ext_zeroout(inode, &zero_ex2);
                                 if (err)
                                         goto out;
                         }
 
+                        split_map.m_len += split_map.m_lblk - ee_block;
                         split_map.m_lblk = ee_block;
-                        split_map.m_len = map->m_lblk - ee_block + map->m_len;
                         allocated = map->m_len;
                 }
         }
@@ -3642,8 +3633,11 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
                 err = 0;
 out:
         /* If we have gotten a failure, don't zero out status tree */
-        if (!err)
-                err = ext4_zeroout_es(inode, &zero_ex);
+        if (!err) {
+                err = ext4_zeroout_es(inode, &zero_ex1);
+                if (!err)
+                        err = ext4_zeroout_es(inode, &zero_ex2);
+        }
         return err ? err : allocated;
 }
 
@@ -4883,6 +4877,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
 
         /* Zero out partial block at the edges of the range */
         ret = ext4_zero_partial_blocks(handle, inode, offset, len);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 
         if (file->f_flags & O_SYNC)
                 ext4_handle_sync(handle);
@@ -5569,6 +5565,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
                 ext4_handle_sync(handle);
         inode->i_mtime = inode->i_ctime = current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
+        ext4_update_inode_fsync_trans(handle, inode, 1);
 
 out_stop:
         ext4_journal_stop(handle);
@@ -5742,6 +5739,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len)
         up_write(&EXT4_I(inode)->i_data_sem);
         if (IS_SYNC(inode))
                 ext4_handle_sync(handle);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 
 out_stop:
         ext4_journal_stop(handle);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 831fd6beebf0..02ce7e7bbdf5 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -474,57 +474,37 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
         endoff = (loff_t)end_blk << blkbits;
 
         index = startoff >> PAGE_SHIFT;
-        end = endoff >> PAGE_SHIFT;
+        end = (endoff - 1) >> PAGE_SHIFT;
 
         pagevec_init(&pvec, 0);
         do {
                 int i, num;
                 unsigned long nr_pages;
 
-                num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+                num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
                 nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
                                           (pgoff_t)num);
-                if (nr_pages == 0) {
-                        if (whence == SEEK_DATA)
-                                break;
-
-                        BUG_ON(whence != SEEK_HOLE);
-                        /*
-                         * If this is the first time to go into the loop and
-                         * offset is not beyond the end offset, it will be a
-                         * hole at this offset
-                         */
-                        if (lastoff == startoff || lastoff < endoff)
-                                found = 1;
-                        break;
-                }
-
-                /*
-                 * If this is the first time to go into the loop and
-                 * offset is smaller than the first page offset, it will be a
-                 * hole at this offset.
-                 */
-                if (lastoff == startoff && whence == SEEK_HOLE &&
-                    lastoff < page_offset(pvec.pages[0])) {
-                        found = 1;
+                if (nr_pages == 0)
                         break;
-                }
 
                 for (i = 0; i < nr_pages; i++) {
                         struct page *page = pvec.pages[i];
                         struct buffer_head *bh, *head;
 
                         /*
-                         * If the current offset is not beyond the end of given
-                         * range, it will be a hole.
+                         * If current offset is smaller than the page offset,
+                         * there is a hole at this offset.
                          */
-                        if (lastoff < endoff && whence == SEEK_HOLE &&
-                            page->index > end) {
+                        if (whence == SEEK_HOLE && lastoff < endoff &&
+                            lastoff < page_offset(pvec.pages[i])) {
                                 found = 1;
                                 *offset = lastoff;
                                 goto out;
                         }
 
+                        if (page->index > end)
+                                goto out;
+
                         lock_page(page);
 
                         if (unlikely(page->mapping != inode->i_mapping)) {
@@ -564,20 +544,18 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
                         unlock_page(page);
                 }
 
-                /*
-                 * The no. of pages is less than our desired, that would be a
-                 * hole in there.
-                 */
-                if (nr_pages < num && whence == SEEK_HOLE) {
-                        found = 1;
-                        *offset = lastoff;
+                /* The no. of pages is less than our desired, we are done. */
+                if (nr_pages < num)
                         break;
-                }
 
                 index = pvec.pages[i - 1]->index + 1;
                 pagevec_release(&pvec);
         } while (index <= end);
 
+        if (whence == SEEK_HOLE && lastoff < endoff) {
+                found = 1;
+                *offset = lastoff;
+        }
 out:
         pagevec_release(&pvec);
         return found;
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index d5dea4c293ef..8d141c0c8ff9 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1627,7 +1627,6 @@ out:
 
 struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                         struct ext4_filename *fname,
-                                        const struct qstr *d_name,
                                         struct ext4_dir_entry_2 **res_dir,
                                         int *has_inline_data)
 {
@@ -1649,7 +1648,7 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
                                                 EXT4_INLINE_DOTDOT_SIZE;
         inline_size = EXT4_MIN_INLINE_DATA_SIZE - EXT4_INLINE_DOTDOT_SIZE;
         ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
-                              dir, fname, d_name, 0, res_dir);
+                              dir, fname, 0, res_dir);
         if (ret == 1)
                 goto out_find;
         if (ret < 0)
@@ -1662,7 +1661,7 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
         inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
 
         ret = ext4_search_dir(iloc.bh, inline_start, inline_size,
-                              dir, fname, d_name, 0, res_dir);
+                              dir, fname, 0, res_dir);
         if (ret == 1)
                 goto out_find;
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 1bd0bfa547f6..5cf82d03968c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2124,15 +2124,29 @@ static int ext4_writepage(struct page *page,
 static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
 {
         int len;
-        loff_t size = i_size_read(mpd->inode);
+        loff_t size;
         int err;
 
         BUG_ON(page->index != mpd->first_page);
+        clear_page_dirty_for_io(page);
+        /*
+         * We have to be very careful here!  Nothing protects writeback path
+         * against i_size changes and the page can be writeably mapped into
+         * page tables. So an application can be growing i_size and writing
+         * data through mmap while writeback runs. clear_page_dirty_for_io()
+         * write-protects our page in page tables and the page cannot get
+         * written to again until we release page lock. So only after
+         * clear_page_dirty_for_io() we are safe to sample i_size for
+         * ext4_bio_write_page() to zero-out tail of the written page. We rely
+         * on the barrier provided by TestClearPageDirty in
+         * clear_page_dirty_for_io() to make sure i_size is really sampled only
+         * after page tables are updated.
+         */
+        size = i_size_read(mpd->inode);
         if (page->index == size >> PAGE_SHIFT)
                 len = size & ~PAGE_MASK;
         else
                 len = PAGE_SIZE;
-        clear_page_dirty_for_io(page);
         err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false);
         if (!err)
                 mpd->wbc->nr_to_write--;
@@ -3629,9 +3643,6 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter)
                 get_block_func = ext4_dio_get_block_unwritten_async;
                 dio_flags = DIO_LOCKING;
         }
-#ifdef CONFIG_EXT4_FS_ENCRYPTION
-        BUG_ON(ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode));
-#endif
         ret = __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev, iter,
                                    get_block_func, ext4_end_io_dio, NULL,
                                    dio_flags);
@@ -3713,7 +3724,7 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter)
          */
         inode_lock_shared(inode);
         ret = filemap_write_and_wait_range(mapping, iocb->ki_pos,
-                                           iocb->ki_pos + count);
+                                           iocb->ki_pos + count - 1);
         if (ret)
                 goto out_unlock;
         ret = __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev,
@@ -4207,6 +4218,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
 
         inode->i_mtime = inode->i_ctime = current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
+        if (ret >= 0)
+                ext4_update_inode_fsync_trans(handle, inode, 1);
 out_stop:
         ext4_journal_stop(handle);
 out_dio:
@@ -5637,8 +5650,9 @@ static int ext4_expand_extra_isize(struct inode *inode,
         /* No extended attributes present */
         if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
             header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
-                memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
-                        new_extra_isize);
+                memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
+                       EXT4_I(inode)->i_extra_isize, 0,
+                       new_extra_isize - EXT4_I(inode)->i_extra_isize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
                 return 0;
         }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 5083bce20ac4..b7928cddd539 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3887,7 +3887,8 @@ ext4_mb_discard_group_preallocations(struct super_block *sb,
 
         err = ext4_mb_load_buddy(sb, group, &e4b);
         if (err) {
-                ext4_error(sb, "Error loading buddy information for %u", group);
+                ext4_warning(sb, "Error %d loading buddy information for %u",
+                             err, group);
                 put_bh(bitmap_bh);
                 return 0;
         }
@@ -4044,10 +4045,11 @@ repeat:
                 BUG_ON(pa->pa_type != MB_INODE_PA);
                 group = ext4_get_group_number(sb, pa->pa_pstart);
 
-                err = ext4_mb_load_buddy(sb, group, &e4b);
+                err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+                                             GFP_NOFS|__GFP_NOFAIL);
                 if (err) {
-                        ext4_error(sb, "Error loading buddy information for %u",
-                                        group);
+                        ext4_error(sb, "Error %d loading buddy information for %u",
+                                   err, group);
                         continue;
                 }
 
@@ -4303,11 +4305,14 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
         spin_unlock(&lg->lg_prealloc_lock);
 
         list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) {
+                int err;
 
                 group = ext4_get_group_number(sb, pa->pa_pstart);
-                if (ext4_mb_load_buddy(sb, group, &e4b)) {
-                        ext4_error(sb, "Error loading buddy information for %u",
-                                        group);
+                err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+                                             GFP_NOFS|__GFP_NOFAIL);
+                if (err) {
+                        ext4_error(sb, "Error %d loading buddy information for %u",
+                                   err, group);
                         continue;
                 }
                 ext4_lock_group(sb, group);
@@ -5127,8 +5132,8 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group,
 
         ret = ext4_mb_load_buddy(sb, group, &e4b);
         if (ret) {
-                ext4_error(sb, "Error in loading buddy "
-                                "information for %u", group);
+                ext4_warning(sb, "Error %d loading buddy information for %u",
+                             ret, group);
                 return ret;
         }
         bitmap = e4b.bd_bitmap;
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b81f7d46f344..404256caf9cf 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1155,12 +1155,11 @@ errout:
 static inline int search_dirblock(struct buffer_head *bh,
                                   struct inode *dir,
                                   struct ext4_filename *fname,
-                                  const struct qstr *d_name,
                                   unsigned int offset,
                                   struct ext4_dir_entry_2 **res_dir)
 {
         return ext4_search_dir(bh, bh->b_data, dir->i_sb->s_blocksize, dir,
-                               fname, d_name, offset, res_dir);
+                               fname, offset, res_dir);
 }
 
 /*
@@ -1262,7 +1261,6 @@ static inline bool ext4_match(const struct ext4_filename *fname,
  */
 int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,
                     struct inode *dir, struct ext4_filename *fname,
-                    const struct qstr *d_name,
                     unsigned int offset, struct ext4_dir_entry_2 **res_dir)
 {
         struct ext4_dir_entry_2 * de;
@@ -1355,7 +1353,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
 
         if (ext4_has_inline_data(dir)) {
                 int has_inline_data = 1;
-                ret = ext4_find_inline_entry(dir, &fname, d_name, res_dir,
+                ret = ext4_find_inline_entry(dir, &fname, res_dir,
                                              &has_inline_data);
                 if (has_inline_data) {
                         if (inlined)
@@ -1447,7 +1445,7 @@ restart:
                         goto next;
                 }
                 set_buffer_verified(bh);
-                i = search_dirblock(bh, dir, &fname, d_name,
+                i = search_dirblock(bh, dir, &fname,
                             block << EXT4_BLOCK_SIZE_BITS(sb), res_dir);
                 if (i == 1) {
                         EXT4_I(dir)->i_dir_start_lookup = block;
@@ -1488,7 +1486,6 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 {
         struct super_block * sb = dir->i_sb;
         struct dx_frame frames[2], *frame;
-        const struct qstr *d_name = fname->usr_fname;
         struct buffer_head *bh;
         ext4_lblk_t block;
         int retval;
@@ -1505,7 +1502,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
                 if (IS_ERR(bh))
                         goto errout;
 
-                retval = search_dirblock(bh, dir, fname, d_name,
+                retval = search_dirblock(bh, dir, fname,
                                          block << EXT4_BLOCK_SIZE_BITS(sb),
                                          res_dir);
                 if (retval == 1)
@@ -1530,7 +1527,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,
 
         bh = NULL;
 errout:
-        dxtrace(printk(KERN_DEBUG "%s not found\n", d_name->name));
+        dxtrace(printk(KERN_DEBUG "%s not found\n", fname->usr_fname->name));
 success:
         dx_release(frames);
         return bh;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 0b177da9ea82..d37c81f327e7 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -848,14 +848,9 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
 {
         int type;
 
-        if (ext4_has_feature_quota(sb)) {
-                dquot_disable(sb, -1,
-                              DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED);
-        } else {
-                /* Use our quota_off function to clear inode flags etc. */
-                for (type = 0; type < EXT4_MAXQUOTAS; type++)
-                        ext4_quota_off(sb, type);
-        }
+        /* Use our quota_off function to clear inode flags etc. */
+        for (type = 0; type < EXT4_MAXQUOTAS; type++)
+                ext4_quota_off(sb, type);
 }
 #else
 static inline void ext4_quota_off_umount(struct super_block *sb)
@@ -1179,6 +1174,9 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                 return res;
         }
 
+        res = dquot_initialize(inode);
+        if (res)
+                return res;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_MISC,
                         ext4_jbd2_credits_xattr(inode));
@@ -5485,7 +5483,7 @@ static int ext4_quota_off(struct super_block *sb, int type)
                 goto out;
 
         err = dquot_quota_off(sb, type);
-        if (err)
+        if (err || ext4_has_feature_quota(sb))
                 goto out_put;
 
         inode_lock(inode);
@@ -5505,6 +5503,7 @@ static int ext4_quota_off(struct super_block *sb, int type)
 out_unlock:
         inode_unlock(inode);
 out_put:
+        lockdep_set_quota_inode(inode, I_DATA_SEM_NORMAL);
         iput(inode);
         return err;
 out:
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 8fb7ce14e6eb..5d3c2536641c 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -888,6 +888,8 @@ inserted:
                         else {
                                 u32 ref;
 
+                                WARN_ON_ONCE(dquot_initialize_needed(inode));
+
                                 /* The old block is released after updating
                                    the inode. */
                                 error = dquot_alloc_block(inode,
@@ -954,6 +956,8 @@ inserted:
                         /* We need to allocate a new block */
                         ext4_fsblk_t goal, block;
 
+                        WARN_ON_ONCE(dquot_initialize_needed(inode));
+
                         goal = ext4_group_first_block_no(sb,
                                                 EXT4_I(inode)->i_block_group);
 
@@ -1166,6 +1170,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
                 return -EINVAL;
         if (strlen(name) > 255)
                 return -ERANGE;
+
         ext4_write_lock_xattr(inode, &no_expand);
 
         error = ext4_reserve_inode_write(handle, inode, &is.iloc);
@@ -1267,6 +1272,9 @@ ext4_xattr_set(struct inode *inode, int name_index, const char *name,
         int error, retries = 0;
         int credits = ext4_jbd2_credits_xattr(inode);
 
+        error = dquot_initialize(inode);
+        if (error)
+                return error;
 retry:
         handle = ext4_journal_start(inode, EXT4_HT_XATTR, credits);
         if (IS_ERR(handle)) {
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 2185c7a040a1..fd2e651bad6d 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1078,6 +1078,7 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address,
 {
         SHASH_DESC_ON_STACK(shash, sbi->s_chksum_driver);
         u32 *ctx = (u32 *)shash_desc_ctx(shash);
+        u32 retval;
         int err;
 
         shash->tfm = sbi->s_chksum_driver;
@@ -1087,7 +1088,9 @@ static inline u32 f2fs_crc32(struct f2fs_sb_info *sbi, const void *address,
         err = crypto_shash_update(shash, address, length);
         BUG_ON(err);
 
-        return *ctx;
+        retval = *ctx;
+        barrier_data(ctx);
+        return retval;
 }
 
 static inline bool f2fs_crc_valid(struct f2fs_sb_info *sbi, __u32 blk_crc,
diff --git a/fs/fs_pin.c b/fs/fs_pin.c
index 611b5408f6ec..e747b3d720ee 100644
--- a/fs/fs_pin.c
+++ b/fs/fs_pin.c
@@ -34,7 +34,7 @@ void pin_insert(struct fs_pin *pin, struct vfsmount *m)
 
 void pin_kill(struct fs_pin *p)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if (!p) {
                 rcu_read_unlock();
@@ -61,7 +61,7 @@ void pin_kill(struct fs_pin *p)
                 rcu_read_unlock();
                 schedule();
                 rcu_read_lock();
-                if (likely(list_empty(&wait.task_list)))
+                if (likely(list_empty(&wait.entry)))
                         break;
                 /* OK, we know p couldn't have been freed yet */
                 spin_lock_irq(&p->wait.lock);
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index f865b96374df..d2955daf17a4 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -659,7 +659,7 @@ static void log_write_header(struct gfs2_sbd *sdp, u32 flags)
         struct gfs2_log_header *lh;
         unsigned int tail;
         u32 hash;
-        int op_flags = REQ_PREFLUSH | REQ_FUA | REQ_META;
+        int op_flags = REQ_PREFLUSH | REQ_FUA | REQ_META | REQ_SYNC;
         struct page *page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
         enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state);
         lh = page_address(page);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index dde861387a40..d44f5456eb9b 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -200,7 +200,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/fs/inode.c b/fs/inode.c
index db5914783a71..70761d6cafcd 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1891,11 +1891,11 @@ static void __wait_on_freeing_inode(struct inode *inode)
         wait_queue_head_t *wq;
         DEFINE_WAIT_BIT(wait, &inode->i_state, __I_NEW);
         wq = bit_waitqueue(&inode->i_state, __I_NEW);
-        prepare_to_wait(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+        prepare_to_wait(wq, &wait.wq_entry, TASK_UNINTERRUPTIBLE);
         spin_unlock(&inode->i_lock);
         spin_unlock(&inode_hash_lock);
         schedule();
-        finish_wait(wq, &wait.wait);
+        finish_wait(wq, &wait.wq_entry);
         spin_lock(&inode_hash_lock);
 }
 
@@ -2038,11 +2038,11 @@ static void __inode_dio_wait(struct inode *inode)
         DEFINE_WAIT_BIT(q, &inode->i_state, __I_DIO_WAKEUP);
 
         do {
-                prepare_to_wait(wq, &q.wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(wq, &q.wq_entry, TASK_UNINTERRUPTIBLE);
                 if (atomic_read(&inode->i_dio_count))
                         schedule();
         } while (atomic_read(&inode->i_dio_count));
-        finish_wait(wq, &q.wait);
+        finish_wait(wq, &q.wq_entry);
 }
 
 /**
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index ebad34266bcf..7d5ef3bf3f3e 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2579,10 +2579,10 @@ restart:
                 wait_queue_head_t *wq;
                 DEFINE_WAIT_BIT(wait, &jinode->i_flags, __JI_COMMIT_RUNNING);
                 wq = bit_waitqueue(&jinode->i_flags, __JI_COMMIT_RUNNING);
-                prepare_to_wait(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(wq, &wait.wq_entry, TASK_UNINTERRUPTIBLE);
                 spin_unlock(&journal->j_list_lock);
                 schedule();
-                finish_wait(wq, &wait.wait);
+                finish_wait(wq, &wait.wq_entry);
                 goto restart;
         }
 
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 9ee4832b6f8b..2d30a6da7013 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -680,6 +680,12 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask)
 
         rwsem_release(&journal->j_trans_commit_map, 1, _THIS_IP_);
         handle->h_buffer_credits = nblocks;
+        /*
+         * Restore the original nofs context because the journal restart
+         * is basically the same thing as journal stop and start.
+         * start_this_handle will start a new nofs context.
+         */
+        memalloc_nofs_restore(handle->saved_alloc_context);
         ret = start_this_handle(journal, handle, gfp_mask);
         return ret;
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index 8bd3e4d448b9..5a4438445bf7 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3488,6 +3488,8 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
                 return err;
         }
 
+        put_mnt_ns(old_mnt_ns);
+
         /* Update the pwd and root */
         set_fs_pwd(fs, &root);
         set_fs_root(fs, &root);
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index f5714ee01000..23542dc44a25 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -454,6 +454,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
                         goto out_err_free;
 
                 /* fh */
+                rc = -EIO;
                 p = xdr_inline_decode(&stream, 4);
                 if (!p)
                         goto out_err_free;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index e9b4c3320e37..8701d7617964 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -7,6 +7,7 @@
 #include <linux/security.h>
 #include <linux/crc32.h>
 #include <linux/nfs_page.h>
+#include <linux/wait_bit.h>
 
 #define NFS_MS_MASK (MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_SYNCHRONOUS)
 
@@ -398,7 +399,6 @@ extern struct file_system_type nfs4_referral_fs_type;
 bool nfs_auth_info_match(const struct nfs_auth_info *, rpc_authflavor_t);
 struct dentry *nfs_try_mount(int, const char *, struct nfs_mount_info *,
                         struct nfs_subversion *);
-void nfs_initialise_sb(struct super_block *);
 int nfs_set_sb_security(struct super_block *, struct dentry *, struct nfs_mount_info *);
 int nfs_clone_sb_security(struct super_block *, struct dentry *, struct nfs_mount_info *);
 struct dentry *nfs_fs_mount_common(struct nfs_server *, int, const char *,
@@ -458,7 +458,6 @@ extern void nfs_read_prepare(struct rpc_task *task, void *calldata);
 extern void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio);
 
 /* super.c */
-void nfs_clone_super(struct super_block *, struct nfs_mount_info *);
 void nfs_umount_begin(struct super_block *);
 int  nfs_statfs(struct dentry *, struct kstatfs *);
 int  nfs_show_options(struct seq_file *, struct dentry *);
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 1a224a33a6c2..e5686be67be8 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -246,7 +246,7 @@ struct vfsmount *nfs_do_submount(struct dentry *dentry, struct nfs_fh *fh,
 
         devname = nfs_devname(dentry, page, PAGE_SIZE);
         if (IS_ERR(devname))
-                mnt = (struct vfsmount *)devname;
+                mnt = ERR_CAST(devname);
         else
                 mnt = nfs_do_clone_mount(NFS_SB(dentry->d_sb), devname, &mountdata);
 
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 929d09a5310a..319a47db218d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -177,7 +177,7 @@ static ssize_t _nfs42_proc_copy(struct file *src,
         if (status)
                 goto out;
 
-        if (!nfs_write_verifier_cmp(&res->write_res.verifier.verifier,
+        if (nfs_write_verifier_cmp(&res->write_res.verifier.verifier,
                                     &res->commit_res.verf->verifier)) {
                 status = -EAGAIN;
                 goto out;
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 692a7a8bfc7a..66776f022111 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -582,7 +582,6 @@ int nfs40_walk_client_list(struct nfs_client *new,
                          */
                         nfs4_schedule_path_down_recovery(pos);
                 default:
-                        spin_lock(&nn->nfs_client_lock);
                         goto out;
                 }
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index c08c46a3b8cd..be5a8f84e5bb 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6372,7 +6372,7 @@ struct nfs4_lock_waiter {
 };
 
 static int
-nfs4_wake_lock_waiter(wait_queue_t *wait, unsigned int mode, int flags, void *key)
+nfs4_wake_lock_waiter(wait_queue_entry_t *wait, unsigned int mode, int flags, void *key)
 {
         int ret;
         struct cb_notify_lock_args *cbnl = key;
@@ -6415,7 +6415,7 @@ nfs4_retry_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
                                            .inode = state->inode,
                                            .owner = &owner,
                                            .notified = false };
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         /* Don't bother with waitqueue if we don't expect a callback */
         if (!test_bit(NFS_STATE_MAY_NOTIFY_LOCK, &state->flags))
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index adc6ec28d4b5..c383d0913b54 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2094,12 +2094,26 @@ pnfs_generic_pg_check_layout(struct nfs_pageio_descriptor *pgio)
 }
 EXPORT_SYMBOL_GPL(pnfs_generic_pg_check_layout);
 
+/*
+ * Check for any intersection between the request and the pgio->pg_lseg,
+ * and if none, put this pgio->pg_lseg away.
+ */
+static void
+pnfs_generic_pg_check_range(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+{
+        if (pgio->pg_lseg && !pnfs_lseg_request_intersecting(pgio->pg_lseg, req)) {
+                pnfs_put_lseg(pgio->pg_lseg);
+                pgio->pg_lseg = NULL;
+        }
+}
+
 void
 pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
 {
         u64 rd_size = req->wb_bytes;
 
         pnfs_generic_pg_check_layout(pgio);
+        pnfs_generic_pg_check_range(pgio, req);
         if (pgio->pg_lseg == NULL) {
                 if (pgio->pg_dreq == NULL)
                         rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
@@ -2131,6 +2145,7 @@ pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *pgio,
                            struct nfs_page *req, u64 wb_size)
 {
         pnfs_generic_pg_check_layout(pgio);
+        pnfs_generic_pg_check_range(pgio, req);
         if (pgio->pg_lseg == NULL) {
                 pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
                                                    req->wb_context,
@@ -2191,16 +2206,10 @@ pnfs_generic_pg_test(struct nfs_pageio_descriptor *pgio,
                 seg_end = pnfs_end_offset(pgio->pg_lseg->pls_range.offset,
                                      pgio->pg_lseg->pls_range.length);
                 req_start = req_offset(req);
-                WARN_ON_ONCE(req_start >= seg_end);
+
                 /* start of request is past the last byte of this segment */
-                if (req_start >= seg_end) {
-                        /* reference the new lseg */
-                        if (pgio->pg_ops->pg_cleanup)
-                                pgio->pg_ops->pg_cleanup(pgio);
-                        if (pgio->pg_ops->pg_init)
-                                pgio->pg_ops->pg_init(pgio, req);
+                if (req_start >= seg_end)
                         return 0;
-                }
 
                 /* adjust 'size' iff there are fewer bytes left in the
                  * segment than what nfs_generic_pg_test returned */
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 2d05b756a8d6..99731e3e332f 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -593,6 +593,16 @@ pnfs_lseg_range_intersecting(const struct pnfs_layout_range *l1,
         return pnfs_is_range_intersecting(l1->offset, end1, l2->offset, end2);
 }
 
+static inline bool
+pnfs_lseg_request_intersecting(struct pnfs_layout_segment *lseg, struct nfs_page *req)
+{
+        u64 seg_last = pnfs_end_offset(lseg->pls_range.offset, lseg->pls_range.length);
+        u64 req_last = req_offset(req) + req->wb_bytes;
+
+        return pnfs_is_range_intersecting(lseg->pls_range.offset, seg_last,
+                                req_offset(req), req_last);
+}
+
 extern unsigned int layoutstats_timer;
 
 #ifdef NFS_DEBUG
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2f3822a4a7d5..eceb4eabb064 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2301,7 +2301,7 @@ EXPORT_SYMBOL_GPL(nfs_remount);
 /*
  * Initialise the common bits of the superblock
  */
-inline void nfs_initialise_sb(struct super_block *sb)
+static void nfs_initialise_sb(struct super_block *sb)
 {
         struct nfs_server *server = NFS_SB(sb);
 
@@ -2348,7 +2348,8 @@ EXPORT_SYMBOL_GPL(nfs_fill_super);
 /*
  * Finish setting up a cloned NFS2/3/4 superblock
  */
-void nfs_clone_super(struct super_block *sb, struct nfs_mount_info *mount_info)
+static void nfs_clone_super(struct super_block *sb,
+                            struct nfs_mount_info *mount_info)
 {
         const struct super_block *old_sb = mount_info->cloned->sb;
         struct nfs_server *server = NFS_SB(sb);
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 12feac6ee2fd..452334694a5d 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -334,11 +334,8 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
         if (!p)
                 return 0;
         p = xdr_decode_hyper(p, &args->offset);
-        args->count = ntohl(*p++);
-
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
 
+        args->count = ntohl(*p++);
         len = min(args->count, max_blocksize);
 
         /* set up the kvec */
@@ -352,7 +349,7 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
                 v++;
         }
         args->vlen = v;
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -544,11 +541,9 @@ nfs3svc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p,
         p = decode_fh(p, &args->fh);
         if (!p)
                 return 0;
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -574,14 +569,10 @@ nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
         args->verf   = p; p += 2;
         args->dircount = ~0;
         args->count  = ntohl(*p++);
-
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
-
         args->count  = min_t(u32, args->count, PAGE_SIZE);
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -599,9 +590,6 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
         args->dircount = ntohl(*p++);
         args->count    = ntohl(*p++);
 
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
-
         len = args->count = min(args->count, max_blocksize);
         while (len > 0) {
                 struct page *p = *(rqstp->rq_next_page++);
@@ -609,7 +597,8 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
                         args->buffer = page_address(p);
                 len -= PAGE_SIZE;
         }
-        return 1;
+
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index c453a1998e00..dadb3bf305b2 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1769,6 +1769,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         opdesc->op_get_currentstateid(cstate, &op->u);
                 op->status = opdesc->op_func(rqstp, cstate, &op->u);
 
+                /* Only from SEQUENCE */
+                if (cstate->status == nfserr_replay_cache) {
+                        dprintk("%s NFS4.1 replay from cache\n", __func__);
+                        status = op->status;
+                        goto out;
+                }
                 if (!op->status) {
                         if (opdesc->op_set_currentstateid)
                                 opdesc->op_set_currentstateid(cstate, &op->u);
@@ -1779,14 +1785,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                         if (need_wrongsec_check(rqstp))
                                 op->status = check_nfsd_access(current_fh->fh_export, rqstp);
                 }
-
 encode_op:
-                /* Only from SEQUENCE */
-                if (cstate->status == nfserr_replay_cache) {
-                        dprintk("%s NFS4.1 replay from cache\n", __func__);
-                        status = op->status;
-                        goto out;
-                }
                 if (op->status == nfserr_replay_me) {
                         op->replay = &cstate->replay_owner->so_replay;
                         nfsd4_encode_replay(&resp->xdr, op);
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 6a4947a3f4fa..de07ff625777 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -257,9 +257,6 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
         len = args->count     = ntohl(*p++);
         p++; /* totalcount - unused */
 
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
-
         len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2);
 
         /* set up somewhere to store response.
@@ -275,7 +272,7 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
                 v++;
         }
         args->vlen = v;
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -365,11 +362,9 @@ nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd_readli
         p = decode_fh(p, &args->fh);
         if (!p)
                 return 0;
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 int
@@ -407,11 +402,9 @@ nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
         args->cookie = ntohl(*p++);
         args->count  = ntohl(*p++);
         args->count  = min_t(u32, args->count, PAGE_SIZE);
-        if (!xdr_argsize_check(rqstp, p))
-                return 0;
         args->buffer = page_address(*(rqstp->rq_next_page++));
 
-        return 1;
+        return xdr_argsize_check(rqstp, p);
 }
 
 /*
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index febed1217b3f..70ded52dc1dd 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2161,7 +2161,7 @@ void nilfs_flush_segment(struct super_block *sb, ino_t ino)
 }
 
 struct nilfs_segctor_wait_request {
-        wait_queue_t    wq;
+        wait_queue_entry_t      wq;
         __u32           seq;
         int             err;
         atomic_t        done;
@@ -2206,8 +2206,7 @@ static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err)
         unsigned long flags;
 
         spin_lock_irqsave(&sci->sc_wait_request.lock, flags);
-        list_for_each_entry_safe(wrq, n, &sci->sc_wait_request.task_list,
-                                 wq.task_list) {
+        list_for_each_entry_safe(wrq, n, &sci->sc_wait_request.head, wq.entry) {
                 if (!atomic_read(&wrq->done) &&
                     nilfs_cnt32_ge(sci->sc_seq_done, wrq->seq)) {
                         wrq->err = err;
diff --git a/fs/ntfs/namei.c b/fs/ntfs/namei.c
index 358258364616..4690cd75d8d7 100644
--- a/fs/ntfs/namei.c
+++ b/fs/ntfs/namei.c
@@ -159,7 +159,7 @@ static struct dentry *ntfs_lookup(struct inode *dir_ino, struct dentry *dent,
                                         PTR_ERR(dent_inode));
                 kfree(name);
                 /* Return the error code. */
-                return (struct dentry *)dent_inode;
+                return ERR_CAST(dent_inode);
         }
         /* It is guaranteed that @name is no longer allocated at this point. */
         if (MREF_ERR(mref) == -ENOENT) {
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 827fc9809bc2..9f88188060db 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -119,7 +119,7 @@ check_err:
 
         if (IS_ERR(inode)) {
                 mlog_errno(PTR_ERR(inode));
-                result = (void *)inode;
+                result = ERR_CAST(inode);
                 goto bail;
         }
 
diff --git a/fs/orangefs/orangefs-bufmap.c b/fs/orangefs/orangefs-bufmap.c
index 83b506020718..038d67545d9f 100644
--- a/fs/orangefs/orangefs-bufmap.c
+++ b/fs/orangefs/orangefs-bufmap.c
@@ -46,8 +46,8 @@ static void run_down(struct slot_map *m)
         spin_lock(&m->q.lock);
         if (m->c != -1) {
                 for (;;) {
-                        if (likely(list_empty(&wait.task_list)))
-                                __add_wait_queue_tail(&m->q, &wait);
+                        if (likely(list_empty(&wait.entry)))
+                                __add_wait_queue_entry_tail(&m->q, &wait);
                         set_current_state(TASK_UNINTERRUPTIBLE);
 
                         if (m->c == -1)
@@ -84,8 +84,8 @@ static int wait_for_free(struct slot_map *m)
 
         do {
                 long n = left, t;
-                if (likely(list_empty(&wait.task_list)))
-                        __add_wait_queue_tail_exclusive(&m->q, &wait);
+                if (likely(list_empty(&wait.entry)))
+                        __add_wait_queue_entry_tail_exclusive(&m->q, &wait);
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 if (m->c > 0)
@@ -108,8 +108,8 @@ static int wait_for_free(struct slot_map *m)
                         left = -EINTR;
         } while (left > 0);
 
-        if (!list_empty(&wait.task_list))
-                list_del(&wait.task_list);
+        if (!list_empty(&wait.entry))
+                list_del(&wait.entry);
         else if (left <= 0 && waitqueue_active(&m->q))
                 __wake_up_locked_key(&m->q, TASK_INTERRUPTIBLE, NULL);
         __set_current_state(TASK_RUNNING);
diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig
index 0daac5112f7a..c0c9683934b7 100644
--- a/fs/overlayfs/Kconfig
+++ b/fs/overlayfs/Kconfig
@@ -1,5 +1,6 @@
 config OVERLAY_FS
         tristate "Overlay filesystem support"
+        select EXPORTFS
         help
           An overlay filesystem combines two filesystems - an 'upper' filesystem
           and a 'lower' filesystem.  When a name exists in both filesystems, the
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 9008ab9fbd2e..7a44533f4bbf 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -300,7 +300,11 @@ static int ovl_set_origin(struct dentry *dentry, struct dentry *lower,
                         return PTR_ERR(fh);
         }
 
-        err = ovl_do_setxattr(upper, OVL_XATTR_ORIGIN, fh, fh ? fh->len : 0, 0);
+        /*
+         * Do not fail when upper doesn't support xattrs.
+         */
+        err = ovl_check_setxattr(dentry, upper, OVL_XATTR_ORIGIN, fh,
+                                 fh ? fh->len : 0, 0);
         kfree(fh);
 
         return err;
@@ -342,13 +346,14 @@ static int ovl_copy_up_locked(struct dentry *workdir, struct dentry *upperdir,
         if (tmpfile)
                 temp = ovl_do_tmpfile(upperdir, stat->mode);
         else
-                temp = ovl_lookup_temp(workdir, dentry);
-        err = PTR_ERR(temp);
-        if (IS_ERR(temp))
-                goto out1;
-
+                temp = ovl_lookup_temp(workdir);
         err = 0;
-        if (!tmpfile)
+        if (IS_ERR(temp)) {
+                err = PTR_ERR(temp);
+                temp = NULL;
+        }
+
+        if (!err && !tmpfile)
                 err = ovl_create_real(wdir, temp, &cattr, NULL, true);
 
         if (new_creds) {
@@ -454,6 +459,11 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
         ovl_path_upper(parent, &parentpath);
         upperdir = parentpath.dentry;
 
+        /* Mark parent "impure" because it may now contain non-pure upper */
+        err = ovl_set_impure(parent, upperdir);
+        if (err)
+                return err;
+
         err = vfs_getattr(&parentpath, &pstat,
                           STATX_ATIME | STATX_MTIME, AT_STATX_SYNC_AS_STAT);
         if (err)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 723b98b90698..a63a71656e9b 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -41,7 +41,7 @@ void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
         }
 }
 
-struct dentry *ovl_lookup_temp(struct dentry *workdir, struct dentry *dentry)
+struct dentry *ovl_lookup_temp(struct dentry *workdir)
 {
         struct dentry *temp;
         char name[20];
@@ -68,7 +68,7 @@ static struct dentry *ovl_whiteout(struct dentry *workdir,
         struct dentry *whiteout;
         struct inode *wdir = workdir->d_inode;
 
-        whiteout = ovl_lookup_temp(workdir, dentry);
+        whiteout = ovl_lookup_temp(workdir);
         if (IS_ERR(whiteout))
                 return whiteout;
 
@@ -127,17 +127,28 @@ int ovl_create_real(struct inode *dir, struct dentry *newdentry,
         return err;
 }
 
-static int ovl_set_opaque(struct dentry *dentry, struct dentry *upperdentry)
+static int ovl_set_opaque_xerr(struct dentry *dentry, struct dentry *upper,
+                               int xerr)
 {
         int err;
 
-        err = ovl_do_setxattr(upperdentry, OVL_XATTR_OPAQUE, "y", 1, 0);
+        err = ovl_check_setxattr(dentry, upper, OVL_XATTR_OPAQUE, "y", 1, xerr);
         if (!err)
                 ovl_dentry_set_opaque(dentry);
 
         return err;
 }
 
+static int ovl_set_opaque(struct dentry *dentry, struct dentry *upperdentry)
+{
+        /*
+         * Fail with -EIO when trying to create opaque dir and upper doesn't
+         * support xattrs. ovl_rename() calls ovl_set_opaque_xerr(-EXDEV) to
+         * return a specific error for noxattr case.
+         */
+        return ovl_set_opaque_xerr(dentry, upperdentry, -EIO);
+}
+
 /* Common operations required to be done after creation of file on upper */
 static void ovl_instantiate(struct dentry *dentry, struct inode *inode,
                             struct dentry *newdentry, bool hardlink)
@@ -162,6 +173,11 @@ static bool ovl_type_merge(struct dentry *dentry)
         return OVL_TYPE_MERGE(ovl_path_type(dentry));
 }
 
+static bool ovl_type_origin(struct dentry *dentry)
+{
+        return OVL_TYPE_ORIGIN(ovl_path_type(dentry));
+}
+
 static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
                             struct cattr *attr, struct dentry *hardlink)
 {
@@ -250,7 +266,7 @@ static struct dentry *ovl_clear_empty(struct dentry *dentry,
         if (upper->d_parent->d_inode != udir)
                 goto out_unlock;
 
-        opaquedir = ovl_lookup_temp(workdir, dentry);
+        opaquedir = ovl_lookup_temp(workdir);
         err = PTR_ERR(opaquedir);
         if (IS_ERR(opaquedir))
                 goto out_unlock;
@@ -382,7 +398,7 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
         if (err)
                 goto out;
 
-        newdentry = ovl_lookup_temp(workdir, dentry);
+        newdentry = ovl_lookup_temp(workdir);
         err = PTR_ERR(newdentry);
         if (IS_ERR(newdentry))
                 goto out_unlock;
@@ -846,18 +862,16 @@ static int ovl_set_redirect(struct dentry *dentry, bool samedir)
         if (IS_ERR(redirect))
                 return PTR_ERR(redirect);
 
-        err = ovl_do_setxattr(ovl_dentry_upper(dentry), OVL_XATTR_REDIRECT,
-                              redirect, strlen(redirect), 0);
+        err = ovl_check_setxattr(dentry, ovl_dentry_upper(dentry),
+                                 OVL_XATTR_REDIRECT,
+                                 redirect, strlen(redirect), -EXDEV);
         if (!err) {
                 spin_lock(&dentry->d_lock);
                 ovl_dentry_set_redirect(dentry, redirect);
                 spin_unlock(&dentry->d_lock);
         } else {
                 kfree(redirect);
-                if (err == -EOPNOTSUPP)
-                        ovl_clear_redirect_dir(dentry->d_sb);
-                else
-                        pr_warn_ratelimited("overlay: failed to set redirect (%i)\n", err);
+                pr_warn_ratelimited("overlay: failed to set redirect (%i)\n", err);
                 /* Fall back to userspace copy-up */
                 err = -EXDEV;
         }
@@ -943,6 +957,25 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
         old_upperdir = ovl_dentry_upper(old->d_parent);
         new_upperdir = ovl_dentry_upper(new->d_parent);
 
+        if (!samedir) {
+                /*
+                 * When moving a merge dir or non-dir with copy up origin into
+                 * a new parent, we are marking the new parent dir "impure".
+                 * When ovl_iterate() iterates an "impure" upper dir, it will
+                 * lookup the origin inodes of the entries to fill d_ino.
+                 */
+                if (ovl_type_origin(old)) {
+                        err = ovl_set_impure(new->d_parent, new_upperdir);
+                        if (err)
+                                goto out_revert_creds;
+                }
+                if (!overwrite && ovl_type_origin(new)) {
+                        err = ovl_set_impure(old->d_parent, old_upperdir);
+                        if (err)
+                                goto out_revert_creds;
+                }
+        }
+
         trap = lock_rename(new_upperdir, old_upperdir);
 
         olddentry = lookup_one_len(old->d_name.name, old_upperdir,
@@ -992,7 +1025,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
                 if (ovl_type_merge_or_lower(old))
                         err = ovl_set_redirect(old, samedir);
                 else if (!old_opaque && ovl_type_merge(new->d_parent))
-                        err = ovl_set_opaque(old, olddentry);
+                        err = ovl_set_opaque_xerr(old, olddentry, -EXDEV);
                 if (err)
                         goto out_dput;
         }
@@ -1000,7 +1033,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
                 if (ovl_type_merge_or_lower(new))
                         err = ovl_set_redirect(new, samedir);
                 else if (!new_opaque && ovl_type_merge(old->d_parent))
-                        err = ovl_set_opaque(new, newdentry);
+                        err = ovl_set_opaque_xerr(new, newdentry, -EXDEV);
                 if (err)
                         goto out_dput;
         }
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index ad9547f82da5..d613e2c41242 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -240,6 +240,16 @@ int ovl_xattr_get(struct dentry *dentry, const char *name,
         return res;
 }
 
+static bool ovl_can_list(const char *s)
+{
+        /* List all non-trusted xatts */
+        if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0)
+                return true;
+
+        /* Never list trusted.overlay, list other trusted for superuser only */
+        return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN);
+}
+
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
         struct dentry *realdentry = ovl_dentry_real(dentry);
@@ -263,7 +273,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
                         return -EIO;
 
                 len -= slen;
-                if (ovl_is_private_xattr(s)) {
+                if (!ovl_can_list(s)) {
                         res -= slen;
                         memmove(s, s + slen, len);
                 } else {
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index bad0f665a635..f3136c31e72a 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -169,17 +169,7 @@ invalid:
 
 static bool ovl_is_opaquedir(struct dentry *dentry)
 {
-        int res;
-        char val;
-
-        if (!d_is_dir(dentry))
-                return false;
-
-        res = vfs_getxattr(dentry, OVL_XATTR_OPAQUE, &val, 1);
-        if (res == 1 && val == 'y')
-                return true;
-
-        return false;
+        return ovl_check_dir_xattr(dentry, OVL_XATTR_OPAQUE);
 }
 
 static int ovl_lookup_single(struct dentry *base, struct ovl_lookup_data *d,
@@ -351,6 +341,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
         unsigned int ctr = 0;
         struct inode *inode = NULL;
         bool upperopaque = false;
+        bool upperimpure = false;
         char *upperredirect = NULL;
         struct dentry *this;
         unsigned int i;
@@ -395,6 +386,8 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
                                 poe = roe;
                 }
                 upperopaque = d.opaque;
+                if (upperdentry && d.is_dir)
+                        upperimpure = ovl_is_impuredir(upperdentry);
         }
 
         if (!d.stop && poe->numlower) {
@@ -463,6 +456,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
 
         revert_creds(old_cred);
         oe->opaque = upperopaque;
+        oe->impure = upperimpure;
         oe->redirect = upperredirect;
         oe->__upperdentry = upperdentry;
         memcpy(oe->lowerstack, stack, sizeof(struct path) * ctr);
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index caa36cb9c46d..0623cebeefff 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -24,6 +24,7 @@ enum ovl_path_type {
 #define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX "opaque"
 #define OVL_XATTR_REDIRECT OVL_XATTR_PREFIX "redirect"
 #define OVL_XATTR_ORIGIN OVL_XATTR_PREFIX "origin"
+#define OVL_XATTR_IMPURE OVL_XATTR_PREFIX "impure"
 
 /*
  * The tuple (fh,uuid) is a universal unique identifier for a copy up origin,
@@ -203,10 +204,10 @@ struct dentry *ovl_dentry_real(struct dentry *dentry);
 struct ovl_dir_cache *ovl_dir_cache(struct dentry *dentry);
 void ovl_set_dir_cache(struct dentry *dentry, struct ovl_dir_cache *cache);
 bool ovl_dentry_is_opaque(struct dentry *dentry);
+bool ovl_dentry_is_impure(struct dentry *dentry);
 bool ovl_dentry_is_whiteout(struct dentry *dentry);
 void ovl_dentry_set_opaque(struct dentry *dentry);
 bool ovl_redirect_dir(struct super_block *sb);
-void ovl_clear_redirect_dir(struct super_block *sb);
 const char *ovl_dentry_get_redirect(struct dentry *dentry);
 void ovl_dentry_set_redirect(struct dentry *dentry, const char *redirect);
 void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry);
@@ -219,6 +220,17 @@ bool ovl_is_whiteout(struct dentry *dentry);
 struct file *ovl_path_open(struct path *path, int flags);
 int ovl_copy_up_start(struct dentry *dentry);
 void ovl_copy_up_end(struct dentry *dentry);
+bool ovl_check_dir_xattr(struct dentry *dentry, const char *name);
+int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry,
+                       const char *name, const void *value, size_t size,
+                       int xerr);
+int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
+
+static inline bool ovl_is_impuredir(struct dentry *dentry)
+{
+        return ovl_check_dir_xattr(dentry, OVL_XATTR_IMPURE);
+}
+
 
 /* namei.c */
 int ovl_path_next(int idx, struct dentry *dentry, struct path *path);
@@ -263,7 +275,7 @@ static inline void ovl_copyattr(struct inode *from, struct inode *to)
 
 /* dir.c */
 extern const struct inode_operations ovl_dir_inode_operations;
-struct dentry *ovl_lookup_temp(struct dentry *workdir, struct dentry *dentry);
+struct dentry *ovl_lookup_temp(struct dentry *workdir);
 struct cattr {
         dev_t rdev;
         umode_t mode;
diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
index b2023ddb8532..34bc4a9f5c61 100644
--- a/fs/overlayfs/ovl_entry.h
+++ b/fs/overlayfs/ovl_entry.h
@@ -28,6 +28,7 @@ struct ovl_fs {
         /* creds of process who forced instantiation of super block */
         const struct cred *creator_cred;
         bool tmpfile;
+        bool noxattr;
         wait_queue_head_t copyup_wq;
         /* sb common to all layers */
         struct super_block *same_sb;
@@ -42,6 +43,7 @@ struct ovl_entry {
                         u64 version;
                         const char *redirect;
                         bool opaque;
+                        bool impure;
                         bool copying;
                 };
                 struct rcu_head rcu;
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 9828b7de8999..4882ffb37bae 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -891,6 +891,19 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                                 dput(temp);
                         else
                                 pr_warn("overlayfs: upper fs does not support tmpfile.\n");
+
+                        /*
+                         * Check if upper/work fs supports trusted.overlay.*
+                         * xattr
+                         */
+                        err = ovl_do_setxattr(ufs->workdir, OVL_XATTR_OPAQUE,
+                                              "0", 1, 0);
+                        if (err) {
+                                ufs->noxattr = true;
+                                pr_warn("overlayfs: upper fs does not support xattr.\n");
+                        } else {
+                                vfs_removexattr(ufs->workdir, OVL_XATTR_OPAQUE);
+                        }
                 }
         }
 
@@ -961,7 +974,10 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
         path_put(&workpath);
         kfree(lowertmp);
 
-        oe->__upperdentry = upperpath.dentry;
+        if (upperpath.dentry) {
+                oe->__upperdentry = upperpath.dentry;
+                oe->impure = ovl_is_impuredir(upperpath.dentry);
+        }
         for (i = 0; i < numlower; i++) {
                 oe->lowerstack[i].dentry = stack[i].dentry;
                 oe->lowerstack[i].mnt = ufs->lower_mnt[i];
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index cfdea47313a1..809048913889 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -175,6 +175,13 @@ bool ovl_dentry_is_opaque(struct dentry *dentry)
         return oe->opaque;
 }
 
+bool ovl_dentry_is_impure(struct dentry *dentry)
+{
+        struct ovl_entry *oe = dentry->d_fsdata;
+
+        return oe->impure;
+}
+
 bool ovl_dentry_is_whiteout(struct dentry *dentry)
 {
         return !dentry->d_inode && ovl_dentry_is_opaque(dentry);
@@ -191,14 +198,7 @@ bool ovl_redirect_dir(struct super_block *sb)
 {
         struct ovl_fs *ofs = sb->s_fs_info;
 
-        return ofs->config.redirect_dir;
-}
-
-void ovl_clear_redirect_dir(struct super_block *sb)
-{
-        struct ovl_fs *ofs = sb->s_fs_info;
-
-        ofs->config.redirect_dir = false;
+        return ofs->config.redirect_dir && !ofs->noxattr;
 }
 
 const char *ovl_dentry_get_redirect(struct dentry *dentry)
@@ -303,3 +303,59 @@ void ovl_copy_up_end(struct dentry *dentry)
         wake_up_locked(&ofs->copyup_wq);
         spin_unlock(&ofs->copyup_wq.lock);
 }
+
+bool ovl_check_dir_xattr(struct dentry *dentry, const char *name)
+{
+        int res;
+        char val;
+
+        if (!d_is_dir(dentry))
+                return false;
+
+        res = vfs_getxattr(dentry, name, &val, 1);
+        if (res == 1 && val == 'y')
+                return true;
+
+        return false;
+}
+
+int ovl_check_setxattr(struct dentry *dentry, struct dentry *upperdentry,
+                       const char *name, const void *value, size_t size,
+                       int xerr)
+{
+        int err;
+        struct ovl_fs *ofs = dentry->d_sb->s_fs_info;
+
+        if (ofs->noxattr)
+                return xerr;
+
+        err = ovl_do_setxattr(upperdentry, name, value, size, 0);
+
+        if (err == -EOPNOTSUPP) {
+                pr_warn("overlayfs: cannot set %s xattr on upper\n", name);
+                ofs->noxattr = true;
+                return xerr;
+        }
+
+        return err;
+}
+
+int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry)
+{
+        int err;
+        struct ovl_entry *oe = dentry->d_fsdata;
+
+        if (oe->impure)
+                return 0;
+
+        /*
+         * Do not fail when upper doesn't support xattrs.
+         * Upper inodes won't have origin nor redirect xattr anyway.
+         */
+        err = ovl_check_setxattr(dentry, upperdentry, OVL_XATTR_IMPURE,
+                                 "y", 1, 0);
+        if (!err)
+                oe->impure = true;
+
+        return err;
+}
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 45f6bf68fff3..f1e1927ccd48 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -821,7 +821,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
         if (!mmget_not_zero(mm))
                 goto free;
 
-        flags = write ? FOLL_WRITE : 0;
+        flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
 
         while (count > 0) {
                 int this_len = min_t(int, count, PAGE_SIZE);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f0c8b33d99b1..520802da059c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -300,11 +300,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
 
         /* We don't show the stack guard page in /proc/maps */
         start = vma->vm_start;
-        if (stack_guard_page_start(vma, start))
-                start += PAGE_SIZE;
         end = vma->vm_end;
-        if (stack_guard_page_end(vma, end))
-                end -= PAGE_SIZE;
 
         seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
         seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index ebf80c7739e1..48813aeaab80 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1512,6 +1512,22 @@ int dquot_initialize(struct inode *inode)
 }
 EXPORT_SYMBOL(dquot_initialize);
 
+bool dquot_initialize_needed(struct inode *inode)
+{
+        struct dquot **dquots;
+        int i;
+
+        if (!dquot_active(inode))
+                return false;
+
+        dquots = i_dquot(inode);
+        for (i = 0; i < MAXQUOTAS; i++)
+                if (!dquots[i] && sb_has_quota_active(inode->i_sb, i))
+                        return true;
+        return false;
+}
+EXPORT_SYMBOL(dquot_initialize_needed);
+
 /*
  * Release all quotas referenced by inode.
  *
diff --git a/fs/read_write.c b/fs/read_write.c
index 47c1d4484df9..19d4d88fa285 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1285,7 +1285,7 @@ static size_t compat_writev(struct file *file,
         if (!(file->f_mode & FMODE_CAN_WRITE))
                 goto out;
 
-        ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, 0);
+        ret = compat_do_readv_writev(WRITE, file, vec, vlen, pos, flags);
 
 out:
         if (ret > 0)
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index da01f497180a..a11d773e5ff3 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -1112,7 +1112,7 @@ static int flush_commit_list(struct super_block *s,
                 depth = reiserfs_write_unlock_nested(s);
                 if (reiserfs_barrier_flush(s))
                         __sync_dirty_buffer(jl->j_commit_bh,
-                                        REQ_PREFLUSH | REQ_FUA);
+                                        REQ_SYNC | REQ_PREFLUSH | REQ_FUA);
                 else
                         sync_dirty_buffer(jl->j_commit_bh);
                 reiserfs_write_lock_nested(s, depth);
@@ -1271,7 +1271,7 @@ static int _update_journal_header_block(struct super_block *sb,
 
                 if (reiserfs_barrier_flush(sb))
                         __sync_dirty_buffer(journal->j_header_bh,
-                                        REQ_PREFLUSH | REQ_FUA);
+                                        REQ_SYNC | REQ_PREFLUSH | REQ_FUA);
                 else
                         sync_dirty_buffer(journal->j_header_bh);
 
@@ -2956,7 +2956,7 @@ void reiserfs_wait_on_write_block(struct super_block *s)
 
 static void queue_log_writer(struct super_block *s)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct reiserfs_journal *journal = SB_JOURNAL(s);
         set_bit(J_WRITERS_QUEUED, &journal->j_state);
 
diff --git a/fs/select.c b/fs/select.c
index d6c652a31e99..5b524a977d91 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -180,7 +180,7 @@ static struct poll_table_entry *poll_get_entry(struct poll_wqueues *p)
         return table->entry++;
 }
 
-static int __pollwake(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int __pollwake(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         struct poll_wqueues *pwq = wait->private;
         DECLARE_WAITQUEUE(dummy_wait, pwq->polling_task);
@@ -206,7 +206,7 @@ static int __pollwake(wait_queue_t *wait, unsigned mode, int sync, void *key)
         return default_wake_function(&dummy_wait, mode, sync, key);
 }
 
-static int pollwake(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int pollwake(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         struct poll_table_entry *entry;
 
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 7e3d71109f51..593b022ac11b 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -43,7 +43,7 @@ void signalfd_cleanup(struct sighand_struct *sighand)
         if (likely(!waitqueue_active(wqh)))
                 return;
 
-        /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
+        /* wait_queue_entry_t->func(POLLFREE) should do remove_wait_queue() */
         wake_up_poll(wqh, POLLHUP | POLLFREE);
 }
 
diff --git a/fs/stat.c b/fs/stat.c
index f494b182c7c7..c35610845ab1 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -672,6 +672,7 @@ void __inode_add_bytes(struct inode *inode, loff_t bytes)
                 inode->i_bytes -= 512;
         }
 }
+EXPORT_SYMBOL(__inode_add_bytes);
 
 void inode_add_bytes(struct inode *inode, loff_t bytes)
 {
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index a0376a2c1c29..0315fea1d589 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -82,7 +82,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
                         ufs_error (sb, "ufs_free_fragments",
                                    "bit already cleared for fragment %u", i);
         }
-        
+
+        inode_sub_bytes(inode, count << uspi->s_fshift);
         fs32_add(sb, &ucg->cg_cs.cs_nffree, count);
         uspi->cs_total.cs_nffree += count;
         fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count);
@@ -184,6 +185,7 @@ do_more:
                         ufs_error(sb, "ufs_free_blocks", "freeing free fragment");
                 }
                 ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
+                inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift);
                 if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
                         ufs_clusteracct (sb, ucpi, blkno, 1);
 
@@ -398,10 +400,12 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         /*
          * There is not enough space for user on the device
          */
-        if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) {
-                mutex_unlock(&UFS_SB(sb)->s_lock);
-                UFSD("EXIT (FAILED)\n");
-                return 0;
+        if (unlikely(ufs_freefrags(uspi) <= uspi->s_root_blocks)) {
+                if (!capable(CAP_SYS_RESOURCE)) {
+                        mutex_unlock(&UFS_SB(sb)->s_lock);
+                        UFSD("EXIT (FAILED)\n");
+                        return 0;
+                }
         }
 
         if (goal >= uspi->s_size) 
@@ -419,12 +423,12 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
                 if (result) {
                         ufs_clear_frags(inode, result + oldcount,
                                         newcount - oldcount, locked_page != NULL);
+                        *err = 0;
                         write_seqlock(&UFS_I(inode)->meta_lock);
                         ufs_cpu_to_data_ptr(sb, p, result);
-                        write_sequnlock(&UFS_I(inode)->meta_lock);
-                        *err = 0;
                         UFS_I(inode)->i_lastfrag =
                                 max(UFS_I(inode)->i_lastfrag, fragment + count);
+                        write_sequnlock(&UFS_I(inode)->meta_lock);
                 }
                 mutex_unlock(&UFS_SB(sb)->s_lock);
                 UFSD("EXIT, result %llu\n", (unsigned long long)result);
@@ -437,8 +441,10 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         result = ufs_add_fragments(inode, tmp, oldcount, newcount);
         if (result) {
                 *err = 0;
+                read_seqlock_excl(&UFS_I(inode)->meta_lock);
                 UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag,
                                                 fragment + count);
+                read_sequnlock_excl(&UFS_I(inode)->meta_lock);
                 ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                 locked_page != NULL);
                 mutex_unlock(&UFS_SB(sb)->s_lock);
@@ -472,16 +478,16 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         if (result) {
                 ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                 locked_page != NULL);
+                mutex_unlock(&UFS_SB(sb)->s_lock);
                 ufs_change_blocknr(inode, fragment - oldcount, oldcount,
                                    uspi->s_sbbase + tmp,
                                    uspi->s_sbbase + result, locked_page);
+                *err = 0;
                 write_seqlock(&UFS_I(inode)->meta_lock);
                 ufs_cpu_to_data_ptr(sb, p, result);
-                write_sequnlock(&UFS_I(inode)->meta_lock);
-                *err = 0;
                 UFS_I(inode)->i_lastfrag = max(UFS_I(inode)->i_lastfrag,
                                                 fragment + count);
-                mutex_unlock(&UFS_SB(sb)->s_lock);
+                write_sequnlock(&UFS_I(inode)->meta_lock);
                 if (newcount < request)
                         ufs_free_fragments (inode, result + newcount, request - newcount);
                 ufs_free_fragments (inode, tmp, oldcount);
@@ -494,6 +500,20 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         return 0;
 }               
 
+static bool try_add_frags(struct inode *inode, unsigned frags)
+{
+        unsigned size = frags * i_blocksize(inode);
+        spin_lock(&inode->i_lock);
+        __inode_add_bytes(inode, size);
+        if (unlikely((u32)inode->i_blocks != inode->i_blocks)) {
+                __inode_sub_bytes(inode, size);
+                spin_unlock(&inode->i_lock);
+                return false;
+        }
+        spin_unlock(&inode->i_lock);
+        return true;
+}
+
 static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
                              unsigned oldcount, unsigned newcount)
 {
@@ -530,6 +550,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
         for (i = oldcount; i < newcount; i++)
                 if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i))
                         return 0;
+
+        if (!try_add_frags(inode, count))
+                return 0;
         /*
          * Block can be extended
          */
@@ -647,6 +670,7 @@ cg_found:
                         ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i);
                 i = uspi->s_fpb - count;
 
+                inode_sub_bytes(inode, i << uspi->s_fshift);
                 fs32_add(sb, &ucg->cg_cs.cs_nffree, i);
                 uspi->cs_total.cs_nffree += i;
                 fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i);
@@ -657,6 +681,8 @@ cg_found:
         result = ufs_bitmap_search (sb, ucpi, goal, allocsize);
         if (result == INVBLOCK)
                 return 0;
+        if (!try_add_frags(inode, count))
+                return 0;
         for (i = 0; i < count; i++)
                 ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i);
         
@@ -716,6 +742,8 @@ norot:
                 return INVBLOCK;
         ucpi->c_rotor = result;
 gotit:
+        if (!try_add_frags(inode, uspi->s_fpb))
+                return 0;
         blkno = ufs_fragstoblks(result);
         ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
         if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7e41aee7b69a..9f4590261134 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -235,7 +235,8 @@ ufs_extend_tail(struct inode *inode, u64 writes_to,
 
         p = ufs_get_direct_data_ptr(uspi, ufsi, block);
         tmp = ufs_new_fragments(inode, p, lastfrag, ufs_data_ptr_to_cpu(sb, p),
-                                new_size, err, locked_page);
+                                new_size - (lastfrag & uspi->s_fpbmask), err,
+                                locked_page);
         return tmp != 0;
 }
 
@@ -284,7 +285,7 @@ ufs_inode_getfrag(struct inode *inode, unsigned index,
                         goal += uspi->s_fpb;
         }
         tmp = ufs_new_fragments(inode, p, ufs_blknum(new_fragment),
-                                goal, uspi->s_fpb, err, locked_page);
+                                goal, nfrags, err, locked_page);
 
         if (!tmp) {
                 *err = -ENOSPC;
@@ -400,11 +401,20 @@ static int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buff
         u64 phys64 = 0;
         unsigned frag = fragment & uspi->s_fpbmask;
 
-        if (!create) {
-                phys64 = ufs_frag_map(inode, offsets, depth);
-                goto out;
-        }
+        phys64 = ufs_frag_map(inode, offsets, depth);
+        if (!create)
+                goto done;
 
+        if (phys64) {
+                if (fragment >= UFS_NDIR_FRAGMENT)
+                        goto done;
+                read_seqlock_excl(&UFS_I(inode)->meta_lock);
+                if (fragment < UFS_I(inode)->i_lastfrag) {
+                        read_sequnlock_excl(&UFS_I(inode)->meta_lock);
+                        goto done;
+                }
+                read_sequnlock_excl(&UFS_I(inode)->meta_lock);
+        }
         /* This code entered only while writing ....? */
 
         mutex_lock(&UFS_I(inode)->truncate_mutex);
@@ -448,6 +458,11 @@ out:
         }
         mutex_unlock(&UFS_I(inode)->truncate_mutex);
         return err;
+
+done:
+        if (phys64)
+                map_bh(bh_result, sb, phys64 + frag);
+        return 0;
 }
 
 static int ufs_writepage(struct page *page, struct writeback_control *wbc)
@@ -841,8 +856,11 @@ void ufs_evict_inode(struct inode * inode)
         truncate_inode_pages_final(&inode->i_data);
         if (want_delete) {
                 inode->i_size = 0;
-                if (inode->i_blocks)
+                if (inode->i_blocks &&
+                    (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                     S_ISLNK(inode->i_mode)))
                         ufs_truncate_blocks(inode);
+                ufs_update_inode(inode, inode_needs_sync(inode));
         }
 
         invalidate_inode_buffers(inode);
@@ -868,7 +886,6 @@ static inline void free_data(struct to_free *ctx, u64 from, unsigned count)
         ctx->to = from + count;
 }
 
-#define DIRECT_BLOCK ((inode->i_size + uspi->s_bsize - 1) >> uspi->s_bshift)
 #define DIRECT_FRAGMENT ((inode->i_size + uspi->s_fsize - 1) >> uspi->s_fshift)
 
 static void ufs_trunc_direct(struct inode *inode)
@@ -1100,25 +1117,30 @@ out:
        return err;
 }
 
-static void __ufs_truncate_blocks(struct inode *inode)
+static void ufs_truncate_blocks(struct inode *inode)
 {
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
         struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
         unsigned offsets[4];
-        int depth = ufs_block_to_path(inode, DIRECT_BLOCK, offsets);
+        int depth;
         int depth2;
         unsigned i;
         struct ufs_buffer_head *ubh[3];
         void *p;
         u64 block;
 
-        if (!depth)
-                return;
+        if (inode->i_size) {
+                sector_t last = (inode->i_size - 1) >> uspi->s_bshift;
+                depth = ufs_block_to_path(inode, last, offsets);
+                if (!depth)
+                        return;
+        } else {
+                depth = 1;
+        }
 
-        /* find the last non-zero in offsets[] */
         for (depth2 = depth - 1; depth2; depth2--)
-                if (offsets[depth2])
+                if (offsets[depth2] != uspi->s_apb - 1)
                         break;
 
         mutex_lock(&ufsi->truncate_mutex);
@@ -1127,9 +1149,8 @@ static void __ufs_truncate_blocks(struct inode *inode)
                 offsets[0] = UFS_IND_BLOCK;
         } else {
                 /* get the blocks that should be partially emptied */
-                p = ufs_get_direct_data_ptr(uspi, ufsi, offsets[0]);
+                p = ufs_get_direct_data_ptr(uspi, ufsi, offsets[0]++);
                 for (i = 0; i < depth2; i++) {
-                        offsets[i]++;   /* next branch is fully freed */
                         block = ufs_data_ptr_to_cpu(sb, p);
                         if (!block)
                                 break;
@@ -1140,7 +1161,7 @@ static void __ufs_truncate_blocks(struct inode *inode)
                                 write_sequnlock(&ufsi->meta_lock);
                                 break;
                         }
-                        p = ubh_get_data_ptr(uspi, ubh[i], offsets[i + 1]);
+                        p = ubh_get_data_ptr(uspi, ubh[i], offsets[i + 1]++);
                 }
                 while (i--)
                         free_branch_tail(inode, offsets[i + 1], ubh[i], depth - i - 1);
@@ -1155,7 +1176,9 @@ static void __ufs_truncate_blocks(struct inode *inode)
                         free_full_branch(inode, block, i - UFS_IND_BLOCK + 1);
                 }
         }
+        read_seqlock_excl(&ufsi->meta_lock);
         ufsi->i_lastfrag = DIRECT_FRAGMENT;
+        read_sequnlock_excl(&ufsi->meta_lock);
         mark_inode_dirty(inode);
         mutex_unlock(&ufsi->truncate_mutex);
 }
@@ -1183,7 +1206,7 @@ static int ufs_truncate(struct inode *inode, loff_t size)
 
         truncate_setsize(inode, size);
 
-        __ufs_truncate_blocks(inode);
+        ufs_truncate_blocks(inode);
         inode->i_mtime = inode->i_ctime = current_time(inode);
         mark_inode_dirty(inode);
 out:
@@ -1191,16 +1214,6 @@ out:
         return err;
 }
 
-static void ufs_truncate_blocks(struct inode *inode)
-{
-        if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
-              S_ISLNK(inode->i_mode)))
-                return;
-        if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                return;
-        __ufs_truncate_blocks(inode);
-}
-
 int ufs_setattr(struct dentry *dentry, struct iattr *attr)
 {
         struct inode *inode = d_inode(dentry);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 131b2b77c818..d5300adbfd79 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -480,7 +480,7 @@ static void ufs_setup_cstotal(struct super_block *sb)
         usb3 = ubh_get_usb_third(uspi);
 
         if ((mtype == UFS_MOUNT_UFSTYPE_44BSD &&
-             (usb1->fs_flags & UFS_FLAGS_UPDATED)) ||
+             (usb2->fs_un.fs_u2.fs_maxbsize == usb1->fs_bsize)) ||
             mtype == UFS_MOUNT_UFSTYPE_UFS2) {
                 /*we have statistic in different place, then usual*/
                 uspi->cs_total.cs_ndir = fs64_to_cpu(sb, usb2->fs_un.fs_u2.cs_ndir);
@@ -596,9 +596,7 @@ static void ufs_put_cstotal(struct super_block *sb)
         usb2 = ubh_get_usb_second(uspi);
         usb3 = ubh_get_usb_third(uspi);
 
-        if ((mtype == UFS_MOUNT_UFSTYPE_44BSD &&
-             (usb1->fs_flags & UFS_FLAGS_UPDATED)) ||
-            mtype == UFS_MOUNT_UFSTYPE_UFS2) {
+        if (mtype == UFS_MOUNT_UFSTYPE_UFS2) {
                 /*we have statistic in different place, then usual*/
                 usb2->fs_un.fs_u2.cs_ndir =
                         cpu_to_fs64(sb, uspi->cs_total.cs_ndir);
@@ -608,16 +606,26 @@ static void ufs_put_cstotal(struct super_block *sb)
                         cpu_to_fs64(sb, uspi->cs_total.cs_nifree);
                 usb3->fs_un1.fs_u2.cs_nffree =
                         cpu_to_fs64(sb, uspi->cs_total.cs_nffree);
-        } else {
-                usb1->fs_cstotal.cs_ndir =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_ndir);
-                usb1->fs_cstotal.cs_nbfree =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_nbfree);
-                usb1->fs_cstotal.cs_nifree =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_nifree);
-                usb1->fs_cstotal.cs_nffree =
-                        cpu_to_fs32(sb, uspi->cs_total.cs_nffree);
+                goto out;
         }
+
+        if (mtype == UFS_MOUNT_UFSTYPE_44BSD &&
+             (usb2->fs_un.fs_u2.fs_maxbsize == usb1->fs_bsize)) {
+                /* store stats in both old and new places */
+                usb2->fs_un.fs_u2.cs_ndir =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_ndir);
+                usb2->fs_un.fs_u2.cs_nbfree =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_nbfree);
+                usb3->fs_un1.fs_u2.cs_nifree =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_nifree);
+                usb3->fs_un1.fs_u2.cs_nffree =
+                        cpu_to_fs64(sb, uspi->cs_total.cs_nffree);
+        }
+        usb1->fs_cstotal.cs_ndir = cpu_to_fs32(sb, uspi->cs_total.cs_ndir);
+        usb1->fs_cstotal.cs_nbfree = cpu_to_fs32(sb, uspi->cs_total.cs_nbfree);
+        usb1->fs_cstotal.cs_nifree = cpu_to_fs32(sb, uspi->cs_total.cs_nifree);
+        usb1->fs_cstotal.cs_nffree = cpu_to_fs32(sb, uspi->cs_total.cs_nffree);
+out:
         ubh_mark_buffer_dirty(USPI_UBH(uspi));
         ufs_print_super_stuff(sb, usb1, usb2, usb3);
         UFSD("EXIT\n");
@@ -746,6 +754,23 @@ static void ufs_put_super(struct super_block *sb)
         return;
 }
 
+static u64 ufs_max_bytes(struct super_block *sb)
+{
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+        int bits = uspi->s_apbshift;
+        u64 res;
+
+        if (bits > 21)
+                res = ~0ULL;
+        else
+                res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) +
+                        (1LL << (3*bits));
+
+        if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift))
+                return MAX_LFS_FILESIZE;
+        return res << uspi->s_bshift;
+}
+
 static int ufs_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct ufs_sb_info * sbi;
@@ -812,9 +837,8 @@ static int ufs_fill_super(struct super_block *sb, void *data, int silent)
         uspi->s_dirblksize = UFS_SECTOR_SIZE;
         super_block_offset=UFS_SBLOCK;
 
-        /* Keep 2Gig file limit. Some UFS variants need to override 
-           this but as I don't know which I'll let those in the know loosen
-           the rules */
+        sb->s_maxbytes = MAX_LFS_FILESIZE;
+
         switch (sbi->s_mount_opt & UFS_MOUNT_UFSTYPE) {
         case UFS_MOUNT_UFSTYPE_44BSD:
                 UFSD("ufstype=44bsd\n");
@@ -980,6 +1004,13 @@ again:
                 flags |=  UFS_ST_SUN;
         }
 
+        if ((flags & UFS_ST_MASK) == UFS_ST_44BSD &&
+            uspi->s_postblformat == UFS_42POSTBLFMT) {
+                if (!silent)
+                        pr_err("this is not a 44bsd filesystem");
+                goto failed;
+        }
+
         /*
          * Check ufs magic number
          */
@@ -1127,8 +1158,8 @@ magic_found:
         uspi->s_cgmask = fs32_to_cpu(sb, usb1->fs_cgmask);
 
         if ((flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2) {
-                uspi->s_u2_size  = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_size);
-                uspi->s_u2_dsize = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_dsize);
+                uspi->s_size  = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_size);
+                uspi->s_dsize = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_dsize);
         } else {
                 uspi->s_size  =  fs32_to_cpu(sb, usb1->fs_size);
                 uspi->s_dsize =  fs32_to_cpu(sb, usb1->fs_dsize);
@@ -1177,6 +1208,9 @@ magic_found:
         uspi->s_postbloff = fs32_to_cpu(sb, usb3->fs_postbloff);
         uspi->s_rotbloff = fs32_to_cpu(sb, usb3->fs_rotbloff);
 
+        uspi->s_root_blocks = mul_u64_u32_div(uspi->s_dsize,
+                                              uspi->s_minfree, 100);
+
         /*
          * Compute another frequently used values
          */
@@ -1212,6 +1246,7 @@ magic_found:
                             "fast symlink size (%u)\n", uspi->s_maxsymlinklen);
                 uspi->s_maxsymlinklen = maxsymlen;
         }
+        sb->s_maxbytes = ufs_max_bytes(sb);
         sb->s_max_links = UFS_LINK_MAX;
 
         inode = ufs_iget(sb, UFS_ROOTINO);
@@ -1365,19 +1400,17 @@ static int ufs_statfs(struct dentry *dentry, struct kstatfs *buf)
         mutex_lock(&UFS_SB(sb)->s_lock);
         usb3 = ubh_get_usb_third(uspi);
         
-        if ((flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2) {
+        if ((flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2)
                 buf->f_type = UFS2_MAGIC;
-                buf->f_blocks = fs64_to_cpu(sb, usb3->fs_un1.fs_u2.fs_dsize);
-        } else {
+        else
                 buf->f_type = UFS_MAGIC;
-                buf->f_blocks = uspi->s_dsize;
-        }
-        buf->f_bfree = ufs_blkstofrags(uspi->cs_total.cs_nbfree) +
-                uspi->cs_total.cs_nffree;
+
+        buf->f_blocks = uspi->s_dsize;
+        buf->f_bfree = ufs_freefrags(uspi);
         buf->f_ffree = uspi->cs_total.cs_nifree;
         buf->f_bsize = sb->s_blocksize;
-        buf->f_bavail = (buf->f_bfree > (((long)buf->f_blocks / 100) * uspi->s_minfree))
-                ? (buf->f_bfree - (((long)buf->f_blocks / 100) * uspi->s_minfree)) : 0;
+        buf->f_bavail = (buf->f_bfree > uspi->s_root_blocks)
+                ? (buf->f_bfree - uspi->s_root_blocks) : 0;
         buf->f_files = uspi->s_ncg * uspi->s_ipg;
         buf->f_namelen = UFS_MAXNAMLEN;
         buf->f_fsid.val[0] = (u32)id;
diff --git a/fs/ufs/ufs_fs.h b/fs/ufs/ufs_fs.h
index 0cbd5d340b67..823d55a37586 100644
--- a/fs/ufs/ufs_fs.h
+++ b/fs/ufs/ufs_fs.h
@@ -733,10 +733,8 @@ struct ufs_sb_private_info {
         __u32   s_dblkno;       /* offset of first data after cg */
         __u32   s_cgoffset;     /* cylinder group offset in cylinder */
         __u32   s_cgmask;       /* used to calc mod fs_ntrak */
-        __u32   s_size;         /* number of blocks (fragments) in fs */
-        __u32   s_dsize;        /* number of data blocks in fs */
-        __u64   s_u2_size;      /* ufs2: number of blocks (fragments) in fs */
-        __u64   s_u2_dsize;     /*ufs2:  number of data blocks in fs */
+        __u64   s_size;         /* number of blocks (fragments) in fs */
+        __u64   s_dsize;        /* number of data blocks in fs */
         __u32   s_ncg;          /* number of cylinder groups */
         __u32   s_bsize;        /* size of basic blocks */
         __u32   s_fsize;        /* size of fragments */
@@ -793,6 +791,7 @@ struct ufs_sb_private_info {
         __u32   s_maxsymlinklen;/* upper limit on fast symlinks' size */
         __s32   fs_magic;       /* filesystem magic */
         unsigned int s_dirblksize;
+        __u64   s_root_blocks;
 };
 
 /*
diff --git a/fs/ufs/util.c b/fs/ufs/util.c
index f41ad0a6106f..02497a492eb2 100644
--- a/fs/ufs/util.c
+++ b/fs/ufs/util.c
@@ -243,9 +243,8 @@ ufs_set_inode_dev(struct super_block *sb, struct ufs_inode_info *ufsi, dev_t dev
 struct page *ufs_get_locked_page(struct address_space *mapping,
                                  pgoff_t index)
 {
-        struct page *page;
-
-        page = find_lock_page(mapping, index);
+        struct inode *inode = mapping->host;
+        struct page *page = find_lock_page(mapping, index);
         if (!page) {
                 page = read_mapping_page(mapping, index, NULL);
 
@@ -253,7 +252,7 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
                         printk(KERN_ERR "ufs_change_blocknr: "
                                "read_mapping_page error: ino %lu, index: %lu\n",
                                mapping->host->i_ino, index);
-                        goto out;
+                        return page;
                 }
 
                 lock_page(page);
@@ -262,8 +261,7 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
                         /* Truncate got there first */
                         unlock_page(page);
                         put_page(page);
-                        page = NULL;
-                        goto out;
+                        return NULL;
                 }
 
                 if (!PageUptodate(page) || PageError(page)) {
@@ -272,11 +270,12 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
 
                         printk(KERN_ERR "ufs_change_blocknr: "
                                "can not read page: ino %lu, index: %lu\n",
-                               mapping->host->i_ino, index);
+                               inode->i_ino, index);
 
-                        page = ERR_PTR(-EIO);
+                        return ERR_PTR(-EIO);
                 }
         }
-out:
+        if (!page_has_buffers(page))
+                create_empty_buffers(page, 1 << inode->i_blkbits, 0);
         return page;
 }
diff --git a/fs/ufs/util.h b/fs/ufs/util.h
index b7fbf53dbc81..9fc7119a1551 100644
--- a/fs/ufs/util.h
+++ b/fs/ufs/util.h
@@ -350,16 +350,11 @@ static inline void *ubh_get_data_ptr(struct ufs_sb_private_info *uspi,
 #define ubh_blkmap(ubh,begin,bit) \
         ((*ubh_get_addr(ubh, (begin) + ((bit) >> 3)) >> ((bit) & 7)) & (0xff >> (UFS_MAXFRAG - uspi->s_fpb)))
 
-/*
- * Determine the number of available frags given a
- * percentage to hold in reserve.
- */
 static inline u64
-ufs_freespace(struct ufs_sb_private_info *uspi, int percentreserved)
+ufs_freefrags(struct ufs_sb_private_info *uspi)
 {
         return ufs_blkstofrags(uspi->cs_total.cs_nbfree) +
-                uspi->cs_total.cs_nffree -
-                (uspi->s_dsize * (percentreserved) / 100);
+                uspi->cs_total.cs_nffree;
 }
 
 /*
@@ -473,15 +468,19 @@ static inline unsigned _ubh_find_last_zero_bit_(
 static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi,
         struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
 {
+        u8 mask;
         switch (uspi->s_fpb) {
         case 8:
                 return (*ubh_get_addr (ubh, begin + block) == 0xff);
         case 4:
-                return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2)));
+                mask = 0x0f << ((block & 0x01) << 2);
+                return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask;
         case 2:
-                return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1)));
+                mask = 0x03 << ((block & 0x03) << 1);
+                return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask;
         case 1:
-                return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07)));
+                mask = 0x01 << (block & 0x07);
+                return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask;
         }
         return 0;       
 }
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index f7555fc25877..6148ccd6cccf 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -81,7 +81,7 @@ struct userfaultfd_unmap_ctx {
 
 struct userfaultfd_wait_queue {
         struct uffd_msg msg;
-        wait_queue_t wq;
+        wait_queue_entry_t wq;
         struct userfaultfd_ctx *ctx;
         bool waken;
 };
@@ -91,7 +91,7 @@ struct userfaultfd_wake_range {
         unsigned long len;
 };
 
-static int userfaultfd_wake_function(wait_queue_t *wq, unsigned mode,
+static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode,
                                      int wake_flags, void *key)
 {
         struct userfaultfd_wake_range *range = key;
@@ -129,7 +129,7 @@ static int userfaultfd_wake_function(wait_queue_t *wq, unsigned mode,
                  * wouldn't be enough, the smp_mb__before_spinlock is
                  * enough to avoid an explicit smp_mb() here.
                  */
-                list_del_init(&wq->task_list);
+                list_del_init(&wq->entry);
 out:
         return ret;
 }
@@ -340,9 +340,28 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
         bool must_wait, return_to_userland;
         long blocking_state;
 
-        BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
-
         ret = VM_FAULT_SIGBUS;
+
+        /*
+         * We don't do userfault handling for the final child pid update.
+         *
+         * We also don't do userfault handling during
+         * coredumping. hugetlbfs has the special
+         * follow_hugetlb_page() to skip missing pages in the
+         * FOLL_DUMP case, anon memory also checks for FOLL_DUMP with
+         * the no_page_table() helper in follow_page_mask(), but the
+         * shmem_vm_ops->fault method is invoked even during
+         * coredumping without mmap_sem and it ends up here.
+         */
+        if (current->flags & (PF_EXITING|PF_DUMPCORE))
+                goto out;
+
+        /*
+         * Coredumping runs without mmap_sem so we can only check that
+         * the mmap_sem is held, if PF_DUMPCORE was not set.
+         */
+        WARN_ON_ONCE(!rwsem_is_locked(&mm->mmap_sem));
+
         ctx = vmf->vma->vm_userfaultfd_ctx.ctx;
         if (!ctx)
                 goto out;
@@ -361,12 +380,6 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
                 goto out;
 
         /*
-         * We don't do userfault handling for the final child pid update.
-         */
-        if (current->flags & PF_EXITING)
-                goto out;
-
-        /*
          * Check that we can return VM_FAULT_RETRY.
          *
          * NOTE: it should become possible to return VM_FAULT_RETRY
@@ -509,13 +522,13 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
          * and it's fine not to block on the spinlock. The uwq on this
          * kernel stack can be released after the list_del_init.
          */
-        if (!list_empty_careful(&uwq.wq.task_list)) {
+        if (!list_empty_careful(&uwq.wq.entry)) {
                 spin_lock(&ctx->fault_pending_wqh.lock);
                 /*
                  * No need of list_del_init(), the uwq on the stack
                  * will be freed shortly anyway.
                  */
-                list_del(&uwq.wq.task_list);
+                list_del(&uwq.wq.entry);
                 spin_unlock(&ctx->fault_pending_wqh.lock);
         }
 
@@ -847,7 +860,7 @@ wakeup:
 static inline struct userfaultfd_wait_queue *find_userfault_in(
                 wait_queue_head_t *wqh)
 {
-        wait_queue_t *wq;
+        wait_queue_entry_t *wq;
         struct userfaultfd_wait_queue *uwq;
 
         VM_BUG_ON(!spin_is_locked(&wqh->lock));
@@ -856,7 +869,7 @@ static inline struct userfaultfd_wait_queue *find_userfault_in(
         if (!waitqueue_active(wqh))
                 goto out;
         /* walk in reverse to provide FIFO behavior to read userfaults */
-        wq = list_last_entry(&wqh->task_list, typeof(*wq), task_list);
+        wq = list_last_entry(&wqh->head, typeof(*wq), entry);
         uwq = container_of(wq, struct userfaultfd_wait_queue, wq);
 out:
         return uwq;
@@ -990,14 +1003,14 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
                          * changes __remove_wait_queue() to use
                          * list_del_init() in turn breaking the
                          * !list_empty_careful() check in
-                         * handle_userfault(). The uwq->wq.task_list
+                         * handle_userfault(). The uwq->wq.head list
                          * must never be empty at any time during the
                          * refile, or the waitqueue could disappear
                          * from under us. The "wait_queue_head_t"
                          * parameter of __remove_wait_queue() is unused
                          * anyway.
                          */
-                        list_del(&uwq->wq.task_list);
+                        list_del(&uwq->wq.entry);
                         __add_wait_queue(&ctx->fault_wqh, &uwq->wq);
 
                         write_seqcount_end(&ctx->refile_seq);
@@ -1019,7 +1032,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
                                 fork_nctx = (struct userfaultfd_ctx *)
                                         (unsigned long)
                                         uwq->msg.arg.reserved.reserved1;
-                                list_move(&uwq->wq.task_list, &fork_event);
+                                list_move(&uwq->wq.entry, &fork_event);
                                 spin_unlock(&ctx->event_wqh.lock);
                                 ret = 0;
                                 break;
@@ -1056,8 +1069,8 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
                         if (!list_empty(&fork_event)) {
                                 uwq = list_first_entry(&fork_event,
                                                        typeof(*uwq),
-                                                       wq.task_list);
-                                list_del(&uwq->wq.task_list);
+                                                       wq.entry);
+                                list_del(&uwq->wq.entry);
                                 __add_wait_queue(&ctx->event_wqh, &uwq->wq);
                                 userfaultfd_event_complete(ctx, uwq);
                         }
@@ -1734,17 +1747,17 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd,
 static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
 {
         struct userfaultfd_ctx *ctx = f->private_data;
-        wait_queue_t *wq;
+        wait_queue_entry_t *wq;
         struct userfaultfd_wait_queue *uwq;
         unsigned long pending = 0, total = 0;
 
         spin_lock(&ctx->fault_pending_wqh.lock);
-        list_for_each_entry(wq, &ctx->fault_pending_wqh.task_list, task_list) {
+        list_for_each_entry(wq, &ctx->fault_pending_wqh.head, entry) {
                 uwq = container_of(wq, struct userfaultfd_wait_queue, wq);
                 pending++;
                 total++;
         }
-        list_for_each_entry(wq, &ctx->fault_wqh.task_list, task_list) {
+        list_for_each_entry(wq, &ctx->fault_wqh.head, entry) {
                 uwq = container_of(wq, struct userfaultfd_wait_queue, wq);
                 total++;
         }
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index f02eb7673392..a7048eafa8e6 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1280,7 +1280,6 @@ xfs_bmap_read_extents(
                 xfs_bmbt_rec_t  *frp;
                 xfs_fsblock_t   nextbno;
                 xfs_extnum_t    num_recs;
-                xfs_extnum_t    start;
 
                 num_recs = xfs_btree_get_numrecs(block);
                 if (unlikely(i + num_recs > room)) {
@@ -1303,7 +1302,6 @@ xfs_bmap_read_extents(
                  * Copy records into the extent records.
                  */
                 frp = XFS_BMBT_REC_ADDR(mp, block, 1);
-                start = i;
                 for (j = 0; j < num_recs; j++, i++, frp++) {
                         xfs_bmbt_rec_host_t *trp = xfs_iext_get_ext(ifp, i);
                         trp->l0 = be64_to_cpu(frp->l0);
@@ -2065,8 +2063,10 @@ xfs_bmap_add_extent_delay_real(
                 }
                 temp = xfs_bmap_worst_indlen(bma->ip, temp);
                 temp2 = xfs_bmap_worst_indlen(bma->ip, temp2);
-                diff = (int)(temp + temp2 - startblockval(PREV.br_startblock) -
-                        (bma->cur ? bma->cur->bc_private.b.allocated : 0));
+                diff = (int)(temp + temp2 -
+                             (startblockval(PREV.br_startblock) -
+                              (bma->cur ?
+                               bma->cur->bc_private.b.allocated : 0)));
                 if (diff > 0) {
                         error = xfs_mod_fdblocks(bma->ip->i_mount,
                                                  -((int64_t)diff), false);
@@ -2123,7 +2123,6 @@ xfs_bmap_add_extent_delay_real(
                 temp = da_new;
                 if (bma->cur)
                         temp += bma->cur->bc_private.b.allocated;
-                ASSERT(temp <= da_old);
                 if (temp < da_old)
                         xfs_mod_fdblocks(bma->ip->i_mount,
                                         (int64_t)(da_old - temp), false);
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 5392674bf893..3a673ba201aa 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -4395,7 +4395,7 @@ xfs_btree_visit_blocks(
                         xfs_btree_readahead_ptr(cur, ptr, 1);
 
                         /* save for the next iteration of the loop */
-                        lptr = *ptr;
+                        xfs_btree_copy_ptrs(cur, &lptr, ptr, 1);
                 }
 
                 /* for each buffer in the level */
diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
index b177ef33cd4c..82a38d86ebad 100644
--- a/fs/xfs/libxfs/xfs_refcount.c
+++ b/fs/xfs/libxfs/xfs_refcount.c
@@ -1629,13 +1629,28 @@ xfs_refcount_recover_cow_leftovers(
         if (mp->m_sb.sb_agblocks >= XFS_REFC_COW_START)
                 return -EOPNOTSUPP;
 
-        error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
+        INIT_LIST_HEAD(&debris);
+
+        /*
+         * In this first part, we use an empty transaction to gather up
+         * all the leftover CoW extents so that we can subsequently
+         * delete them.  The empty transaction is used to avoid
+         * a buffer lock deadlock if there happens to be a loop in the
+         * refcountbt because we're allowed to re-grab a buffer that is
+         * already attached to our transaction.  When we're done
+         * recording the CoW debris we cancel the (empty) transaction
+         * and everything goes away cleanly.
+         */
+        error = xfs_trans_alloc_empty(mp, &tp);
         if (error)
                 return error;
-        cur = xfs_refcountbt_init_cursor(mp, NULL, agbp, agno, NULL);
+
+        error = xfs_alloc_read_agf(mp, tp, agno, 0, &agbp);
+        if (error)
+                goto out_trans;
+        cur = xfs_refcountbt_init_cursor(mp, tp, agbp, agno, NULL);
 
         /* Find all the leftover CoW staging extents. */
-        INIT_LIST_HEAD(&debris);
         memset(&low, 0, sizeof(low));
         memset(&high, 0, sizeof(high));
         low.rc.rc_startblock = XFS_REFC_COW_START;
@@ -1645,10 +1660,11 @@ xfs_refcount_recover_cow_leftovers(
         if (error)
                 goto out_cursor;
         xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
-        xfs_buf_relse(agbp);
+        xfs_trans_brelse(tp, agbp);
+        xfs_trans_cancel(tp);
 
         /* Now iterate the list to free the leftovers */
-        list_for_each_entry(rr, &debris, rr_list) {
+        list_for_each_entry_safe(rr, n, &debris, rr_list) {
                 /* Set up transaction. */
                 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0, 0, &tp);
                 if (error)
@@ -1676,8 +1692,16 @@ xfs_refcount_recover_cow_leftovers(
                 error = xfs_trans_commit(tp);
                 if (error)
                         goto out_free;
+
+                list_del(&rr->rr_list);
+                kmem_free(rr);
         }
 
+        return error;
+out_defer:
+        xfs_defer_cancel(&dfops);
+out_trans:
+        xfs_trans_cancel(tp);
 out_free:
         /* Free the leftover list */
         list_for_each_entry_safe(rr, n, &debris, rr_list) {
@@ -1688,11 +1712,6 @@ out_free:
 
 out_cursor:
         xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
-        xfs_buf_relse(agbp);
-        goto out_free;
-
-out_defer:
-        xfs_defer_cancel(&dfops);
-        xfs_trans_cancel(tp);
-        goto out_free;
+        xfs_trans_brelse(tp, agbp);
+        goto out_trans;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 2b954308a1d6..9e3cc2146d5b 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -582,9 +582,13 @@ xfs_getbmap(
                 }
                 break;
         default:
+                /* Local format data forks report no extents. */
+                if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL) {
+                        bmv->bmv_entries = 0;
+                        return 0;
+                }
                 if (ip->i_d.di_format != XFS_DINODE_FMT_EXTENTS &&
-                    ip->i_d.di_format != XFS_DINODE_FMT_BTREE &&
-                    ip->i_d.di_format != XFS_DINODE_FMT_LOCAL)
+                    ip->i_d.di_format != XFS_DINODE_FMT_BTREE)
                         return -EINVAL;
 
                 if (xfs_get_extsz_hint(ip) ||
@@ -712,7 +716,7 @@ xfs_getbmap(
                          * extents.
                          */
                         if (map[i].br_startblock == DELAYSTARTBLOCK &&
-                            map[i].br_startoff <= XFS_B_TO_FSB(mp, XFS_ISIZE(ip)))
+                            map[i].br_startoff < XFS_B_TO_FSB(mp, XFS_ISIZE(ip)))
                                 ASSERT((iflags & BMV_IF_DELALLOC) != 0);
 
                         if (map[i].br_startblock == HOLESTARTBLOCK &&
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 62fa39276a24..16d6a578fc16 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -97,12 +97,16 @@ static inline void
 xfs_buf_ioacct_inc(
         struct xfs_buf  *bp)
 {
-        if (bp->b_flags & (XBF_NO_IOACCT|_XBF_IN_FLIGHT))
+        if (bp->b_flags & XBF_NO_IOACCT)
                 return;
 
         ASSERT(bp->b_flags & XBF_ASYNC);
-        bp->b_flags |= _XBF_IN_FLIGHT;
-        percpu_counter_inc(&bp->b_target->bt_io_count);
+        spin_lock(&bp->b_lock);
+        if (!(bp->b_state & XFS_BSTATE_IN_FLIGHT)) {
+                bp->b_state |= XFS_BSTATE_IN_FLIGHT;
+                percpu_counter_inc(&bp->b_target->bt_io_count);
+        }
+        spin_unlock(&bp->b_lock);
 }
 
 /*
@@ -110,14 +114,24 @@ xfs_buf_ioacct_inc(
  * freed and unaccount from the buftarg.
  */
 static inline void
-xfs_buf_ioacct_dec(
+__xfs_buf_ioacct_dec(
         struct xfs_buf  *bp)
 {
-        if (!(bp->b_flags & _XBF_IN_FLIGHT))
-                return;
+        lockdep_assert_held(&bp->b_lock);
 
-        bp->b_flags &= ~_XBF_IN_FLIGHT;
-        percpu_counter_dec(&bp->b_target->bt_io_count);
+        if (bp->b_state & XFS_BSTATE_IN_FLIGHT) {
+                bp->b_state &= ~XFS_BSTATE_IN_FLIGHT;
+                percpu_counter_dec(&bp->b_target->bt_io_count);
+        }
+}
+
+static inline void
+xfs_buf_ioacct_dec(
+        struct xfs_buf  *bp)
+{
+        spin_lock(&bp->b_lock);
+        __xfs_buf_ioacct_dec(bp);
+        spin_unlock(&bp->b_lock);
 }
 
 /*
@@ -149,9 +163,9 @@ xfs_buf_stale(
          * unaccounted (released to LRU) before that occurs. Drop in-flight
          * status now to preserve accounting consistency.
          */
-        xfs_buf_ioacct_dec(bp);
-
         spin_lock(&bp->b_lock);
+        __xfs_buf_ioacct_dec(bp);
+
         atomic_set(&bp->b_lru_ref, 0);
         if (!(bp->b_state & XFS_BSTATE_DISPOSE) &&
             (list_lru_del(&bp->b_target->bt_lru, &bp->b_lru)))
@@ -979,12 +993,12 @@ xfs_buf_rele(
                  * ensures the decrement occurs only once per-buf.
                  */
                 if ((atomic_read(&bp->b_hold) == 1) && !list_empty(&bp->b_lru))
-                        xfs_buf_ioacct_dec(bp);
+                        __xfs_buf_ioacct_dec(bp);
                 goto out_unlock;
         }
 
         /* the last reference has been dropped ... */
-        xfs_buf_ioacct_dec(bp);
+        __xfs_buf_ioacct_dec(bp);
         if (!(bp->b_flags & XBF_STALE) && atomic_read(&bp->b_lru_ref)) {
                 /*
                  * If the buffer is added to the LRU take a new reference to the
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 8d1d44f87ce9..1508121f29f2 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -63,7 +63,6 @@ typedef enum {
 #define _XBF_KMEM        (1 << 21)/* backed by heap memory */
 #define _XBF_DELWRI_Q    (1 << 22)/* buffer on a delwri queue */
 #define _XBF_COMPOUND    (1 << 23)/* compound buffer */
-#define _XBF_IN_FLIGHT   (1 << 25) /* I/O in flight, for accounting purposes */
 
 typedef unsigned int xfs_buf_flags_t;
 
@@ -84,14 +83,14 @@ typedef unsigned int xfs_buf_flags_t;
         { _XBF_PAGES,           "PAGES" }, \
         { _XBF_KMEM,            "KMEM" }, \
         { _XBF_DELWRI_Q,        "DELWRI_Q" }, \
-        { _XBF_COMPOUND,        "COMPOUND" }, \
-        { _XBF_IN_FLIGHT,       "IN_FLIGHT" }
+        { _XBF_COMPOUND,        "COMPOUND" }
 
 
 /*
  * Internal state flags.
  */
 #define XFS_BSTATE_DISPOSE       (1 << 0)       /* buffer being discarded */
+#define XFS_BSTATE_IN_FLIGHT     (1 << 1)       /* I/O in flight */
 
 /*
  * The xfs_buftarg contains 2 notions of "sector size" -
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 35703a801372..5fb5a0958a14 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1043,49 +1043,17 @@ xfs_find_get_desired_pgoff(
 
         index = startoff >> PAGE_SHIFT;
         endoff = XFS_FSB_TO_B(mp, map->br_startoff + map->br_blockcount);
-        end = endoff >> PAGE_SHIFT;
+        end = (endoff - 1) >> PAGE_SHIFT;
         do {
                 int             want;
                 unsigned        nr_pages;
                 unsigned int    i;
 
-                want = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+                want = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
                 nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
                                           want);
-                /*
-                 * No page mapped into given range.  If we are searching holes
-                 * and if this is the first time we got into the loop, it means
-                 * that the given offset is landed in a hole, return it.
-                 *
-                 * If we have already stepped through some block buffers to find
-                 * holes but they all contains data.  In this case, the last
-                 * offset is already updated and pointed to the end of the last
-                 * mapped page, if it does not reach the endpoint to search,
-                 * that means there should be a hole between them.
-                 */
-                if (nr_pages == 0) {
-                        /* Data search found nothing */
-                        if (type == DATA_OFF)
-                                break;
-
-                        ASSERT(type == HOLE_OFF);
-                        if (lastoff == startoff || lastoff < endoff) {
-                                found = true;
-                                *offset = lastoff;
-                        }
-                        break;
-                }
-
-                /*
-                 * At lease we found one page.  If this is the first time we
-                 * step into the loop, and if the first page index offset is
-                 * greater than the given search offset, a hole was found.
-                 */
-                if (type == HOLE_OFF && lastoff == startoff &&
-                    lastoff < page_offset(pvec.pages[0])) {
-                        found = true;
+                if (nr_pages == 0)
                         break;
-                }
 
                 for (i = 0; i < nr_pages; i++) {
                         struct page     *page = pvec.pages[i];
@@ -1098,18 +1066,18 @@ xfs_find_get_desired_pgoff(
                          * file mapping. However, page->index will not change
                          * because we have a reference on the page.
                          *
-                         * Searching done if the page index is out of range.
-                         * If the current offset is not reaches the end of
-                         * the specified search range, there should be a hole
-                         * between them.
+                         * If current page offset is beyond where we've ended,
+                         * we've found a hole.
                          */
-                        if (page->index > end) {
-                                if (type == HOLE_OFF && lastoff < endoff) {
-                                        *offset = lastoff;
-                                        found = true;
-                                }
+                        if (type == HOLE_OFF && lastoff < endoff &&
+                            lastoff < page_offset(pvec.pages[i])) {
+                                found = true;
+                                *offset = lastoff;
                                 goto out;
                         }
+                        /* Searching done if the page index is out of range. */
+                        if (page->index > end)
+                                goto out;
 
                         lock_page(page);
                         /*
@@ -1151,21 +1119,20 @@ xfs_find_get_desired_pgoff(
 
                 /*
                  * The number of returned pages less than our desired, search
-                 * done.  In this case, nothing was found for searching data,
-                 * but we found a hole behind the last offset.
+                 * done.
                  */
-                if (nr_pages < want) {
-                        if (type == HOLE_OFF) {
-                                *offset = lastoff;
-                                found = true;
-                        }
+                if (nr_pages < want)
                         break;
-                }
 
                 index = pvec.pages[i - 1]->index + 1;
                 pagevec_release(&pvec);
         } while (index <= end);
 
+        /* No page at lastoff and we are not done - we found a hole. */
+        if (type == HOLE_OFF && lastoff < endoff) {
+                *offset = lastoff;
+                found = true;
+        }
 out:
         pagevec_release(&pvec);
         return found;
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index 3683819887a5..814ed729881d 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -828,6 +828,7 @@ xfs_getfsmap(
         struct xfs_fsmap                dkeys[2];       /* per-dev keys */
         struct xfs_getfsmap_dev         handlers[XFS_GETFSMAP_DEVS];
         struct xfs_getfsmap_info        info = { NULL };
+        bool                            use_rmap;
         int                             i;
         int                             error = 0;
 
@@ -837,12 +838,14 @@ xfs_getfsmap(
             !xfs_getfsmap_is_valid_device(mp, &head->fmh_keys[1]))
                 return -EINVAL;
 
+        use_rmap = capable(CAP_SYS_ADMIN) &&
+                   xfs_sb_version_hasrmapbt(&mp->m_sb);
         head->fmh_entries = 0;
 
         /* Set up our device handlers. */
         memset(handlers, 0, sizeof(handlers));
         handlers[0].dev = new_encode_dev(mp->m_ddev_targp->bt_dev);
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
+        if (use_rmap)
                 handlers[0].fn = xfs_getfsmap_datadev_rmapbt;
         else
                 handlers[0].fn = xfs_getfsmap_datadev_bnobt;
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index f61c84f8e31a..b9c12e1cc23a 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -66,7 +66,6 @@ xfs_inode_alloc(
 
         XFS_STATS_INC(mp, vn_active);
         ASSERT(atomic_read(&ip->i_pincount) == 0);
-        ASSERT(!spin_is_locked(&ip->i_flags_lock));
         ASSERT(!xfs_isiflocked(ip));
         ASSERT(ip->i_ino == 0);
 
@@ -190,7 +189,7 @@ xfs_perag_set_reclaim_tag(
 {
         struct xfs_mount        *mp = pag->pag_mount;
 
-        ASSERT(spin_is_locked(&pag->pag_ici_lock));
+        lockdep_assert_held(&pag->pag_ici_lock);
         if (pag->pag_ici_reclaimable++)
                 return;
 
@@ -212,7 +211,7 @@ xfs_perag_clear_reclaim_tag(
 {
         struct xfs_mount        *mp = pag->pag_mount;
 
-        ASSERT(spin_is_locked(&pag->pag_ici_lock));
+        lockdep_assert_held(&pag->pag_ici_lock);
         if (--pag->pag_ici_reclaimable)
                 return;
 
@@ -270,12 +269,12 @@ xfs_inew_wait(
         DEFINE_WAIT_BIT(wait, &ip->i_flags, __XFS_INEW_BIT);
 
         do {
-                prepare_to_wait(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(wq, &wait.wq_entry, TASK_UNINTERRUPTIBLE);
                 if (!xfs_iflags_test(ip, XFS_INEW))
                         break;
                 schedule();
         } while (true);
-        finish_wait(wq, &wait.wait);
+        finish_wait(wq, &wait.wq_entry);
 }
 
 /*
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index ec9826c56500..c0a1e840a588 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -622,12 +622,12 @@ __xfs_iflock(
         DEFINE_WAIT_BIT(wait, &ip->i_flags, __XFS_IFLOCK_BIT);
 
         do {
-                prepare_to_wait_exclusive(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait_exclusive(wq, &wait.wq_entry, TASK_UNINTERRUPTIBLE);
                 if (xfs_isiflocked(ip))
                         io_schedule();
         } while (!xfs_iflock_nowait(ip));
 
-        finish_wait(wq, &wait.wait);
+        finish_wait(wq, &wait.wq_entry);
 }
 
 STATIC uint
@@ -2486,11 +2486,11 @@ __xfs_iunpin_wait(
         xfs_iunpin(ip);
 
         do {
-                prepare_to_wait(wq, &wait.wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(wq, &wait.wq_entry, TASK_UNINTERRUPTIBLE);
                 if (xfs_ipincount(ip))
                         io_schedule();
         } while (xfs_ipincount(ip));
-        finish_wait(wq, &wait.wait);
+        finish_wait(wq, &wait.wq_entry);
 }
 
 void
diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index d92543f3bbfd..bdc55c0da19c 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -374,6 +374,20 @@ struct acpi_table_desc {
         u16 validation_count;
 };
 
+/*
+ * Maximum value of the validation_count field in struct acpi_table_desc.
+ * When reached, validation_count cannot be changed any more and the table will
+ * be permanently regarded as validated.
+ *
+ * This is to prevent situations in which unbalanced table get/put operations
+ * may cause premature table unmapping in the OS to happen.
+ *
+ * The maximum validation count can be defined to any value, but should be
+ * greater than the maximum number of OS early stage mapping slots to avoid
+ * leaking early stage table mappings to the late stage.
+ */
+#define ACPI_MAX_TABLE_VALIDATIONS          ACPI_UINT16_MAX
+
 /* Masks for Flags field above */
 
 #define ACPI_TABLE_ORIGIN_EXTERNAL_VIRTUAL  (0) /* Virtual address, external maintained */
diff --git a/include/drm/drm_dp_helper.h b/include/drm/drm_dp_helper.h
index c0bd0d7651a9..bb837310c07e 100644
--- a/include/drm/drm_dp_helper.h
+++ b/include/drm/drm_dp_helper.h
@@ -913,4 +913,55 @@ void drm_dp_aux_unregister(struct drm_dp_aux *aux);
 int drm_dp_start_crc(struct drm_dp_aux *aux, struct drm_crtc *crtc);
 int drm_dp_stop_crc(struct drm_dp_aux *aux);
 
+struct drm_dp_dpcd_ident {
+        u8 oui[3];
+        u8 device_id[6];
+        u8 hw_rev;
+        u8 sw_major_rev;
+        u8 sw_minor_rev;
+} __packed;
+
+/**
+ * struct drm_dp_desc - DP branch/sink device descriptor
+ * @ident: DP device identification from DPCD 0x400 (sink) or 0x500 (branch).
+ * @quirks: Quirks; use drm_dp_has_quirk() to query for the quirks.
+ */
+struct drm_dp_desc {
+        struct drm_dp_dpcd_ident ident;
+        u32 quirks;
+};
+
+int drm_dp_read_desc(struct drm_dp_aux *aux, struct drm_dp_desc *desc,
+                     bool is_branch);
+
+/**
+ * enum drm_dp_quirk - Display Port sink/branch device specific quirks
+ *
+ * Display Port sink and branch devices in the wild have a variety of bugs, try
+ * to collect them here. The quirks are shared, but it's up to the drivers to
+ * implement workarounds for them.
+ */
+enum drm_dp_quirk {
+        /**
+         * @DP_DPCD_QUIRK_LIMITED_M_N:
+         *
+         * The device requires main link attributes Mvid and Nvid to be limited
+         * to 16 bits.
+         */
+        DP_DPCD_QUIRK_LIMITED_M_N,
+};
+
+/**
+ * drm_dp_has_quirk() - does the DP device have a specific quirk
+ * @desc: Device decriptor filled by drm_dp_read_desc()
+ * @quirk: Quirk to query for
+ *
+ * Return true if DP device identified by @desc has @quirk.
+ */
+static inline bool
+drm_dp_has_quirk(const struct drm_dp_desc *desc, enum drm_dp_quirk quirk)
+{
+        return desc->quirks & BIT(quirk);
+}
+
 #endif /* _DRM_DP_HELPER_H_ */
diff --git a/include/dt-bindings/clock/sun50i-a64-ccu.h b/include/dt-bindings/clock/sun50i-a64-ccu.h
index 370c0a0473fc..d66432c6e675 100644
--- a/include/dt-bindings/clock/sun50i-a64-ccu.h
+++ b/include/dt-bindings/clock/sun50i-a64-ccu.h
@@ -43,6 +43,8 @@
 #ifndef _DT_BINDINGS_CLK_SUN50I_A64_H_
 #define _DT_BINDINGS_CLK_SUN50I_A64_H_
 
+#define CLK_PLL_PERIPH0         11
+
 #define CLK_BUS_MIPI_DSI        28
 #define CLK_BUS_CE              29
 #define CLK_BUS_DMA             30
diff --git a/include/dt-bindings/clock/sun8i-h3-ccu.h b/include/dt-bindings/clock/sun8i-h3-ccu.h
index c2afc41d6964..e139fe5c62ec 100644
--- a/include/dt-bindings/clock/sun8i-h3-ccu.h
+++ b/include/dt-bindings/clock/sun8i-h3-ccu.h
@@ -43,6 +43,8 @@
 #ifndef _DT_BINDINGS_CLK_SUN8I_H3_H_
 #define _DT_BINDINGS_CLK_SUN8I_H3_H_
 
+#define CLK_PLL_PERIPH0         9
+
 #define CLK_CPUX                14
 
 #define CLK_BUS_CE              20
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index c47aa248c640..95ba83806c5d 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -33,7 +33,7 @@ struct blk_mq_hw_ctx {
         struct blk_mq_ctx       **ctxs;
         unsigned int            nr_ctx;
 
-        wait_queue_t            dispatch_wait;
+        wait_queue_entry_t              dispatch_wait;
         atomic_t                wait_index;
 
         struct blk_mq_tags      *tags;
@@ -238,7 +238,6 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
                                 bool kick_requeue_list);
 void blk_mq_kick_requeue_list(struct request_queue *q);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
-void blk_mq_abort_requeue_list(struct request_queue *q);
 void blk_mq_complete_request(struct request *rq);
 
 bool blk_mq_queue_stopped(struct request_queue *q);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index ab92c4ea138b..b74a3edcb3da 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -586,6 +586,8 @@ struct request_queue {
 
         size_t                  cmd_size;
         void                    *rq_alloc_data;
+
+        struct work_struct      release_work;
 };
 
 #define QUEUE_FLAG_QUEUED       1       /* uses generic tag queueing */
diff --git a/include/linux/ceph/ceph_debug.h b/include/linux/ceph/ceph_debug.h
index aa2e19182d99..51c5bd64bd00 100644
--- a/include/linux/ceph/ceph_debug.h
+++ b/include/linux/ceph/ceph_debug.h
@@ -3,6 +3,8 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/string.h>
+
 #ifdef CONFIG_CEPH_LIB_PRETTYDEBUG
 
 /*
@@ -12,12 +14,10 @@
  */
 
 # if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
-extern const char *ceph_file_part(const char *s, int len);
 #  define dout(fmt, ...)                                                \
         pr_debug("%.*s %12.12s:%-4d : " fmt,                            \
                  8 - (int)sizeof(KBUILD_MODNAME), "    ",               \
-                 ceph_file_part(__FILE__, sizeof(__FILE__)),            \
-                 __LINE__, ##__VA_ARGS__)
+                 kbasename(__FILE__), __LINE__, ##__VA_ARGS__)
 # else
 /* faux printk call just to see any compiler warnings. */
 #  define dout(fmt, ...)        do {                            \
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 21745946cae1..ec47101cb1bf 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -48,6 +48,7 @@ enum {
         CSS_ONLINE      = (1 << 1), /* between ->css_online() and ->css_offline() */
         CSS_RELEASED    = (1 << 2), /* refcnt reached zero, released */
         CSS_VISIBLE     = (1 << 3), /* css is visible to userland */
+        CSS_DYING       = (1 << 4), /* css is dying */
 };
 
 /* bits in struct cgroup flags field */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index ed2573e149fa..710a005c6b7a 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -344,6 +344,26 @@ static inline bool css_tryget_online(struct cgroup_subsys_state *css)
 }
 
 /**
+ * css_is_dying - test whether the specified css is dying
+ * @css: target css
+ *
+ * Test whether @css is in the process of offlining or already offline.  In
+ * most cases, ->css_online() and ->css_offline() callbacks should be
+ * enough; however, the actual offline operations are RCU delayed and this
+ * test returns %true also when @css is scheduled to be offlined.
+ *
+ * This is useful, for example, when the use case requires synchronous
+ * behavior with respect to cgroup removal.  cgroup removal schedules css
+ * offlining but the css can seem alive while the operation is being
+ * delayed.  If the delay affects user visible semantics, this test can be
+ * used to resolve the situation.
+ */
+static inline bool css_is_dying(struct cgroup_subsys_state *css)
+{
+        return !(css->flags & CSS_NO_REF) && percpu_ref_is_dying(&css->refcnt);
+}
+
+/**
  * css_put - put a css reference
  * @css: target css
  *
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index de179993e039..d614c5ea1b5e 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -15,3 +15,11 @@
  * with any version that can compile the kernel
  */
 #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+
+/*
+ * GCC does not warn about unused static inline functions for
+ * -Wunused-function.  This turns out to avoid the need for complex #ifdef
+ * directives.  Suppress the warning in clang as well.
+ */
+#undef inline
+#define inline inline __attribute__((unused)) notrace
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index 2319b8c108e8..c96709049683 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -74,7 +74,8 @@ extern void config_item_init_type_name(struct config_item *item,
                                        const char *name,
                                        struct config_item_type *type);
 
-extern struct config_item * config_item_get(struct config_item *);
+extern struct config_item *config_item_get(struct config_item *);
+extern struct config_item *config_item_get_unless_zero(struct config_item *);
 extern void config_item_put(struct config_item *);
 
 struct config_item_type {
diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h
index 4eac2670bfa1..92f20832fd28 100644
--- a/include/linux/dma-iommu.h
+++ b/include/linux/dma-iommu.h
@@ -78,6 +78,7 @@ void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list);
 
 struct iommu_domain;
 struct msi_msg;
+struct device;
 
 static inline int iommu_dma_init(void)
 {
diff --git a/include/linux/dmi.h b/include/linux/dmi.h
index 5e9c74cf8894..9bbf21a516e4 100644
--- a/include/linux/dmi.h
+++ b/include/linux/dmi.h
@@ -136,7 +136,7 @@ static inline int dmi_name_in_vendors(const char *s) { return 0; }
 static inline int dmi_name_in_serial(const char *s) { return 0; }
 #define dmi_available 0
 static inline int dmi_walk(void (*decode)(const struct dmi_header *, void *),
-        void *private_data) { return -1; }
+        void *private_data) { return -ENXIO; }
 static inline bool dmi_match(enum dmi_field f, const char *str)
         { return false; }
 static inline void dmi_memdev_name(u16 handle, const char **bank,
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 9ec5e22846e0..0e306c5a86d6 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -153,7 +153,7 @@ struct elevator_type
 #endif
 
         /* managed by elevator core */
-        char icq_cache_name[ELV_NAME_MAX + 5];  /* elvname + "_io_cq" */
+        char icq_cache_name[ELV_NAME_MAX + 6];  /* elvname + "_io_cq" */
         struct list_head list;
 };
 
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index ff0b981f078e..9e4befd95bc7 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -37,7 +37,7 @@ struct eventfd_ctx *eventfd_ctx_fdget(int fd);
 struct eventfd_ctx *eventfd_ctx_fileget(struct file *file);
 __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n);
 ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt);
-int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_t *wait,
+int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait,
                                   __u64 *cnt);
 
 #else /* CONFIG_EVENTFD */
@@ -73,7 +73,7 @@ static inline ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait,
 }
 
 static inline int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx,
-                                                wait_queue_t *wait, __u64 *cnt)
+                                                wait_queue_entry_t *wait, __u64 *cnt)
 {
         return -ENOSYS;
 }
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 56197f82af45..62d948f80730 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -272,6 +272,16 @@ struct bpf_prog_aux;
                 .off   = OFF,                                   \
                 .imm   = IMM })
 
+/* Unconditional jumps, goto pc + off16 */
+
+#define BPF_JMP_A(OFF)                                          \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_JMP | BPF_JA,                      \
+                .dst_reg = 0,                                   \
+                .src_reg = 0,                                   \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Function call */
 
 #define BPF_EMIT_CALL(FUNC)                                     \
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 803e5a9b2654..53f7e49d8fe5 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2,7 +2,7 @@
 #define _LINUX_FS_H
 
 #include <linux/linkage.h>
-#include <linux/wait.h>
+#include <linux/wait_bit.h>
 #include <linux/kdev_t.h>
 #include <linux/dcache.h>
 #include <linux/path.h>
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 2b1a44f5bdb6..a89d37e8b387 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -41,7 +41,7 @@ struct vm_area_struct;
 #define ___GFP_WRITE            0x800000u
 #define ___GFP_KSWAPD_RECLAIM   0x1000000u
 #ifdef CONFIG_LOCKDEP
-#define ___GFP_NOLOCKDEP        0x4000000u
+#define ___GFP_NOLOCKDEP        0x2000000u
 #else
 #define ___GFP_NOLOCKDEP        0
 #endif
diff --git a/include/linux/gpio/machine.h b/include/linux/gpio/machine.h
index c0d712d22b07..f738d50cc17d 100644
--- a/include/linux/gpio/machine.h
+++ b/include/linux/gpio/machine.h
@@ -56,7 +56,14 @@ struct gpiod_lookup_table {
         .flags = _flags,                                                  \
 }
 
+#ifdef CONFIG_GPIOLIB
 void gpiod_add_lookup_table(struct gpiod_lookup_table *table);
 void gpiod_remove_lookup_table(struct gpiod_lookup_table *table);
+#else
+static inline
+void gpiod_add_lookup_table(struct gpiod_lookup_table *table) {}
+static inline
+void gpiod_remove_lookup_table(struct gpiod_lookup_table *table) {}
+#endif
 
 #endif /* __LINUX_GPIO_MACHINE_H */
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 8d5fcd6284ce..283dc2f5364d 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -614,14 +614,16 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
 static inline netdev_features_t vlan_features_check(const struct sk_buff *skb,
                                                     netdev_features_t features)
 {
-        if (skb_vlan_tagged_multi(skb))
-                features = netdev_intersect_features(features,
-                                                     NETIF_F_SG |
-                                                     NETIF_F_HIGHDMA |
-                                                     NETIF_F_FRAGLIST |
-                                                     NETIF_F_HW_CSUM |
-                                                     NETIF_F_HW_VLAN_CTAG_TX |
-                                                     NETIF_F_HW_VLAN_STAG_TX);
+        if (skb_vlan_tagged_multi(skb)) {
+                /* In the case of multi-tagged packets, use a direct mask
+                 * instead of using netdev_interesect_features(), to make
+                 * sure that only devices supporting NETIF_F_HW_CSUM will
+                 * have checksum offloading support.
+                 */
+                features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_HW_CSUM |
+                            NETIF_F_FRAGLIST | NETIF_F_HW_VLAN_CTAG_TX |
+                            NETIF_F_HW_VLAN_STAG_TX;
+        }
 
         return features;
 }
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index fffb91202bc9..1fa293a37f4a 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -417,6 +417,10 @@
 #define ICH_HCR_EN                      (1 << 0)
 #define ICH_HCR_UIE                     (1 << 1)
 
+#define ICH_VMCR_ACK_CTL_SHIFT          2
+#define ICH_VMCR_ACK_CTL_MASK           (1 << ICH_VMCR_ACK_CTL_SHIFT)
+#define ICH_VMCR_FIQ_EN_SHIFT           3
+#define ICH_VMCR_FIQ_EN_MASK            (1 << ICH_VMCR_FIQ_EN_SHIFT)
 #define ICH_VMCR_CBPR_SHIFT             4
 #define ICH_VMCR_CBPR_MASK              (1 << ICH_VMCR_CBPR_SHIFT)
 #define ICH_VMCR_EOIM_SHIFT             9
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index dc30f3d057eb..d3453ee072fc 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -25,7 +25,18 @@
 #define GICC_ENABLE                     0x1
 #define GICC_INT_PRI_THRESHOLD          0xf0
 
-#define GIC_CPU_CTRL_EOImodeNS          (1 << 9)
+#define GIC_CPU_CTRL_EnableGrp0_SHIFT   0
+#define GIC_CPU_CTRL_EnableGrp0         (1 << GIC_CPU_CTRL_EnableGrp0_SHIFT)
+#define GIC_CPU_CTRL_EnableGrp1_SHIFT   1
+#define GIC_CPU_CTRL_EnableGrp1         (1 << GIC_CPU_CTRL_EnableGrp1_SHIFT)
+#define GIC_CPU_CTRL_AckCtl_SHIFT       2
+#define GIC_CPU_CTRL_AckCtl             (1 << GIC_CPU_CTRL_AckCtl_SHIFT)
+#define GIC_CPU_CTRL_FIQEn_SHIFT        3
+#define GIC_CPU_CTRL_FIQEn              (1 << GIC_CPU_CTRL_FIQEn_SHIFT)
+#define GIC_CPU_CTRL_CBPR_SHIFT         4
+#define GIC_CPU_CTRL_CBPR               (1 << GIC_CPU_CTRL_CBPR_SHIFT)
+#define GIC_CPU_CTRL_EOImodeNS_SHIFT    9
+#define GIC_CPU_CTRL_EOImodeNS          (1 << GIC_CPU_CTRL_EOImodeNS_SHIFT)
 
 #define GICC_IAR_INT_ID_MASK            0x3ff
 #define GICC_INT_SPURIOUS               1023
@@ -84,8 +95,19 @@
 #define GICH_LR_EOI                     (1 << 19)
 #define GICH_LR_HW                      (1 << 31)
 
-#define GICH_VMCR_CTRL_SHIFT            0
-#define GICH_VMCR_CTRL_MASK             (0x21f << GICH_VMCR_CTRL_SHIFT)
+#define GICH_VMCR_ENABLE_GRP0_SHIFT     0
+#define GICH_VMCR_ENABLE_GRP0_MASK      (1 << GICH_VMCR_ENABLE_GRP0_SHIFT)
+#define GICH_VMCR_ENABLE_GRP1_SHIFT     1
+#define GICH_VMCR_ENABLE_GRP1_MASK      (1 << GICH_VMCR_ENABLE_GRP1_SHIFT)
+#define GICH_VMCR_ACK_CTL_SHIFT         2
+#define GICH_VMCR_ACK_CTL_MASK          (1 << GICH_VMCR_ACK_CTL_SHIFT)
+#define GICH_VMCR_FIQ_EN_SHIFT          3
+#define GICH_VMCR_FIQ_EN_MASK           (1 << GICH_VMCR_FIQ_EN_SHIFT)
+#define GICH_VMCR_CBPR_SHIFT            4
+#define GICH_VMCR_CBPR_MASK             (1 << GICH_VMCR_CBPR_SHIFT)
+#define GICH_VMCR_EOI_MODE_SHIFT        9
+#define GICH_VMCR_EOI_MODE_MASK         (1 << GICH_VMCR_EOI_MODE_SHIFT)
+
 #define GICH_VMCR_PRIMASK_SHIFT         27
 #define GICH_VMCR_PRIMASK_MASK          (0x1f << GICH_VMCR_PRIMASK_SHIFT)
 #define GICH_VMCR_BINPOINT_SHIFT        21
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 36872fbb815d..734377ad42e9 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -64,13 +64,17 @@ extern int register_refined_jiffies(long clock_tick_rate);
 /* TICK_USEC is the time between ticks in usec assuming fake USER_HZ */
 #define TICK_USEC ((1000000UL + USER_HZ/2) / USER_HZ)
 
+#ifndef __jiffy_arch_data
+#define __jiffy_arch_data
+#endif
+
 /*
  * The 64-bit value is not atomic - you MUST NOT read it
  * without sampling the sequence number in jiffies_lock.
  * get_jiffies_64() will do this for you as appropriate.
  */
 extern u64 __cacheline_aligned_in_smp jiffies_64;
-extern unsigned long volatile __cacheline_aligned_in_smp jiffies;
+extern unsigned long volatile __cacheline_aligned_in_smp __jiffy_arch_data jiffies;
 
 #if (BITS_PER_LONG < 64)
 u64 get_jiffies_64(void);
diff --git a/include/linux/key.h b/include/linux/key.h
index 0c9b93b0d1f7..78e25aabedaf 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -173,7 +173,6 @@ struct key {
 #ifdef KEY_DEBUGGING
         unsigned                magic;
 #define KEY_DEBUG_MAGIC         0x18273645u
-#define KEY_DEBUG_MAGIC_X       0xf8e9dacbu
 #endif
 
         unsigned long           flags;          /* status flags (change with bitops) */
diff --git a/include/linux/kvm_irqfd.h b/include/linux/kvm_irqfd.h
index 0c1de05098c8..76c2fbc59f35 100644
--- a/include/linux/kvm_irqfd.h
+++ b/include/linux/kvm_irqfd.h
@@ -46,7 +46,7 @@ struct kvm_kernel_irqfd_resampler {
 struct kvm_kernel_irqfd {
         /* Used for MSI fast-path */
         struct kvm *kvm;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         /* Update side is protected by irqfds.lock */
         struct kvm_kernel_irq_routing_entry irq_entry;
         seqcount_t irq_entry_sc;
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 4ce24a376262..8098695e5d8d 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -425,12 +425,20 @@ static inline void early_memtest(phys_addr_t start, phys_addr_t end)
 }
 #endif
 
+extern unsigned long memblock_reserved_memory_within(phys_addr_t start_addr,
+                phys_addr_t end_addr);
 #else
 static inline phys_addr_t memblock_alloc(phys_addr_t size, phys_addr_t align)
 {
         return 0;
 }
 
+static inline unsigned long memblock_reserved_memory_within(phys_addr_t start_addr,
+                phys_addr_t end_addr)
+{
+        return 0;
+}
+
 #endif /* CONFIG_HAVE_MEMBLOCK */
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index b4ee8f62ce8d..8e2828d48d7f 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -470,6 +470,7 @@ struct mlx4_update_qp_params {
         u16     rate_val;
 };
 
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn);
 int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
                    enum mlx4_update_qp_attr attr,
                    struct mlx4_update_qp_params *params);
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index dd9a263ed368..a940ec6a046c 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -787,8 +787,14 @@ enum {
 };
 
 enum {
-        CQE_RSS_HTYPE_IP        = 0x3 << 6,
-        CQE_RSS_HTYPE_L4        = 0x3 << 2,
+        CQE_RSS_HTYPE_IP        = 0x3 << 2,
+        /* cqe->rss_hash_type[3:2] - IP destination selected for hash
+         * (00 = none,  01 = IPv4, 10 = IPv6, 11 = Reserved)
+         */
+        CQE_RSS_HTYPE_L4        = 0x3 << 6,
+        /* cqe->rss_hash_type[7:6] - L4 destination selected for hash
+         * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI
+         */
 };
 
 enum {
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index bcdf739ee41a..93273d9ea4d1 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -787,7 +787,12 @@ enum {
 
 typedef void (*mlx5_cmd_cbk_t)(int status, void *context);
 
+enum {
+        MLX5_CMD_ENT_STATE_PENDING_COMP,
+};
+
 struct mlx5_cmd_work_ent {
+        unsigned long           state;
         struct mlx5_cmd_msg    *in;
         struct mlx5_cmd_msg    *out;
         void                   *uout;
@@ -976,7 +981,7 @@ void mlx5_cq_completion(struct mlx5_core_dev *dev, u32 cqn);
 void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type);
 void mlx5_srq_event(struct mlx5_core_dev *dev, u32 srqn, int event_type);
 struct mlx5_core_srq *mlx5_core_get_srq(struct mlx5_core_dev *dev, u32 srqn);
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec);
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced);
 void mlx5_cq_event(struct mlx5_core_dev *dev, u32 cqn, int event_type);
 int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                        int nent, u64 mask, const char *name,
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 32de0724b400..edafedb7b509 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -766,6 +766,12 @@ enum {
         MLX5_CAP_PORT_TYPE_ETH = 0x1,
 };
 
+enum {
+        MLX5_CAP_UMR_FENCE_STRONG       = 0x0,
+        MLX5_CAP_UMR_FENCE_SMALL        = 0x1,
+        MLX5_CAP_UMR_FENCE_NONE         = 0x2,
+};
+
 struct mlx5_ifc_cmd_hca_cap_bits {
         u8         reserved_at_0[0x80];
 
@@ -875,7 +881,9 @@ struct mlx5_ifc_cmd_hca_cap_bits {
         u8         reserved_at_202[0x1];
         u8         ipoib_enhanced_offloads[0x1];
         u8         ipoib_basic_offloads[0x1];
-        u8         reserved_at_205[0xa];
+        u8         reserved_at_205[0x5];
+        u8         umr_fence[0x2];
+        u8         reserved_at_20c[0x3];
         u8         drain_sigerr[0x1];
         u8         cmdif_checksum[0x2];
         u8         sigerr_cqe[0x1];
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7cb17c6b97de..6f543a47fc92 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1393,12 +1393,6 @@ int clear_page_dirty_for_io(struct page *page);
 
 int get_cmdline(struct task_struct *task, char *buffer, int buflen);
 
-/* Is the vma a continuation of the stack vma above it? */
-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
-{
-        return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-}
-
 static inline bool vma_is_anonymous(struct vm_area_struct *vma)
 {
         return !vma->vm_ops;
@@ -1414,28 +1408,6 @@ bool vma_is_shmem(struct vm_area_struct *vma);
 static inline bool vma_is_shmem(struct vm_area_struct *vma) { return false; }
 #endif
 
-static inline int stack_guard_page_start(struct vm_area_struct *vma,
-                                             unsigned long addr)
-{
-        return (vma->vm_flags & VM_GROWSDOWN) &&
-                (vma->vm_start == addr) &&
-                !vma_growsdown(vma->vm_prev, addr);
-}
-
-/* Is the vma a continuation of the stack vma below it? */
-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
-{
-        return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
-}
-
-static inline int stack_guard_page_end(struct vm_area_struct *vma,
-                                           unsigned long addr)
-{
-        return (vma->vm_flags & VM_GROWSUP) &&
-                (vma->vm_end == addr) &&
-                !vma_growsup(vma->vm_next, addr);
-}
-
 int vma_is_stack_for_current(struct vm_area_struct *vma);
 
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
@@ -2222,6 +2194,7 @@ void page_cache_async_readahead(struct address_space *mapping,
                                 pgoff_t offset,
                                 unsigned long size);
 
+extern unsigned long stack_guard_gap;
 /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
 extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
 
@@ -2250,6 +2223,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m
         return vma;
 }
 
+static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
+{
+        unsigned long vm_start = vma->vm_start;
+
+        if (vma->vm_flags & VM_GROWSDOWN) {
+                vm_start -= stack_guard_gap;
+                if (vm_start > vma->vm_start)
+                        vm_start = 0;
+        }
+        return vm_start;
+}
+
+static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
+{
+        unsigned long vm_end = vma->vm_end;
+
+        if (vma->vm_flags & VM_GROWSUP) {
+                vm_end += stack_guard_gap;
+                if (vm_end < vma->vm_end)
+                        vm_end = -PAGE_SIZE;
+        }
+        return vm_end;
+}
+
 static inline unsigned long vma_pages(struct vm_area_struct *vma)
 {
         return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
@@ -2327,6 +2324,17 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
 #define FOLL_REMOTE     0x2000  /* we are working on non-current tsk/mm */
 #define FOLL_COW        0x4000  /* internal GUP flag */
 
+static inline int vm_fault_to_errno(int vm_fault, int foll_flags)
+{
+        if (vm_fault & VM_FAULT_OOM)
+                return -ENOMEM;
+        if (vm_fault & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+                return (foll_flags & FOLL_HWPOISON) ? -EHWPOISON : -EFAULT;
+        if (vm_fault & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+                return -EFAULT;
+        return 0;
+}
+
 typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
                         void *data);
 extern int apply_to_page_range(struct mm_struct *mm, unsigned long address,
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index ebaccd4e7d8c..ef6a13b7bd3e 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -678,6 +678,7 @@ typedef struct pglist_data {
          * is the first PFN that needs to be initialised.
          */
         unsigned long first_deferred_pfn;
+        unsigned long static_init_size;
 #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 566fda587fcf..3f74ef2281e8 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -467,6 +467,7 @@ enum dmi_field {
         DMI_PRODUCT_VERSION,
         DMI_PRODUCT_SERIAL,
         DMI_PRODUCT_UUID,
+        DMI_PRODUCT_FAMILY,
         DMI_BOARD_VENDOR,
         DMI_BOARD_NAME,
         DMI_BOARD_VERSION,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3f39d27decf4..4ed952c17fc7 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -914,8 +914,7 @@ struct xfrmdev_ops {
  *
  * int (*ndo_change_mtu)(struct net_device *dev, int new_mtu);
  *      Called when a user wants to change the Maximum Transfer Unit
- *      of a device. If not defined, any request to change MTU will
- *      will return an error.
+ *      of a device.
  *
  * void (*ndo_tx_timeout)(struct net_device *dev);
  *      Callback used when the transmitter has not made any progress
@@ -1596,8 +1595,8 @@ enum netdev_priv_flags {
  *      @rtnl_link_state:       This enum represents the phases of creating
  *                              a new link
  *
- *      @destructor:            Called from unregister,
- *                              can be used to call free_netdev
+ *      @needs_free_netdev:     Should unregister perform free_netdev?
+ *      @priv_destructor:       Called from unregister
  *      @npinfo:                XXX: need comments on this one
  *      @nd_net:                Network namespace this network device is inside
  *
@@ -1858,7 +1857,8 @@ struct net_device {
                 RTNL_LINK_INITIALIZING,
         } rtnl_link_state:16;
 
-        void (*destructor)(struct net_device *dev);
+        bool needs_free_netdev;
+        void (*priv_destructor)(struct net_device *dev);
 
 #ifdef CONFIG_NETPOLL
         struct netpoll_info __rcu       *npinfo;
@@ -4261,6 +4261,11 @@ static inline const char *netdev_name(const struct net_device *dev)
         return dev->name;
 }
 
+static inline bool netdev_unregistering(const struct net_device *dev)
+{
+        return dev->reg_state == NETREG_UNREGISTERING;
+}
+
 static inline const char *netdev_reg_state(const struct net_device *dev)
 {
         switch (dev->reg_state) {
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index dc8224ae28d5..e0d1946270f3 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -64,6 +64,7 @@ extern struct platform_device *of_platform_device_create(struct device_node *np,
                                                    const char *bus_id,
                                                    struct device *parent);
 
+extern int of_platform_device_destroy(struct device *dev, void *data);
 extern int of_platform_bus_probe(struct device_node *root,
                                  const struct of_device_id *matches,
                                  struct device *parent);
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 316a19f6b635..e7bbd9d4dc6c 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -524,7 +524,7 @@ void page_endio(struct page *page, bool is_write, int err);
 /*
  * Add an arbitrary waiter to a page's wait queue
  */
-extern void add_page_wait_queue(struct page *page, wait_queue_t *waiter);
+extern void add_page_wait_queue(struct page *page, wait_queue_entry_t *waiter);
 
 /*
  * Fault everything in given userspace address range in.
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 33c2b0b77429..8039f9f0ca05 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -183,6 +183,11 @@ enum pci_dev_flags {
         PCI_DEV_FLAGS_BRIDGE_XLATE_ROOT = (__force pci_dev_flags_t) (1 << 9),
         /* Do not use FLR even if device advertises PCI_AF_CAP */
         PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10),
+        /*
+         * Resume before calling the driver's system suspend hooks, disabling
+         * the direct_complete optimization.
+         */
+        PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
 };
 
 enum pci_irq_reroute_variant {
@@ -1342,9 +1347,9 @@ pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                unsigned int max_vecs, unsigned int flags,
                                const struct irq_affinity *aff_desc)
 {
-        if (min_vecs > 1)
-                return -EINVAL;
-        return 1;
+        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1 && dev->irq)
+                return 1;
+        return -ENOSPC;
 }
 
 static inline void pci_free_irq_vectors(struct pci_dev *dev)
diff --git a/include/linux/pinctrl/pinconf-generic.h b/include/linux/pinctrl/pinconf-generic.h
index 279e3c5326e3..7620eb127cff 100644
--- a/include/linux/pinctrl/pinconf-generic.h
+++ b/include/linux/pinctrl/pinconf-generic.h
@@ -42,8 +42,6 @@
  * @PIN_CONFIG_BIAS_PULL_UP: the pin will be pulled up (usually with high
  *      impedance to VDD). If the argument is != 0 pull-up is enabled,
  *      if it is 0, pull-up is total, i.e. the pin is connected to VDD.
- * @PIN_CONFIG_BIDIRECTIONAL: the pin will be configured to allow simultaneous
- *      input and output operations.
  * @PIN_CONFIG_DRIVE_OPEN_DRAIN: the pin will be driven with open drain (open
  *      collector) which means it is usually wired with other output ports
  *      which are then pulled up with an external resistor. Setting this
@@ -98,7 +96,6 @@ enum pin_config_param {
         PIN_CONFIG_BIAS_PULL_DOWN,
         PIN_CONFIG_BIAS_PULL_PIN_DEFAULT,
         PIN_CONFIG_BIAS_PULL_UP,
-        PIN_CONFIG_BIDIRECTIONAL,
         PIN_CONFIG_DRIVE_OPEN_DRAIN,
         PIN_CONFIG_DRIVE_OPEN_SOURCE,
         PIN_CONFIG_DRIVE_PUSH_PULL,
diff --git a/include/linux/poll.h b/include/linux/poll.h
index 75ffc5729e4c..2889f09a1c60 100644
--- a/include/linux/poll.h
+++ b/include/linux/poll.h
@@ -75,7 +75,7 @@ static inline void init_poll_funcptr(poll_table *pt, poll_queue_proc qproc)
 struct poll_table_entry {
         struct file *filp;
         unsigned long key;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         wait_queue_head_t *wait_address;
 };
 
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 422bc2e4cb6a..ef3eb8bbfee4 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -54,7 +54,8 @@ extern int ptrace_request(struct task_struct *child, long request,
                           unsigned long addr, unsigned long data);
 extern void ptrace_notify(int exit_code);
 extern void __ptrace_link(struct task_struct *child,
-                          struct task_struct *new_parent);
+                          struct task_struct *new_parent,
+                          const struct cred *ptracer_cred);
 extern void __ptrace_unlink(struct task_struct *child);
 extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
 #define PTRACE_MODE_READ        0x01
@@ -206,7 +207,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
         if (unlikely(ptrace) && current->ptrace) {
                 child->ptrace = current->ptrace;
-                __ptrace_link(child, current->parent);
+                __ptrace_link(child, current->parent, current->ptracer_cred);
 
                 if (child->ptrace & PT_SEIZED)
                         task_set_jobctl_pending(child, JOBCTL_TRAP_STOP);
@@ -215,6 +216,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
                 set_tsk_thread_flag(child, TIF_SIGPENDING);
         }
+        else
+                child->ptracer_cred = NULL;
 }
 
 /**
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index 9c6f768b7d32..dda22f45fc1b 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -44,6 +44,7 @@ void inode_sub_rsv_space(struct inode *inode, qsize_t number);
 void inode_reclaim_rsv_space(struct inode *inode, qsize_t number);
 
 int dquot_initialize(struct inode *inode);
+bool dquot_initialize_needed(struct inode *inode);
 void dquot_drop(struct inode *inode);
 struct dquot *dqget(struct super_block *sb, struct kqid qid);
 static inline struct dquot *dqgrab(struct dquot *dquot)
@@ -207,6 +208,11 @@ static inline int dquot_initialize(struct inode *inode)
         return 0;
 }
 
+static inline bool dquot_initialize_needed(struct inode *inode)
+{
+        return false;
+}
+
 static inline void dquot_drop(struct inode *inode)
 {
 }
diff --git a/include/linux/serdev.h b/include/linux/serdev.h
index cda76c6506ca..e69402d4a8ae 100644
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -195,6 +195,7 @@ int serdev_device_open(struct serdev_device *);
 void serdev_device_close(struct serdev_device *);
 unsigned int serdev_device_set_baudrate(struct serdev_device *, unsigned int);
 void serdev_device_set_flow_control(struct serdev_device *, bool);
+int serdev_device_write_buf(struct serdev_device *, const unsigned char *, size_t);
 void serdev_device_wait_until_sent(struct serdev_device *, long);
 int serdev_device_get_tiocm(struct serdev_device *);
 int serdev_device_set_tiocm(struct serdev_device *, int, int);
@@ -236,6 +237,12 @@ static inline unsigned int serdev_device_set_baudrate(struct serdev_device *sdev
         return 0;
 }
 static inline void serdev_device_set_flow_control(struct serdev_device *sdev, bool enable) {}
+static inline int serdev_device_write_buf(struct serdev_device *serdev,
+                                          const unsigned char *buf,
+                                          size_t count)
+{
+        return -ENODEV;
+}
 static inline void serdev_device_wait_until_sent(struct serdev_device *sdev, long timeout) {}
 static inline int serdev_device_get_tiocm(struct serdev_device *serdev)
 {
@@ -301,7 +308,7 @@ struct tty_driver;
 struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx);
-void serdev_tty_port_unregister(struct tty_port *port);
+int serdev_tty_port_unregister(struct tty_port *port);
 #else
 static inline struct device *serdev_tty_port_register(struct tty_port *port,
                                            struct device *parent,
@@ -309,14 +316,10 @@ static inline struct device *serdev_tty_port_register(struct tty_port *port,
 {
         return ERR_PTR(-ENODEV);
 }
-static inline void serdev_tty_port_unregister(struct tty_port *port) {}
-#endif /* CONFIG_SERIAL_DEV_CTRL_TTYPORT */
-
-static inline int serdev_device_write_buf(struct serdev_device *serdev,
-                                          const unsigned char *data,
-                                          size_t count)
+static inline int serdev_tty_port_unregister(struct tty_port *port)
 {
-        return serdev_device_write(serdev, data, count, 0);
+        return -ENODEV;
 }
+#endif /* CONFIG_SERIAL_DEV_CTRL_TTYPORT */
 
 #endif /*_LINUX_SERDEV_H */
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 167ad8831aaf..4c1d5f7e62c4 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -172,9 +172,7 @@ static inline int srcu_read_lock(struct srcu_struct *sp) __acquires(sp)
 {
         int retval;
 
-        preempt_disable();
         retval = __srcu_read_lock(sp);
-        preempt_enable();
         rcu_lock_acquire(&(sp)->dep_map);
         return retval;
 }
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 7ba040c797ec..9d7529ffc4ce 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -13,7 +13,7 @@
 #include <linux/ktime.h>
 #include <linux/sunrpc/types.h>
 #include <linux/spinlock.h>
-#include <linux/wait.h>
+#include <linux/wait_bit.h>
 #include <linux/workqueue.h>
 #include <linux/sunrpc/xdr.h>
 
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 94631026f79c..11cef5a7bc87 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -336,7 +336,8 @@ xdr_argsize_check(struct svc_rqst *rqstp, __be32 *p)
 {
         char *cp = (char *)p;
         struct kvec *vec = &rqstp->rq_arg.head[0];
-        return cp == (char *)vec->iov_base + vec->iov_len;
+        return cp >= (char*)vec->iov_base
+                && cp <= (char*)vec->iov_base + vec->iov_len;
 }
 
 static inline int
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 0b1cf32edfd7..d9718378a8be 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -189,8 +189,6 @@ struct platform_suspend_ops {
 struct platform_freeze_ops {
         int (*begin)(void);
         int (*prepare)(void);
-        void (*wake)(void);
-        void (*sync)(void);
         void (*restore)(void);
         void (*end)(void);
 };
@@ -430,8 +428,7 @@ extern unsigned int pm_wakeup_irq;
 
 extern bool pm_wakeup_pending(void);
 extern void pm_system_wakeup(void);
-extern void pm_system_cancel_wakeup(void);
-extern void pm_wakeup_clear(bool reset);
+extern void pm_wakeup_clear(void);
 extern void pm_system_irq_wakeup(unsigned int irq_number);
 extern bool pm_get_wakeup_count(unsigned int *count, bool block);
 extern bool pm_save_wakeup_count(unsigned int count);
@@ -481,7 +478,7 @@ static inline int unregister_pm_notifier(struct notifier_block *nb)
 
 static inline bool pm_wakeup_pending(void) { return false; }
 static inline void pm_system_wakeup(void) {}
-static inline void pm_wakeup_clear(bool reset) {}
+static inline void pm_wakeup_clear(void) {}
 static inline void pm_system_irq_wakeup(unsigned int irq_number) {}
 
 static inline void lock_system_sleep(void) {}
diff --git a/include/linux/tty.h b/include/linux/tty.h
index d07cd2105a6c..eccb4ec30a8a 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -558,6 +558,15 @@ extern struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct tty_driver *driver, unsigned index,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp);
+extern struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device);
+extern struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp);
+extern void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index);
 extern int tty_port_alloc_xmit_buf(struct tty_port *port);
 extern void tty_port_free_xmit_buf(struct tty_port *port);
 extern void tty_port_destroy(struct tty_port *port);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 7dffa5624ea6..97116379db5f 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -206,6 +206,7 @@ struct cdc_state {
 };
 
 extern int usbnet_generic_cdc_bind(struct usbnet *, struct usb_interface *);
+extern int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf);
 extern int usbnet_cdc_bind(struct usbnet *, struct usb_interface *);
 extern void usbnet_cdc_unbind(struct usbnet *, struct usb_interface *);
 extern void usbnet_cdc_status(struct usbnet *, struct urb *);
diff --git a/include/linux/vfio.h b/include/linux/vfio.h
index edf9b2cad277..f57076b958b7 100644
--- a/include/linux/vfio.h
+++ b/include/linux/vfio.h
@@ -183,7 +183,7 @@ struct virqfd {
         void                    (*thread)(void *, void *);
         void                    *data;
         struct work_struct      inject;
-        wait_queue_t            wait;
+        wait_queue_entry_t              wait;
         poll_table              pt;
         struct work_struct      shutdown;
         struct virqfd           **pvirqfd;
diff --git a/include/linux/wait.h b/include/linux/wait.h
index db076ca7f11d..b289c96151ee 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -10,38 +10,30 @@
 #include <asm/current.h>
 #include <uapi/linux/wait.h>
 
-typedef struct __wait_queue wait_queue_t;
-typedef int (*wait_queue_func_t)(wait_queue_t *wait, unsigned mode, int flags, void *key);
-int default_wake_function(wait_queue_t *wait, unsigned mode, int flags, void *key);
+typedef struct wait_queue_entry wait_queue_entry_t;
 
-/* __wait_queue::flags */
+typedef int (*wait_queue_func_t)(struct wait_queue_entry *wq_entry, unsigned mode, int flags, void *key);
+int default_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int flags, void *key);
+
+/* wait_queue_entry::flags */
 #define WQ_FLAG_EXCLUSIVE       0x01
 #define WQ_FLAG_WOKEN           0x02
 
-struct __wait_queue {
+/*
+ * A single wait-queue entry structure:
+ */
+struct wait_queue_entry {
         unsigned int            flags;
         void                    *private;
         wait_queue_func_t       func;
-        struct list_head        task_list;
-};
-
-struct wait_bit_key {
-        void                    *flags;
-        int                     bit_nr;
-#define WAIT_ATOMIC_T_BIT_NR    -1
-        unsigned long           timeout;
+        struct list_head        entry;
 };
 
-struct wait_bit_queue {
-        struct wait_bit_key     key;
-        wait_queue_t            wait;
-};
-
-struct __wait_queue_head {
+struct wait_queue_head {
         spinlock_t              lock;
-        struct list_head        task_list;
+        struct list_head        head;
 };
-typedef struct __wait_queue_head wait_queue_head_t;
+typedef struct wait_queue_head wait_queue_head_t;
 
 struct task_struct;
 
@@ -49,82 +41,76 @@ struct task_struct;
  * Macros for declaration and initialisaton of the datatypes
  */
 
-#define __WAITQUEUE_INITIALIZER(name, tsk) {                            \
-        .private        = tsk,                                          \
-        .func           = default_wake_function,                        \
-        .task_list      = { NULL, NULL } }
+#define __WAITQUEUE_INITIALIZER(name, tsk) {                                    \
+        .private        = tsk,                                                  \
+        .func           = default_wake_function,                                \
+        .entry          = { NULL, NULL } }
 
-#define DECLARE_WAITQUEUE(name, tsk)                                    \
-        wait_queue_t name = __WAITQUEUE_INITIALIZER(name, tsk)
+#define DECLARE_WAITQUEUE(name, tsk)                                            \
+        struct wait_queue_entry name = __WAITQUEUE_INITIALIZER(name, tsk)
 
-#define __WAIT_QUEUE_HEAD_INITIALIZER(name) {                           \
-        .lock           = __SPIN_LOCK_UNLOCKED(name.lock),              \
-        .task_list      = { &(name).task_list, &(name).task_list } }
+#define __WAIT_QUEUE_HEAD_INITIALIZER(name) {                                   \
+        .lock           = __SPIN_LOCK_UNLOCKED(name.lock),                      \
+        .head           = { &(name).head, &(name).head } }
 
 #define DECLARE_WAIT_QUEUE_HEAD(name) \
-        wait_queue_head_t name = __WAIT_QUEUE_HEAD_INITIALIZER(name)
-
-#define __WAIT_BIT_KEY_INITIALIZER(word, bit)                           \
-        { .flags = word, .bit_nr = bit, }
+        struct wait_queue_head name = __WAIT_QUEUE_HEAD_INITIALIZER(name)
 
-#define __WAIT_ATOMIC_T_KEY_INITIALIZER(p)                              \
-        { .flags = p, .bit_nr = WAIT_ATOMIC_T_BIT_NR, }
+extern void __init_waitqueue_head(struct wait_queue_head *wq_head, const char *name, struct lock_class_key *);
 
-extern void __init_waitqueue_head(wait_queue_head_t *q, const char *name, struct lock_class_key *);
-
-#define init_waitqueue_head(q)                          \
-        do {                                            \
-                static struct lock_class_key __key;     \
-                                                        \
-                __init_waitqueue_head((q), #q, &__key); \
+#define init_waitqueue_head(wq_head)                                            \
+        do {                                                                    \
+                static struct lock_class_key __key;                             \
+                                                                                \
+                __init_waitqueue_head((wq_head), #wq_head, &__key);             \
         } while (0)
 
 #ifdef CONFIG_LOCKDEP
 # define __WAIT_QUEUE_HEAD_INIT_ONSTACK(name) \
         ({ init_waitqueue_head(&name); name; })
 # define DECLARE_WAIT_QUEUE_HEAD_ONSTACK(name) \
-        wait_queue_head_t name = __WAIT_QUEUE_HEAD_INIT_ONSTACK(name)
+        struct wait_queue_head name = __WAIT_QUEUE_HEAD_INIT_ONSTACK(name)
 #else
 # define DECLARE_WAIT_QUEUE_HEAD_ONSTACK(name) DECLARE_WAIT_QUEUE_HEAD(name)
 #endif
 
-static inline void init_waitqueue_entry(wait_queue_t *q, struct task_struct *p)
+static inline void init_waitqueue_entry(struct wait_queue_entry *wq_entry, struct task_struct *p)
 {
-        q->flags        = 0;
-        q->private      = p;
-        q->func         = default_wake_function;
+        wq_entry->flags         = 0;
+        wq_entry->private       = p;
+        wq_entry->func          = default_wake_function;
 }
 
 static inline void
-init_waitqueue_func_entry(wait_queue_t *q, wait_queue_func_t func)
+init_waitqueue_func_entry(struct wait_queue_entry *wq_entry, wait_queue_func_t func)
 {
-        q->flags        = 0;
-        q->private      = NULL;
-        q->func         = func;
+        wq_entry->flags         = 0;
+        wq_entry->private       = NULL;
+        wq_entry->func          = func;
 }
 
 /**
  * waitqueue_active -- locklessly test for waiters on the queue
- * @q: the waitqueue to test for waiters
+ * @wq_head: the waitqueue to test for waiters
  *
  * returns true if the wait list is not empty
  *
  * NOTE: this function is lockless and requires care, incorrect usage _will_
  * lead to sporadic and non-obvious failure.
  *
- * Use either while holding wait_queue_head_t::lock or when used for wakeups
+ * Use either while holding wait_queue_head::lock or when used for wakeups
  * with an extra smp_mb() like:
  *
  *      CPU0 - waker                    CPU1 - waiter
  *
  *                                      for (;;) {
- *      @cond = true;                     prepare_to_wait(&wq, &wait, state);
+ *      @cond = true;                     prepare_to_wait(&wq_head, &wait, state);
  *      smp_mb();                         // smp_mb() from set_current_state()
- *      if (waitqueue_active(wq))         if (@cond)
- *        wake_up(wq);                      break;
+ *      if (waitqueue_active(wq_head))         if (@cond)
+ *        wake_up(wq_head);                      break;
  *                                        schedule();
  *                                      }
- *                                      finish_wait(&wq, &wait);
+ *                                      finish_wait(&wq_head, &wait);
  *
  * Because without the explicit smp_mb() it's possible for the
  * waitqueue_active() load to get hoisted over the @cond store such that we'll
@@ -133,20 +119,20 @@ init_waitqueue_func_entry(wait_queue_t *q, wait_queue_func_t func)
  * Also note that this 'optimization' trades a spin_lock() for an smp_mb(),
  * which (when the lock is uncontended) are of roughly equal cost.
  */
-static inline int waitqueue_active(wait_queue_head_t *q)
+static inline int waitqueue_active(struct wait_queue_head *wq_head)
 {
-        return !list_empty(&q->task_list);
+        return !list_empty(&wq_head->head);
 }
 
 /**
  * wq_has_sleeper - check if there are any waiting processes
- * @wq: wait queue head
+ * @wq_head: wait queue head
  *
- * Returns true if wq has waiting processes
+ * Returns true if wq_head has waiting processes
  *
  * Please refer to the comment for waitqueue_active.
  */
-static inline bool wq_has_sleeper(wait_queue_head_t *wq)
+static inline bool wq_has_sleeper(struct wait_queue_head *wq_head)
 {
         /*
          * We need to be sure we are in sync with the
@@ -156,63 +142,51 @@ static inline bool wq_has_sleeper(wait_queue_head_t *wq)
          * waiting side.
          */
         smp_mb();
-        return waitqueue_active(wq);
+        return waitqueue_active(wq_head);
 }
 
-extern void add_wait_queue(wait_queue_head_t *q, wait_queue_t *wait);
-extern void add_wait_queue_exclusive(wait_queue_head_t *q, wait_queue_t *wait);
-extern void remove_wait_queue(wait_queue_head_t *q, wait_queue_t *wait);
+extern void add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
+extern void add_wait_queue_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
+extern void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
 
-static inline void __add_wait_queue(wait_queue_head_t *head, wait_queue_t *new)
+static inline void __add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
-        list_add(&new->task_list, &head->task_list);
+        list_add(&wq_entry->entry, &wq_head->head);
 }
 
 /*
  * Used for wake-one threads:
  */
 static inline void
-__add_wait_queue_exclusive(wait_queue_head_t *q, wait_queue_t *wait)
+__add_wait_queue_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
-        wait->flags |= WQ_FLAG_EXCLUSIVE;
-        __add_wait_queue(q, wait);
+        wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
+        __add_wait_queue(wq_head, wq_entry);
 }
 
-static inline void __add_wait_queue_tail(wait_queue_head_t *head,
-                                         wait_queue_t *new)
+static inline void __add_wait_queue_entry_tail(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
-        list_add_tail(&new->task_list, &head->task_list);
+        list_add_tail(&wq_entry->entry, &wq_head->head);
 }
 
 static inline void
-__add_wait_queue_tail_exclusive(wait_queue_head_t *q, wait_queue_t *wait)
+__add_wait_queue_entry_tail_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
-        wait->flags |= WQ_FLAG_EXCLUSIVE;
-        __add_wait_queue_tail(q, wait);
+        wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
+        __add_wait_queue_entry_tail(wq_head, wq_entry);
 }
 
 static inline void
-__remove_wait_queue(wait_queue_head_t *head, wait_queue_t *old)
+__remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
-        list_del(&old->task_list);
+        list_del(&wq_entry->entry);
 }
 
-typedef int wait_bit_action_f(struct wait_bit_key *, int mode);
-void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
-void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key);
-void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
-void __wake_up_locked(wait_queue_head_t *q, unsigned int mode, int nr);
-void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr);
-void __wake_up_bit(wait_queue_head_t *, void *, int);
-int __wait_on_bit(wait_queue_head_t *, struct wait_bit_queue *, wait_bit_action_f *, unsigned);
-int __wait_on_bit_lock(wait_queue_head_t *, struct wait_bit_queue *, wait_bit_action_f *, unsigned);
-void wake_up_bit(void *, int);
-void wake_up_atomic_t(atomic_t *);
-int out_of_line_wait_on_bit(void *, int, wait_bit_action_f *, unsigned);
-int out_of_line_wait_on_bit_timeout(void *, int, wait_bit_action_f *, unsigned, unsigned long);
-int out_of_line_wait_on_bit_lock(void *, int, wait_bit_action_f *, unsigned);
-int out_of_line_wait_on_atomic_t(atomic_t *, int (*)(atomic_t *), unsigned);
-wait_queue_head_t *bit_waitqueue(void *, int);
+void __wake_up(struct wait_queue_head *wq_head, unsigned int mode, int nr, void *key);
+void __wake_up_locked_key(struct wait_queue_head *wq_head, unsigned int mode, void *key);
+void __wake_up_sync_key(struct wait_queue_head *wq_head, unsigned int mode, int nr, void *key);
+void __wake_up_locked(struct wait_queue_head *wq_head, unsigned int mode, int nr);
+void __wake_up_sync(struct wait_queue_head *wq_head, unsigned int mode, int nr);
 
 #define wake_up(x)                      __wake_up(x, TASK_NORMAL, 1, NULL)
 #define wake_up_nr(x, nr)               __wake_up(x, TASK_NORMAL, nr, NULL)
@@ -228,28 +202,28 @@ wait_queue_head_t *bit_waitqueue(void *, int);
 /*
  * Wakeup macros to be used to report events to the targets.
  */
-#define wake_up_poll(x, m)                                              \
+#define wake_up_poll(x, m)                                                      \
         __wake_up(x, TASK_NORMAL, 1, (void *) (m))
-#define wake_up_locked_poll(x, m)                                       \
+#define wake_up_locked_poll(x, m)                                               \
         __wake_up_locked_key((x), TASK_NORMAL, (void *) (m))
-#define wake_up_interruptible_poll(x, m)                                \
+#define wake_up_interruptible_poll(x, m)                                        \
         __wake_up(x, TASK_INTERRUPTIBLE, 1, (void *) (m))
-#define wake_up_interruptible_sync_poll(x, m)                           \
+#define wake_up_interruptible_sync_poll(x, m)                                   \
         __wake_up_sync_key((x), TASK_INTERRUPTIBLE, 1, (void *) (m))
 
-#define ___wait_cond_timeout(condition)                                 \
-({                                                                      \
-        bool __cond = (condition);                                      \
-        if (__cond && !__ret)                                           \
-                __ret = 1;                                              \
-        __cond || !__ret;                                               \
+#define ___wait_cond_timeout(condition)                                         \
+({                                                                              \
+        bool __cond = (condition);                                              \
+        if (__cond && !__ret)                                                   \
+                __ret = 1;                                                      \
+        __cond || !__ret;                                                       \
 })
 
-#define ___wait_is_interruptible(state)                                 \
-        (!__builtin_constant_p(state) ||                                \
-                state == TASK_INTERRUPTIBLE || state == TASK_KILLABLE)  \
+#define ___wait_is_interruptible(state)                                         \
+        (!__builtin_constant_p(state) ||                                        \
+                state == TASK_INTERRUPTIBLE || state == TASK_KILLABLE)          \
 
-extern void init_wait_entry(wait_queue_t *__wait, int flags);
+extern void init_wait_entry(struct wait_queue_entry *wq_entry, int flags);
 
 /*
  * The below macro ___wait_event() has an explicit shadow of the __ret
@@ -263,108 +237,108 @@ extern void init_wait_entry(wait_queue_t *__wait, int flags);
  * otherwise.
  */
 
-#define ___wait_event(wq, condition, state, exclusive, ret, cmd)        \
-({                                                                      \
-        __label__ __out;                                                \
-        wait_queue_t __wait;                                            \
-        long __ret = ret;       /* explicit shadow */                   \
-                                                                        \
-        init_wait_entry(&__wait, exclusive ? WQ_FLAG_EXCLUSIVE : 0);    \
-        for (;;) {                                                      \
-                long __int = prepare_to_wait_event(&wq, &__wait, state);\
-                                                                        \
-                if (condition)                                          \
-                        break;                                          \
-                                                                        \
-                if (___wait_is_interruptible(state) && __int) {         \
-                        __ret = __int;                                  \
-                        goto __out;                                     \
-                }                                                       \
-                                                                        \
-                cmd;                                                    \
-        }                                                               \
-        finish_wait(&wq, &__wait);                                      \
-__out:  __ret;                                                          \
+#define ___wait_event(wq_head, condition, state, exclusive, ret, cmd)           \
+({                                                                              \
+        __label__ __out;                                                        \
+        struct wait_queue_entry __wq_entry;                                     \
+        long __ret = ret;       /* explicit shadow */                           \
+                                                                                \
+        init_wait_entry(&__wq_entry, exclusive ? WQ_FLAG_EXCLUSIVE : 0);        \
+        for (;;) {                                                              \
+                long __int = prepare_to_wait_event(&wq_head, &__wq_entry, state);\
+                                                                                \
+                if (condition)                                                  \
+                        break;                                                  \
+                                                                                \
+                if (___wait_is_interruptible(state) && __int) {                 \
+                        __ret = __int;                                          \
+                        goto __out;                                             \
+                }                                                               \
+                                                                                \
+                cmd;                                                            \
+        }                                                                       \
+        finish_wait(&wq_head, &__wq_entry);                                     \
+__out:  __ret;                                                                  \
 })
 
-#define __wait_event(wq, condition)                                     \
-        (void)___wait_event(wq, condition, TASK_UNINTERRUPTIBLE, 0, 0,  \
+#define __wait_event(wq_head, condition)                                        \
+        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
                             schedule())
 
 /**
  * wait_event - sleep until a condition gets true
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  *
  * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
  * @condition evaluates to true. The @condition is checked each time
- * the waitqueue @wq is woken up.
+ * the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
  */
-#define wait_event(wq, condition)                                       \
-do {                                                                    \
-        might_sleep();                                                  \
-        if (condition)                                                  \
-                break;                                                  \
-        __wait_event(wq, condition);                                    \
+#define wait_event(wq_head, condition)                                          \
+do {                                                                            \
+        might_sleep();                                                          \
+        if (condition)                                                          \
+                break;                                                          \
+        __wait_event(wq_head, condition);                                       \
 } while (0)
 
-#define __io_wait_event(wq, condition)                                  \
-        (void)___wait_event(wq, condition, TASK_UNINTERRUPTIBLE, 0, 0,  \
+#define __io_wait_event(wq_head, condition)                                     \
+        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
                             io_schedule())
 
 /*
  * io_wait_event() -- like wait_event() but with io_schedule()
  */
-#define io_wait_event(wq, condition)                                    \
-do {                                                                    \
-        might_sleep();                                                  \
-        if (condition)                                                  \
-                break;                                                  \
-        __io_wait_event(wq, condition);                                 \
+#define io_wait_event(wq_head, condition)                                       \
+do {                                                                            \
+        might_sleep();                                                          \
+        if (condition)                                                          \
+                break;                                                          \
+        __io_wait_event(wq_head, condition);                                    \
 } while (0)
 
-#define __wait_event_freezable(wq, condition)                           \
-        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 0, 0,          \
+#define __wait_event_freezable(wq_head, condition)                              \
+        ___wait_event(wq_head, condition, TASK_INTERRUPTIBLE, 0, 0,             \
                             schedule(); try_to_freeze())
 
 /**
  * wait_event_freezable - sleep (or freeze) until a condition gets true
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE -- so as not to contribute
  * to system load) until the @condition evaluates to true. The
- * @condition is checked each time the waitqueue @wq is woken up.
+ * @condition is checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
  */
-#define wait_event_freezable(wq, condition)                             \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_freezable(wq, condition);          \
-        __ret;                                                          \
+#define wait_event_freezable(wq_head, condition)                                \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_freezable(wq_head, condition);             \
+        __ret;                                                                  \
 })
 
-#define __wait_event_timeout(wq, condition, timeout)                    \
-        ___wait_event(wq, ___wait_cond_timeout(condition),              \
-                      TASK_UNINTERRUPTIBLE, 0, timeout,                 \
+#define __wait_event_timeout(wq_head, condition, timeout)                       \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_UNINTERRUPTIBLE, 0, timeout,                         \
                       __ret = schedule_timeout(__ret))
 
 /**
  * wait_event_timeout - sleep until a condition gets true or a timeout elapses
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @timeout: timeout, in jiffies
  *
  * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
  * @condition evaluates to true. The @condition is checked each time
- * the waitqueue @wq is woken up.
+ * the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -375,83 +349,83 @@ do {									\
  * or the remaining jiffies (at least 1) if the @condition evaluated
  * to %true before the @timeout elapsed.
  */
-#define wait_event_timeout(wq, condition, timeout)                      \
-({                                                                      \
-        long __ret = timeout;                                           \
-        might_sleep();                                                  \
-        if (!___wait_cond_timeout(condition))                           \
-                __ret = __wait_event_timeout(wq, condition, timeout);   \
-        __ret;                                                          \
+#define wait_event_timeout(wq_head, condition, timeout)                         \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_timeout(wq_head, condition, timeout);      \
+        __ret;                                                                  \
 })
 
-#define __wait_event_freezable_timeout(wq, condition, timeout)          \
-        ___wait_event(wq, ___wait_cond_timeout(condition),              \
-                      TASK_INTERRUPTIBLE, 0, timeout,                   \
+#define __wait_event_freezable_timeout(wq_head, condition, timeout)             \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_INTERRUPTIBLE, 0, timeout,                           \
                       __ret = schedule_timeout(__ret); try_to_freeze())
 
 /*
  * like wait_event_timeout() -- except it uses TASK_INTERRUPTIBLE to avoid
  * increasing load and is freezable.
  */
-#define wait_event_freezable_timeout(wq, condition, timeout)            \
-({                                                                      \
-        long __ret = timeout;                                           \
-        might_sleep();                                                  \
-        if (!___wait_cond_timeout(condition))                           \
-                __ret = __wait_event_freezable_timeout(wq, condition, timeout); \
-        __ret;                                                          \
+#define wait_event_freezable_timeout(wq_head, condition, timeout)               \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_freezable_timeout(wq_head, condition, timeout); \
+        __ret;                                                                  \
 })
 
-#define __wait_event_exclusive_cmd(wq, condition, cmd1, cmd2)           \
-        (void)___wait_event(wq, condition, TASK_UNINTERRUPTIBLE, 1, 0,  \
+#define __wait_event_exclusive_cmd(wq_head, condition, cmd1, cmd2)              \
+        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 1, 0,     \
                             cmd1; schedule(); cmd2)
 /*
  * Just like wait_event_cmd(), except it sets exclusive flag
  */
-#define wait_event_exclusive_cmd(wq, condition, cmd1, cmd2)             \
-do {                                                                    \
-        if (condition)                                                  \
-                break;                                                  \
-        __wait_event_exclusive_cmd(wq, condition, cmd1, cmd2);          \
+#define wait_event_exclusive_cmd(wq_head, condition, cmd1, cmd2)                \
+do {                                                                            \
+        if (condition)                                                          \
+                break;                                                          \
+        __wait_event_exclusive_cmd(wq_head, condition, cmd1, cmd2);             \
 } while (0)
 
-#define __wait_event_cmd(wq, condition, cmd1, cmd2)                     \
-        (void)___wait_event(wq, condition, TASK_UNINTERRUPTIBLE, 0, 0,  \
+#define __wait_event_cmd(wq_head, condition, cmd1, cmd2)                        \
+        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
                             cmd1; schedule(); cmd2)
 
 /**
  * wait_event_cmd - sleep until a condition gets true
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @cmd1: the command will be executed before sleep
  * @cmd2: the command will be executed after sleep
  *
  * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
  * @condition evaluates to true. The @condition is checked each time
- * the waitqueue @wq is woken up.
+ * the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
  */
-#define wait_event_cmd(wq, condition, cmd1, cmd2)                       \
-do {                                                                    \
-        if (condition)                                                  \
-                break;                                                  \
-        __wait_event_cmd(wq, condition, cmd1, cmd2);                    \
+#define wait_event_cmd(wq_head, condition, cmd1, cmd2)                          \
+do {                                                                            \
+        if (condition)                                                          \
+                break;                                                          \
+        __wait_event_cmd(wq_head, condition, cmd1, cmd2);                       \
 } while (0)
 
-#define __wait_event_interruptible(wq, condition)                       \
-        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 0, 0,          \
+#define __wait_event_interruptible(wq_head, condition)                          \
+        ___wait_event(wq_head, condition, TASK_INTERRUPTIBLE, 0, 0,             \
                       schedule())
 
 /**
  * wait_event_interruptible - sleep until a condition gets true
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE) until the
  * @condition evaluates to true or a signal is received.
- * The @condition is checked each time the waitqueue @wq is woken up.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -459,29 +433,29 @@ do {									\
  * The function will return -ERESTARTSYS if it was interrupted by a
  * signal and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible(wq, condition)                         \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_interruptible(wq, condition);      \
-        __ret;                                                          \
+#define wait_event_interruptible(wq_head, condition)                            \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_interruptible(wq_head, condition);         \
+        __ret;                                                                  \
 })
 
-#define __wait_event_interruptible_timeout(wq, condition, timeout)      \
-        ___wait_event(wq, ___wait_cond_timeout(condition),              \
-                      TASK_INTERRUPTIBLE, 0, timeout,                   \
+#define __wait_event_interruptible_timeout(wq_head, condition, timeout)         \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_INTERRUPTIBLE, 0, timeout,                           \
                       __ret = schedule_timeout(__ret))
 
 /**
  * wait_event_interruptible_timeout - sleep until a condition gets true or a timeout elapses
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @timeout: timeout, in jiffies
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE) until the
  * @condition evaluates to true or a signal is received.
- * The @condition is checked each time the waitqueue @wq is woken up.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -493,50 +467,49 @@ do {									\
  * to %true before the @timeout elapsed, or -%ERESTARTSYS if it was
  * interrupted by a signal.
  */
-#define wait_event_interruptible_timeout(wq, condition, timeout)        \
-({                                                                      \
-        long __ret = timeout;                                           \
-        might_sleep();                                                  \
-        if (!___wait_cond_timeout(condition))                           \
-                __ret = __wait_event_interruptible_timeout(wq,          \
-                                                condition, timeout);    \
-        __ret;                                                          \
+#define wait_event_interruptible_timeout(wq_head, condition, timeout)           \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_interruptible_timeout(wq_head,             \
+                                                condition, timeout);            \
+        __ret;                                                                  \
 })
 
-#define __wait_event_hrtimeout(wq, condition, timeout, state)           \
-({                                                                      \
-        int __ret = 0;                                                  \
-        struct hrtimer_sleeper __t;                                     \
-                                                                        \
-        hrtimer_init_on_stack(&__t.timer, CLOCK_MONOTONIC,              \
-                              HRTIMER_MODE_REL);                        \
-        hrtimer_init_sleeper(&__t, current);                            \
-        if ((timeout) != KTIME_MAX)                             \
-                hrtimer_start_range_ns(&__t.timer, timeout,             \
-                                       current->timer_slack_ns,         \
-                                       HRTIMER_MODE_REL);               \
-                                                                        \
-        __ret = ___wait_event(wq, condition, state, 0, 0,               \
-                if (!__t.task) {                                        \
-                        __ret = -ETIME;                                 \
-                        break;                                          \
-                }                                                       \
-                schedule());                                            \
-                                                                        \
-        hrtimer_cancel(&__t.timer);                                     \
-        destroy_hrtimer_on_stack(&__t.timer);                           \
-        __ret;                                                          \
+#define __wait_event_hrtimeout(wq_head, condition, timeout, state)              \
+({                                                                              \
+        int __ret = 0;                                                          \
+        struct hrtimer_sleeper __t;                                             \
+                                                                                \
+        hrtimer_init_on_stack(&__t.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);   \
+        hrtimer_init_sleeper(&__t, current);                                    \
+        if ((timeout) != KTIME_MAX)                                             \
+                hrtimer_start_range_ns(&__t.timer, timeout,                     \
+                                       current->timer_slack_ns,                 \
+                                       HRTIMER_MODE_REL);                       \
+                                                                                \
+        __ret = ___wait_event(wq_head, condition, state, 0, 0,                  \
+                if (!__t.task) {                                                \
+                        __ret = -ETIME;                                         \
+                        break;                                                  \
+                }                                                               \
+                schedule());                                                    \
+                                                                                \
+        hrtimer_cancel(&__t.timer);                                             \
+        destroy_hrtimer_on_stack(&__t.timer);                                   \
+        __ret;                                                                  \
 })
 
 /**
  * wait_event_hrtimeout - sleep until a condition gets true or a timeout elapses
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @timeout: timeout, as a ktime_t
  *
  * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
  * @condition evaluates to true or a signal is received.
- * The @condition is checked each time the waitqueue @wq is woken up.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -544,25 +517,25 @@ do {									\
  * The function returns 0 if @condition became true, or -ETIME if the timeout
  * elapsed.
  */
-#define wait_event_hrtimeout(wq, condition, timeout)                    \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_hrtimeout(wq, condition, timeout,  \
-                                               TASK_UNINTERRUPTIBLE);   \
-        __ret;                                                          \
+#define wait_event_hrtimeout(wq_head, condition, timeout)                       \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_hrtimeout(wq_head, condition, timeout,     \
+                                               TASK_UNINTERRUPTIBLE);           \
+        __ret;                                                                  \
 })
 
 /**
  * wait_event_interruptible_hrtimeout - sleep until a condition gets true or a timeout elapses
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @timeout: timeout, as a ktime_t
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE) until the
  * @condition evaluates to true or a signal is received.
- * The @condition is checked each time the waitqueue @wq is woken up.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -570,73 +543,73 @@ do {									\
  * The function returns 0 if @condition became true, -ERESTARTSYS if it was
  * interrupted by a signal, or -ETIME if the timeout elapsed.
  */
-#define wait_event_interruptible_hrtimeout(wq, condition, timeout)      \
-({                                                                      \
-        long __ret = 0;                                                 \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_hrtimeout(wq, condition, timeout,  \
-                                               TASK_INTERRUPTIBLE);     \
-        __ret;                                                          \
+#define wait_event_interruptible_hrtimeout(wq, condition, timeout)              \
+({                                                                              \
+        long __ret = 0;                                                         \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_hrtimeout(wq, condition, timeout,          \
+                                               TASK_INTERRUPTIBLE);             \
+        __ret;                                                                  \
 })
 
-#define __wait_event_interruptible_exclusive(wq, condition)             \
-        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 1, 0,          \
+#define __wait_event_interruptible_exclusive(wq, condition)                     \
+        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 1, 0,                  \
                       schedule())
 
-#define wait_event_interruptible_exclusive(wq, condition)               \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_interruptible_exclusive(wq, condition);\
-        __ret;                                                          \
+#define wait_event_interruptible_exclusive(wq, condition)                       \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_interruptible_exclusive(wq, condition);    \
+        __ret;                                                                  \
 })
 
-#define __wait_event_killable_exclusive(wq, condition)                  \
-        ___wait_event(wq, condition, TASK_KILLABLE, 1, 0,               \
+#define __wait_event_killable_exclusive(wq, condition)                          \
+        ___wait_event(wq, condition, TASK_KILLABLE, 1, 0,                       \
                       schedule())
 
-#define wait_event_killable_exclusive(wq, condition)                    \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_killable_exclusive(wq, condition); \
-        __ret;                                                          \
+#define wait_event_killable_exclusive(wq, condition)                            \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_killable_exclusive(wq, condition);         \
+        __ret;                                                                  \
 })
 
 
-#define __wait_event_freezable_exclusive(wq, condition)                 \
-        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 1, 0,          \
+#define __wait_event_freezable_exclusive(wq, condition)                         \
+        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 1, 0,                  \
                         schedule(); try_to_freeze())
 
-#define wait_event_freezable_exclusive(wq, condition)                   \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_freezable_exclusive(wq, condition);\
-        __ret;                                                          \
+#define wait_event_freezable_exclusive(wq, condition)                           \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_freezable_exclusive(wq, condition);        \
+        __ret;                                                                  \
 })
 
-extern int do_wait_intr(wait_queue_head_t *, wait_queue_t *);
-extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
-
-#define __wait_event_interruptible_locked(wq, condition, exclusive, fn) \
-({                                                                      \
-        int __ret;                                                      \
-        DEFINE_WAIT(__wait);                                            \
-        if (exclusive)                                                  \
-                __wait.flags |= WQ_FLAG_EXCLUSIVE;                      \
-        do {                                                            \
-                __ret = fn(&(wq), &__wait);                             \
-                if (__ret)                                              \
-                        break;                                          \
-        } while (!(condition));                                         \
-        __remove_wait_queue(&(wq), &__wait);                            \
-        __set_current_state(TASK_RUNNING);                              \
-        __ret;                                                          \
+extern int do_wait_intr(wait_queue_head_t *, wait_queue_entry_t *);
+extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_entry_t *);
+
+#define __wait_event_interruptible_locked(wq, condition, exclusive, fn)         \
+({                                                                              \
+        int __ret;                                                              \
+        DEFINE_WAIT(__wait);                                                    \
+        if (exclusive)                                                          \
+                __wait.flags |= WQ_FLAG_EXCLUSIVE;                              \
+        do {                                                                    \
+                __ret = fn(&(wq), &__wait);                                     \
+                if (__ret)                                                      \
+                        break;                                                  \
+        } while (!(condition));                                                 \
+        __remove_wait_queue(&(wq), &__wait);                                    \
+        __set_current_state(TASK_RUNNING);                                      \
+        __ret;                                                                  \
 })
 
 
@@ -663,8 +636,8 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  * The function will return -ERESTARTSYS if it was interrupted by a
  * signal and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible_locked(wq, condition)                  \
-        ((condition)                                                    \
+#define wait_event_interruptible_locked(wq, condition)                          \
+        ((condition)                                                            \
          ? 0 : __wait_event_interruptible_locked(wq, condition, 0, do_wait_intr))
 
 /**
@@ -690,8 +663,8 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  * The function will return -ERESTARTSYS if it was interrupted by a
  * signal and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible_locked_irq(wq, condition)              \
-        ((condition)                                                    \
+#define wait_event_interruptible_locked_irq(wq, condition)                      \
+        ((condition)                                                            \
          ? 0 : __wait_event_interruptible_locked(wq, condition, 0, do_wait_intr_irq))
 
 /**
@@ -721,8 +694,8 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  * The function will return -ERESTARTSYS if it was interrupted by a
  * signal and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible_exclusive_locked(wq, condition)        \
-        ((condition)                                                    \
+#define wait_event_interruptible_exclusive_locked(wq, condition)                \
+        ((condition)                                                            \
          ? 0 : __wait_event_interruptible_locked(wq, condition, 1, do_wait_intr))
 
 /**
@@ -752,12 +725,12 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  * The function will return -ERESTARTSYS if it was interrupted by a
  * signal and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible_exclusive_locked_irq(wq, condition)    \
-        ((condition)                                                    \
+#define wait_event_interruptible_exclusive_locked_irq(wq, condition)            \
+        ((condition)                                                            \
          ? 0 : __wait_event_interruptible_locked(wq, condition, 1, do_wait_intr_irq))
 
 
-#define __wait_event_killable(wq, condition)                            \
+#define __wait_event_killable(wq, condition)                                    \
         ___wait_event(wq, condition, TASK_KILLABLE, 0, 0, schedule())
 
 /**
@@ -775,21 +748,21 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  * The function will return -ERESTARTSYS if it was interrupted by a
  * signal and 0 if @condition evaluated to true.
  */
-#define wait_event_killable(wq, condition)                              \
-({                                                                      \
-        int __ret = 0;                                                  \
-        might_sleep();                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_killable(wq, condition);           \
-        __ret;                                                          \
+#define wait_event_killable(wq_head, condition)                                 \
+({                                                                              \
+        int __ret = 0;                                                          \
+        might_sleep();                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_killable(wq_head, condition);              \
+        __ret;                                                                  \
 })
 
 
-#define __wait_event_lock_irq(wq, condition, lock, cmd)                 \
-        (void)___wait_event(wq, condition, TASK_UNINTERRUPTIBLE, 0, 0,  \
-                            spin_unlock_irq(&lock);                     \
-                            cmd;                                        \
-                            schedule();                                 \
+#define __wait_event_lock_irq(wq_head, condition, lock, cmd)                    \
+        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
+                            spin_unlock_irq(&lock);                             \
+                            cmd;                                                \
+                            schedule();                                         \
                             spin_lock_irq(&lock))
 
 /**
@@ -797,7 +770,7 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  *                           condition is checked under the lock. This
  *                           is expected to be called with the lock
  *                           taken.
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @lock: a locked spinlock_t, which will be released before cmd
  *        and schedule() and reacquired afterwards.
@@ -806,7 +779,7 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  *
  * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
  * @condition evaluates to true. The @condition is checked each time
- * the waitqueue @wq is woken up.
+ * the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -815,11 +788,11 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
  * dropped before invoking the cmd and going to sleep and is reacquired
  * afterwards.
  */
-#define wait_event_lock_irq_cmd(wq, condition, lock, cmd)               \
-do {                                                                    \
-        if (condition)                                                  \
-                break;                                                  \
-        __wait_event_lock_irq(wq, condition, lock, cmd);                \
+#define wait_event_lock_irq_cmd(wq_head, condition, lock, cmd)                  \
+do {                                                                            \
+        if (condition)                                                          \
+                break;                                                          \
+        __wait_event_lock_irq(wq_head, condition, lock, cmd);                   \
 } while (0)
 
 /**
@@ -827,14 +800,14 @@ do {									\
  *                       condition is checked under the lock. This
  *                       is expected to be called with the lock
  *                       taken.
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @lock: a locked spinlock_t, which will be released before schedule()
  *        and reacquired afterwards.
  *
  * The process is put to sleep (TASK_UNINTERRUPTIBLE) until the
  * @condition evaluates to true. The @condition is checked each time
- * the waitqueue @wq is woken up.
+ * the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -842,26 +815,26 @@ do {									\
  * This is supposed to be called while holding the lock. The lock is
  * dropped before going to sleep and is reacquired afterwards.
  */
-#define wait_event_lock_irq(wq, condition, lock)                        \
-do {                                                                    \
-        if (condition)                                                  \
-                break;                                                  \
-        __wait_event_lock_irq(wq, condition, lock, );                   \
+#define wait_event_lock_irq(wq_head, condition, lock)                           \
+do {                                                                            \
+        if (condition)                                                          \
+                break;                                                          \
+        __wait_event_lock_irq(wq_head, condition, lock, );                      \
 } while (0)
 
 
-#define __wait_event_interruptible_lock_irq(wq, condition, lock, cmd)   \
-        ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 0, 0,          \
-                      spin_unlock_irq(&lock);                           \
-                      cmd;                                              \
-                      schedule();                                       \
+#define __wait_event_interruptible_lock_irq(wq_head, condition, lock, cmd)      \
+        ___wait_event(wq_head, condition, TASK_INTERRUPTIBLE, 0, 0,             \
+                      spin_unlock_irq(&lock);                                   \
+                      cmd;                                                      \
+                      schedule();                                               \
                       spin_lock_irq(&lock))
 
 /**
  * wait_event_interruptible_lock_irq_cmd - sleep until a condition gets true.
  *              The condition is checked under the lock. This is expected to
  *              be called with the lock taken.
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @lock: a locked spinlock_t, which will be released before cmd and
  *        schedule() and reacquired afterwards.
@@ -870,7 +843,7 @@ do {									\
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE) until the
  * @condition evaluates to true or a signal is received. The @condition is
- * checked each time the waitqueue @wq is woken up.
+ * checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -882,27 +855,27 @@ do {									\
  * The macro will return -ERESTARTSYS if it was interrupted by a signal
  * and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible_lock_irq_cmd(wq, condition, lock, cmd) \
-({                                                                      \
-        int __ret = 0;                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_interruptible_lock_irq(wq,         \
-                                                condition, lock, cmd);  \
-        __ret;                                                          \
+#define wait_event_interruptible_lock_irq_cmd(wq_head, condition, lock, cmd)    \
+({                                                                              \
+        int __ret = 0;                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_interruptible_lock_irq(wq_head,            \
+                                                condition, lock, cmd);          \
+        __ret;                                                                  \
 })
 
 /**
  * wait_event_interruptible_lock_irq - sleep until a condition gets true.
  *              The condition is checked under the lock. This is expected
  *              to be called with the lock taken.
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @lock: a locked spinlock_t, which will be released before schedule()
  *        and reacquired afterwards.
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE) until the
  * @condition evaluates to true or signal is received. The @condition is
- * checked each time the waitqueue @wq is woken up.
+ * checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -913,28 +886,28 @@ do {									\
  * The macro will return -ERESTARTSYS if it was interrupted by a signal
  * and 0 if @condition evaluated to true.
  */
-#define wait_event_interruptible_lock_irq(wq, condition, lock)          \
-({                                                                      \
-        int __ret = 0;                                                  \
-        if (!(condition))                                               \
-                __ret = __wait_event_interruptible_lock_irq(wq,         \
-                                                condition, lock,);      \
-        __ret;                                                          \
+#define wait_event_interruptible_lock_irq(wq_head, condition, lock)             \
+({                                                                              \
+        int __ret = 0;                                                          \
+        if (!(condition))                                                       \
+                __ret = __wait_event_interruptible_lock_irq(wq_head,            \
+                                                condition, lock,);              \
+        __ret;                                                                  \
 })
 
-#define __wait_event_interruptible_lock_irq_timeout(wq, condition,      \
-                                                    lock, timeout)      \
-        ___wait_event(wq, ___wait_cond_timeout(condition),              \
-                      TASK_INTERRUPTIBLE, 0, timeout,                   \
-                      spin_unlock_irq(&lock);                           \
-                      __ret = schedule_timeout(__ret);                  \
+#define __wait_event_interruptible_lock_irq_timeout(wq_head, condition,         \
+                                                    lock, timeout)              \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_INTERRUPTIBLE, 0, timeout,                           \
+                      spin_unlock_irq(&lock);                                   \
+                      __ret = schedule_timeout(__ret);                          \
                       spin_lock_irq(&lock));
 
 /**
  * wait_event_interruptible_lock_irq_timeout - sleep until a condition gets
  *              true or a timeout elapses. The condition is checked under
  *              the lock. This is expected to be called with the lock taken.
- * @wq: the waitqueue to wait on
+ * @wq_head: the waitqueue to wait on
  * @condition: a C expression for the event to wait for
  * @lock: a locked spinlock_t, which will be released before schedule()
  *        and reacquired afterwards.
@@ -942,7 +915,7 @@ do {									\
  *
  * The process is put to sleep (TASK_INTERRUPTIBLE) until the
  * @condition evaluates to true or signal is received. The @condition is
- * checked each time the waitqueue @wq is woken up.
+ * checked each time the waitqueue @wq_head is woken up.
  *
  * wake_up() has to be called after changing any variable that could
  * change the result of the wait condition.
@@ -954,263 +927,42 @@ do {									\
  * was interrupted by a signal, and the remaining jiffies otherwise
  * if the condition evaluated to true before the timeout elapsed.
  */
-#define wait_event_interruptible_lock_irq_timeout(wq, condition, lock,  \
-                                                  timeout)              \
-({                                                                      \
-        long __ret = timeout;                                           \
-        if (!___wait_cond_timeout(condition))                           \
-                __ret = __wait_event_interruptible_lock_irq_timeout(    \
-                                        wq, condition, lock, timeout);  \
-        __ret;                                                          \
+#define wait_event_interruptible_lock_irq_timeout(wq_head, condition, lock,     \
+                                                  timeout)                      \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_interruptible_lock_irq_timeout(            \
+                                        wq_head, condition, lock, timeout);     \
+        __ret;                                                                  \
 })
 
 /*
  * Waitqueues which are removed from the waitqueue_head at wakeup time
  */
-void prepare_to_wait(wait_queue_head_t *q, wait_queue_t *wait, int state);
-void prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state);
-long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state);
-void finish_wait(wait_queue_head_t *q, wait_queue_t *wait);
-long wait_woken(wait_queue_t *wait, unsigned mode, long timeout);
-int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
-int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
-int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
-
-#define DEFINE_WAIT_FUNC(name, function)                                \
-        wait_queue_t name = {                                           \
-                .private        = current,                              \
-                .func           = function,                             \
-                .task_list      = LIST_HEAD_INIT((name).task_list),     \
+void prepare_to_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
+void prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
+long prepare_to_wait_event(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
+void finish_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
+long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout);
+int woken_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key);
+int autoremove_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key);
+
+#define DEFINE_WAIT_FUNC(name, function)                                        \
+        struct wait_queue_entry name = {                                        \
+                .private        = current,                                      \
+                .func           = function,                                     \
+                .entry          = LIST_HEAD_INIT((name).entry),                 \
         }
 
 #define DEFINE_WAIT(name) DEFINE_WAIT_FUNC(name, autoremove_wake_function)
 
-#define DEFINE_WAIT_BIT(name, word, bit)                                \
-        struct wait_bit_queue name = {                                  \
-                .key = __WAIT_BIT_KEY_INITIALIZER(word, bit),           \
-                .wait   = {                                             \
-                        .private        = current,                      \
-                        .func           = wake_bit_function,            \
-                        .task_list      =                               \
-                                LIST_HEAD_INIT((name).wait.task_list),  \
-                },                                                      \
-        }
-
-#define init_wait(wait)                                                 \
-        do {                                                            \
-                (wait)->private = current;                              \
-                (wait)->func = autoremove_wake_function;                \
-                INIT_LIST_HEAD(&(wait)->task_list);                     \
-                (wait)->flags = 0;                                      \
+#define init_wait(wait)                                                         \
+        do {                                                                    \
+                (wait)->private = current;                                      \
+                (wait)->func = autoremove_wake_function;                        \
+                INIT_LIST_HEAD(&(wait)->entry);                                 \
+                (wait)->flags = 0;                                              \
         } while (0)
 
-
-extern int bit_wait(struct wait_bit_key *, int);
-extern int bit_wait_io(struct wait_bit_key *, int);
-extern int bit_wait_timeout(struct wait_bit_key *, int);
-extern int bit_wait_io_timeout(struct wait_bit_key *, int);
-
-/**
- * wait_on_bit - wait for a bit to be cleared
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @mode: the task state to sleep in
- *
- * There is a standard hashed waitqueue table for generic use. This
- * is the part of the hashtable's accessor API that waits on a bit.
- * For instance, if one were to have waiters on a bitflag, one would
- * call wait_on_bit() in threads waiting for the bit to clear.
- * One uses wait_on_bit() where one is waiting for the bit to clear,
- * but has no intention of setting it.
- * Returned value will be zero if the bit was cleared, or non-zero
- * if the process received a signal and the mode permitted wakeup
- * on that signal.
- */
-static inline int
-wait_on_bit(unsigned long *word, int bit, unsigned mode)
-{
-        might_sleep();
-        if (!test_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit(word, bit,
-                                       bit_wait,
-                                       mode);
-}
-
-/**
- * wait_on_bit_io - wait for a bit to be cleared
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @mode: the task state to sleep in
- *
- * Use the standard hashed waitqueue table to wait for a bit
- * to be cleared.  This is similar to wait_on_bit(), but calls
- * io_schedule() instead of schedule() for the actual waiting.
- *
- * Returned value will be zero if the bit was cleared, or non-zero
- * if the process received a signal and the mode permitted wakeup
- * on that signal.
- */
-static inline int
-wait_on_bit_io(unsigned long *word, int bit, unsigned mode)
-{
-        might_sleep();
-        if (!test_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit(word, bit,
-                                       bit_wait_io,
-                                       mode);
-}
-
-/**
- * wait_on_bit_timeout - wait for a bit to be cleared or a timeout elapses
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @mode: the task state to sleep in
- * @timeout: timeout, in jiffies
- *
- * Use the standard hashed waitqueue table to wait for a bit
- * to be cleared. This is similar to wait_on_bit(), except also takes a
- * timeout parameter.
- *
- * Returned value will be zero if the bit was cleared before the
- * @timeout elapsed, or non-zero if the @timeout elapsed or process
- * received a signal and the mode permitted wakeup on that signal.
- */
-static inline int
-wait_on_bit_timeout(unsigned long *word, int bit, unsigned mode,
-                    unsigned long timeout)
-{
-        might_sleep();
-        if (!test_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit_timeout(word, bit,
-                                               bit_wait_timeout,
-                                               mode, timeout);
-}
-
-/**
- * wait_on_bit_action - wait for a bit to be cleared
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @action: the function used to sleep, which may take special actions
- * @mode: the task state to sleep in
- *
- * Use the standard hashed waitqueue table to wait for a bit
- * to be cleared, and allow the waiting action to be specified.
- * This is like wait_on_bit() but allows fine control of how the waiting
- * is done.
- *
- * Returned value will be zero if the bit was cleared, or non-zero
- * if the process received a signal and the mode permitted wakeup
- * on that signal.
- */
-static inline int
-wait_on_bit_action(unsigned long *word, int bit, wait_bit_action_f *action,
-                   unsigned mode)
-{
-        might_sleep();
-        if (!test_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit(word, bit, action, mode);
-}
-
-/**
- * wait_on_bit_lock - wait for a bit to be cleared, when wanting to set it
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @mode: the task state to sleep in
- *
- * There is a standard hashed waitqueue table for generic use. This
- * is the part of the hashtable's accessor API that waits on a bit
- * when one intends to set it, for instance, trying to lock bitflags.
- * For instance, if one were to have waiters trying to set bitflag
- * and waiting for it to clear before setting it, one would call
- * wait_on_bit() in threads waiting to be able to set the bit.
- * One uses wait_on_bit_lock() where one is waiting for the bit to
- * clear with the intention of setting it, and when done, clearing it.
- *
- * Returns zero if the bit was (eventually) found to be clear and was
- * set.  Returns non-zero if a signal was delivered to the process and
- * the @mode allows that signal to wake the process.
- */
-static inline int
-wait_on_bit_lock(unsigned long *word, int bit, unsigned mode)
-{
-        might_sleep();
-        if (!test_and_set_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit_lock(word, bit, bit_wait, mode);
-}
-
-/**
- * wait_on_bit_lock_io - wait for a bit to be cleared, when wanting to set it
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @mode: the task state to sleep in
- *
- * Use the standard hashed waitqueue table to wait for a bit
- * to be cleared and then to atomically set it.  This is similar
- * to wait_on_bit(), but calls io_schedule() instead of schedule()
- * for the actual waiting.
- *
- * Returns zero if the bit was (eventually) found to be clear and was
- * set.  Returns non-zero if a signal was delivered to the process and
- * the @mode allows that signal to wake the process.
- */
-static inline int
-wait_on_bit_lock_io(unsigned long *word, int bit, unsigned mode)
-{
-        might_sleep();
-        if (!test_and_set_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit_lock(word, bit, bit_wait_io, mode);
-}
-
-/**
- * wait_on_bit_lock_action - wait for a bit to be cleared, when wanting to set it
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- * @action: the function used to sleep, which may take special actions
- * @mode: the task state to sleep in
- *
- * Use the standard hashed waitqueue table to wait for a bit
- * to be cleared and then to set it, and allow the waiting action
- * to be specified.
- * This is like wait_on_bit() but allows fine control of how the waiting
- * is done.
- *
- * Returns zero if the bit was (eventually) found to be clear and was
- * set.  Returns non-zero if a signal was delivered to the process and
- * the @mode allows that signal to wake the process.
- */
-static inline int
-wait_on_bit_lock_action(unsigned long *word, int bit, wait_bit_action_f *action,
-                        unsigned mode)
-{
-        might_sleep();
-        if (!test_and_set_bit(bit, word))
-                return 0;
-        return out_of_line_wait_on_bit_lock(word, bit, action, mode);
-}
-
-/**
- * wait_on_atomic_t - Wait for an atomic_t to become 0
- * @val: The atomic value being waited on, a kernel virtual address
- * @action: the function used to sleep, which may take special actions
- * @mode: the task state to sleep in
- *
- * Wait for an atomic_t to become 0.  We abuse the bit-wait waitqueue table for
- * the purpose of getting a waitqueue, but we set the key to a bit number
- * outside of the target 'word'.
- */
-static inline
-int wait_on_atomic_t(atomic_t *val, int (*action)(atomic_t *), unsigned mode)
-{
-        might_sleep();
-        if (atomic_read(val) == 0)
-                return 0;
-        return out_of_line_wait_on_atomic_t(val, action, mode);
-}
-
 #endif /* _LINUX_WAIT_H */
diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h
new file mode 100644
index 000000000000..12b26660d7e9
--- /dev/null
+++ b/include/linux/wait_bit.h
@@ -0,0 +1,261 @@
+#ifndef _LINUX_WAIT_BIT_H
+#define _LINUX_WAIT_BIT_H
+
+/*
+ * Linux wait-bit related types and methods:
+ */
+#include <linux/wait.h>
+
+struct wait_bit_key {
+        void                    *flags;
+        int                     bit_nr;
+#define WAIT_ATOMIC_T_BIT_NR    -1
+        unsigned long           timeout;
+};
+
+struct wait_bit_queue_entry {
+        struct wait_bit_key     key;
+        struct wait_queue_entry wq_entry;
+};
+
+#define __WAIT_BIT_KEY_INITIALIZER(word, bit)                                   \
+        { .flags = word, .bit_nr = bit, }
+
+#define __WAIT_ATOMIC_T_KEY_INITIALIZER(p)                                      \
+        { .flags = p, .bit_nr = WAIT_ATOMIC_T_BIT_NR, }
+
+typedef int wait_bit_action_f(struct wait_bit_key *key, int mode);
+void __wake_up_bit(struct wait_queue_head *wq_head, void *word, int bit);
+int __wait_on_bit(struct wait_queue_head *wq_head, struct wait_bit_queue_entry *wbq_entry, wait_bit_action_f *action, unsigned int mode);
+int __wait_on_bit_lock(struct wait_queue_head *wq_head, struct wait_bit_queue_entry *wbq_entry, wait_bit_action_f *action, unsigned int mode);
+void wake_up_bit(void *word, int bit);
+void wake_up_atomic_t(atomic_t *p);
+int out_of_line_wait_on_bit(void *word, int, wait_bit_action_f *action, unsigned int mode);
+int out_of_line_wait_on_bit_timeout(void *word, int, wait_bit_action_f *action, unsigned int mode, unsigned long timeout);
+int out_of_line_wait_on_bit_lock(void *word, int, wait_bit_action_f *action, unsigned int mode);
+int out_of_line_wait_on_atomic_t(atomic_t *p, int (*)(atomic_t *), unsigned int mode);
+struct wait_queue_head *bit_waitqueue(void *word, int bit);
+extern void __init wait_bit_init(void);
+
+int wake_bit_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key);
+
+#define DEFINE_WAIT_BIT(name, word, bit)                                        \
+        struct wait_bit_queue_entry name = {                                    \
+                .key = __WAIT_BIT_KEY_INITIALIZER(word, bit),                   \
+                .wq_entry = {                                                   \
+                        .private        = current,                              \
+                        .func           = wake_bit_function,                    \
+                        .entry          =                                       \
+                                LIST_HEAD_INIT((name).wq_entry.entry),          \
+                },                                                              \
+        }
+
+extern int bit_wait(struct wait_bit_key *key, int bit);
+extern int bit_wait_io(struct wait_bit_key *key, int bit);
+extern int bit_wait_timeout(struct wait_bit_key *key, int bit);
+extern int bit_wait_io_timeout(struct wait_bit_key *key, int bit);
+
+/**
+ * wait_on_bit - wait for a bit to be cleared
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @mode: the task state to sleep in
+ *
+ * There is a standard hashed waitqueue table for generic use. This
+ * is the part of the hashtable's accessor API that waits on a bit.
+ * For instance, if one were to have waiters on a bitflag, one would
+ * call wait_on_bit() in threads waiting for the bit to clear.
+ * One uses wait_on_bit() where one is waiting for the bit to clear,
+ * but has no intention of setting it.
+ * Returned value will be zero if the bit was cleared, or non-zero
+ * if the process received a signal and the mode permitted wakeup
+ * on that signal.
+ */
+static inline int
+wait_on_bit(unsigned long *word, int bit, unsigned mode)
+{
+        might_sleep();
+        if (!test_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit(word, bit,
+                                       bit_wait,
+                                       mode);
+}
+
+/**
+ * wait_on_bit_io - wait for a bit to be cleared
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @mode: the task state to sleep in
+ *
+ * Use the standard hashed waitqueue table to wait for a bit
+ * to be cleared.  This is similar to wait_on_bit(), but calls
+ * io_schedule() instead of schedule() for the actual waiting.
+ *
+ * Returned value will be zero if the bit was cleared, or non-zero
+ * if the process received a signal and the mode permitted wakeup
+ * on that signal.
+ */
+static inline int
+wait_on_bit_io(unsigned long *word, int bit, unsigned mode)
+{
+        might_sleep();
+        if (!test_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit(word, bit,
+                                       bit_wait_io,
+                                       mode);
+}
+
+/**
+ * wait_on_bit_timeout - wait for a bit to be cleared or a timeout elapses
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @mode: the task state to sleep in
+ * @timeout: timeout, in jiffies
+ *
+ * Use the standard hashed waitqueue table to wait for a bit
+ * to be cleared. This is similar to wait_on_bit(), except also takes a
+ * timeout parameter.
+ *
+ * Returned value will be zero if the bit was cleared before the
+ * @timeout elapsed, or non-zero if the @timeout elapsed or process
+ * received a signal and the mode permitted wakeup on that signal.
+ */
+static inline int
+wait_on_bit_timeout(unsigned long *word, int bit, unsigned mode,
+                    unsigned long timeout)
+{
+        might_sleep();
+        if (!test_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit_timeout(word, bit,
+                                               bit_wait_timeout,
+                                               mode, timeout);
+}
+
+/**
+ * wait_on_bit_action - wait for a bit to be cleared
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @action: the function used to sleep, which may take special actions
+ * @mode: the task state to sleep in
+ *
+ * Use the standard hashed waitqueue table to wait for a bit
+ * to be cleared, and allow the waiting action to be specified.
+ * This is like wait_on_bit() but allows fine control of how the waiting
+ * is done.
+ *
+ * Returned value will be zero if the bit was cleared, or non-zero
+ * if the process received a signal and the mode permitted wakeup
+ * on that signal.
+ */
+static inline int
+wait_on_bit_action(unsigned long *word, int bit, wait_bit_action_f *action,
+                   unsigned mode)
+{
+        might_sleep();
+        if (!test_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit(word, bit, action, mode);
+}
+
+/**
+ * wait_on_bit_lock - wait for a bit to be cleared, when wanting to set it
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @mode: the task state to sleep in
+ *
+ * There is a standard hashed waitqueue table for generic use. This
+ * is the part of the hashtable's accessor API that waits on a bit
+ * when one intends to set it, for instance, trying to lock bitflags.
+ * For instance, if one were to have waiters trying to set bitflag
+ * and waiting for it to clear before setting it, one would call
+ * wait_on_bit() in threads waiting to be able to set the bit.
+ * One uses wait_on_bit_lock() where one is waiting for the bit to
+ * clear with the intention of setting it, and when done, clearing it.
+ *
+ * Returns zero if the bit was (eventually) found to be clear and was
+ * set.  Returns non-zero if a signal was delivered to the process and
+ * the @mode allows that signal to wake the process.
+ */
+static inline int
+wait_on_bit_lock(unsigned long *word, int bit, unsigned mode)
+{
+        might_sleep();
+        if (!test_and_set_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit_lock(word, bit, bit_wait, mode);
+}
+
+/**
+ * wait_on_bit_lock_io - wait for a bit to be cleared, when wanting to set it
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @mode: the task state to sleep in
+ *
+ * Use the standard hashed waitqueue table to wait for a bit
+ * to be cleared and then to atomically set it.  This is similar
+ * to wait_on_bit(), but calls io_schedule() instead of schedule()
+ * for the actual waiting.
+ *
+ * Returns zero if the bit was (eventually) found to be clear and was
+ * set.  Returns non-zero if a signal was delivered to the process and
+ * the @mode allows that signal to wake the process.
+ */
+static inline int
+wait_on_bit_lock_io(unsigned long *word, int bit, unsigned mode)
+{
+        might_sleep();
+        if (!test_and_set_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit_lock(word, bit, bit_wait_io, mode);
+}
+
+/**
+ * wait_on_bit_lock_action - wait for a bit to be cleared, when wanting to set it
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ * @action: the function used to sleep, which may take special actions
+ * @mode: the task state to sleep in
+ *
+ * Use the standard hashed waitqueue table to wait for a bit
+ * to be cleared and then to set it, and allow the waiting action
+ * to be specified.
+ * This is like wait_on_bit() but allows fine control of how the waiting
+ * is done.
+ *
+ * Returns zero if the bit was (eventually) found to be clear and was
+ * set.  Returns non-zero if a signal was delivered to the process and
+ * the @mode allows that signal to wake the process.
+ */
+static inline int
+wait_on_bit_lock_action(unsigned long *word, int bit, wait_bit_action_f *action,
+                        unsigned mode)
+{
+        might_sleep();
+        if (!test_and_set_bit(bit, word))
+                return 0;
+        return out_of_line_wait_on_bit_lock(word, bit, action, mode);
+}
+
+/**
+ * wait_on_atomic_t - Wait for an atomic_t to become 0
+ * @val: The atomic value being waited on, a kernel virtual address
+ * @action: the function used to sleep, which may take special actions
+ * @mode: the task state to sleep in
+ *
+ * Wait for an atomic_t to become 0.  We abuse the bit-wait waitqueue table for
+ * the purpose of getting a waitqueue, but we set the key to a bit number
+ * outside of the target 'word'.
+ */
+static inline
+int wait_on_atomic_t(atomic_t *val, int (*action)(atomic_t *), unsigned mode)
+{
+        might_sleep();
+        if (atomic_read(val) == 0)
+                return 0;
+        return out_of_line_wait_on_atomic_t(val, action, mode);
+}
+
+#endif /* _LINUX_WAIT_BIT_H */
diff --git a/include/media/cec-notifier.h b/include/media/cec-notifier.h
index eb50ce54b759..298f996969df 100644
--- a/include/media/cec-notifier.h
+++ b/include/media/cec-notifier.h
@@ -29,7 +29,7 @@ struct edid;
 struct cec_adapter;
 struct cec_notifier;
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#if IS_REACHABLE(CONFIG_CEC_CORE) && IS_ENABLED(CONFIG_CEC_NOTIFIER)
 
 /**
  * cec_notifier_get - find or create a new cec_notifier for the given device.
@@ -106,6 +106,16 @@ static inline void cec_notifier_set_phys_addr_from_edid(struct cec_notifier *n,
 {
 }
 
+static inline void cec_notifier_register(struct cec_notifier *n,
+                         struct cec_adapter *adap,
+                         void (*callback)(struct cec_adapter *adap, u16 pa))
+{
+}
+
+static inline void cec_notifier_unregister(struct cec_notifier *n)
+{
+}
+
 #endif
 
 #endif
diff --git a/include/media/cec.h b/include/media/cec.h
index b8eb895731d5..201f060978da 100644
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -173,7 +173,7 @@ struct cec_adapter {
         bool passthrough;
         struct cec_log_addrs log_addrs;
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
         struct cec_notifier *notifier;
 #endif
 
@@ -206,7 +206,7 @@ static inline bool cec_is_sink(const struct cec_adapter *adap)
 #define cec_phys_addr_exp(pa) \
         ((pa) >> 12), ((pa) >> 8) & 0xf, ((pa) >> 4) & 0xf, (pa) & 0xf
 
-#if IS_ENABLED(CONFIG_CEC_CORE)
+#if IS_REACHABLE(CONFIG_CEC_CORE)
 struct cec_adapter *cec_allocate_adapter(const struct cec_adap_ops *ops,
                 void *priv, const char *name, u32 caps, u8 available_las);
 int cec_register_adapter(struct cec_adapter *adap, struct device *parent);
@@ -300,7 +300,7 @@ u16 cec_phys_addr_for_input(u16 phys_addr, u8 input);
  */
 int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
 
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 void cec_register_cec_notifier(struct cec_adapter *adap,
                                struct cec_notifier *notifier);
 #endif
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index fd60eccb59a6..75e612a45824 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -62,7 +62,7 @@ struct unix_sock {
 #define UNIX_GC_CANDIDATE       0
 #define UNIX_GC_MAYBE_CYCLE     1
         struct socket_wq        peer_wq;
-        wait_queue_t            peer_wake;
+        wait_queue_entry_t              peer_wake;
 };
 
 static inline struct unix_sock *unix_sk(const struct sock *sk)
diff --git a/include/net/dst.h b/include/net/dst.h
index 049af33da3b6..cfc043784166 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -107,10 +107,16 @@ struct dst_entry {
         };
 };
 
+struct dst_metrics {
+        u32             metrics[RTAX_MAX];
+        atomic_t        refcnt;
+};
+extern const struct dst_metrics dst_default_metrics;
+
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
-extern const u32 dst_default_metrics[];
 
 #define DST_METRICS_READ_ONLY           0x1UL
+#define DST_METRICS_REFCOUNTED          0x2UL
 #define DST_METRICS_FLAGS               0x3UL
 #define __DST_METRICS_PTR(Y)    \
         ((u32 *)((Y) & ~DST_METRICS_FLAGS))
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 6692c5758b33..f7f6aa789c61 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -114,11 +114,11 @@ struct fib_info {
         __be32                  fib_prefsrc;
         u32                     fib_tb_id;
         u32                     fib_priority;
-        u32                     *fib_metrics;
-#define fib_mtu fib_metrics[RTAX_MTU-1]
-#define fib_window fib_metrics[RTAX_WINDOW-1]
-#define fib_rtt fib_metrics[RTAX_RTT-1]
-#define fib_advmss fib_metrics[RTAX_ADVMSS-1]
+        struct dst_metrics      *fib_metrics;
+#define fib_mtu fib_metrics->metrics[RTAX_MTU-1]
+#define fib_window fib_metrics->metrics[RTAX_WINDOW-1]
+#define fib_rtt fib_metrics->metrics[RTAX_RTT-1]
+#define fib_advmss fib_metrics->metrics[RTAX_ADVMSS-1]
         int                     fib_nhs;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         int                     fib_weight;
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index dbf0abba33b8..3e505bbff8ca 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1007,6 +1007,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
  */
 extern const struct proto_ops inet6_stream_ops;
 extern const struct proto_ops inet6_dgram_ops;
+extern const struct proto_ops inet6_sockraw_ops;
 
 struct group_source_req;
 struct group_filter;
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index f31fb6331a53..3248beaf16b0 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 #include <net/act_api.h>
+#include <linux/tc_act/tc_csum.h>
 
 struct tcf_csum {
         struct tc_action common;
@@ -11,4 +12,18 @@ struct tcf_csum {
 };
 #define to_tcf_csum(a) ((struct tcf_csum *)a)
 
+static inline bool is_tcf_csum(const struct tc_action *a)
+{
+#ifdef CONFIG_NET_CLS_ACT
+        if (a->ops && a->ops->type == TCA_ACT_CSUM)
+                return true;
+#endif
+        return false;
+}
+
+static inline u32 tcf_csum_update_flags(const struct tc_action *a)
+{
+        return to_tcf_csum(a)->update_flags;
+}
+
 #endif /* __NET_TC_CSUM_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 38a7427ae902..be6223c586fa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -924,7 +924,7 @@ struct tcp_congestion_ops {
         void (*cwnd_event)(struct sock *sk, enum tcp_ca_event ev);
         /* call when ack arrives (optional) */
         void (*in_ack_event)(struct sock *sk, u32 flags);
-        /* new value of cwnd after loss (optional) */
+        /* new value of cwnd after loss (required) */
         u32  (*undo_cwnd)(struct sock *sk);
         /* hook for packet ack accounting (optional) */
         void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 6793a30c66b1..7e7e2b0d2915 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -979,10 +979,6 @@ struct xfrm_dst {
         struct flow_cache_object flo;
         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
         int num_pols, num_xfrms;
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct flowi *origin;
-        struct xfrm_selector *partner;
-#endif
         u32 xfrm_genid;
         u32 policy_genid;
         u32 route_mtu_cached;
@@ -998,12 +994,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
         dst_release(xdst->route);
         if (likely(xdst->u.dst.xfrm))
                 xfrm_state_put(xdst->u.dst.xfrm);
-#ifdef CONFIG_XFRM_SUB_POLICY
-        kfree(xdst->origin);
-        xdst->origin = NULL;
-        kfree(xdst->partner);
-        xdst->partner = NULL;
-#endif
 }
 #endif
 
diff --git a/include/rdma/ib_sa.h b/include/rdma/ib_sa.h
index f5f70e345318..355b81f4242d 100644
--- a/include/rdma/ib_sa.h
+++ b/include/rdma/ib_sa.h
@@ -158,7 +158,6 @@ enum sa_path_rec_type {
 };
 
 struct sa_path_rec_ib {
-        __be64       service_id;
         __be16       dlid;
         __be16       slid;
         u8           raw_traffic;
@@ -174,7 +173,6 @@ struct sa_path_rec_roce {
 };
 
 struct sa_path_rec_opa {
-        __be64       service_id;
         __be32       dlid;
         __be32       slid;
         u8           raw_traffic;
@@ -189,6 +187,7 @@ struct sa_path_rec_opa {
 struct sa_path_rec {
         union ib_gid dgid;
         union ib_gid sgid;
+        __be64       service_id;
         /* reserved */
         __be32       flow_label;
         u8           hop_limit;
@@ -262,7 +261,7 @@ static inline void path_conv_opa_to_ib(struct sa_path_rec *ib,
                 ib->ib.dlid     = htons(ntohl(opa->opa.dlid));
                 ib->ib.slid     = htons(ntohl(opa->opa.slid));
         }
-        ib->ib.service_id       = opa->opa.service_id;
+        ib->service_id          = opa->service_id;
         ib->ib.raw_traffic      = opa->opa.raw_traffic;
 }
 
@@ -281,7 +280,7 @@ static inline void path_conv_ib_to_opa(struct sa_path_rec *opa,
         }
         opa->opa.slid           = slid;
         opa->opa.dlid           = dlid;
-        opa->opa.service_id     = ib->ib.service_id;
+        opa->service_id         = ib->service_id;
         opa->opa.raw_traffic    = ib->ib.raw_traffic;
 }
 
@@ -591,15 +590,6 @@ static inline bool sa_path_is_roce(struct sa_path_rec *rec)
                 (rec->rec_type == SA_PATH_REC_TYPE_ROCE_V2));
 }
 
-static inline void sa_path_set_service_id(struct sa_path_rec *rec,
-                                          __be64 service_id)
-{
-        if (rec->rec_type == SA_PATH_REC_TYPE_IB)
-                rec->ib.service_id = service_id;
-        else if (rec->rec_type == SA_PATH_REC_TYPE_OPA)
-                rec->opa.service_id = service_id;
-}
-
 static inline void sa_path_set_slid(struct sa_path_rec *rec, __be32 slid)
 {
         if (rec->rec_type == SA_PATH_REC_TYPE_IB)
@@ -625,15 +615,6 @@ static inline void sa_path_set_raw_traffic(struct sa_path_rec *rec,
                 rec->opa.raw_traffic = raw_traffic;
 }
 
-static inline __be64 sa_path_get_service_id(struct sa_path_rec *rec)
-{
-        if (rec->rec_type == SA_PATH_REC_TYPE_IB)
-                return rec->ib.service_id;
-        else if (rec->rec_type == SA_PATH_REC_TYPE_OPA)
-                return rec->opa.service_id;
-        return 0;
-}
-
 static inline __be32 sa_path_get_slid(struct sa_path_rec *rec)
 {
         if (rec->rec_type == SA_PATH_REC_TYPE_IB)
diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h
index 585266144329..348c102cb5f6 100644
--- a/include/rdma/rdma_netlink.h
+++ b/include/rdma/rdma_netlink.h
@@ -10,9 +10,6 @@ struct ibnl_client_cbs {
         struct module *module;
 };
 
-int ibnl_init(void);
-void ibnl_cleanup(void);
-
 /**
  * Add a a client to the list of IB netlink exporters.
  * @index: Index of the added client
@@ -77,11 +74,4 @@ int ibnl_unicast(struct sk_buff *skb, struct nlmsghdr *nlh,
 int ibnl_multicast(struct sk_buff *skb, struct nlmsghdr *nlh,
                         unsigned int group, gfp_t flags);
 
-/**
- * Check if there are any listeners to the netlink group
- * @group: the netlink group ID
- * Returns 0 on success or a negative for no listeners.
- */
-int ibnl_chk_listeners(unsigned int group);
-
 #endif /* _RDMA_NETLINK_H */
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 275581d483dd..5f17fb770477 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -557,6 +557,7 @@ struct iscsi_conn {
 #define LOGIN_FLAGS_READ_ACTIVE         1
 #define LOGIN_FLAGS_CLOSED              2
 #define LOGIN_FLAGS_READY               4
+#define LOGIN_FLAGS_INITIAL_PDU         8
         unsigned long           login_flags;
         struct delayed_work     login_work;
         struct delayed_work     login_cleanup_work;
diff --git a/include/uapi/linux/auto_fs.h b/include/uapi/linux/auto_fs.h
index aa63451ef20a..1953f8d6063b 100644
--- a/include/uapi/linux/auto_fs.h
+++ b/include/uapi/linux/auto_fs.h
@@ -26,7 +26,7 @@
 #define AUTOFS_MIN_PROTO_VERSION        AUTOFS_PROTO_VERSION
 
 /*
- * The wait_queue_token (autofs_wqt_t) is part of a structure which is passed
+ * The wait_queue_entry_token (autofs_wqt_t) is part of a structure which is passed
  * back to the kernel via ioctl from userspace. On architectures where 32- and
  * 64-bit userspace binaries can be executed it's important that the size of
  * autofs_wqt_t stays constant between 32- and 64-bit Linux kernels so that we
@@ -49,7 +49,7 @@ struct autofs_packet_hdr {
 
 struct autofs_packet_missing {
         struct autofs_packet_hdr hdr;
-        autofs_wqt_t wait_queue_token;
+        autofs_wqt_t wait_queue_entry_token;
         int len;
         char name[NAME_MAX+1];
 };      
diff --git a/include/uapi/linux/auto_fs4.h b/include/uapi/linux/auto_fs4.h
index 7c6da423d54e..65b72d0222e7 100644
--- a/include/uapi/linux/auto_fs4.h
+++ b/include/uapi/linux/auto_fs4.h
@@ -108,7 +108,7 @@ enum autofs_notify {
 /* v4 multi expire (via pipe) */
 struct autofs_packet_expire_multi {
         struct autofs_packet_hdr hdr;
-        autofs_wqt_t wait_queue_token;
+        autofs_wqt_t wait_queue_entry_token;
         int len;
         char name[NAME_MAX+1];
 };
@@ -123,7 +123,7 @@ union autofs_packet_union {
 /* autofs v5 common packet struct */
 struct autofs_v5_packet {
         struct autofs_packet_hdr hdr;
-        autofs_wqt_t wait_queue_token;
+        autofs_wqt_t wait_queue_entry_token;
         __u32 dev;
         __u64 ino;
         __u32 uid;
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index d179d7767f51..7d4a594d5d58 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1486,8 +1486,10 @@ enum ethtool_link_mode_bit_indices {
  * it was forced up into this mode or autonegotiated.
  */
 
-/* The forced speed, in units of 1Mb. All values 0 to INT_MAX are legal. */
-/* Update drivers/net/phy/phy.c:phy_speed_to_str() when adding new values */
+/* The forced speed, in units of 1Mb. All values 0 to INT_MAX are legal.
+ * Update drivers/net/phy/phy.c:phy_speed_to_str() and
+ * drivers/net/bonding/bond_3ad.c:__get_link_speed() when adding new values.
+ */
 #define SPEED_10                10
 #define SPEED_100               100
 #define SPEED_1000              1000
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index 201c6644b237..ef16df06642a 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -70,8 +70,8 @@ struct keyctl_dh_params {
 };
 
 struct keyctl_kdf_params {
-        char *hashname;
-        char *otherinfo;
+        char __user *hashname;
+        char __user *otherinfo;
         __u32 otherinfolen;
         __u32 __spare[8];
 };
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 61b7d36dfe34..156ee4cab82e 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -343,6 +343,7 @@ enum ovs_key_attr {
 #define OVS_KEY_ATTR_MAX (__OVS_KEY_ATTR_MAX - 1)
 
 enum ovs_tunnel_key_attr {
+        /* OVS_TUNNEL_KEY_ATTR_NONE, standard nl API requires this attribute! */
         OVS_TUNNEL_KEY_ATTR_ID,                 /* be64 Tunnel ID */
         OVS_TUNNEL_KEY_ATTR_IPV4_SRC,           /* be32 src IP address. */
         OVS_TUNNEL_KEY_ATTR_IPV4_DST,           /* be32 dst IP address. */
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 5e00b2333c26..172dc8ee0e3b 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -86,6 +86,7 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
         array->map.key_size = attr->key_size;
         array->map.value_size = attr->value_size;
         array->map.max_entries = attr->max_entries;
+        array->map.map_flags = attr->map_flags;
         array->elem_size = elem_size;
 
         if (!percpu)
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 39cfafd895b8..b09185f0f17d 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -432,6 +432,7 @@ static struct bpf_map *trie_alloc(union bpf_attr *attr)
         trie->map.key_size = attr->key_size;
         trie->map.value_size = attr->value_size;
         trie->map.max_entries = attr->max_entries;
+        trie->map.map_flags = attr->map_flags;
         trie->data_size = attr->key_size -
                           offsetof(struct bpf_lpm_trie_key, data);
         trie->max_prefixlen = trie->data_size * 8;
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 4dfd6f2ec2f9..31147d730abf 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -88,6 +88,7 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
         smap->map.key_size = attr->key_size;
         smap->map.value_size = value_size;
         smap->map.max_entries = attr->max_entries;
+        smap->map.map_flags = attr->map_flags;
         smap->n_buckets = n_buckets;
         smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT;
 
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c72cd41f5b8b..339c8a1371de 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -463,19 +463,22 @@ static const int caller_saved[CALLER_SAVED_REGS] = {
         BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5
 };
 
+static void mark_reg_not_init(struct bpf_reg_state *regs, u32 regno)
+{
+        BUG_ON(regno >= MAX_BPF_REG);
+
+        memset(&regs[regno], 0, sizeof(regs[regno]));
+        regs[regno].type = NOT_INIT;
+        regs[regno].min_value = BPF_REGISTER_MIN_RANGE;
+        regs[regno].max_value = BPF_REGISTER_MAX_RANGE;
+}
+
 static void init_reg_state(struct bpf_reg_state *regs)
 {
         int i;
 
-        for (i = 0; i < MAX_BPF_REG; i++) {
-                regs[i].type = NOT_INIT;
-                regs[i].imm = 0;
-                regs[i].min_value = BPF_REGISTER_MIN_RANGE;
-                regs[i].max_value = BPF_REGISTER_MAX_RANGE;
-                regs[i].min_align = 0;
-                regs[i].aux_off = 0;
-                regs[i].aux_off_align = 0;
-        }
+        for (i = 0; i < MAX_BPF_REG; i++)
+                mark_reg_not_init(regs, i);
 
         /* frame pointer */
         regs[BPF_REG_FP].type = FRAME_PTR;
@@ -843,9 +846,6 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
 {
         bool strict = env->strict_alignment;
 
-        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
-                strict = true;
-
         switch (reg->type) {
         case PTR_TO_PACKET:
                 return check_pkt_ptr_alignment(reg, off, size, strict);
@@ -1349,7 +1349,6 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         struct bpf_verifier_state *state = &env->cur_state;
         const struct bpf_func_proto *fn = NULL;
         struct bpf_reg_state *regs = state->regs;
-        struct bpf_reg_state *reg;
         struct bpf_call_arg_meta meta;
         bool changes_data;
         int i, err;
@@ -1416,11 +1415,8 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         }
 
         /* reset caller saved regs */
-        for (i = 0; i < CALLER_SAVED_REGS; i++) {
-                reg = regs + caller_saved[i];
-                reg->type = NOT_INIT;
-                reg->imm = 0;
-        }
+        for (i = 0; i < CALLER_SAVED_REGS; i++)
+                mark_reg_not_init(regs, caller_saved[i]);
 
         /* update return register */
         if (fn->ret_type == RET_INTEGER) {
@@ -2448,7 +2444,6 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
 {
         struct bpf_reg_state *regs = env->cur_state.regs;
         u8 mode = BPF_MODE(insn->code);
-        struct bpf_reg_state *reg;
         int i, err;
 
         if (!may_access_skb(env->prog->type)) {
@@ -2481,11 +2476,8 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
         }
 
         /* reset caller saved regs to unreadable */
-        for (i = 0; i < CALLER_SAVED_REGS; i++) {
-                reg = regs + caller_saved[i];
-                reg->type = NOT_INIT;
-                reg->imm = 0;
-        }
+        for (i = 0; i < CALLER_SAVED_REGS; i++)
+                mark_reg_not_init(regs, caller_saved[i]);
 
         /* mark destination R0 register as readable, since it contains
          * the value fetched from the packet
@@ -2696,7 +2688,8 @@ err_free:
 /* the following conditions reduce the number of explored insns
  * from ~140k to ~80k for ultra large programs that use a lot of ptr_to_packet
  */
-static bool compare_ptrs_to_packet(struct bpf_reg_state *old,
+static bool compare_ptrs_to_packet(struct bpf_verifier_env *env,
+                                   struct bpf_reg_state *old,
                                    struct bpf_reg_state *cur)
 {
         if (old->id != cur->id)
@@ -2739,7 +2732,7 @@ static bool compare_ptrs_to_packet(struct bpf_reg_state *old,
          * 'if (R4 > data_end)' and all further insn were already good with r=20,
          * so they will be good with r=30 and we can prune the search.
          */
-        if (old->off <= cur->off &&
+        if (!env->strict_alignment && old->off <= cur->off &&
             old->off >= old->range && cur->off >= cur->range)
                 return true;
 
@@ -2810,7 +2803,7 @@ static bool states_equal(struct bpf_verifier_env *env,
                         continue;
 
                 if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&
-                    compare_ptrs_to_packet(rold, rcur))
+                    compare_ptrs_to_packet(env, rold, rcur))
                         continue;
 
                 return false;
@@ -3588,10 +3581,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
         } else {
                 log_level = 0;
         }
-        if (attr->prog_flags & BPF_F_STRICT_ALIGNMENT)
+
+        env->strict_alignment = !!(attr->prog_flags & BPF_F_STRICT_ALIGNMENT);
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
                 env->strict_alignment = true;
-        else
-                env->strict_alignment = false;
 
         ret = replace_map_fd_with_map_ptr(env);
         if (ret < 0)
@@ -3697,7 +3690,10 @@ int bpf_analyzer(struct bpf_prog *prog, const struct bpf_ext_analyzer_ops *ops,
         mutex_lock(&bpf_verifier_lock);
 
         log_level = 0;
+
         env->strict_alignment = false;
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+                env->strict_alignment = true;
 
         env->explored_states = kcalloc(env->prog->len,
                                        sizeof(struct bpf_verifier_state_list *),
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c3c9a0e1b3c9..8d4e85eae42c 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4265,6 +4265,11 @@ static void kill_css(struct cgroup_subsys_state *css)
 {
         lockdep_assert_held(&cgroup_mutex);
 
+        if (css->flags & CSS_DYING)
+                return;
+
+        css->flags |= CSS_DYING;
+
         /*
          * This must happen before css is disassociated with its cgroup.
          * See seq_css() for details.
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index f6501f4f6040..ae643412948a 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -176,9 +176,9 @@ typedef enum {
 } cpuset_flagbits_t;
 
 /* convenient tests for these bits */
-static inline bool is_cpuset_online(const struct cpuset *cs)
+static inline bool is_cpuset_online(struct cpuset *cs)
 {
-        return test_bit(CS_ONLINE, &cs->flags);
+        return test_bit(CS_ONLINE, &cs->flags) && !css_is_dying(&cs->css);
 }
 
 static inline int is_cpu_exclusive(const struct cpuset *cs)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 9ae6fbe5b5cf..cb5103413bd8 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1658,13 +1658,13 @@ static ssize_t write_cpuhp_target(struct device *dev,
         ret = !sp->name || sp->cant_stop ? -EINVAL : 0;
         mutex_unlock(&cpuhp_state_mutex);
         if (ret)
-                return ret;
+                goto out;
 
         if (st->state < target)
                 ret = do_cpu_up(dev->id, target);
         else
                 ret = do_cpu_down(dev->id, target);
-
+out:
         unlock_device_hotplug();
         return ret ? ret : count;
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6e75a5c9412d..6c4e523dc1e2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7316,6 +7316,21 @@ int perf_event_account_interrupt(struct perf_event *event)
         return __perf_event_account_interrupt(event, 1);
 }
 
+static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs)
+{
+        /*
+         * Due to interrupt latency (AKA "skid"), we may enter the
+         * kernel before taking an overflow, even if the PMU is only
+         * counting user events.
+         * To avoid leaking information to userspace, we must always
+         * reject kernel samples when exclude_kernel is set.
+         */
+        if (event->attr.exclude_kernel && !user_mode(regs))
+                return false;
+
+        return true;
+}
+
 /*
  * Generic event overflow handling, sampling.
  */
@@ -7337,6 +7352,12 @@ static int __perf_event_overflow(struct perf_event *event,
         ret = __perf_event_account_interrupt(event, throttle);
 
         /*
+         * For security, drop the skid kernel samples if necessary.
+         */
+        if (!sample_is_allowed(event, regs))
+                return ret;
+
+        /*
          * XXX event_limit might not quite work as expected on inherited
          * events
          */
diff --git a/kernel/exit.c b/kernel/exit.c
index 516acdb0e0ec..7d694437ab44 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1004,7 +1004,7 @@ struct wait_opts {
         int __user              *wo_stat;
         struct rusage __user    *wo_rusage;
 
-        wait_queue_t            child_wait;
+        wait_queue_entry_t              child_wait;
         int                     notask_error;
 };
 
@@ -1541,7 +1541,7 @@ static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
         return 0;
 }
 
-static int child_wait_callback(wait_queue_t *wait, unsigned mode,
+static int child_wait_callback(wait_queue_entry_t *wait, unsigned mode,
                                 int sync, void *key)
 {
         struct wait_opts *wo = container_of(wait, struct wait_opts,
diff --git a/kernel/fork.c b/kernel/fork.c
index aa1076c5e4a9..e53770d2bf95 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1577,6 +1577,18 @@ static __latent_entropy struct task_struct *copy_process(
         if (!p)
                 goto fork_out;
 
+        /*
+         * This _must_ happen before we call free_task(), i.e. before we jump
+         * to any of the bad_fork_* labels. This is to avoid freeing
+         * p->set_child_tid which is (ab)used as a kthread's data pointer for
+         * kernel threads (PF_KTHREAD).
+         */
+        p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+        /*
+         * Clear TID on mm_release()?
+         */
+        p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
+
         ftrace_graph_init_task(p);
 
         rt_mutex_init_task(p);
@@ -1743,11 +1755,6 @@ static __latent_entropy struct task_struct *copy_process(
                 }
         }
 
-        p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
-        /*
-         * Clear TID on mm_release()?
-         */
-        p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
 #ifdef CONFIG_BLOCK
         p->plug = NULL;
 #endif
diff --git a/kernel/futex.c b/kernel/futex.c
index 357348a6cf6b..d6cf71d08f21 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -225,7 +225,7 @@ struct futex_pi_state {
  * @requeue_pi_key:     the requeue_pi target futex key
  * @bitset:             bitset for the optional bitmasked wakeup
  *
- * We use this hashed waitqueue, instead of a normal wait_queue_t, so
+ * We use this hashed waitqueue, instead of a normal wait_queue_entry_t, so
  * we can wake only the relevant ones (hashed queues may be shared).
  *
  * A futex_q has a woken state, just like tasks have TASK_RUNNING.
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 070be980c37a..425170d4439b 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1312,8 +1312,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                         ret = __irq_set_trigger(desc,
                                                 new->flags & IRQF_TRIGGER_MASK);
 
-                        if (ret)
+                        if (ret) {
+                                irq_release_resources(desc);
                                 goto out_mask;
+                        }
                 }
 
                 desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 2d2d3a568e4e..adfe3b4cfe05 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -122,7 +122,7 @@ static void *alloc_insn_page(void)
         return module_alloc(PAGE_SIZE);
 }
 
-static void free_insn_page(void *page)
+void __weak free_insn_page(void *page)
 {
         module_memfree(page);
 }
diff --git a/kernel/livepatch/Kconfig b/kernel/livepatch/Kconfig
index 045022557936..ec4565122e65 100644
--- a/kernel/livepatch/Kconfig
+++ b/kernel/livepatch/Kconfig
@@ -10,6 +10,7 @@ config LIVEPATCH
         depends on SYSFS
         depends on KALLSYMS_ALL
         depends on HAVE_LIVEPATCH
+        depends on !TRIM_UNUSED_KSYMS
         help
           Say Y here if you want to support kernel live patching.
           This option has no runtime impact until a kernel "patch"
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index b95509416909..28cd09e635ed 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1785,12 +1785,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
         int ret;
 
         raw_spin_lock_irq(&lock->wait_lock);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-
         /* sleep on the mutex */
+        set_current_state(TASK_INTERRUPTIBLE);
         ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
-
+        /*
+         * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
+         * have to fix that up.
+         */
+        fixup_rt_mutex_waiters(lock);
         raw_spin_unlock_irq(&lock->wait_lock);
 
         return ret;
@@ -1822,15 +1824,25 @@ bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_lock_irq(&lock->wait_lock);
         /*
+         * Do an unconditional try-lock, this deals with the lock stealing
+         * state where __rt_mutex_futex_unlock() -> mark_wakeup_next_waiter()
+         * sets a NULL owner.
+         *
+         * We're not interested in the return value, because the subsequent
+         * test on rt_mutex_owner() will infer that. If the trylock succeeded,
+         * we will own the lock and it will have removed the waiter. If we
+         * failed the trylock, we're still not owner and we need to remove
+         * ourselves.
+         */
+        try_to_take_rt_mutex(lock, current, waiter);
+        /*
          * Unless we're the owner; we're still enqueued on the wait_list.
          * So check if we became owner, if not, take us off the wait_list.
          */
         if (rt_mutex_owner(lock) != current) {
                 remove_waiter(lock, waiter);
-                fixup_rt_mutex_waiters(lock);
                 cleanup = true;
         }
-
         /*
          * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
          * have to fix that up.
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 78672d324a6e..c7209f060eeb 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -132,7 +132,7 @@ int freeze_processes(void)
         if (!pm_freezing)
                 atomic_inc(&system_freezing_cnt);
 
-        pm_wakeup_clear(true);
+        pm_wakeup_clear();
         pr_info("Freezing user space processes ... ");
         pm_freezing = true;
         error = try_to_freeze_tasks(true);
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index c0248c74d6d4..15e6baef5c73 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -72,8 +72,6 @@ static void freeze_begin(void)
 
 static void freeze_enter(void)
 {
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, true);
-
         spin_lock_irq(&suspend_freeze_lock);
         if (pm_wakeup_pending())
                 goto out;
@@ -100,27 +98,6 @@ static void freeze_enter(void)
  out:
         suspend_freeze_state = FREEZE_STATE_NONE;
         spin_unlock_irq(&suspend_freeze_lock);
-
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, false);
-}
-
-static void s2idle_loop(void)
-{
-        do {
-                freeze_enter();
-
-                if (freeze_ops && freeze_ops->wake)
-                        freeze_ops->wake();
-
-                dpm_resume_noirq(PMSG_RESUME);
-                if (freeze_ops && freeze_ops->sync)
-                        freeze_ops->sync();
-
-                if (pm_wakeup_pending())
-                        break;
-
-                pm_wakeup_clear(false);
-        } while (!dpm_suspend_noirq(PMSG_SUSPEND));
 }
 
 void freeze_wake(void)
@@ -394,8 +371,10 @@ static int suspend_enter(suspend_state_t state, bool *wakeup)
          * all the devices are suspended.
          */
         if (state == PM_SUSPEND_FREEZE) {
-                s2idle_loop();
-                goto Platform_early_resume;
+                trace_suspend_resume(TPS("machine_suspend"), state, true);
+                freeze_enter();
+                trace_suspend_resume(TPS("machine_suspend"), state, false);
+                goto Platform_wake;
         }
 
         error = disable_nonboot_cpus();
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 32fac391ac2a..bd53ea579dc8 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -269,7 +269,6 @@ static struct console *exclusive_console;
 #define MAX_CMDLINECONSOLES 8
 
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
-static int console_cmdline_cnt;
 
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -1906,25 +1905,12 @@ static int __add_preferred_console(char *name, int idx, char *options,
          *      See if this tty is not yet registered, and
          *      if we have a slot free.
          */
-        for (i = 0, c = console_cmdline; i < console_cmdline_cnt; i++, c++) {
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                 if (strcmp(c->name, name) == 0 && c->index == idx) {
-                        if (brl_options)
-                                return 0;
-
-                        /*
-                         * Maintain an invariant that will help to find if
-                         * the matching console is preferred, see
-                         * register_console():
-                         *
-                         * The last non-braille console is always
-                         * the preferred one.
-                         */
-                        if (i != console_cmdline_cnt - 1)
-                                swap(console_cmdline[i],
-                                     console_cmdline[console_cmdline_cnt - 1]);
-
-                        preferred_console = console_cmdline_cnt - 1;
-
+                        if (!brl_options)
+                                preferred_console = i;
                         return 0;
                 }
         }
@@ -1937,7 +1923,6 @@ static int __add_preferred_console(char *name, int idx, char *options,
         braille_set_options(c, brl_options);
 
         c->index = idx;
-        console_cmdline_cnt++;
         return 0;
 }
 /*
@@ -2477,23 +2462,12 @@ void register_console(struct console *newcon)
         }
 
         /*
-         * See if this console matches one we selected on the command line.
-         *
-         * There may be several entries in the console_cmdline array matching
-         * with the same console, one with newcon->match(), another by
-         * name/index:
-         *
-         *      pl011,mmio,0x87e024000000,115200 -- added from SPCR
-         *      ttyAMA0 -- added from command line
-         *
-         * Traverse the console_cmdline array in reverse order to be
-         * sure that if this console is preferred then it will be the first
-         * matching entry.  We use the invariant that is maintained in
-         * __add_preferred_console().
+         *      See if this console matches one we selected on
+         *      the command line.
          */
-        for (i = console_cmdline_cnt - 1; i >= 0; i--) {
-                c = console_cmdline + i;
-
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                 if (!newcon->match ||
                     newcon->match(newcon, c->name, c->index, c->options) != 0) {
                         /* default matching */
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 266ddcc1d8bb..60f356d91060 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -60,19 +60,25 @@ int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
 }
 
 
+void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
+                   const struct cred *ptracer_cred)
+{
+        BUG_ON(!list_empty(&child->ptrace_entry));
+        list_add(&child->ptrace_entry, &new_parent->ptraced);
+        child->parent = new_parent;
+        child->ptracer_cred = get_cred(ptracer_cred);
+}
+
 /*
  * ptrace a task: make the debugger its new parent and
  * move it to the ptrace list.
  *
  * Must be called with the tasklist lock write-held.
  */
-void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
+static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
 {
-        BUG_ON(!list_empty(&child->ptrace_entry));
-        list_add(&child->ptrace_entry, &new_parent->ptraced);
-        child->parent = new_parent;
         rcu_read_lock();
-        child->ptracer_cred = get_cred(__task_cred(new_parent));
+        __ptrace_link(child, new_parent, __task_cred(new_parent));
         rcu_read_unlock();
 }
 
@@ -386,7 +392,7 @@ static int ptrace_attach(struct task_struct *task, long request,
                 flags |= PT_SEIZED;
         task->ptrace = flags;
 
-        __ptrace_link(task, current);
+        ptrace_link(task, current);
 
         /* SEIZE doesn't trap tracee on attach */
         if (!seize)
@@ -459,7 +465,7 @@ static int ptrace_traceme(void)
                  */
                 if (!ret && !(current->real_parent->flags & PF_EXITING)) {
                         current->ptrace = PT_PTRACED;
-                        __ptrace_link(current, current->real_parent);
+                        ptrace_link(current, current->real_parent);
                 }
         }
         write_unlock_irq(&tasklist_lock);
diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
index 584d8a983883..dea03614263f 100644
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -263,7 +263,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
  * Returns an index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -271,7 +271,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
         int idx;
 
         idx = READ_ONCE(sp->completed) & 0x1;
-        __this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
+        this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
         smp_mb(); /* B */  /* Avoid leaking the critical section. */
         return idx;
 }
@@ -281,7 +281,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
  * Removes the count for the old reader from the appropriate per-CPU
  * element of the srcu_struct.  Note that this may well be a different
  * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 36e1f82faed1..32798eb14853 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -97,8 +97,9 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
- * Returns an index that must be passed to the matching srcu_read_unlock().
+ * srcu_struct.  Can be invoked from irq/bh handlers, but the matching
+ * __srcu_read_unlock() must be in the same handler instance.  Returns an
+ * index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
 {
@@ -112,7 +113,7 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
 
 /*
  * Removes the count for the old reader from the appropriate element of
- * the srcu_struct.  Must be called from process context.
+ * the srcu_struct.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 3ae8474557df..157654fa436a 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -357,7 +357,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 
 /*
  * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
  * Returns an index that must be passed to the matching srcu_read_unlock().
  */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -365,7 +365,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
         int idx;
 
         idx = READ_ONCE(sp->srcu_idx) & 0x1;
-        __this_cpu_inc(sp->sda->srcu_lock_count[idx]);
+        this_cpu_inc(sp->sda->srcu_lock_count[idx]);
         smp_mb(); /* B */  /* Avoid leaking the critical section. */
         return idx;
 }
@@ -375,7 +375,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
  * Removes the count for the old reader from the appropriate per-CPU
  * element of the srcu_struct.  Note that this may well be a different
  * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
  */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile
index 5e4c2e7a632b..53f0164ed362 100644
--- a/kernel/sched/Makefile
+++ b/kernel/sched/Makefile
@@ -17,7 +17,7 @@ endif
 
 obj-y += core.o loadavg.o clock.o cputime.o
 obj-y += idle_task.o fair.o rt.o deadline.o
-obj-y += wait.o swait.o completion.o idle.o
+obj-y += wait.o wait_bit.o swait.o completion.o idle.o
 obj-$(CONFIG_SMP) += cpupri.o cpudeadline.o topology.o stop_task.o
 obj-$(CONFIG_SCHED_AUTOGROUP) += autogroup.o
 obj-$(CONFIG_SCHEDSTATS) += stats.o
diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c
index 53f9558fa925..13fc5ae9bf2f 100644
--- a/kernel/sched/completion.c
+++ b/kernel/sched/completion.c
@@ -66,7 +66,7 @@ do_wait_for_common(struct completion *x,
         if (!x->done) {
                 DECLARE_WAITQUEUE(wait, current);
 
-                __add_wait_queue_tail_exclusive(&x->wait, &wait);
+                __add_wait_queue_entry_tail_exclusive(&x->wait, &wait);
                 do {
                         if (signal_pending_state(state, current)) {
                                 timeout = -ERESTARTSYS;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c343b8135774..62166da1c359 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10,6 +10,7 @@
 #include <uapi/linux/sched/types.h>
 #include <linux/sched/loadavg.h>
 #include <linux/sched/hotplug.h>
+#include <linux/wait_bit.h>
 #include <linux/cpuset.h>
 #include <linux/delayacct.h>
 #include <linux/init_task.h>
@@ -3692,7 +3693,7 @@ asmlinkage __visible void __sched preempt_schedule_irq(void)
         exception_exit(prev_state);
 }
 
-int default_wake_function(wait_queue_t *curr, unsigned mode, int wake_flags,
+int default_wake_function(wait_queue_entry_t *curr, unsigned mode, int wake_flags,
                           void *key)
 {
         return try_to_wake_up(curr->private, mode, wake_flags);
@@ -5592,7 +5593,7 @@ void idle_task_exit(void)
         BUG_ON(cpu_online(smp_processor_id()));
 
         if (mm != &init_mm) {
-                switch_mm_irqs_off(mm, &init_mm, current);
+                switch_mm(mm, &init_mm, current);
                 finish_arch_post_lock_switch();
         }
         mmdrop(mm);
@@ -6010,28 +6011,13 @@ static struct kmem_cache *task_group_cache __read_mostly;
 DECLARE_PER_CPU(cpumask_var_t, load_balance_mask);
 DECLARE_PER_CPU(cpumask_var_t, select_idle_mask);
 
-#define WAIT_TABLE_BITS 8
-#define WAIT_TABLE_SIZE (1 << WAIT_TABLE_BITS)
-static wait_queue_head_t bit_wait_table[WAIT_TABLE_SIZE] __cacheline_aligned;
-
-wait_queue_head_t *bit_waitqueue(void *word, int bit)
-{
-        const int shift = BITS_PER_LONG == 32 ? 5 : 6;
-        unsigned long val = (unsigned long)word << shift | bit;
-
-        return bit_wait_table + hash_long(val, WAIT_TABLE_BITS);
-}
-EXPORT_SYMBOL(bit_waitqueue);
-
 void __init sched_init(void)
 {
         int i, j;
         unsigned long alloc_size = 0, ptr;
 
         sched_clock_init();
-
-        for (i = 0; i < WAIT_TABLE_SIZE; i++)
-                init_waitqueue_head(bit_wait_table + i);
+        wait_bit_init();
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
         alloc_size += 2 * nr_cpu_ids * sizeof(void **);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 622eed1b7658..076a2e31951c 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -101,9 +101,6 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
         if (sg_policy->next_freq == next_freq)
                 return;
 
-        if (sg_policy->next_freq > next_freq)
-                next_freq = (sg_policy->next_freq + next_freq) >> 1;
-
         sg_policy->next_freq = next_freq;
         sg_policy->last_freq_update_time = time;
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index cb3a3da7089f..a24661ac3d23 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3565,7 +3565,7 @@ static inline void check_schedstat_required(void)
                         trace_sched_stat_runtime_enabled())  {
                 printk_deferred_once("Scheduler tracepoints stat_sleep, stat_iowait, "
                              "stat_blocked and stat_runtime require the "
-                             "kernel parameter schedstats=enabled or "
+                             "kernel parameter schedstats=enable or "
                              "kernel.sched_schedstats=1\n");
         }
 #endif
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index b8c84c6dee64..17f11c6b0a9f 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -12,44 +12,44 @@
 #include <linux/hash.h>
 #include <linux/kthread.h>
 
-void __init_waitqueue_head(wait_queue_head_t *q, const char *name, struct lock_class_key *key)
+void __init_waitqueue_head(struct wait_queue_head *wq_head, const char *name, struct lock_class_key *key)
 {
-        spin_lock_init(&q->lock);
-        lockdep_set_class_and_name(&q->lock, key, name);
-        INIT_LIST_HEAD(&q->task_list);
+        spin_lock_init(&wq_head->lock);
+        lockdep_set_class_and_name(&wq_head->lock, key, name);
+        INIT_LIST_HEAD(&wq_head->head);
 }
 
 EXPORT_SYMBOL(__init_waitqueue_head);
 
-void add_wait_queue(wait_queue_head_t *q, wait_queue_t *wait)
+void add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
         unsigned long flags;
 
-        wait->flags &= ~WQ_FLAG_EXCLUSIVE;
-        spin_lock_irqsave(&q->lock, flags);
-        __add_wait_queue(q, wait);
-        spin_unlock_irqrestore(&q->lock, flags);
+        wq_entry->flags &= ~WQ_FLAG_EXCLUSIVE;
+        spin_lock_irqsave(&wq_head->lock, flags);
+        __add_wait_queue_entry_tail(wq_head, wq_entry);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(add_wait_queue);
 
-void add_wait_queue_exclusive(wait_queue_head_t *q, wait_queue_t *wait)
+void add_wait_queue_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
         unsigned long flags;
 
-        wait->flags |= WQ_FLAG_EXCLUSIVE;
-        spin_lock_irqsave(&q->lock, flags);
-        __add_wait_queue_tail(q, wait);
-        spin_unlock_irqrestore(&q->lock, flags);
+        wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
+        spin_lock_irqsave(&wq_head->lock, flags);
+        __add_wait_queue_entry_tail(wq_head, wq_entry);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(add_wait_queue_exclusive);
 
-void remove_wait_queue(wait_queue_head_t *q, wait_queue_t *wait)
+void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&q->lock, flags);
-        __remove_wait_queue(q, wait);
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_lock_irqsave(&wq_head->lock, flags);
+        __remove_wait_queue(wq_head, wq_entry);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(remove_wait_queue);
 
@@ -63,12 +63,12 @@ EXPORT_SYMBOL(remove_wait_queue);
  * started to run but is not in state TASK_RUNNING. try_to_wake_up() returns
  * zero in this (rare) case, and we handle it by continuing to scan the queue.
  */
-static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
+static void __wake_up_common(struct wait_queue_head *wq_head, unsigned int mode,
                         int nr_exclusive, int wake_flags, void *key)
 {
-        wait_queue_t *curr, *next;
+        wait_queue_entry_t *curr, *next;
 
-        list_for_each_entry_safe(curr, next, &q->task_list, task_list) {
+        list_for_each_entry_safe(curr, next, &wq_head->head, entry) {
                 unsigned flags = curr->flags;
 
                 if (curr->func(curr, mode, wake_flags, key) &&
@@ -79,7 +79,7 @@ static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
 
 /**
  * __wake_up - wake up threads blocked on a waitqueue.
- * @q: the waitqueue
+ * @wq_head: the waitqueue
  * @mode: which threads
  * @nr_exclusive: how many wake-one or wake-many threads to wake up
  * @key: is directly passed to the wakeup function
@@ -87,35 +87,35 @@ static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
  * It may be assumed that this function implies a write memory barrier before
  * changing the task state if and only if any tasks are woken up.
  */
-void __wake_up(wait_queue_head_t *q, unsigned int mode,
+void __wake_up(struct wait_queue_head *wq_head, unsigned int mode,
                         int nr_exclusive, void *key)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&q->lock, flags);
-        __wake_up_common(q, mode, nr_exclusive, 0, key);
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_lock_irqsave(&wq_head->lock, flags);
+        __wake_up_common(wq_head, mode, nr_exclusive, 0, key);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(__wake_up);
 
 /*
  * Same as __wake_up but called with the spinlock in wait_queue_head_t held.
  */
-void __wake_up_locked(wait_queue_head_t *q, unsigned int mode, int nr)
+void __wake_up_locked(struct wait_queue_head *wq_head, unsigned int mode, int nr)
 {
-        __wake_up_common(q, mode, nr, 0, NULL);
+        __wake_up_common(wq_head, mode, nr, 0, NULL);
 }
 EXPORT_SYMBOL_GPL(__wake_up_locked);
 
-void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key)
+void __wake_up_locked_key(struct wait_queue_head *wq_head, unsigned int mode, void *key)
 {
-        __wake_up_common(q, mode, 1, 0, key);
+        __wake_up_common(wq_head, mode, 1, 0, key);
 }
 EXPORT_SYMBOL_GPL(__wake_up_locked_key);
 
 /**
  * __wake_up_sync_key - wake up threads blocked on a waitqueue.
- * @q: the waitqueue
+ * @wq_head: the waitqueue
  * @mode: which threads
  * @nr_exclusive: how many wake-one or wake-many threads to wake up
  * @key: opaque value to be passed to wakeup targets
@@ -130,30 +130,30 @@ EXPORT_SYMBOL_GPL(__wake_up_locked_key);
  * It may be assumed that this function implies a write memory barrier before
  * changing the task state if and only if any tasks are woken up.
  */
-void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode,
+void __wake_up_sync_key(struct wait_queue_head *wq_head, unsigned int mode,
                         int nr_exclusive, void *key)
 {
         unsigned long flags;
         int wake_flags = 1; /* XXX WF_SYNC */
 
-        if (unlikely(!q))
+        if (unlikely(!wq_head))
                 return;
 
         if (unlikely(nr_exclusive != 1))
                 wake_flags = 0;
 
-        spin_lock_irqsave(&q->lock, flags);
-        __wake_up_common(q, mode, nr_exclusive, wake_flags, key);
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_lock_irqsave(&wq_head->lock, flags);
+        __wake_up_common(wq_head, mode, nr_exclusive, wake_flags, key);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL_GPL(__wake_up_sync_key);
 
 /*
  * __wake_up_sync - see __wake_up_sync_key()
  */
-void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr_exclusive)
+void __wake_up_sync(struct wait_queue_head *wq_head, unsigned int mode, int nr_exclusive)
 {
-        __wake_up_sync_key(q, mode, nr_exclusive, NULL);
+        __wake_up_sync_key(wq_head, mode, nr_exclusive, NULL);
 }
 EXPORT_SYMBOL_GPL(__wake_up_sync);      /* For internal use only */
 
@@ -170,48 +170,48 @@ EXPORT_SYMBOL_GPL(__wake_up_sync);	/* For internal use only */
  * loads to move into the critical region).
  */
 void
-prepare_to_wait(wait_queue_head_t *q, wait_queue_t *wait, int state)
+prepare_to_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state)
 {
         unsigned long flags;
 
-        wait->flags &= ~WQ_FLAG_EXCLUSIVE;
-        spin_lock_irqsave(&q->lock, flags);
-        if (list_empty(&wait->task_list))
-                __add_wait_queue(q, wait);
+        wq_entry->flags &= ~WQ_FLAG_EXCLUSIVE;
+        spin_lock_irqsave(&wq_head->lock, flags);
+        if (list_empty(&wq_entry->entry))
+                __add_wait_queue(wq_head, wq_entry);
         set_current_state(state);
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(prepare_to_wait);
 
 void
-prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state)
+prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state)
 {
         unsigned long flags;
 
-        wait->flags |= WQ_FLAG_EXCLUSIVE;
-        spin_lock_irqsave(&q->lock, flags);
-        if (list_empty(&wait->task_list))
-                __add_wait_queue_tail(q, wait);
+        wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
+        spin_lock_irqsave(&wq_head->lock, flags);
+        if (list_empty(&wq_entry->entry))
+                __add_wait_queue_entry_tail(wq_head, wq_entry);
         set_current_state(state);
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 }
 EXPORT_SYMBOL(prepare_to_wait_exclusive);
 
-void init_wait_entry(wait_queue_t *wait, int flags)
+void init_wait_entry(struct wait_queue_entry *wq_entry, int flags)
 {
-        wait->flags = flags;
-        wait->private = current;
-        wait->func = autoremove_wake_function;
-        INIT_LIST_HEAD(&wait->task_list);
+        wq_entry->flags = flags;
+        wq_entry->private = current;
+        wq_entry->func = autoremove_wake_function;
+        INIT_LIST_HEAD(&wq_entry->entry);
 }
 EXPORT_SYMBOL(init_wait_entry);
 
-long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state)
+long prepare_to_wait_event(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state)
 {
         unsigned long flags;
         long ret = 0;
 
-        spin_lock_irqsave(&q->lock, flags);
+        spin_lock_irqsave(&wq_head->lock, flags);
         if (unlikely(signal_pending_state(state, current))) {
                 /*
                  * Exclusive waiter must not fail if it was selected by wakeup,
@@ -219,24 +219,24 @@ long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state)
                  *
                  * The caller will recheck the condition and return success if
                  * we were already woken up, we can not miss the event because
-                 * wakeup locks/unlocks the same q->lock.
+                 * wakeup locks/unlocks the same wq_head->lock.
                  *
                  * But we need to ensure that set-condition + wakeup after that
                  * can't see us, it should wake up another exclusive waiter if
                  * we fail.
                  */
-                list_del_init(&wait->task_list);
+                list_del_init(&wq_entry->entry);
                 ret = -ERESTARTSYS;
         } else {
-                if (list_empty(&wait->task_list)) {
-                        if (wait->flags & WQ_FLAG_EXCLUSIVE)
-                                __add_wait_queue_tail(q, wait);
+                if (list_empty(&wq_entry->entry)) {
+                        if (wq_entry->flags & WQ_FLAG_EXCLUSIVE)
+                                __add_wait_queue_entry_tail(wq_head, wq_entry);
                         else
-                                __add_wait_queue(q, wait);
+                                __add_wait_queue(wq_head, wq_entry);
                 }
                 set_current_state(state);
         }
-        spin_unlock_irqrestore(&q->lock, flags);
+        spin_unlock_irqrestore(&wq_head->lock, flags);
 
         return ret;
 }
@@ -249,10 +249,10 @@ EXPORT_SYMBOL(prepare_to_wait_event);
  * condition in the caller before they add the wait
  * entry to the wake queue.
  */
-int do_wait_intr(wait_queue_head_t *wq, wait_queue_t *wait)
+int do_wait_intr(wait_queue_head_t *wq, wait_queue_entry_t *wait)
 {
-        if (likely(list_empty(&wait->task_list)))
-                __add_wait_queue_tail(wq, wait);
+        if (likely(list_empty(&wait->entry)))
+                __add_wait_queue_entry_tail(wq, wait);
 
         set_current_state(TASK_INTERRUPTIBLE);
         if (signal_pending(current))
@@ -265,10 +265,10 @@ int do_wait_intr(wait_queue_head_t *wq, wait_queue_t *wait)
 }
 EXPORT_SYMBOL(do_wait_intr);
 
-int do_wait_intr_irq(wait_queue_head_t *wq, wait_queue_t *wait)
+int do_wait_intr_irq(wait_queue_head_t *wq, wait_queue_entry_t *wait)
 {
-        if (likely(list_empty(&wait->task_list)))
-                __add_wait_queue_tail(wq, wait);
+        if (likely(list_empty(&wait->entry)))
+                __add_wait_queue_entry_tail(wq, wait);
 
         set_current_state(TASK_INTERRUPTIBLE);
         if (signal_pending(current))
@@ -283,14 +283,14 @@ EXPORT_SYMBOL(do_wait_intr_irq);
 
 /**
  * finish_wait - clean up after waiting in a queue
- * @q: waitqueue waited on
- * @wait: wait descriptor
+ * @wq_head: waitqueue waited on
+ * @wq_entry: wait descriptor
  *
  * Sets current thread back to running state and removes
  * the wait descriptor from the given waitqueue if still
  * queued.
  */
-void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
+void finish_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
 {
         unsigned long flags;
 
@@ -308,20 +308,20 @@ void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
          *    have _one_ other CPU that looks at or modifies
          *    the list).
          */
-        if (!list_empty_careful(&wait->task_list)) {
-                spin_lock_irqsave(&q->lock, flags);
-                list_del_init(&wait->task_list);
-                spin_unlock_irqrestore(&q->lock, flags);
+        if (!list_empty_careful(&wq_entry->entry)) {
+                spin_lock_irqsave(&wq_head->lock, flags);
+                list_del_init(&wq_entry->entry);
+                spin_unlock_irqrestore(&wq_head->lock, flags);
         }
 }
 EXPORT_SYMBOL(finish_wait);
 
-int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
+int autoremove_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key)
 {
-        int ret = default_wake_function(wait, mode, sync, key);
+        int ret = default_wake_function(wq_entry, mode, sync, key);
 
         if (ret)
-                list_del_init(&wait->task_list);
+                list_del_init(&wq_entry->entry);
         return ret;
 }
 EXPORT_SYMBOL(autoremove_wake_function);
@@ -334,24 +334,24 @@ static inline bool is_kthread_should_stop(void)
 /*
  * DEFINE_WAIT_FUNC(wait, woken_wake_func);
  *
- * add_wait_queue(&wq, &wait);
+ * add_wait_queue(&wq_head, &wait);
  * for (;;) {
  *     if (condition)
  *         break;
  *
  *     p->state = mode;                         condition = true;
  *     smp_mb(); // A                           smp_wmb(); // C
- *     if (!wait->flags & WQ_FLAG_WOKEN)        wait->flags |= WQ_FLAG_WOKEN;
+ *     if (!wq_entry->flags & WQ_FLAG_WOKEN)    wq_entry->flags |= WQ_FLAG_WOKEN;
  *         schedule()                           try_to_wake_up();
  *     p->state = TASK_RUNNING;             ~~~~~~~~~~~~~~~~~~
- *     wait->flags &= ~WQ_FLAG_WOKEN;           condition = true;
+ *     wq_entry->flags &= ~WQ_FLAG_WOKEN;               condition = true;
  *     smp_mb() // B                            smp_wmb(); // C
- *                                              wait->flags |= WQ_FLAG_WOKEN;
+ *                                              wq_entry->flags |= WQ_FLAG_WOKEN;
  * }
- * remove_wait_queue(&wq, &wait);
+ * remove_wait_queue(&wq_head, &wait);
  *
  */
-long wait_woken(wait_queue_t *wait, unsigned mode, long timeout)
+long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout)
 {
         set_current_state(mode); /* A */
         /*
@@ -359,7 +359,7 @@ long wait_woken(wait_queue_t *wait, unsigned mode, long timeout)
          * woken_wake_function() such that if we observe WQ_FLAG_WOKEN we must
          * also observe all state before the wakeup.
          */
-        if (!(wait->flags & WQ_FLAG_WOKEN) && !is_kthread_should_stop())
+        if (!(wq_entry->flags & WQ_FLAG_WOKEN) && !is_kthread_should_stop())
                 timeout = schedule_timeout(timeout);
         __set_current_state(TASK_RUNNING);
 
@@ -369,13 +369,13 @@ long wait_woken(wait_queue_t *wait, unsigned mode, long timeout)
          * condition being true _OR_ WQ_FLAG_WOKEN such that we will not miss
          * an event.
          */
-        smp_store_mb(wait->flags, wait->flags & ~WQ_FLAG_WOKEN); /* B */
+        smp_store_mb(wq_entry->flags, wq_entry->flags & ~WQ_FLAG_WOKEN); /* B */
 
         return timeout;
 }
 EXPORT_SYMBOL(wait_woken);
 
-int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
+int woken_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key)
 {
         /*
          * Although this function is called under waitqueue lock, LOCK
@@ -385,267 +385,8 @@ int woken_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
          * and is paired with smp_store_mb() in wait_woken().
          */
         smp_wmb(); /* C */
-        wait->flags |= WQ_FLAG_WOKEN;
+        wq_entry->flags |= WQ_FLAG_WOKEN;
 
-        return default_wake_function(wait, mode, sync, key);
+        return default_wake_function(wq_entry, mode, sync, key);
 }
 EXPORT_SYMBOL(woken_wake_function);
-
-int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *arg)
-{
-        struct wait_bit_key *key = arg;
-        struct wait_bit_queue *wait_bit
-                = container_of(wait, struct wait_bit_queue, wait);
-
-        if (wait_bit->key.flags != key->flags ||
-                        wait_bit->key.bit_nr != key->bit_nr ||
-                        test_bit(key->bit_nr, key->flags))
-                return 0;
-        else
-                return autoremove_wake_function(wait, mode, sync, key);
-}
-EXPORT_SYMBOL(wake_bit_function);
-
-/*
- * To allow interruptible waiting and asynchronous (i.e. nonblocking)
- * waiting, the actions of __wait_on_bit() and __wait_on_bit_lock() are
- * permitted return codes. Nonzero return codes halt waiting and return.
- */
-int __sched
-__wait_on_bit(wait_queue_head_t *wq, struct wait_bit_queue *q,
-              wait_bit_action_f *action, unsigned mode)
-{
-        int ret = 0;
-
-        do {
-                prepare_to_wait(wq, &q->wait, mode);
-                if (test_bit(q->key.bit_nr, q->key.flags))
-                        ret = (*action)(&q->key, mode);
-        } while (test_bit(q->key.bit_nr, q->key.flags) && !ret);
-        finish_wait(wq, &q->wait);
-        return ret;
-}
-EXPORT_SYMBOL(__wait_on_bit);
-
-int __sched out_of_line_wait_on_bit(void *word, int bit,
-                                    wait_bit_action_f *action, unsigned mode)
-{
-        wait_queue_head_t *wq = bit_waitqueue(word, bit);
-        DEFINE_WAIT_BIT(wait, word, bit);
-
-        return __wait_on_bit(wq, &wait, action, mode);
-}
-EXPORT_SYMBOL(out_of_line_wait_on_bit);
-
-int __sched out_of_line_wait_on_bit_timeout(
-        void *word, int bit, wait_bit_action_f *action,
-        unsigned mode, unsigned long timeout)
-{
-        wait_queue_head_t *wq = bit_waitqueue(word, bit);
-        DEFINE_WAIT_BIT(wait, word, bit);
-
-        wait.key.timeout = jiffies + timeout;
-        return __wait_on_bit(wq, &wait, action, mode);
-}
-EXPORT_SYMBOL_GPL(out_of_line_wait_on_bit_timeout);
-
-int __sched
-__wait_on_bit_lock(wait_queue_head_t *wq, struct wait_bit_queue *q,
-                        wait_bit_action_f *action, unsigned mode)
-{
-        int ret = 0;
-
-        for (;;) {
-                prepare_to_wait_exclusive(wq, &q->wait, mode);
-                if (test_bit(q->key.bit_nr, q->key.flags)) {
-                        ret = action(&q->key, mode);
-                        /*
-                         * See the comment in prepare_to_wait_event().
-                         * finish_wait() does not necessarily takes wq->lock,
-                         * but test_and_set_bit() implies mb() which pairs with
-                         * smp_mb__after_atomic() before wake_up_page().
-                         */
-                        if (ret)
-                                finish_wait(wq, &q->wait);
-                }
-                if (!test_and_set_bit(q->key.bit_nr, q->key.flags)) {
-                        if (!ret)
-                                finish_wait(wq, &q->wait);
-                        return 0;
-                } else if (ret) {
-                        return ret;
-                }
-        }
-}
-EXPORT_SYMBOL(__wait_on_bit_lock);
-
-int __sched out_of_line_wait_on_bit_lock(void *word, int bit,
-                                         wait_bit_action_f *action, unsigned mode)
-{
-        wait_queue_head_t *wq = bit_waitqueue(word, bit);
-        DEFINE_WAIT_BIT(wait, word, bit);
-
-        return __wait_on_bit_lock(wq, &wait, action, mode);
-}
-EXPORT_SYMBOL(out_of_line_wait_on_bit_lock);
-
-void __wake_up_bit(wait_queue_head_t *wq, void *word, int bit)
-{
-        struct wait_bit_key key = __WAIT_BIT_KEY_INITIALIZER(word, bit);
-        if (waitqueue_active(wq))
-                __wake_up(wq, TASK_NORMAL, 1, &key);
-}
-EXPORT_SYMBOL(__wake_up_bit);
-
-/**
- * wake_up_bit - wake up a waiter on a bit
- * @word: the word being waited on, a kernel virtual address
- * @bit: the bit of the word being waited on
- *
- * There is a standard hashed waitqueue table for generic use. This
- * is the part of the hashtable's accessor API that wakes up waiters
- * on a bit. For instance, if one were to have waiters on a bitflag,
- * one would call wake_up_bit() after clearing the bit.
- *
- * In order for this to function properly, as it uses waitqueue_active()
- * internally, some kind of memory barrier must be done prior to calling
- * this. Typically, this will be smp_mb__after_atomic(), but in some
- * cases where bitflags are manipulated non-atomically under a lock, one
- * may need to use a less regular barrier, such fs/inode.c's smp_mb(),
- * because spin_unlock() does not guarantee a memory barrier.
- */
-void wake_up_bit(void *word, int bit)
-{
-        __wake_up_bit(bit_waitqueue(word, bit), word, bit);
-}
-EXPORT_SYMBOL(wake_up_bit);
-
-/*
- * Manipulate the atomic_t address to produce a better bit waitqueue table hash
- * index (we're keying off bit -1, but that would produce a horrible hash
- * value).
- */
-static inline wait_queue_head_t *atomic_t_waitqueue(atomic_t *p)
-{
-        if (BITS_PER_LONG == 64) {
-                unsigned long q = (unsigned long)p;
-                return bit_waitqueue((void *)(q & ~1), q & 1);
-        }
-        return bit_waitqueue(p, 0);
-}
-
-static int wake_atomic_t_function(wait_queue_t *wait, unsigned mode, int sync,
-                                  void *arg)
-{
-        struct wait_bit_key *key = arg;
-        struct wait_bit_queue *wait_bit
-                = container_of(wait, struct wait_bit_queue, wait);
-        atomic_t *val = key->flags;
-
-        if (wait_bit->key.flags != key->flags ||
-            wait_bit->key.bit_nr != key->bit_nr ||
-            atomic_read(val) != 0)
-                return 0;
-        return autoremove_wake_function(wait, mode, sync, key);
-}
-
-/*
- * To allow interruptible waiting and asynchronous (i.e. nonblocking) waiting,
- * the actions of __wait_on_atomic_t() are permitted return codes.  Nonzero
- * return codes halt waiting and return.
- */
-static __sched
-int __wait_on_atomic_t(wait_queue_head_t *wq, struct wait_bit_queue *q,
-                       int (*action)(atomic_t *), unsigned mode)
-{
-        atomic_t *val;
-        int ret = 0;
-
-        do {
-                prepare_to_wait(wq, &q->wait, mode);
-                val = q->key.flags;
-                if (atomic_read(val) == 0)
-                        break;
-                ret = (*action)(val);
-        } while (!ret && atomic_read(val) != 0);
-        finish_wait(wq, &q->wait);
-        return ret;
-}
-
-#define DEFINE_WAIT_ATOMIC_T(name, p)                                   \
-        struct wait_bit_queue name = {                                  \
-                .key = __WAIT_ATOMIC_T_KEY_INITIALIZER(p),              \
-                .wait   = {                                             \
-                        .private        = current,                      \
-                        .func           = wake_atomic_t_function,       \
-                        .task_list      =                               \
-                                LIST_HEAD_INIT((name).wait.task_list),  \
-                },                                                      \
-        }
-
-__sched int out_of_line_wait_on_atomic_t(atomic_t *p, int (*action)(atomic_t *),
-                                         unsigned mode)
-{
-        wait_queue_head_t *wq = atomic_t_waitqueue(p);
-        DEFINE_WAIT_ATOMIC_T(wait, p);
-
-        return __wait_on_atomic_t(wq, &wait, action, mode);
-}
-EXPORT_SYMBOL(out_of_line_wait_on_atomic_t);
-
-/**
- * wake_up_atomic_t - Wake up a waiter on a atomic_t
- * @p: The atomic_t being waited on, a kernel virtual address
- *
- * Wake up anyone waiting for the atomic_t to go to zero.
- *
- * Abuse the bit-waker function and its waitqueue hash table set (the atomic_t
- * check is done by the waiter's wake function, not the by the waker itself).
- */
-void wake_up_atomic_t(atomic_t *p)
-{
-        __wake_up_bit(atomic_t_waitqueue(p), p, WAIT_ATOMIC_T_BIT_NR);
-}
-EXPORT_SYMBOL(wake_up_atomic_t);
-
-__sched int bit_wait(struct wait_bit_key *word, int mode)
-{
-        schedule();
-        if (signal_pending_state(mode, current))
-                return -EINTR;
-        return 0;
-}
-EXPORT_SYMBOL(bit_wait);
-
-__sched int bit_wait_io(struct wait_bit_key *word, int mode)
-{
-        io_schedule();
-        if (signal_pending_state(mode, current))
-                return -EINTR;
-        return 0;
-}
-EXPORT_SYMBOL(bit_wait_io);
-
-__sched int bit_wait_timeout(struct wait_bit_key *word, int mode)
-{
-        unsigned long now = READ_ONCE(jiffies);
-        if (time_after_eq(now, word->timeout))
-                return -EAGAIN;
-        schedule_timeout(word->timeout - now);
-        if (signal_pending_state(mode, current))
-                return -EINTR;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(bit_wait_timeout);
-
-__sched int bit_wait_io_timeout(struct wait_bit_key *word, int mode)
-{
-        unsigned long now = READ_ONCE(jiffies);
-        if (time_after_eq(now, word->timeout))
-                return -EAGAIN;
-        io_schedule_timeout(word->timeout - now);
-        if (signal_pending_state(mode, current))
-                return -EINTR;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(bit_wait_io_timeout);
diff --git a/kernel/sched/wait_bit.c b/kernel/sched/wait_bit.c
new file mode 100644
index 000000000000..f8159698aa4d
--- /dev/null
+++ b/kernel/sched/wait_bit.c
@@ -0,0 +1,286 @@
+/*
+ * The implementation of the wait_bit*() and related waiting APIs:
+ */
+#include <linux/wait_bit.h>
+#include <linux/sched/signal.h>
+#include <linux/sched/debug.h>
+#include <linux/hash.h>
+
+#define WAIT_TABLE_BITS 8
+#define WAIT_TABLE_SIZE (1 << WAIT_TABLE_BITS)
+
+static wait_queue_head_t bit_wait_table[WAIT_TABLE_SIZE] __cacheline_aligned;
+
+wait_queue_head_t *bit_waitqueue(void *word, int bit)
+{
+        const int shift = BITS_PER_LONG == 32 ? 5 : 6;
+        unsigned long val = (unsigned long)word << shift | bit;
+
+        return bit_wait_table + hash_long(val, WAIT_TABLE_BITS);
+}
+EXPORT_SYMBOL(bit_waitqueue);
+
+int wake_bit_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *arg)
+{
+        struct wait_bit_key *key = arg;
+        struct wait_bit_queue_entry *wait_bit = container_of(wq_entry, struct wait_bit_queue_entry, wq_entry);
+
+        if (wait_bit->key.flags != key->flags ||
+                        wait_bit->key.bit_nr != key->bit_nr ||
+                        test_bit(key->bit_nr, key->flags))
+                return 0;
+        else
+                return autoremove_wake_function(wq_entry, mode, sync, key);
+}
+EXPORT_SYMBOL(wake_bit_function);
+
+/*
+ * To allow interruptible waiting and asynchronous (i.e. nonblocking)
+ * waiting, the actions of __wait_on_bit() and __wait_on_bit_lock() are
+ * permitted return codes. Nonzero return codes halt waiting and return.
+ */
+int __sched
+__wait_on_bit(struct wait_queue_head *wq_head, struct wait_bit_queue_entry *wbq_entry,
+              wait_bit_action_f *action, unsigned mode)
+{
+        int ret = 0;
+
+        do {
+                prepare_to_wait(wq_head, &wbq_entry->wq_entry, mode);
+                if (test_bit(wbq_entry->key.bit_nr, wbq_entry->key.flags))
+                        ret = (*action)(&wbq_entry->key, mode);
+        } while (test_bit(wbq_entry->key.bit_nr, wbq_entry->key.flags) && !ret);
+        finish_wait(wq_head, &wbq_entry->wq_entry);
+        return ret;
+}
+EXPORT_SYMBOL(__wait_on_bit);
+
+int __sched out_of_line_wait_on_bit(void *word, int bit,
+                                    wait_bit_action_f *action, unsigned mode)
+{
+        struct wait_queue_head *wq_head = bit_waitqueue(word, bit);
+        DEFINE_WAIT_BIT(wq_entry, word, bit);
+
+        return __wait_on_bit(wq_head, &wq_entry, action, mode);
+}
+EXPORT_SYMBOL(out_of_line_wait_on_bit);
+
+int __sched out_of_line_wait_on_bit_timeout(
+        void *word, int bit, wait_bit_action_f *action,
+        unsigned mode, unsigned long timeout)
+{
+        struct wait_queue_head *wq_head = bit_waitqueue(word, bit);
+        DEFINE_WAIT_BIT(wq_entry, word, bit);
+
+        wq_entry.key.timeout = jiffies + timeout;
+        return __wait_on_bit(wq_head, &wq_entry, action, mode);
+}
+EXPORT_SYMBOL_GPL(out_of_line_wait_on_bit_timeout);
+
+int __sched
+__wait_on_bit_lock(struct wait_queue_head *wq_head, struct wait_bit_queue_entry *wbq_entry,
+                        wait_bit_action_f *action, unsigned mode)
+{
+        int ret = 0;
+
+        for (;;) {
+                prepare_to_wait_exclusive(wq_head, &wbq_entry->wq_entry, mode);
+                if (test_bit(wbq_entry->key.bit_nr, wbq_entry->key.flags)) {
+                        ret = action(&wbq_entry->key, mode);
+                        /*
+                         * See the comment in prepare_to_wait_event().
+                         * finish_wait() does not necessarily takes wwq_head->lock,
+                         * but test_and_set_bit() implies mb() which pairs with
+                         * smp_mb__after_atomic() before wake_up_page().
+                         */
+                        if (ret)
+                                finish_wait(wq_head, &wbq_entry->wq_entry);
+                }
+                if (!test_and_set_bit(wbq_entry->key.bit_nr, wbq_entry->key.flags)) {
+                        if (!ret)
+                                finish_wait(wq_head, &wbq_entry->wq_entry);
+                        return 0;
+                } else if (ret) {
+                        return ret;
+                }
+        }
+}
+EXPORT_SYMBOL(__wait_on_bit_lock);
+
+int __sched out_of_line_wait_on_bit_lock(void *word, int bit,
+                                         wait_bit_action_f *action, unsigned mode)
+{
+        struct wait_queue_head *wq_head = bit_waitqueue(word, bit);
+        DEFINE_WAIT_BIT(wq_entry, word, bit);
+
+        return __wait_on_bit_lock(wq_head, &wq_entry, action, mode);
+}
+EXPORT_SYMBOL(out_of_line_wait_on_bit_lock);
+
+void __wake_up_bit(struct wait_queue_head *wq_head, void *word, int bit)
+{
+        struct wait_bit_key key = __WAIT_BIT_KEY_INITIALIZER(word, bit);
+        if (waitqueue_active(wq_head))
+                __wake_up(wq_head, TASK_NORMAL, 1, &key);
+}
+EXPORT_SYMBOL(__wake_up_bit);
+
+/**
+ * wake_up_bit - wake up a waiter on a bit
+ * @word: the word being waited on, a kernel virtual address
+ * @bit: the bit of the word being waited on
+ *
+ * There is a standard hashed waitqueue table for generic use. This
+ * is the part of the hashtable's accessor API that wakes up waiters
+ * on a bit. For instance, if one were to have waiters on a bitflag,
+ * one would call wake_up_bit() after clearing the bit.
+ *
+ * In order for this to function properly, as it uses waitqueue_active()
+ * internally, some kind of memory barrier must be done prior to calling
+ * this. Typically, this will be smp_mb__after_atomic(), but in some
+ * cases where bitflags are manipulated non-atomically under a lock, one
+ * may need to use a less regular barrier, such fs/inode.c's smp_mb(),
+ * because spin_unlock() does not guarantee a memory barrier.
+ */
+void wake_up_bit(void *word, int bit)
+{
+        __wake_up_bit(bit_waitqueue(word, bit), word, bit);
+}
+EXPORT_SYMBOL(wake_up_bit);
+
+/*
+ * Manipulate the atomic_t address to produce a better bit waitqueue table hash
+ * index (we're keying off bit -1, but that would produce a horrible hash
+ * value).
+ */
+static inline wait_queue_head_t *atomic_t_waitqueue(atomic_t *p)
+{
+        if (BITS_PER_LONG == 64) {
+                unsigned long q = (unsigned long)p;
+                return bit_waitqueue((void *)(q & ~1), q & 1);
+        }
+        return bit_waitqueue(p, 0);
+}
+
+static int wake_atomic_t_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync,
+                                  void *arg)
+{
+        struct wait_bit_key *key = arg;
+        struct wait_bit_queue_entry *wait_bit = container_of(wq_entry, struct wait_bit_queue_entry, wq_entry);
+        atomic_t *val = key->flags;
+
+        if (wait_bit->key.flags != key->flags ||
+            wait_bit->key.bit_nr != key->bit_nr ||
+            atomic_read(val) != 0)
+                return 0;
+        return autoremove_wake_function(wq_entry, mode, sync, key);
+}
+
+/*
+ * To allow interruptible waiting and asynchronous (i.e. nonblocking) waiting,
+ * the actions of __wait_on_atomic_t() are permitted return codes.  Nonzero
+ * return codes halt waiting and return.
+ */
+static __sched
+int __wait_on_atomic_t(struct wait_queue_head *wq_head, struct wait_bit_queue_entry *wbq_entry,
+                       int (*action)(atomic_t *), unsigned mode)
+{
+        atomic_t *val;
+        int ret = 0;
+
+        do {
+                prepare_to_wait(wq_head, &wbq_entry->wq_entry, mode);
+                val = wbq_entry->key.flags;
+                if (atomic_read(val) == 0)
+                        break;
+                ret = (*action)(val);
+        } while (!ret && atomic_read(val) != 0);
+        finish_wait(wq_head, &wbq_entry->wq_entry);
+        return ret;
+}
+
+#define DEFINE_WAIT_ATOMIC_T(name, p)                                   \
+        struct wait_bit_queue_entry name = {                            \
+                .key = __WAIT_ATOMIC_T_KEY_INITIALIZER(p),              \
+                .wq_entry = {                                           \
+                        .private        = current,                      \
+                        .func           = wake_atomic_t_function,       \
+                        .entry          =                               \
+                                LIST_HEAD_INIT((name).wq_entry.entry),  \
+                },                                                      \
+        }
+
+__sched int out_of_line_wait_on_atomic_t(atomic_t *p, int (*action)(atomic_t *),
+                                         unsigned mode)
+{
+        struct wait_queue_head *wq_head = atomic_t_waitqueue(p);
+        DEFINE_WAIT_ATOMIC_T(wq_entry, p);
+
+        return __wait_on_atomic_t(wq_head, &wq_entry, action, mode);
+}
+EXPORT_SYMBOL(out_of_line_wait_on_atomic_t);
+
+/**
+ * wake_up_atomic_t - Wake up a waiter on a atomic_t
+ * @p: The atomic_t being waited on, a kernel virtual address
+ *
+ * Wake up anyone waiting for the atomic_t to go to zero.
+ *
+ * Abuse the bit-waker function and its waitqueue hash table set (the atomic_t
+ * check is done by the waiter's wake function, not the by the waker itself).
+ */
+void wake_up_atomic_t(atomic_t *p)
+{
+        __wake_up_bit(atomic_t_waitqueue(p), p, WAIT_ATOMIC_T_BIT_NR);
+}
+EXPORT_SYMBOL(wake_up_atomic_t);
+
+__sched int bit_wait(struct wait_bit_key *word, int mode)
+{
+        schedule();
+        if (signal_pending_state(mode, current))
+                return -EINTR;
+        return 0;
+}
+EXPORT_SYMBOL(bit_wait);
+
+__sched int bit_wait_io(struct wait_bit_key *word, int mode)
+{
+        io_schedule();
+        if (signal_pending_state(mode, current))
+                return -EINTR;
+        return 0;
+}
+EXPORT_SYMBOL(bit_wait_io);
+
+__sched int bit_wait_timeout(struct wait_bit_key *word, int mode)
+{
+        unsigned long now = READ_ONCE(jiffies);
+        if (time_after_eq(now, word->timeout))
+                return -EAGAIN;
+        schedule_timeout(word->timeout - now);
+        if (signal_pending_state(mode, current))
+                return -EINTR;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(bit_wait_timeout);
+
+__sched int bit_wait_io_timeout(struct wait_bit_key *word, int mode)
+{
+        unsigned long now = READ_ONCE(jiffies);
+        if (time_after_eq(now, word->timeout))
+                return -EAGAIN;
+        io_schedule_timeout(word->timeout - now);
+        if (signal_pending_state(mode, current))
+                return -EINTR;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(bit_wait_io_timeout);
+
+void __init wait_bit_init(void)
+{
+        int i;
+
+        for (i = 0; i < WAIT_TABLE_SIZE; i++)
+                init_waitqueue_head(bit_wait_table + i);
+}
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 5cb5b0008d97..ee2f4202d82a 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -387,7 +387,7 @@ void alarm_start_relative(struct alarm *alarm, ktime_t start)
 {
         struct alarm_base *base = &alarm_bases[alarm->type];
 
-        start = ktime_add(start, base->gettime());
+        start = ktime_add_safe(start, base->gettime());
         alarm_start(alarm, start);
 }
 EXPORT_SYMBOL_GPL(alarm_start_relative);
@@ -475,7 +475,7 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval)
                 overrun++;
         }
 
-        alarm->node.expires = ktime_add(alarm->node.expires, interval);
+        alarm->node.expires = ktime_add_safe(alarm->node.expires, interval);
         return overrun;
 }
 EXPORT_SYMBOL_GPL(alarm_forward);
@@ -660,13 +660,21 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
 
         /* start the timer */
         timr->it.alarm.interval = timespec64_to_ktime(new_setting->it_interval);
+
+        /*
+         * Rate limit to the tick as a hot fix to prevent DOS. Will be
+         * mopped up later.
+         */
+        if (timr->it.alarm.interval < TICK_NSEC)
+                timr->it.alarm.interval = TICK_NSEC;
+
         exp = timespec64_to_ktime(new_setting->it_value);
         /* Convert (if necessary) to absolute time */
         if (flags != TIMER_ABSTIME) {
                 ktime_t now;
 
                 now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
-                exp = ktime_add(now, exp);
+                exp = ktime_add_safe(now, exp);
         }
 
         alarm_start(&timr->it.alarm.alarmtimer, exp);
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 1370f067fb51..d2a1e6dd0291 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -825,8 +825,10 @@ static void check_thread_timers(struct task_struct *tsk,
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
                          */
-                        pr_info("CPU Watchdog Timeout (hard): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("CPU Watchdog Timeout (hard): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
@@ -838,8 +840,10 @@ static void check_thread_timers(struct task_struct *tsk,
                                 soft += USEC_PER_SEC;
                                 sig->rlim[RLIMIT_RTTIME].rlim_cur = soft;
                         }
-                        pr_info("RT Watchdog Timeout (soft): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("RT Watchdog Timeout (soft): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
                 }
         }
@@ -936,8 +940,10 @@ static void check_process_timers(struct task_struct *tsk,
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
                          */
-                        pr_info("RT Watchdog Timeout (hard): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("RT Watchdog Timeout (hard): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
@@ -945,8 +951,10 @@ static void check_process_timers(struct task_struct *tsk,
                         /*
                          * At the soft limit, send a SIGXCPU every second.
                          */
-                        pr_info("CPU Watchdog Timeout (soft): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("CPU Watchdog Timeout (soft): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
                         if (soft < hard) {
                                 soft++;
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 987e496bb51a..b398c2ea69b2 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -37,9 +37,11 @@ static int tick_broadcast_forced;
 static __cacheline_aligned_in_smp DEFINE_RAW_SPINLOCK(tick_broadcast_lock);
 
 #ifdef CONFIG_TICK_ONESHOT
+static void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 static void tick_broadcast_clear_oneshot(int cpu);
 static void tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 #else
+static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc) { BUG(); }
 static inline void tick_broadcast_clear_oneshot(int cpu) { }
 static inline void tick_resume_broadcast_oneshot(struct clock_event_device *bc) { }
 #endif
@@ -867,7 +869,7 @@ static void tick_broadcast_init_next_event(struct cpumask *mask,
 /**
  * tick_broadcast_setup_oneshot - setup the broadcast device
  */
-void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
+static void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
         int cpu = smp_processor_id();
 
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index f738251000fe..be0ac01f2e12 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -126,7 +126,6 @@ static inline int tick_check_oneshot_change(int allow_nohz) { return 0; }
 
 /* Functions related to oneshot broadcasting */
 #if defined(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST) && defined(CONFIG_TICK_ONESHOT)
-extern void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int cpu);
 extern int tick_broadcast_oneshot_active(void);
@@ -134,7 +133,6 @@ extern void tick_check_oneshot_broadcast_this_cpu(void);
 bool tick_broadcast_oneshot_available(void);
 extern struct cpumask *tick_get_broadcast_oneshot_mask(void);
 #else /* !(BROADCAST && ONESHOT): */
-static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc) { BUG(); }
 static inline void tick_broadcast_switch_to_oneshot(void) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int cpu) { }
 static inline int tick_broadcast_oneshot_active(void) { return 0; }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 74fdfe9ed3db..9e5841dc14b5 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5063,7 +5063,7 @@ ftrace_graph_release(struct inode *inode, struct file *file)
         }
 
  out:
-        kfree(fgd->new_hash);
+        free_ftrace_hash(fgd->new_hash);
         kfree(fgd);
 
         return ret;
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index c74bf39ef764..a86688fabc55 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2864,11 +2864,11 @@ bool flush_work(struct work_struct *work)
 EXPORT_SYMBOL_GPL(flush_work);
 
 struct cwt_wait {
-        wait_queue_t            wait;
+        wait_queue_entry_t              wait;
         struct work_struct      *work;
 };
 
-static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int cwt_wakefn(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
 
diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
index 74a54b7f2562..9f79547d1b97 100644
--- a/lib/libcrc32c.c
+++ b/lib/libcrc32c.c
@@ -43,7 +43,7 @@ static struct crypto_shash *tfm;
 u32 crc32c(u32 crc, const void *address, unsigned int length)
 {
         SHASH_DESC_ON_STACK(shash, tfm);
-        u32 *ctx = (u32 *)shash_desc_ctx(shash);
+        u32 ret, *ctx = (u32 *)shash_desc_ctx(shash);
         int err;
 
         shash->tfm = tfm;
@@ -53,7 +53,9 @@ u32 crc32c(u32 crc, const void *address, unsigned int length)
         err = crypto_shash_update(shash, address, length);
         BUG_ON(err);
 
-        return *ctx;
+        ret = *ctx;
+        barrier_data(ctx);
+        return ret;
 }
 
 EXPORT_SYMBOL(crc32c);
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 889bc31785be..be88cbaadde3 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -4504,6 +4504,44 @@ static struct bpf_test tests[] = {
                 { },
                 { { 0, 1 } },
         },
+        {
+                "JMP_JSGE_K: Signed jump: value walk 1",
+                .u.insns_int = {
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_LD_IMM64(R1, -3),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 6),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 4),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 2),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 1),
+                        BPF_EXIT_INSN(),                /* bad exit */
+                        BPF_ALU32_IMM(BPF_MOV, R0, 1),  /* good exit */
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 1 } },
+        },
+        {
+                "JMP_JSGE_K: Signed jump: value walk 2",
+                .u.insns_int = {
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_LD_IMM64(R1, -3),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 4),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 2),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 2),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 2),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 1),
+                        BPF_EXIT_INSN(),                /* bad exit */
+                        BPF_ALU32_IMM(BPF_MOV, R0, 1),  /* good exit */
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 1 } },
+        },
         /* BPF_JMP | BPF_JGT | BPF_K */
         {
                 "JMP_JGT_K: if (3 > 2) return 1",
diff --git a/mm/filemap.c b/mm/filemap.c
index 6f1be573a5e6..926484561624 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -768,10 +768,10 @@ struct wait_page_key {
 struct wait_page_queue {
         struct page *page;
         int bit_nr;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 };
 
-static int wake_page_function(wait_queue_t *wait, unsigned mode, int sync, void *arg)
+static int wake_page_function(wait_queue_entry_t *wait, unsigned mode, int sync, void *arg)
 {
         struct wait_page_key *key = arg;
         struct wait_page_queue *wait_page
@@ -834,7 +834,7 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q,
                 struct page *page, int bit_nr, int state, bool lock)
 {
         struct wait_page_queue wait_page;
-        wait_queue_t *wait = &wait_page.wait;
+        wait_queue_entry_t *wait = &wait_page.wait;
         int ret = 0;
 
         init_wait(wait);
@@ -845,9 +845,9 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q,
         for (;;) {
                 spin_lock_irq(&q->lock);
 
-                if (likely(list_empty(&wait->task_list))) {
+                if (likely(list_empty(&wait->entry))) {
                         if (lock)
-                                __add_wait_queue_tail_exclusive(q, wait);
+                                __add_wait_queue_entry_tail_exclusive(q, wait);
                         else
                                 __add_wait_queue(q, wait);
                         SetPageWaiters(page);
@@ -907,7 +907,7 @@ int wait_on_page_bit_killable(struct page *page, int bit_nr)
  *
  * Add an arbitrary @waiter to the wait queue for the nominated @page.
  */
-void add_page_wait_queue(struct page *page, wait_queue_t *waiter)
+void add_page_wait_queue(struct page *page, wait_queue_entry_t *waiter)
 {
         wait_queue_head_t *q = page_waitqueue(page);
         unsigned long flags;
diff --git a/mm/gup.c b/mm/gup.c
index d9e6fddcc51f..576c4df58882 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -387,11 +387,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
         /* mlock all present pages, but do not fault in new pages */
         if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK)
                 return -ENOENT;
-        /* For mm_populate(), just skip the stack guard page. */
-        if ((*flags & FOLL_POPULATE) &&
-                        (stack_guard_page_start(vma, address) ||
-                         stack_guard_page_end(vma, address + PAGE_SIZE)))
-                return -ENOENT;
         if (*flags & FOLL_WRITE)
                 fault_flags |= FAULT_FLAG_WRITE;
         if (*flags & FOLL_REMOTE)
@@ -407,12 +402,10 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
 
         ret = handle_mm_fault(vma, address, fault_flags);
         if (ret & VM_FAULT_ERROR) {
-                if (ret & VM_FAULT_OOM)
-                        return -ENOMEM;
-                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
-                        return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT;
-                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
-                        return -EFAULT;
+                int err = vm_fault_to_errno(ret, *flags);
+
+                if (err)
+                        return err;
                 BUG();
         }
 
@@ -723,12 +716,10 @@ retry:
         ret = handle_mm_fault(vma, address, fault_flags);
         major |= ret & VM_FAULT_MAJOR;
         if (ret & VM_FAULT_ERROR) {
-                if (ret & VM_FAULT_OOM)
-                        return -ENOMEM;
-                if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
-                        return -EHWPOISON;
-                if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
-                        return -EFAULT;
+                int err = vm_fault_to_errno(ret, 0);
+
+                if (err)
+                        return err;
                 BUG();
         }
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index a84909cf20d3..88c6167f194d 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1426,8 +1426,11 @@ int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
          */
         if (unlikely(pmd_trans_migrating(*vmf->pmd))) {
                 page = pmd_page(*vmf->pmd);
+                if (!get_page_unless_zero(page))
+                        goto out_unlock;
                 spin_unlock(vmf->ptl);
                 wait_on_page_locked(page);
+                put_page(page);
                 goto out;
         }
 
@@ -1459,9 +1462,12 @@ int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
 
         /* Migration could have started since the pmd_trans_migrating check */
         if (!page_locked) {
+                page_nid = -1;
+                if (!get_page_unless_zero(page))
+                        goto out_unlock;
                 spin_unlock(vmf->ptl);
                 wait_on_page_locked(page);
-                page_nid = -1;
+                put_page(page);
                 goto out;
         }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e5828875f7bb..3eedb187e549 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4170,6 +4170,11 @@ long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                         }
                         ret = hugetlb_fault(mm, vma, vaddr, fault_flags);
                         if (ret & VM_FAULT_ERROR) {
+                                int err = vm_fault_to_errno(ret, flags);
+
+                                if (err)
+                                        return err;
+
                                 remainder = 0;
                                 break;
                         }
diff --git a/mm/ksm.c b/mm/ksm.c
index d9fc0e456128..216184af0e19 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1028,8 +1028,7 @@ static int try_to_merge_one_page(struct vm_area_struct *vma,
                 goto out;
 
         if (PageTransCompound(page)) {
-                err = split_huge_page(page);
-                if (err)
+                if (split_huge_page(page))
                         goto out_unlock;
         }
 
diff --git a/mm/memblock.c b/mm/memblock.c
index b049c9b2dba8..7b8a5db76a2f 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1739,6 +1739,29 @@ static void __init_memblock memblock_dump(struct memblock_type *type)
         }
 }
 
+extern unsigned long __init_memblock
+memblock_reserved_memory_within(phys_addr_t start_addr, phys_addr_t end_addr)
+{
+        struct memblock_region *rgn;
+        unsigned long size = 0;
+        int idx;
+
+        for_each_memblock_type((&memblock.reserved), rgn) {
+                phys_addr_t start, end;
+
+                if (rgn->base + rgn->size < start_addr)
+                        continue;
+                if (rgn->base > end_addr)
+                        continue;
+
+                start = rgn->base;
+                end = start + rgn->size;
+                size += end - start;
+        }
+
+        return size;
+}
+
 void __init_memblock __memblock_dump_all(void)
 {
         pr_info("MEMBLOCK configuration:\n");
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 94172089f52f..d75b38b66ef6 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -170,7 +170,7 @@ struct mem_cgroup_event {
          */
         poll_table pt;
         wait_queue_head_t *wqh;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         struct work_struct remove;
 };
 
@@ -1479,10 +1479,10 @@ static DECLARE_WAIT_QUEUE_HEAD(memcg_oom_waitq);
 
 struct oom_wait_info {
         struct mem_cgroup *memcg;
-        wait_queue_t    wait;
+        wait_queue_entry_t      wait;
 };
 
-static int memcg_oom_wake_function(wait_queue_t *wait,
+static int memcg_oom_wake_function(wait_queue_entry_t *wait,
         unsigned mode, int sync, void *arg)
 {
         struct mem_cgroup *wake_memcg = (struct mem_cgroup *)arg;
@@ -1570,7 +1570,7 @@ bool mem_cgroup_oom_synchronize(bool handle)
         owait.wait.flags = 0;
         owait.wait.func = memcg_oom_wake_function;
         owait.wait.private = current;
-        INIT_LIST_HEAD(&owait.wait.task_list);
+        INIT_LIST_HEAD(&owait.wait.entry);
 
         prepare_to_wait(&memcg_oom_waitq, &owait.wait, TASK_KILLABLE);
         mem_cgroup_mark_under_oom(memcg);
@@ -3725,7 +3725,7 @@ static void memcg_event_remove(struct work_struct *work)
  *
  * Called with wqh->lock held and interrupts disabled.
  */
-static int memcg_event_wake(wait_queue_t *wait, unsigned mode,
+static int memcg_event_wake(wait_queue_entry_t *wait, unsigned mode,
                             int sync, void *key)
 {
         struct mem_cgroup_event *event =
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 2527dfeddb00..ecc183fd94f3 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1184,7 +1184,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
          * page_remove_rmap() in try_to_unmap_one(). So to determine page status
          * correctly, we save a copy of the page flags at this time.
          */
-        page_flags = p->flags;
+        if (PageHuge(p))
+                page_flags = hpage->flags;
+        else
+                page_flags = p->flags;
 
         /*
          * unpoison always clear PG_hwpoison inside page lock
@@ -1595,12 +1598,8 @@ static int soft_offline_huge_page(struct page *page, int flags)
         if (ret) {
                 pr_info("soft offline: %#lx: migration failed %d, type %lx (%pGp)\n",
                         pfn, ret, page->flags, &page->flags);
-                /*
-                 * We know that soft_offline_huge_page() tries to migrate
-                 * only one hugepage pointed to by hpage, so we need not
-                 * run through the pagelist here.
-                 */
-                putback_active_hugepage(hpage);
+                if (!list_empty(&pagelist))
+                        putback_movable_pages(&pagelist);
                 if (ret > 0)
                         ret = -EIO;
         } else {
diff --git a/mm/memory.c b/mm/memory.c
index 6ff5d729ded0..bb11c474857e 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2855,40 +2855,6 @@ out_release:
 }
 
 /*
- * This is like a special single-page "expand_{down|up}wards()",
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
- */
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-{
-        address &= PAGE_MASK;
-        if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-                struct vm_area_struct *prev = vma->vm_prev;
-
-                /*
-                 * Is there a mapping abutting this one below?
-                 *
-                 * That's only ok if it's the same stack mapping
-                 * that has gotten split..
-                 */
-                if (prev && prev->vm_end == address)
-                        return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-
-                return expand_downwards(vma, address - PAGE_SIZE);
-        }
-        if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-                struct vm_area_struct *next = vma->vm_next;
-
-                /* As VM_GROWSDOWN but s/below/above/ */
-                if (next && next->vm_start == address + PAGE_SIZE)
-                        return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-
-                return expand_upwards(vma, address + PAGE_SIZE);
-        }
-        return 0;
-}
-
-/*
  * We enter with non-exclusive mmap_sem (to exclude vma changes,
  * but allow concurrent faults), and pte mapped but not yet locked.
  * We return with mmap_sem still held, but pte unmapped and unlocked.
@@ -2904,10 +2870,6 @@ static int do_anonymous_page(struct vm_fault *vmf)
         if (vma->vm_flags & VM_SHARED)
                 return VM_FAULT_SIGBUS;
 
-        /* Check if we need to add a guard page to the stack */
-        if (check_stack_guard_page(vma, vmf->address) < 0)
-                return VM_FAULT_SIGSEGV;
-
         /*
          * Use pte_alloc() instead of pte_alloc_map().  We can't run
          * pte_offset_map() on pmds where a huge pmd might be created
@@ -3029,6 +2991,17 @@ static int __do_fault(struct vm_fault *vmf)
         return ret;
 }
 
+/*
+ * The ordering of these checks is important for pmds with _PAGE_DEVMAP set.
+ * If we check pmd_trans_unstable() first we will trip the bad_pmd() check
+ * inside of pmd_none_or_trans_huge_or_clear_bad(). This will end up correctly
+ * returning 1 but not before it spams dmesg with the pmd_clear_bad() output.
+ */
+static int pmd_devmap_trans_unstable(pmd_t *pmd)
+{
+        return pmd_devmap(*pmd) || pmd_trans_unstable(pmd);
+}
+
 static int pte_alloc_one_map(struct vm_fault *vmf)
 {
         struct vm_area_struct *vma = vmf->vma;
@@ -3052,18 +3025,27 @@ static int pte_alloc_one_map(struct vm_fault *vmf)
 map_pte:
         /*
          * If a huge pmd materialized under us just retry later.  Use
-         * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
-         * didn't become pmd_trans_huge under us and then back to pmd_none, as
-         * a result of MADV_DONTNEED running immediately after a huge pmd fault
-         * in a different thread of this mm, in turn leading to a misleading
-         * pmd_trans_huge() retval.  All we have to ensure is that it is a
-         * regular pmd that we can walk with pte_offset_map() and we can do that
-         * through an atomic read in C, which is what pmd_trans_unstable()
-         * provides.
+         * pmd_trans_unstable() via pmd_devmap_trans_unstable() instead of
+         * pmd_trans_huge() to ensure the pmd didn't become pmd_trans_huge
+         * under us and then back to pmd_none, as a result of MADV_DONTNEED
+         * running immediately after a huge pmd fault in a different thread of
+         * this mm, in turn leading to a misleading pmd_trans_huge() retval.
+         * All we have to ensure is that it is a regular pmd that we can walk
+         * with pte_offset_map() and we can do that through an atomic read in
+         * C, which is what pmd_trans_unstable() provides.
          */
-        if (pmd_trans_unstable(vmf->pmd) || pmd_devmap(*vmf->pmd))
+        if (pmd_devmap_trans_unstable(vmf->pmd))
                 return VM_FAULT_NOPAGE;
 
+        /*
+         * At this point we know that our vmf->pmd points to a page of ptes
+         * and it cannot become pmd_none(), pmd_devmap() or pmd_trans_huge()
+         * for the duration of the fault.  If a racing MADV_DONTNEED runs and
+         * we zap the ptes pointed to by our vmf->pmd, the vmf->ptl will still
+         * be valid and we will re-check to make sure the vmf->pte isn't
+         * pte_none() under vmf->ptl protection when we return to
+         * alloc_set_pte().
+         */
         vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, vmf->address,
                         &vmf->ptl);
         return 0;
@@ -3690,7 +3672,7 @@ static int handle_pte_fault(struct vm_fault *vmf)
                 vmf->pte = NULL;
         } else {
                 /* See comment in pte_alloc_one_map() */
-                if (pmd_trans_unstable(vmf->pmd) || pmd_devmap(*vmf->pmd))
+                if (pmd_devmap_trans_unstable(vmf->pmd))
                         return 0;
                 /*
                  * A regular pmd is established and it can't morph into a huge
diff --git a/mm/mempool.c b/mm/mempool.c
index 47a659dedd44..1c0294858527 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -312,7 +312,7 @@ void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
 {
         void *element;
         unsigned long flags;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         gfp_t gfp_temp;
 
         VM_WARN_ON_ONCE(gfp_mask & __GFP_ZERO);
diff --git a/mm/mlock.c b/mm/mlock.c
index c483c5c20b4b..b562b5523a65 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -284,7 +284,7 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
 {
         int i;
         int nr = pagevec_count(pvec);
-        int delta_munlocked;
+        int delta_munlocked = -nr;
         struct pagevec pvec_putback;
         int pgrescued = 0;
 
@@ -304,6 +304,8 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
                                 continue;
                         else
                                 __munlock_isolation_failed(page);
+                } else {
+                        delta_munlocked++;
                 }
 
                 /*
@@ -315,7 +317,6 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
                 pagevec_add(&pvec_putback, pvec->pages[i]);
                 pvec->pages[i] = NULL;
         }
-        delta_munlocked = -nr + pagevec_count(&pvec_putback);
         __mod_zone_page_state(zone, NR_MLOCK, delta_munlocked);
         spin_unlock_irq(zone_lru_lock(zone));
 
diff --git a/mm/mmap.c b/mm/mmap.c
index f82741e199c0..8e07976d5e47 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -183,6 +183,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
         unsigned long retval;
         unsigned long newbrk, oldbrk;
         struct mm_struct *mm = current->mm;
+        struct vm_area_struct *next;
         unsigned long min_brk;
         bool populate;
         LIST_HEAD(uf);
@@ -229,7 +230,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
         }
 
         /* Check against existing mmap mappings. */
-        if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
+        next = find_vma(mm, oldbrk);
+        if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
                 goto out;
 
         /* Ok, looks good - let it rip. */
@@ -253,10 +255,22 @@ out:
 
 static long vma_compute_subtree_gap(struct vm_area_struct *vma)
 {
-        unsigned long max, subtree_gap;
-        max = vma->vm_start;
-        if (vma->vm_prev)
-                max -= vma->vm_prev->vm_end;
+        unsigned long max, prev_end, subtree_gap;
+
+        /*
+         * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we
+         * allow two stack_guard_gaps between them here, and when choosing
+         * an unmapped area; whereas when expanding we only require one.
+         * That's a little inconsistent, but keeps the code here simpler.
+         */
+        max = vm_start_gap(vma);
+        if (vma->vm_prev) {
+                prev_end = vm_end_gap(vma->vm_prev);
+                if (max > prev_end)
+                        max -= prev_end;
+                else
+                        max = 0;
+        }
         if (vma->vm_rb.rb_left) {
                 subtree_gap = rb_entry(vma->vm_rb.rb_left,
                                 struct vm_area_struct, vm_rb)->rb_subtree_gap;
@@ -352,7 +366,7 @@ static void validate_mm(struct mm_struct *mm)
                         anon_vma_unlock_read(anon_vma);
                 }
 
-                highest_address = vma->vm_end;
+                highest_address = vm_end_gap(vma);
                 vma = vma->vm_next;
                 i++;
         }
@@ -541,7 +555,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
         if (vma->vm_next)
                 vma_gap_update(vma->vm_next);
         else
-                mm->highest_vm_end = vma->vm_end;
+                mm->highest_vm_end = vm_end_gap(vma);
 
         /*
          * vma->vm_prev wasn't known when we followed the rbtree to find the
@@ -856,7 +870,7 @@ again:
                         vma_gap_update(vma);
                 if (end_changed) {
                         if (!next)
-                                mm->highest_vm_end = end;
+                                mm->highest_vm_end = vm_end_gap(vma);
                         else if (!adjust_next)
                                 vma_gap_update(next);
                 }
@@ -941,7 +955,7 @@ again:
                          * mm->highest_vm_end doesn't need any update
                          * in remove_next == 1 case.
                          */
-                        VM_WARN_ON(mm->highest_vm_end != end);
+                        VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma));
                 }
         }
         if (insert && file)
@@ -1787,7 +1801,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
 
         while (true) {
                 /* Visit left subtree if it looks promising */
-                gap_end = vma->vm_start;
+                gap_end = vm_start_gap(vma);
                 if (gap_end >= low_limit && vma->vm_rb.rb_left) {
                         struct vm_area_struct *left =
                                 rb_entry(vma->vm_rb.rb_left,
@@ -1798,7 +1812,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
                         }
                 }
 
-                gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
+                gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
 check_current:
                 /* Check if current node has a suitable gap */
                 if (gap_start > high_limit)
@@ -1825,8 +1839,8 @@ check_current:
                         vma = rb_entry(rb_parent(prev),
                                        struct vm_area_struct, vm_rb);
                         if (prev == vma->vm_rb.rb_left) {
-                                gap_start = vma->vm_prev->vm_end;
-                                gap_end = vma->vm_start;
+                                gap_start = vm_end_gap(vma->vm_prev);
+                                gap_end = vm_start_gap(vma);
                                 goto check_current;
                         }
                 }
@@ -1890,7 +1904,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 
         while (true) {
                 /* Visit right subtree if it looks promising */
-                gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
+                gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
                 if (gap_start <= high_limit && vma->vm_rb.rb_right) {
                         struct vm_area_struct *right =
                                 rb_entry(vma->vm_rb.rb_right,
@@ -1903,7 +1917,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 
 check_current:
                 /* Check if current node has a suitable gap */
-                gap_end = vma->vm_start;
+                gap_end = vm_start_gap(vma);
                 if (gap_end < low_limit)
                         return -ENOMEM;
                 if (gap_start <= high_limit && gap_end - gap_start >= length)
@@ -1929,7 +1943,7 @@ check_current:
                                        struct vm_area_struct, vm_rb);
                         if (prev == vma->vm_rb.rb_right) {
                                 gap_start = vma->vm_prev ?
-                                        vma->vm_prev->vm_end : 0;
+                                        vm_end_gap(vma->vm_prev) : 0;
                                 goto check_current;
                         }
                 }
@@ -1967,7 +1981,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 unsigned long len, unsigned long pgoff, unsigned long flags)
 {
         struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct vm_unmapped_area_info info;
 
         if (len > TASK_SIZE - mmap_min_addr)
@@ -1978,9 +1992,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
         if (addr) {
                 addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         return addr;
         }
 
@@ -2003,7 +2018,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                           const unsigned long len, const unsigned long pgoff,
                           const unsigned long flags)
 {
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct mm_struct *mm = current->mm;
         unsigned long addr = addr0;
         struct vm_unmapped_area_info info;
@@ -2018,9 +2033,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
         /* requesting a specific address */
         if (addr) {
                 addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)) &&
+                                (!prev || addr >= vm_end_gap(prev)))
                         return addr;
         }
 
@@ -2155,21 +2171,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
  * update accounting. This is shared with both the
  * grow-up and grow-down cases.
  */
-static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow)
+static int acct_stack_growth(struct vm_area_struct *vma,
+                             unsigned long size, unsigned long grow)
 {
         struct mm_struct *mm = vma->vm_mm;
         struct rlimit *rlim = current->signal->rlim;
-        unsigned long new_start, actual_size;
+        unsigned long new_start;
 
         /* address space limit tests */
         if (!may_expand_vm(mm, vma->vm_flags, grow))
                 return -ENOMEM;
 
         /* Stack limit test */
-        actual_size = size;
-        if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
-                actual_size -= PAGE_SIZE;
-        if (actual_size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+        if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur))
                 return -ENOMEM;
 
         /* mlock limit tests */
@@ -2207,17 +2221,30 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
 {
         struct mm_struct *mm = vma->vm_mm;
+        struct vm_area_struct *next;
+        unsigned long gap_addr;
         int error = 0;
 
         if (!(vma->vm_flags & VM_GROWSUP))
                 return -EFAULT;
 
         /* Guard against wrapping around to address 0. */
-        if (address < PAGE_ALIGN(address+4))
-                address = PAGE_ALIGN(address+4);
-        else
+        address &= PAGE_MASK;
+        address += PAGE_SIZE;
+        if (!address)
                 return -ENOMEM;
 
+        /* Enforce stack_guard_gap */
+        gap_addr = address + stack_guard_gap;
+        if (gap_addr < address)
+                return -ENOMEM;
+        next = vma->vm_next;
+        if (next && next->vm_start < gap_addr) {
+                if (!(next->vm_flags & VM_GROWSUP))
+                        return -ENOMEM;
+                /* Check that both stack segments have the same anon_vma? */
+        }
+
         /* We must make sure the anon_vma is allocated. */
         if (unlikely(anon_vma_prepare(vma)))
                 return -ENOMEM;
@@ -2261,7 +2288,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                                 if (vma->vm_next)
                                         vma_gap_update(vma->vm_next);
                                 else
-                                        mm->highest_vm_end = address;
+                                        mm->highest_vm_end = vm_end_gap(vma);
                                 spin_unlock(&mm->page_table_lock);
 
                                 perf_event_mmap(vma);
@@ -2282,6 +2309,8 @@ int expand_downwards(struct vm_area_struct *vma,
                                    unsigned long address)
 {
         struct mm_struct *mm = vma->vm_mm;
+        struct vm_area_struct *prev;
+        unsigned long gap_addr;
         int error;
 
         address &= PAGE_MASK;
@@ -2289,6 +2318,17 @@ int expand_downwards(struct vm_area_struct *vma,
         if (error)
                 return error;
 
+        /* Enforce stack_guard_gap */
+        gap_addr = address - stack_guard_gap;
+        if (gap_addr > address)
+                return -ENOMEM;
+        prev = vma->vm_prev;
+        if (prev && prev->vm_end > gap_addr) {
+                if (!(prev->vm_flags & VM_GROWSDOWN))
+                        return -ENOMEM;
+                /* Check that both stack segments have the same anon_vma? */
+        }
+
         /* We must make sure the anon_vma is allocated. */
         if (unlikely(anon_vma_prepare(vma)))
                 return -ENOMEM;
@@ -2343,28 +2383,25 @@ int expand_downwards(struct vm_area_struct *vma,
         return error;
 }
 
-/*
- * Note how expand_stack() refuses to expand the stack all the way to
- * abut the next virtual mapping, *unless* that mapping itself is also
- * a stack mapping. We want to leave room for a guard page, after all
- * (the guard page itself is not added here, that is done by the
- * actual page faulting logic)
- *
- * This matches the behavior of the guard page logic (see mm/memory.c:
- * check_stack_guard_page()), which only allows the guard page to be
- * removed under these circumstances.
- */
+/* enforced gap between the expanding stack and other mappings. */
+unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
+
+static int __init cmdline_parse_stack_guard_gap(char *p)
+{
+        unsigned long val;
+        char *endptr;
+
+        val = simple_strtoul(p, &endptr, 10);
+        if (!*endptr)
+                stack_guard_gap = val << PAGE_SHIFT;
+
+        return 0;
+}
+__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
+
 #ifdef CONFIG_STACK_GROWSUP
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
-        struct vm_area_struct *next;
-
-        address &= PAGE_MASK;
-        next = vma->vm_next;
-        if (next && next->vm_start == address + PAGE_SIZE) {
-                if (!(next->vm_flags & VM_GROWSUP))
-                        return -ENOMEM;
-        }
         return expand_upwards(vma, address);
 }
 
@@ -2386,14 +2423,6 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
 #else
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
-        struct vm_area_struct *prev;
-
-        address &= PAGE_MASK;
-        prev = vma->vm_prev;
-        if (prev && prev->vm_end == address) {
-                if (!(prev->vm_flags & VM_GROWSDOWN))
-                        return -ENOMEM;
-        }
         return expand_downwards(vma, address);
 }
 
@@ -2491,7 +2520,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
                 vma->vm_prev = prev;
                 vma_gap_update(vma);
         } else
-                mm->highest_vm_end = prev ? prev->vm_end : 0;
+                mm->highest_vm_end = prev ? vm_end_gap(prev) : 0;
         tail_vma->vm_next = NULL;
 
         /* Kill the cache */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index f9e450c6b6e4..2302f250d6b1 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -292,6 +292,26 @@ int page_group_by_mobility_disabled __read_mostly;
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT
 static inline void reset_deferred_meminit(pg_data_t *pgdat)
 {
+        unsigned long max_initialise;
+        unsigned long reserved_lowmem;
+
+        /*
+         * Initialise at least 2G of a node but also take into account that
+         * two large system hashes that can take up 1GB for 0.25TB/node.
+         */
+        max_initialise = max(2UL << (30 - PAGE_SHIFT),
+                (pgdat->node_spanned_pages >> 8));
+
+        /*
+         * Compensate the all the memblock reservations (e.g. crash kernel)
+         * from the initial estimation to make sure we will initialize enough
+         * memory to boot.
+         */
+        reserved_lowmem = memblock_reserved_memory_within(pgdat->node_start_pfn,
+                        pgdat->node_start_pfn + max_initialise);
+        max_initialise += reserved_lowmem;
+
+        pgdat->static_init_size = min(max_initialise, pgdat->node_spanned_pages);
         pgdat->first_deferred_pfn = ULONG_MAX;
 }
 
@@ -314,20 +334,11 @@ static inline bool update_defer_init(pg_data_t *pgdat,
                                 unsigned long pfn, unsigned long zone_end,
                                 unsigned long *nr_initialised)
 {
-        unsigned long max_initialise;
-
         /* Always populate low zones for address-contrained allocations */
         if (zone_end < pgdat_end_pfn(pgdat))
                 return true;
-        /*
-         * Initialise at least 2G of a node but also take into account that
-         * two large system hashes that can take up 1GB for 0.25TB/node.
-         */
-        max_initialise = max(2UL << (30 - PAGE_SHIFT),
-                (pgdat->node_spanned_pages >> 8));
-
         (*nr_initialised)++;
-        if ((*nr_initialised > max_initialise) &&
+        if ((*nr_initialised > pgdat->static_init_size) &&
             (pfn & (PAGES_PER_SECTION - 1)) == 0) {
                 pgdat->first_deferred_pfn = pfn;
                 return false;
@@ -3870,7 +3881,9 @@ retry:
                 goto got_pg;
 
         /* Avoid allocations with no watermarks from looping endlessly */
-        if (test_thread_flag(TIF_MEMDIE))
+        if (test_thread_flag(TIF_MEMDIE) &&
+            (alloc_flags == ALLOC_NO_WATERMARKS ||
+             (gfp_mask & __GFP_NOMEMALLOC)))
                 goto nopage;
 
         /* Retry as long as the OOM killer is making progress */
@@ -6136,7 +6149,6 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
         /* pg_data_t should be reset to zero when it's allocated */
         WARN_ON(pgdat->nr_zones || pgdat->kswapd_classzone_idx);
 
-        reset_deferred_meminit(pgdat);
         pgdat->node_id = nid;
         pgdat->node_start_pfn = node_start_pfn;
         pgdat->per_cpu_nodestats = NULL;
@@ -6158,6 +6170,7 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size,
                 (unsigned long)pgdat->node_mem_map);
 #endif
 
+        reset_deferred_meminit(pgdat);
         free_area_init_core(pgdat);
 }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index e67d6ba4e98e..fdc413f82a99 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1902,10 +1902,10 @@ unlock:
  * entry unconditionally - even if something else had already woken the
  * target.
  */
-static int synchronous_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
+static int synchronous_wake_function(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         int ret = default_wake_function(wait, mode, sync, key);
-        list_del_init(&wait->task_list);
+        list_del_init(&wait->entry);
         return ret;
 }
 
@@ -2840,7 +2840,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                 spin_lock(&inode->i_lock);
                 inode->i_private = NULL;
                 wake_up_all(&shmem_falloc_waitq);
-                WARN_ON_ONCE(!list_empty(&shmem_falloc_waitq.task_list));
+                WARN_ON_ONCE(!list_empty(&shmem_falloc_waitq.head));
                 spin_unlock(&inode->i_lock);
                 error = 0;
                 goto out;
diff --git a/mm/slub.c b/mm/slub.c
index 57e5156f02be..7449593fca72 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5512,6 +5512,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
                 char mbuf[64];
                 char *buf;
                 struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
+                ssize_t len;
 
                 if (!attr || !attr->store || !attr->show)
                         continue;
@@ -5536,8 +5537,9 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
                         buf = buffer;
                 }
 
-                attr->show(root_cache, buf);
-                attr->store(s, buf, strlen(buf));
+                len = attr->show(root_cache, buf);
+                if (len > 0)
+                        attr->store(s, buf, len);
         }
 
         if (buffer)
diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
index ac6318a064d3..3405b4ee1757 100644
--- a/mm/swap_cgroup.c
+++ b/mm/swap_cgroup.c
@@ -48,6 +48,9 @@ static int swap_cgroup_prepare(int type)
                 if (!page)
                         goto not_enough_page;
                 ctrl->map[idx] = page;
+
+                if (!(idx % SWAP_CLUSTER_MAX))
+                        cond_resched();
         }
         return 0;
 not_enough_page:
diff --git a/mm/util.c b/mm/util.c
index 464df3489903..26be6407abd7 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -357,8 +357,11 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node)
         WARN_ON_ONCE((flags & GFP_KERNEL) != GFP_KERNEL);
 
         /*
-         * Make sure that larger requests are not too disruptive - no OOM
-         * killer and no allocation failure warnings as we have a fallback
+         * We want to attempt a large physically contiguous block first because
+         * it is less likely to fragment multiple larger blocks and therefore
+         * contribute to a long term fragmentation less than vmalloc fallback.
+         * However make sure that larger requests are not too disruptive - no
+         * OOM killer and no allocation failure warnings as we have a fallback.
          */
         if (size > PAGE_SIZE) {
                 kmalloc_flags |= __GFP_NOWARN;
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index 6063581f705c..ce0618bfa8d0 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -115,9 +115,9 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned,
         unsigned long pressure = 0;
 
         /*
-         * reclaimed can be greater than scanned in cases
-         * like THP, where the scanned is 1 and reclaimed
-         * could be 512
+         * reclaimed can be greater than scanned for things such as reclaimed
+         * slab pages. shrink_node() just adds reclaimed pages without a
+         * related increment to scanned pages.
          */
         if (reclaimed >= scanned)
                 goto out;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 953b6728bd00..abc5f400fc71 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -813,7 +813,6 @@ static void vlan_dev_free(struct net_device *dev)
 
         free_percpu(vlan->vlan_pcpu_stats);
         vlan->vlan_pcpu_stats = NULL;
-        free_netdev(dev);
 }
 
 void vlan_setup(struct net_device *dev)
@@ -826,7 +825,8 @@ void vlan_setup(struct net_device *dev)
         netif_keep_dst(dev);
 
         dev->netdev_ops         = &vlan_netdev_ops;
-        dev->destructor         = vlan_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = vlan_dev_free;
         dev->ethtool_ops        = &vlan_ethtool_ops;
 
         dev->min_mtu            = 0;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 7bc2208b6cc4..dca3cdd1a014 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -95,7 +95,7 @@ enum {
 
 struct p9_poll_wait {
         struct p9_conn *conn;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         wait_queue_head_t *wait_addr;
 };
 
@@ -522,7 +522,7 @@ error:
         clear_bit(Wworksched, &m->wsched);
 }
 
-static int p9_pollwake(wait_queue_t *wait, unsigned int mode, int sync, void *key)
+static int p9_pollwake(wait_queue_entry_t *wait, unsigned int mode, int sync, void *key)
 {
         struct p9_poll_wait *pwait =
                 container_of(wait, struct p9_poll_wait, wait);
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 013e970eff39..000ca2f113ab 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1064,8 +1064,9 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
 
                 skb_new->protocol = eth_type_trans(skb_new, soft_iface);
 
-                soft_iface->stats.rx_packets++;
-                soft_iface->stats.rx_bytes += skb->len + ETH_HLEN + hdr_size;
+                batadv_inc_counter(bat_priv, BATADV_CNT_RX);
+                batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+                                   skb->len + ETH_HLEN + hdr_size);
 
                 netif_rx(skb_new);
                 batadv_dbg(BATADV_DBG_DAT, bat_priv, "ARP request replied locally\n");
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index e1ebe14ee2a6..ae9f4d37d34f 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -987,7 +987,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                                            "recv_unicast_packet(): Dropped unicast pkt received from another backbone gw %pM.\n",
                                            orig_addr_gw);
-                                return NET_RX_DROP;
+                                goto free_skb;
                         }
                 }
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b25789abf7b9..10f7edfb176e 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1034,8 +1034,6 @@ static void batadv_softif_free(struct net_device *dev)
          * netdev and its private data (bat_priv)
          */
         rcu_barrier();
-
-        free_netdev(dev);
 }
 
 /**
@@ -1047,7 +1045,8 @@ static void batadv_softif_init_early(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &batadv_netdev_ops;
-        dev->destructor = batadv_softif_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = batadv_softif_free;
         dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_NETNS_LOCAL;
         dev->priv_flags |= IFF_NO_QUEUE;
 
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 608959989f8e..ab3b654b05cc 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -598,7 +598,7 @@ static void netdev_setup(struct net_device *dev)
 
         dev->netdev_ops         = &netdev_ops;
         dev->header_ops         = &header_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static struct device_type bt_type = {
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index fbf251fef70f..5c4808b3da2d 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -484,7 +484,7 @@ static int bnep_session(void *arg)
         struct net_device *dev = s->dev;
         struct sock *sk = s->sock->sk;
         struct sk_buff *skb;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         BT_DBG("");
 
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 9e59b6654126..14f7c8135c31 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -280,7 +280,7 @@ static int cmtp_session(void *arg)
         struct cmtp_session *session = arg;
         struct sock *sk = session->sock->sk;
         struct sk_buff *skb;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         BT_DBG("session %p", session);
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0bec4588c3c8..fc31161e98f2 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1244,7 +1244,7 @@ static void hidp_session_run(struct hidp_session *session)
 static int hidp_session_thread(void *arg)
 {
         struct hidp_session *session = arg;
-        wait_queue_t ctrl_wait, intr_wait;
+        wait_queue_entry_t ctrl_wait, intr_wait;
 
         BT_DBG("session %p", session);
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 430b53e7d941..f0f3447e8aa4 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -379,7 +379,7 @@ void br_dev_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->ethtool_ops = &br_ethtool_ops;
         SET_NETDEV_DEVTYPE(dev, &br_type);
         dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 574f78824d8a..32bd3ead9ba1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -595,7 +595,7 @@ static int br_afspec(struct net_bridge *br,
                 err = 0;
                 switch (nla_type(attr)) {
                 case IFLA_BRIDGE_VLAN_TUNNEL_INFO:
-                        if (!(p->flags & BR_VLAN_TUNNEL))
+                        if (!p || !(p->flags & BR_VLAN_TUNNEL))
                                 return -EINVAL;
                         err = br_parse_vlan_tunnel_info(attr, &tinfo_curr);
                         if (err)
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 0db8102995a5..6f12a5271219 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,7 +179,8 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
-                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                 br_port_state_selection(br);
         }
 
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index adcad344c843..21f18ea2fce4 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -754,6 +754,10 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
 
         lock_sock(sk);
 
+        err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         err = -EAFNOSUPPORT;
         if (uaddr->sa_family != AF_CAIF)
                 goto out;
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 59ce1fcc220c..71b6ab240dea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx)
 {
         struct sk_buff *skb;
 
-        if (likely(in_interrupt()))
-                skb = alloc_skb(len + pfx, GFP_ATOMIC);
-        else
-                skb = alloc_skb(len + pfx, GFP_KERNEL);
-
+        skb = alloc_skb(len + pfx, GFP_ATOMIC);
         if (unlikely(skb == NULL))
                 return NULL;
 
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 1816fc9f1ee7..fe3c53efb949 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -392,14 +392,14 @@ static void chnl_net_destructor(struct net_device *dev)
 {
         struct chnl_net *priv = netdev_priv(dev);
         caif_free_client(&priv->chnl);
-        free_netdev(dev);
 }
 
 static void ipcaif_net_setup(struct net_device *dev)
 {
         struct chnl_net *priv;
         dev->netdev_ops = &netdev_ops;
-        dev->destructor = chnl_net_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = chnl_net_destructor;
         dev->flags |= IFF_NOARP;
         dev->flags |= IFF_POINTOPOINT;
         dev->mtu = GPRS_PDP_MTU;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index b6406fe33c76..88edac0f3e36 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -872,8 +872,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
 
 static int can_pernet_init(struct net *net)
 {
-        net->can.can_rcvlists_lock =
-                __SPIN_LOCK_UNLOCKED(net->can.can_rcvlists_lock);
+        spin_lock_init(&net->can.can_rcvlists_lock);
         net->can.can_rx_alldev_list =
                 kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL);
 
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 2034fb926670..8757fb87dab8 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -151,7 +151,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         struct timespec validity;
         void *tp, *tpend;
         void **ptp;
-        struct ceph_crypto_key new_session_key;
+        struct ceph_crypto_key new_session_key = { 0 };
         struct ceph_buffer *new_ticket_blob;
         unsigned long new_expires, new_renew_after;
         u64 new_secret_id;
@@ -215,6 +215,9 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         dout(" ticket blob is %d bytes\n", dlen);
         ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
         blob_struct_v = ceph_decode_8(ptp);
+        if (blob_struct_v != 1)
+                goto bad;
+
         new_secret_id = ceph_decode_64(ptp);
         ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
         if (ret)
@@ -234,13 +237,13 @@ static int process_one_ticket(struct ceph_auth_client *ac,
              type, ceph_entity_type_name(type), th->secret_id,
              (int)th->ticket_blob->vec.iov_len);
         xi->have_keys |= th->service;
-
-out:
-        return ret;
+        return 0;
 
 bad:
         ret = -EINVAL;
-        goto out;
+out:
+        ceph_crypto_key_destroy(&new_session_key);
+        return ret;
 }
 
 static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 4fd02831beed..47e94b560ba0 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -56,19 +56,6 @@ static const struct kernel_param_ops param_ops_supported_features = {
 module_param_cb(supported_features, &param_ops_supported_features, NULL,
                 S_IRUGO);
 
-/*
- * find filename portion of a path (/foo/bar/baz -> baz)
- */
-const char *ceph_file_part(const char *s, int len)
-{
-        const char *e = s + len;
-
-        while (e != s && *(e-1) != '/')
-                e--;
-        return e;
-}
-EXPORT_SYMBOL(ceph_file_part);
-
 const char *ceph_msg_type_name(int type)
 {
         switch (type) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 5766a6c896c4..588a91930051 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1174,8 +1174,8 @@ static struct page *ceph_msg_data_next(struct ceph_msg_data_cursor *cursor,
  * Returns true if the result moves the cursor on to the next piece
  * of the data item.
  */
-static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
-                                size_t bytes)
+static void ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
+                                  size_t bytes)
 {
         bool new_piece;
 
@@ -1207,8 +1207,6 @@ static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
                 new_piece = true;
         }
         cursor->need_crc = new_piece;
-
-        return new_piece;
 }
 
 static size_t sizeof_footer(struct ceph_connection *con)
@@ -1577,7 +1575,6 @@ static int write_partial_message_data(struct ceph_connection *con)
                 size_t page_offset;
                 size_t length;
                 bool last_piece;
-                bool need_crc;
                 int ret;
 
                 page = ceph_msg_data_next(cursor, &page_offset, &length,
@@ -1592,7 +1589,7 @@ static int write_partial_message_data(struct ceph_connection *con)
                 }
                 if (do_datacrc && cursor->need_crc)
                         crc = ceph_crc32c_page(crc, page, page_offset, length);
-                need_crc = ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
         }
 
         dout("%s %p msg %p done\n", __func__, con, msg);
@@ -2231,10 +2228,18 @@ static void process_ack(struct ceph_connection *con)
         struct ceph_msg *m;
         u64 ack = le64_to_cpu(con->in_temp_ack);
         u64 seq;
+        bool reconnect = (con->in_tag == CEPH_MSGR_TAG_SEQ);
+        struct list_head *list = reconnect ? &con->out_queue : &con->out_sent;
 
-        while (!list_empty(&con->out_sent)) {
-                m = list_first_entry(&con->out_sent, struct ceph_msg,
-                                     list_head);
+        /*
+         * In the reconnect case, con_fault() has requeued messages
+         * in out_sent. We should cleanup old messages according to
+         * the reconnect seq.
+         */
+        while (!list_empty(list)) {
+                m = list_first_entry(list, struct ceph_msg, list_head);
+                if (reconnect && m->needs_out_seq)
+                        break;
                 seq = le64_to_cpu(m->hdr.seq);
                 if (seq > ack)
                         break;
@@ -2243,6 +2248,7 @@ static void process_ack(struct ceph_connection *con)
                 m->ack_stamp = jiffies;
                 ceph_msg_remove(m);
         }
+
         prepare_read_tag(con);
 }
 
@@ -2299,7 +2305,7 @@ static int read_partial_msg_data(struct ceph_connection *con)
 
                 if (do_datacrc)
                         crc = ceph_crc32c_page(crc, page, page_offset, ret);
-                (void) ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
         }
         if (do_datacrc)
                 con->in_data_crc = crc;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 29a0ef351c5e..250f11f78609 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -43,15 +43,13 @@ struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
         int i, err = -EINVAL;
         struct ceph_fsid fsid;
         u32 epoch, num_mon;
-        u16 version;
         u32 len;
 
         ceph_decode_32_safe(&p, end, len, bad);
         ceph_decode_need(&p, end, len, bad);
 
         dout("monmap_decode %p %p len %d\n", p, end, (int)(end-p));
-
-        ceph_decode_16_safe(&p, end, version, bad);
+        p += sizeof(u16);  /* skip version */
 
         ceph_decode_need(&p, end, sizeof(fsid) + 2*sizeof(u32), bad);
         ceph_decode_copy(&p, &fsid, sizeof(fsid));
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ffe9e904d4d1..55e3a477f92d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 u32 yes;
                 struct crush_rule *r;
 
+                err = -EINVAL;
                 ceph_decode_32_safe(p, end, yes, bad);
                 if (!yes) {
                         dout("crush_decode NO rule %d off %x %p to %p\n",
diff --git a/net/core/datagram.c b/net/core/datagram.c
index db1866f2ffcf..34678828e2bb 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -68,7 +68,7 @@ static inline int connection_based(struct sock *sk)
         return sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM;
 }
 
-static int receiver_wake_function(wait_queue_t *wait, unsigned int mode, int sync,
+static int receiver_wake_function(wait_queue_entry_t *wait, unsigned int mode, int sync,
                                   void *key)
 {
         unsigned long bits = (unsigned long)key;
diff --git a/net/core/dev.c b/net/core/dev.c
index fca407b4a6ea..6d60149287a1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1253,8 +1253,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
         if (!new_ifalias)
                 return -ENOMEM;
         dev->ifalias = new_ifalias;
+        memcpy(dev->ifalias, alias, len);
+        dev->ifalias[len] = 0;
 
-        strlcpy(dev->ifalias, alias, len+1);
         return len;
 }
 
@@ -4948,6 +4949,19 @@ __sum16 __skb_gro_checksum_complete(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(__skb_gro_checksum_complete);
 
+static void net_rps_send_ipi(struct softnet_data *remsd)
+{
+#ifdef CONFIG_RPS
+        while (remsd) {
+                struct softnet_data *next = remsd->rps_ipi_next;
+
+                if (cpu_online(remsd->cpu))
+                        smp_call_function_single_async(remsd->cpu, &remsd->csd);
+                remsd = next;
+        }
+#endif
+}
+
 /*
  * net_rps_action_and_irq_enable sends any pending IPI's for rps.
  * Note: called with local irq disabled, but exits with local irq enabled.
@@ -4963,14 +4977,7 @@ static void net_rps_action_and_irq_enable(struct softnet_data *sd)
                 local_irq_enable();
 
                 /* Send pending IPI's to kick RPS processing on remote cpus. */
-                while (remsd) {
-                        struct softnet_data *next = remsd->rps_ipi_next;
-
-                        if (cpu_online(remsd->cpu))
-                                smp_call_function_single_async(remsd->cpu,
-                                                           &remsd->csd);
-                        remsd = next;
-                }
+                net_rps_send_ipi(remsd);
         } else
 #endif
                 local_irq_enable();
@@ -7501,6 +7508,8 @@ out:
 err_uninit:
         if (dev->netdev_ops->ndo_uninit)
                 dev->netdev_ops->ndo_uninit(dev);
+        if (dev->priv_destructor)
+                dev->priv_destructor(dev);
         goto out;
 }
 EXPORT_SYMBOL(register_netdevice);
@@ -7708,8 +7717,10 @@ void netdev_run_todo(void)
                 WARN_ON(rcu_access_pointer(dev->ip6_ptr));
                 WARN_ON(dev->dn_ptr);
 
-                if (dev->destructor)
-                        dev->destructor(dev);
+                if (dev->priv_destructor)
+                        dev->priv_destructor(dev);
+                if (dev->needs_free_netdev)
+                        free_netdev(dev);
 
                 /* Report a network device has been unregistered */
                 rtnl_lock();
@@ -8192,7 +8203,7 @@ static int dev_cpu_dead(unsigned int oldcpu)
         struct sk_buff **list_skb;
         struct sk_buff *skb;
         unsigned int cpu;
-        struct softnet_data *sd, *oldsd;
+        struct softnet_data *sd, *oldsd, *remsd = NULL;
 
         local_irq_disable();
         cpu = smp_processor_id();
@@ -8233,6 +8244,13 @@ static int dev_cpu_dead(unsigned int oldcpu)
         raise_softirq_irqoff(NET_TX_SOFTIRQ);
         local_irq_enable();
 
+#ifdef CONFIG_RPS
+        remsd = oldsd->rps_ipi_list;
+        oldsd->rps_ipi_list = NULL;
+#endif
+        /* send out pending IPI's on offline CPU */
+        net_rps_send_ipi(remsd);
+
         /* Process offline CPU's input_pkt_queue */
         while ((skb = __skb_dequeue(&oldsd->process_queue))) {
                 netif_rx_ni(skb);
diff --git a/net/core/devlink.c b/net/core/devlink.c
index b0b87a292e7c..a0adfc31a3fe 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1680,8 +1680,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
@@ -2098,8 +2100,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
diff --git a/net/core/dst.c b/net/core/dst.c
index 960e503b5a52..13ba4a090c41 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard_out);
 
-const u32 dst_default_metrics[RTAX_MAX + 1] = {
+const struct dst_metrics dst_default_metrics = {
         /* This initializer is needed to force linker to place this variable
          * into const section. Otherwise it might end into bss section.
          * We really want to avoid false sharing on this variable, and catch
          * any writes on it.
          */
-        [RTAX_MAX] = 0xdeadbeef,
+        .refcnt = ATOMIC_INIT(1),
 };
 
 void dst_init(struct dst_entry *dst, struct dst_ops *ops,
@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
         if (dev)
                 dev_hold(dev);
         dst->ops = ops;
-        dst_init_metrics(dst, dst_default_metrics, true);
+        dst_init_metrics(dst, dst_default_metrics.metrics, true);
         dst->expires = 0UL;
         dst->path = dst;
         dst->from = NULL;
@@ -314,25 +314,30 @@ EXPORT_SYMBOL(dst_release);
 
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
-        u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC);
+        struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC);
 
         if (p) {
-                u32 *old_p = __DST_METRICS_PTR(old);
+                struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old);
                 unsigned long prev, new;
 
-                memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+                atomic_set(&p->refcnt, 1);
+                memcpy(p->metrics, old_p->metrics, sizeof(p->metrics));
 
                 new = (unsigned long) p;
                 prev = cmpxchg(&dst->_metrics, old, new);
 
                 if (prev != old) {
                         kfree(p);
-                        p = __DST_METRICS_PTR(prev);
+                        p = (struct dst_metrics *)__DST_METRICS_PTR(prev);
                         if (prev & DST_METRICS_READ_ONLY)
                                 p = NULL;
+                } else if (prev & DST_METRICS_REFCOUNTED) {
+                        if (atomic_dec_and_test(&old_p->refcnt))
+                                kfree(old_p);
                 }
         }
-        return p;
+        BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0);
+        return (u32 *)p;
 }
 EXPORT_SYMBOL(dst_cow_metrics_generic);
 
@@ -341,7 +346,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
         unsigned long prev, new;
 
-        new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
+        new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
         prev = cmpxchg(&dst->_metrics, old, new);
         if (prev == old)
                 kfree(__DST_METRICS_PTR(old));
@@ -464,6 +469,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
                 spin_lock_bh(&dst_garbage.lock);
                 dst = dst_garbage.list;
                 dst_garbage.list = NULL;
+                /* The code in dst_ifdown places a hold on the loopback device.
+                 * If the gc entry processing is set to expire after a lengthy
+                 * interval, this hold can cause netdev_wait_allrefs() to hang
+                 * out and wait for a long time -- until the the loopback
+                 * interface is released.  If we're really unlucky, it'll emit
+                 * pr_emerg messages to console too.  Reset the interval here,
+                 * so dst cleanups occur in a more timely fashion.
+                 */
+                if (dst_garbage.timer_inc > DST_GC_INC) {
+                        dst_garbage.timer_inc = DST_GC_INC;
+                        dst_garbage.timer_expires = DST_GC_MIN;
+                        mod_delayed_work(system_wq, &dst_gc_work,
+                                         dst_garbage.timer_expires);
+                }
                 spin_unlock_bh(&dst_garbage.lock);
 
                 if (last)
diff --git a/net/core/filter.c b/net/core/filter.c
index a253a6197e6b..a6bb95fa87b2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2281,6 +2281,7 @@ bool bpf_helper_changes_pkt_data(void *func)
             func == bpf_skb_change_head ||
             func == bpf_skb_change_tail ||
             func == bpf_skb_pull_data ||
+            func == bpf_clone_redirect ||
             func == bpf_l3_csum_replace ||
             func == bpf_l4_csum_replace ||
             func == bpf_xdp_adjust_head)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1934efd4a9d4..26bbfababff2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -315,6 +315,25 @@ out_undo:
         goto out;
 }
 
+static int __net_init net_defaults_init_net(struct net *net)
+{
+        net->core.sysctl_somaxconn = SOMAXCONN;
+        return 0;
+}
+
+static struct pernet_operations net_defaults_ops = {
+        .init = net_defaults_init_net,
+};
+
+static __init int net_defaults_init(void)
+{
+        if (register_pernet_subsys(&net_defaults_ops))
+                panic("Cannot initialize net default settings");
+
+        return 0;
+}
+
+core_initcall(net_defaults_init);
 
 #ifdef CONFIG_NET_NS
 static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 49a279a7cc15..5e61456f6bc7 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1124,6 +1124,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
         struct ifla_vf_mac vf_mac;
         struct ifla_vf_info ivi;
 
+        memset(&ivi, 0, sizeof(ivi));
+
         /* Not all SR-IOV capable drivers support the
          * spoofcheck and "RSS query enable" query.  Preset to
          * -1 so the user space tool can detect that the driver
@@ -1132,7 +1134,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
         ivi.spoofchk = -1;
         ivi.rss_query_en = -1;
         ivi.trusted = -1;
-        memset(ivi.mac, 0, sizeof(ivi.mac));
         /* The default value for VF link state is "auto"
          * IFLA_VF_LINK_STATE_AUTO which equals zero
          */
@@ -3231,8 +3232,11 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int err = 0;
         int fidx = 0;
 
-        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
-                        IFLA_MAX, ifla_policy, NULL) == 0) {
+        err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+                          IFLA_MAX, ifla_policy, NULL);
+        if (err < 0) {
+                return -EINVAL;
+        } else if (err == 0) {
                 if (tb[IFLA_MASTER])
                         br_idx = nla_get_u32(tb[IFLA_MASTER]);
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 346d3e85dfbc..b1be7c01efe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3754,8 +3754,11 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 
         spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
-        if (skb && (skb_next = skb_peek(q)))
+        if (skb && (skb_next = skb_peek(q))) {
                 icmp_next = is_icmp_err_skb(skb_next);
+                if (icmp_next)
+                        sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
+        }
         spin_unlock_irqrestore(&q->lock, flags);
 
         if (is_icmp_err_skb(skb) && !icmp_next)
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index ea23254b2457..b7cd9aafe99e 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -479,8 +479,6 @@ static __net_init int sysctl_core_net_init(struct net *net)
 {
         struct ctl_table *tbl;
 
-        net->core.sysctl_somaxconn = SOMAXCONN;
-
         tbl = netns_core_table;
         if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 1ed81ac6dd1a..aa8ffecc46a4 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
 
-        if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+        if (skb->len < sizeof(*nlh) ||
+            nlh->nlmsg_len < sizeof(*nlh) ||
+            skb->len < nlh->nlmsg_len)
                 return;
 
         if (!netlink_capable(skb, CAP_NET_ADMIN))
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 26130ae438da..90038d45a547 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -223,6 +223,53 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+int dsa_switch_suspend(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        /* Suspend slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        if (ds->ops->suspend)
+                ret = ds->ops->suspend(ds);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_suspend);
+
+int dsa_switch_resume(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        if (ds->ops->resume)
+                ret = ds->ops->resume(ds);
+
+        if (ret)
+                return ret;
+
+        /* Resume slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_resume(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_resume);
+#endif
+
 static struct packet_type dsa_pack_type __read_mostly = {
         .type   = cpu_to_be16(ETH_P_XDSA),
         .func   = dsa_switch_rcv,
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 033b3bfb63dc..7796580e99ee 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -484,8 +484,10 @@ static void dsa_dst_unapply(struct dsa_switch_tree *dst)
                 dsa_ds_unapply(dst, ds);
         }
 
-        if (dst->cpu_switch)
+        if (dst->cpu_switch) {
                 dsa_cpu_port_ethtool_restore(dst->cpu_switch);
+                dst->cpu_switch = NULL;
+        }
 
         pr_info("DSA: tree %d unapplied\n", dst->tree);
         dst->applied = false;
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index ad345c8b0b06..7281098df04e 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -289,53 +289,6 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
         dsa_switch_unregister_notifier(ds);
 }
 
-#ifdef CONFIG_PM_SLEEP
-int dsa_switch_suspend(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        /* Suspend slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        if (ds->ops->suspend)
-                ret = ds->ops->suspend(ds);
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_suspend);
-
-int dsa_switch_resume(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        if (ds->ops->resume)
-                ret = ds->ops->resume(ds);
-
-        if (ret)
-                return ret;
-
-        /* Resume slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_resume(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_resume);
-#endif
-
 /* platform driver init and cleanup *****************************************/
 static int dev_is_class(struct device *dev, void *class)
 {
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index c73160fb11e7..0a0a392dc2bd 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -378,7 +378,6 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
         del_timer_sync(&hsr->announce_timer);
 
         synchronize_rcu();
-        free_netdev(hsr_dev);
 }
 
 static const struct net_device_ops hsr_device_ops = {
@@ -404,7 +403,8 @@ void hsr_dev_setup(struct net_device *dev)
         SET_NETDEV_DEVTYPE(dev, &hsr_type);
         dev->priv_flags |= IFF_NO_QUEUE;
 
-        dev->destructor = hsr_dev_destroy;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = hsr_dev_destroy;
 
         dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
                            NETIF_F_GSO_MASK | NETIF_F_HW_CSUM |
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 4ebe2aa3e7d3..04b5450c5a55 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -324,8 +324,7 @@ static int hsr_fill_frame_info(struct hsr_frame_info *frame,
         unsigned long irqflags;
 
         frame->is_supervision = is_supervision_frame(port->hsr, skb);
-        frame->node_src = hsr_get_node(&port->hsr->node_db, skb,
-                                       frame->is_supervision);
+        frame->node_src = hsr_get_node(port, skb, frame->is_supervision);
         if (frame->node_src == NULL)
                 return -1; /* Unknown node and !is_supervision, or no mem */
 
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 7ea925816f79..284a9b820df8 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -158,9 +158,10 @@ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
 
 /* Get the hsr_node from which 'skb' was sent.
  */
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                               bool is_sup)
 {
+        struct list_head *node_db = &port->hsr->node_db;
         struct hsr_node *node;
         struct ethhdr *ethhdr;
         u16 seq_out;
@@ -186,7 +187,11 @@ struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
                  */
                 seq_out = hsr_get_skb_sequence_nr(skb) - 1;
         } else {
-                WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
+                /* this is called also for frames from master port and
+                 * so warn only for non master ports
+                 */
+                if (port->type != HSR_PT_MASTER)
+                        WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
                 seq_out = HSR_SEQNR_START;
         }
 
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index 438b40f98f5a..4e04f0e868e9 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -18,7 +18,7 @@ struct hsr_node;
 
 struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
                               u16 seq_out);
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                               bool is_sup);
 void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr,
                           struct hsr_port *port);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index d7efbf0dad20..0a866f332290 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -107,7 +107,7 @@ static void lowpan_setup(struct net_device *ldev)
 
         ldev->netdev_ops        = &lowpan_netdev_ops;
         ldev->header_ops        = &lowpan_header_ops;
-        ldev->destructor        = free_netdev;
+        ldev->needs_free_netdev = true;
         ldev->features          |= NETIF_F_NETNS_LOCAL;
 }
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f3dad1661343..58925b6597de 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[] =
                 .type =       SOCK_DGRAM,
                 .protocol =   IPPROTO_ICMP,
                 .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                 .flags =      INET_PROTOSW_REUSE,
        },
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index ae96e6f3e0cb..e9f3386a528b 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -863,8 +863,8 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
 
         n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 
+        addr_type = -1;
         if (n || IN_DEV_ARP_ACCEPT(in_dev)) {
-                addr_type = -1;
                 is_garp = arp_is_garp(net, dev, &addr_type, arp->ar_op,
                                       sip, tip, sha, tha);
         }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 65cc02bd82bc..93322f895eab 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         u8 *tail;
         u8 *vaddr;
         int nfrags;
+        int esph_offset;
         struct page *page;
         struct sk_buff *trailer;
         int tailen = esp->tailen;
@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         }
 
 cow:
+        esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
+
         nfrags = skb_cow_data(skb, tailen, &trailer);
         if (nfrags < 0)
                 goto out;
         tail = skb_tail_pointer(trailer);
-        esp->esph = ip_esp_hdr(skb);
+        esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
 
 skip_cow:
         esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index da449ddb8cc1..ad9ad4aab5da 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -203,6 +203,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp)
 static void free_fib_info_rcu(struct rcu_head *head)
 {
         struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        struct dst_metrics *m;
 
         change_nexthops(fi) {
                 if (nexthop_nh->nh_dev)
@@ -213,8 +214,9 @@ static void free_fib_info_rcu(struct rcu_head *head)
                 rt_fibinfo_free(&nexthop_nh->nh_rth_input);
         } endfor_nexthops(fi);
 
-        if (fi->fib_metrics != (u32 *) dst_default_metrics)
-                kfree(fi->fib_metrics);
+        m = fi->fib_metrics;
+        if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
+                kfree(m);
         kfree(fi);
 }
 
@@ -971,11 +973,11 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                         val = 255;
                 if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                         return -EINVAL;
-                fi->fib_metrics[type - 1] = val;
+                fi->fib_metrics->metrics[type - 1] = val;
         }
 
         if (ecn_ca)
-                fi->fib_metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+                fi->fib_metrics->metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
 
         return 0;
 }
@@ -1033,11 +1035,12 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                 goto failure;
         fib_info_cnt++;
         if (cfg->fc_mx) {
-                fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
                 if (!fi->fib_metrics)
                         goto failure;
+                atomic_set(&fi->fib_metrics->refcnt, 1);
         } else
-                fi->fib_metrics = (u32 *) dst_default_metrics;
+                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
 
         fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
@@ -1238,7 +1241,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
         if (fi->fib_priority &&
             nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority))
                 goto nla_put_failure;
-        if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
+        if (rtnetlink_put_metrics(skb, fi->fib_metrics->metrics) < 0)
                 goto nla_put_failure;
 
         if (fi->fib_prefsrc &&
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 43318b5f5647..9144fa7df2ad 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -657,8 +657,12 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         /* Needed by both icmp_global_allow and icmp_xmit_lock */
         local_bh_disable();
 
-        /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv4_global_allow(net, type, code))
+        /* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
+         * incoming dev is loopback.  If outgoing dev change to not be
+         * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
+         */
+        if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
+              !icmpv4_global_allow(net, type, code))
                 goto out_bh_enable;
 
         sk = icmp_xmit_lock(net);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 44fd86de2823..8f6b5bbcbf69 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2071,21 +2071,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
 static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
-        struct ip_sf_list *psf, *nextpsf;
+        struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
 
-        for (psf = pmc->tomb; psf; psf = nextpsf) {
+        spin_lock_bh(&pmc->lock);
+        tomb = pmc->tomb;
+        pmc->tomb = NULL;
+        sources = pmc->sources;
+        pmc->sources = NULL;
+        pmc->sfmode = MCAST_EXCLUDE;
+        pmc->sfcount[MCAST_INCLUDE] = 0;
+        pmc->sfcount[MCAST_EXCLUDE] = 1;
+        spin_unlock_bh(&pmc->lock);
+
+        for (psf = tomb; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
-        pmc->tomb = NULL;
-        for (psf = pmc->sources; psf; psf = nextpsf) {
+        for (psf = sources; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
-        pmc->sources = NULL;
-        pmc->sfmode = MCAST_EXCLUDE;
-        pmc->sfcount[MCAST_INCLUDE] = 0;
-        pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 
 /* Join a multicast group
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index b878ecbc0608..b436d0775631 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -967,7 +967,6 @@ static void ip_tunnel_dev_free(struct net_device *dev)
         gro_cells_destroy(&tunnel->gro_cells);
         dst_cache_destroy(&tunnel->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 void ip_tunnel_dellink(struct net_device *dev, struct list_head *head)
@@ -1155,7 +1154,8 @@ int ip_tunnel_init(struct net_device *dev)
         struct iphdr *iph = &tunnel->parms.iph;
         int err;
 
-        dev->destructor = ip_tunnel_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip_tunnel_dev_free;
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 551de4d023a8..8ae425cad818 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -101,8 +101,8 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id);
 static void ipmr_free_table(struct mr_table *mrt);
 
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
-                          int local);
+                          struct net_device *dev, struct sk_buff *skb,
+                          struct mfc_cache *cache, int local);
 static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
@@ -501,7 +501,7 @@ static void reg_vif_setup(struct net_device *dev)
         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
@@ -988,7 +988,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
 
                         rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
                 } else {
-                        ip_mr_forward(net, mrt, skb, c, 0);
+                        ip_mr_forward(net, mrt, skb->dev, skb, c, 0);
                 }
         }
 }
@@ -1073,7 +1073,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
 
 /* Queue a packet for resolution. It gets locked cache entry! */
 static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb, struct net_device *dev)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct mfc_cache *c;
@@ -1130,6 +1130,10 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
                 kfree_skb(skb);
                 err = -ENOBUFS;
         } else {
+                if (dev) {
+                        skb->dev = dev;
+                        skb->skb_iif = dev->ifindex;
+                }
                 skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
                 err = 0;
         }
@@ -1828,10 +1832,10 @@ static int ipmr_find_vif(struct mr_table *mrt, struct net_device *dev)
 
 /* "local" means that we should preserve one skb (for local delivery) */
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
-                          int local)
+                          struct net_device *dev, struct sk_buff *skb,
+                          struct mfc_cache *cache, int local)
 {
-        int true_vifi = ipmr_find_vif(mrt, skb->dev);
+        int true_vifi = ipmr_find_vif(mrt, dev);
         int psend = -1;
         int vif, ct;
 
@@ -1853,13 +1857,7 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt,
         }
 
         /* Wrong interface: drop packet and (maybe) send PIM assert. */
-        if (mrt->vif_table[vif].dev != skb->dev) {
-                struct net_device *mdev;
-
-                mdev = l3mdev_master_dev_rcu(mrt->vif_table[vif].dev);
-                if (mdev == skb->dev)
-                        goto forward;
-
+        if (mrt->vif_table[vif].dev != dev) {
                 if (rt_is_output_route(skb_rtable(skb))) {
                         /* It is our own packet, looped back.
                          * Very complicated situation...
@@ -2053,7 +2051,7 @@ int ip_mr_input(struct sk_buff *skb)
                 read_lock(&mrt_lock);
                 vif = ipmr_find_vif(mrt, dev);
                 if (vif >= 0) {
-                        int err2 = ipmr_cache_unresolved(mrt, vif, skb);
+                        int err2 = ipmr_cache_unresolved(mrt, vif, skb, dev);
                         read_unlock(&mrt_lock);
 
                         return err2;
@@ -2064,7 +2062,7 @@ int ip_mr_input(struct sk_buff *skb)
         }
 
         read_lock(&mrt_lock);
-        ip_mr_forward(net, mrt, skb, cache, local);
+        ip_mr_forward(net, mrt, dev, skb, cache, local);
         read_unlock(&mrt_lock);
 
         if (local)
@@ -2238,7 +2236,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
                 iph->saddr = saddr;
                 iph->daddr = daddr;
                 iph->version = 0;
-                err = ipmr_cache_unresolved(mrt, vif, skb2);
+                err = ipmr_cache_unresolved(mrt, vif, skb2, dev);
                 read_unlock(&mrt_lock);
                 rcu_read_unlock();
                 return err;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 655d9eebe43e..6883b3d4ba8f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1385,8 +1385,12 @@ static void rt_add_uncached_list(struct rtable *rt)
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
         struct rtable *rt = (struct rtable *) dst;
 
+        if (p != &dst_default_metrics && atomic_dec_and_test(&p->refcnt))
+                kfree(p);
+
         if (!list_empty(&rt->rt_uncached)) {
                 struct uncached_list *ul = rt->rt_uncached_list;
 
@@ -1438,7 +1442,11 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
                         rt->rt_gateway = nh->nh_gw;
                         rt->rt_uses_gateway = 1;
                 }
-                dst_init_metrics(&rt->dst, fi->fib_metrics, true);
+                dst_init_metrics(&rt->dst, fi->fib_metrics->metrics, true);
+                if (fi->fib_metrics != &dst_default_metrics) {
+                        rt->dst._metrics |= DST_METRICS_REFCOUNTED;
+                        atomic_inc(&fi->fib_metrics->refcnt);
+                }
 #ifdef CONFIG_IP_ROUTE_CLASSID
                 rt->dst.tclassid = nh->nh_tclassid;
 #endif
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 842b575f8fdd..b5ea036ca781 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1084,9 +1084,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr *uaddr = msg->msg_name;
         int err, flags;
 
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+            (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+             uaddr->sa_family == AF_UNSPEC))
                 return -EOPNOTSUPP;
         if (tp->fastopen_req)
                 return -EALREADY; /* Another Fast Open is in progress */
@@ -1108,7 +1111,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
                 }
         }
         flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+        err = __inet_stream_connect(sk->sk_socket, uaddr,
                                     msg->msg_namelen, flags, 1);
         /* fastopen_req could already be freed in __inet_stream_connect
          * if the connection times out or gets rst
@@ -2378,9 +2381,10 @@ static int tcp_repair_set_window(struct tcp_sock *tp, char __user *optbuf, int l
         return 0;
 }
 
-static int tcp_repair_options_est(struct tcp_sock *tp,
+static int tcp_repair_options_est(struct sock *sk,
                 struct tcp_repair_opt __user *optbuf, unsigned int len)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_repair_opt opt;
 
         while (len >= sizeof(opt)) {
@@ -2393,6 +2397,7 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                 switch (opt.opt_code) {
                 case TCPOPT_MSS:
                         tp->rx_opt.mss_clamp = opt.opt_val;
+                        tcp_mtup_init(sk);
                         break;
                 case TCPOPT_WINDOW:
                         {
@@ -2552,7 +2557,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 if (!tp->repair)
                         err = -EINVAL;
                 else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
+                        err = tcp_repair_options_est(sk,
                                         (struct tcp_repair_opt __user *)optval,
                                         optlen);
                 else
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6e3c512054a6..324c9bcc5456 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -180,6 +180,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
 
+        tcp_sk(sk)->prior_ssthresh = 0;
         if (icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
         if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de713c6..8d772fea1dde 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         struct ipv6hdr *ip6_hdr;
         struct ipv6_opt_hdr *hop;
         unsigned char buf[CALIPSO_MAX_BUFFER];
-        int len_delta, new_end, pad;
+        int len_delta, new_end, pad, payload;
         unsigned int start, end;
 
         ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         if (ret_val < 0)
                 return ret_val;
 
+        ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
+
         if (len_delta) {
                 if (len_delta > 0)
                         skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
                         sizeof(*ip6_hdr) + start);
                 skb_reset_network_header(skb);
                 ip6_hdr = ipv6_hdr(skb);
+                payload = ntohs(ip6_hdr->payload_len);
+                ip6_hdr->payload_len = htons(payload + len_delta);
         }
 
         hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 230b5aac9f03..8d7b113958b1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -491,7 +491,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         local_bh_disable();
 
         /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv6_global_allow(type))
+        if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
                 goto out_bh_enable;
 
         mip6_addr_swap(skb);
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 2fd5ca151dcf..77f7f8c7d93d 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -62,6 +62,7 @@ static inline u32 ila_locator_hash(struct ila_locator loc)
 {
         u32 *v = (u32 *)loc.v32;
 
+        __ila_hash_secret_init();
         return jhash_2words(v[0], v[1], hashrnd);
 }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 8d128ba79b66..64eea3962733 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -537,11 +537,10 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
 
-        dsfield = ipv4_get_dsfield(iph);
-
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                          & IPV6_TCLASS_MASK;
+                dsfield = ipv4_get_dsfield(iph);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                 fl6.flowi6_mark = skb->mark;
         else
@@ -598,9 +597,11 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
 
-        dsfield = ipv6_get_dsfield(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
+                dsfield = ipv6_get_dsfield(ipv6h);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
+
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                 fl6.flowlabel |= ip6_flowlabel(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -990,13 +991,13 @@ static void ip6gre_dev_free(struct net_device *dev)
 
         dst_cache_destroy(&t->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static void ip6gre_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops = &ip6gre_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
 
         dev->type = ARPHRD_IP6GRE;
 
@@ -1147,7 +1148,7 @@ static int __net_init ip6gre_init_net(struct net *net)
         return 0;
 
 err_reg_dev:
-        ip6gre_dev_free(ign->fb_tunnel_dev);
+        free_netdev(ign->fb_tunnel_dev);
 err_alloc_dev:
         return err;
 }
@@ -1299,7 +1300,8 @@ static void ip6gre_tap_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &ip6gre_tap_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
 
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 280268f1dd7b..cdb3728faca7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -116,8 +116,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
                 if (udpfrag) {
                         int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        if (err < 0)
+                        if (err < 0) {
+                                kfree_skb_list(segs);
                                 return ERR_PTR(err);
+                        }
                         fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                         fptr->frag_off = htons(offset);
                         if (skb->next)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 6eb2ae507500..c3581973f5d7 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -254,7 +254,6 @@ static void ip6_dev_free(struct net_device *dev)
         gro_cells_destroy(&t->gro_cells);
         dst_cache_destroy(&t->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static int ip6_tnl_create2(struct net_device *dev)
@@ -322,7 +321,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
         return t;
 
 failed_free:
-        ip6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return ERR_PTR(err);
 }
@@ -1095,6 +1094,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 
         if (!dst) {
 route_lookup:
+                /* add dsfield to flowlabel for route lookup */
+                fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
+
                 dst = ip6_route_output(net, NULL, fl6);
 
                 if (dst->error)
@@ -1196,7 +1198,7 @@ route_lookup:
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
-        ip6_flow_hdr(ipv6h, INET_ECN_encapsulate(0, dsfield),
+        ip6_flow_hdr(ipv6h, dsfield,
                      ip6_make_flowlabel(net, skb, fl6->flowlabel, true, fl6));
         ipv6h->hop_limit = hop_limit;
         ipv6h->nexthdr = proto;
@@ -1231,8 +1233,6 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (tproto != IPPROTO_IPIP && tproto != 0)
                 return -1;
 
-        dsfield = ipv4_get_dsfield(iph);
-
         if (t->parms.collect_md) {
                 struct ip_tunnel_info *tun_info;
                 const struct ip_tunnel_key *key;
@@ -1246,6 +1246,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
+                dsfield = ip6_tclass(key->label);
         } else {
                 if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                         encap_limit = t->parms.encap_limit;
@@ -1254,8 +1255,9 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
 
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                         & IPV6_TCLASS_MASK;
+                        dsfield = ipv4_get_dsfield(iph);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                         fl6.flowi6_mark = skb->mark;
                 else
@@ -1267,6 +1269,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                 return -1;
 
+        dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
+
         skb_set_inner_ipproto(skb, IPPROTO_IPIP);
 
         err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1300,8 +1304,6 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
             ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
-        dsfield = ipv6_get_dsfield(ipv6h);
-
         if (t->parms.collect_md) {
                 struct ip_tunnel_info *tun_info;
                 const struct ip_tunnel_key *key;
@@ -1315,6 +1317,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
+                dsfield = ip6_tclass(key->label);
         } else {
                 offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
                 /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
@@ -1337,7 +1340,9 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
 
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= (*(__be32 *)ipv6h & IPV6_TCLASS_MASK);
+                        dsfield = ipv6_get_dsfield(ipv6h);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                         fl6.flowlabel |= ip6_flowlabel(ipv6h);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -1351,6 +1356,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                 return -1;
 
+        dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
+
         skb_set_inner_ipproto(skb, IPPROTO_IPV6);
 
         err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1769,7 +1776,8 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
         dev->netdev_ops = &ip6_tnl_netdev_ops;
-        dev->destructor = ip6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->flags |= IFF_NOARP;
@@ -2216,7 +2224,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         return 0;
 
 err_register:
-        ip6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
         return err;
 }
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d67ef56454b2..837ea1eefe7f 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -180,7 +180,6 @@ vti6_tnl_unlink(struct vti6_net *ip6n, struct ip6_tnl *t)
 static void vti6_dev_free(struct net_device *dev)
 {
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static int vti6_tnl_create2(struct net_device *dev)
@@ -235,7 +234,7 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p
         return t;
 
 failed_free:
-        vti6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return NULL;
 }
@@ -842,7 +841,8 @@ static const struct net_device_ops vti6_netdev_ops = {
 static void vti6_dev_setup(struct net_device *dev)
 {
         dev->netdev_ops = &vti6_netdev_ops;
-        dev->destructor = vti6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = vti6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
@@ -1100,7 +1100,7 @@ static int __net_init vti6_init_net(struct net *net)
         return 0;
 
 err_register:
-        vti6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
         return err;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 374997d26488..2ecb39b943b5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -733,7 +733,7 @@ static void reg_vif_setup(struct net_device *dev)
         dev->mtu                = 1500 - sizeof(struct ipv6hdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 9b522fa90e6d..ac826dd338ff 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protosw = {
         .type =      SOCK_DGRAM,
         .protocol =  IPPROTO_ICMPV6,
         .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
         .flags =     INET_PROTOSW_REUSE,
 };
 
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index cc8e3ae9ca73..e88bcb8ff0fd 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -219,7 +219,7 @@ static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
         u64 buff64[SNMP_MIB_MAX];
         int i;
 
-        memset(buff64, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
+        memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
 
         snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
         for (i = 0; itemlist[i].name; i++)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f992d9e261d..60be012fe708 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
         .family            = PF_INET6,
         .owner             = THIS_MODULE,
         .release           = inet6_release,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index dc61b0b5e64e..7cebd954d5bb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2804,6 +2804,7 @@ static int fib6_ifdown(struct rt6_info *rt, void *arg)
         if ((rt->dst.dev == dev || !dev) &&
             rt != adn->net->ipv6.ip6_null_entry &&
             (rt->rt6i_nsiblings == 0 ||
+             (dev && netdev_unregistering(dev)) ||
              !rt->rt6i_idev->cnf.ignore_routes_with_linkdown))
                 return -1;
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 61e5902f0687..2378503577b0 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -265,7 +265,7 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
         return nt;
 
 failed_free:
-        ipip6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return NULL;
 }
@@ -1336,7 +1336,6 @@ static void ipip6_dev_free(struct net_device *dev)
 
         dst_cache_destroy(&tunnel->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 #define SIT_FEATURES (NETIF_F_SG           | \
@@ -1351,7 +1350,8 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         int t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
         dev->netdev_ops         = &ipip6_netdev_ops;
-        dev->destructor         = ipip6_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = ipip6_dev_free;
 
         dev->type               = ARPHRD_SIT;
         dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
         iph = ipv6_hdr(skb);
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 7a92c0f31912..9ad07a91708e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 74d09f91709e..3be852808a9d 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -65,7 +65,7 @@ static void irlan_eth_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops         = &irlan_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->min_mtu            = 0;
         dev->max_mtu            = ETH_MAX_MTU;
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c1950bb14735..512dc43d0ce6 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3285,7 +3285,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                 p += pol->sadb_x_policy_len*8;
                 sec_ctx = (struct sadb_x_sec_ctx *)p;
                 if (len < pol->sadb_x_policy_len*8 +
-                    sec_ctx->sadb_x_sec_len) {
+                    sec_ctx->sadb_x_sec_len*8) {
                         *dir = -EINVAL;
                         goto out;
                 }
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 8b21af7321b9..4de2ec94b08c 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -114,12 +114,13 @@ static void l2tp_eth_get_stats64(struct net_device *dev,
 {
         struct l2tp_eth *priv = netdev_priv(dev);
 
-        stats->tx_bytes   = atomic_long_read(&priv->tx_bytes);
-        stats->tx_packets = atomic_long_read(&priv->tx_packets);
-        stats->tx_dropped = atomic_long_read(&priv->tx_dropped);
-        stats->rx_bytes   = atomic_long_read(&priv->rx_bytes);
-        stats->rx_packets = atomic_long_read(&priv->rx_packets);
-        stats->rx_errors  = atomic_long_read(&priv->rx_errors);
+        stats->tx_bytes   = (unsigned long) atomic_long_read(&priv->tx_bytes);
+        stats->tx_packets = (unsigned long) atomic_long_read(&priv->tx_packets);
+        stats->tx_dropped = (unsigned long) atomic_long_read(&priv->tx_dropped);
+        stats->rx_bytes   = (unsigned long) atomic_long_read(&priv->rx_bytes);
+        stats->rx_packets = (unsigned long) atomic_long_read(&priv->rx_packets);
+        stats->rx_errors  = (unsigned long) atomic_long_read(&priv->rx_errors);
+
 }
 
 static const struct net_device_ops l2tp_eth_netdev_ops = {
@@ -141,7 +142,7 @@ static void l2tp_eth_dev_setup(struct net_device *dev)
         dev->priv_flags         &= ~IFF_TX_SKB_SHARING;
         dev->features           |= NETIF_F_LLTX;
         dev->netdev_ops         = &l2tp_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8364fe5b59e4..c38d16f22d2a 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -311,6 +311,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         int rc = -EINVAL;
 
         dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
+
+        lock_sock(sk);
         if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
@@ -382,6 +384,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 out_put:
         llc_sap_put(sap);
 out:
+        release_sock(sk);
         return rc;
 }
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 60e2a62f7bef..cf2392b2ac71 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_start_txq(sta, tid, true);
 }
 
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
 
-        trace_api_start_tx_ba_cb(sdata, ra, tid);
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                return;
+
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
+                ieee80211_agg_tx_operational(local, sta, tid);
+}
+
+static struct tid_ampdu_tx *
+ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
+                        const u8 *ra, u16 tid, struct sta_info **sta)
+{
+        struct tid_ampdu_tx *tid_tx;
 
         if (tid >= IEEE80211_NUM_TIDS) {
                 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
                        tid, IEEE80211_NUM_TIDS);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                mutex_unlock(&local->sta_mtx);
+        *sta = sta_info_get_bss(sdata, ra);
+        if (!*sta) {
                 ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
 
-        if (WARN_ON(!tid_tx)) {
+        if (WARN_ON(!tid_tx))
                 ht_dbg(sdata, "addBA was not requested!\n");
-                goto unlock;
-        }
 
-        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
-                goto unlock;
-
-        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
-                ieee80211_agg_tx_operational(local, sta, tid);
-
- unlock:
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-        mutex_unlock(&local->sta_mtx);
+        return tid_tx;
 }
 
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_start_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         bool send_delba = false;
 
-        trace_api_stop_tx_ba_cb(sdata, ra, tid);
-
-        if (tid >= IEEE80211_NUM_TIDS) {
-                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
-                       tid, IEEE80211_NUM_TIDS);
-                return;
-        }
-
-        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid);
-
-        mutex_lock(&local->sta_mtx);
-
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                goto unlock;
-        }
+        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+               sta->sta.addr, tid);
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
         spin_lock_bh(&sta->lock);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+        if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sdata,
                        "unexpected callback to A-MPDU stop for %pM tid %d\n",
                        sta->sta.addr, tid);
@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         spin_unlock_bh(&sta->lock);
 
         if (send_delba)
-                ieee80211_send_delba(sdata, ra, tid,
+                ieee80211_send_delba(sdata, sta->sta.addr, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        mutex_unlock(&sta->ampdu_mlme.mtx);
- unlock:
-        mutex_unlock(&local->sta_mtx);
 }
 
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_stop_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6c2e6060cd54..4a388fe8c2d1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -902,6 +902,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         default:
                 return -EINVAL;
         }
+        sdata->u.ap.req_smps = sdata->smps_mode;
+
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f4a528773563..6ca5442b1e03 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -7,6 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017       Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
         int i;
 
-        cancel_work_sync(&sta->ampdu_mlme.work);
-
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
                 __ieee80211_stop_tx_ba_session(sta, i, reason);
                 __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                                reason != AGG_STOP_DESTROY_STA &&
                                                reason != AGG_STOP_PEER_REQUEST);
         }
+
+        /* stopping might queue the work again - so cancel only afterwards */
+        cancel_work_sync(&sta->ampdu_mlme.work);
 }
 
 void ieee80211_ba_session_work(struct work_struct *work)
@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work)
                 spin_unlock_bh(&sta->lock);
 
                 tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
-                                                 &tid_tx->state))
+                if (!tid_tx)
+                        continue;
+
+                if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state))
+                        ieee80211_start_tx_ba_cb(sta, tid, tid_tx);
+                if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))
                         ___ieee80211_stop_tx_ba_session(sta, tid,
                                                         AGG_STOP_LOCAL_REQUEST);
+                if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state))
+                        ieee80211_stop_tx_ba_cb(sta, tid, tid_tx);
         }
         mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f8f6c148f554..5e002f62c235 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1036,8 +1036,6 @@ struct ieee80211_rx_agg {
 
 enum sdata_queue_type {
         IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
-        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
-        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
         IEEE80211_SDATA_QUEUE_RX_AGG_START      = 3,
         IEEE80211_SDATA_QUEUE_RX_AGG_STOP       = 4,
 };
@@ -1427,12 +1425,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
         return local->hw.wiphy->bands[band];
 }
 
-/* this struct represents 802.11n's RA/TID combination */
-struct ieee80211_ra_tid {
-        u8 ra[ETH_ALEN];
-        u16 tid;
-};
-
 /* this struct holds the value parsing from channel switch IE  */
 struct ieee80211_csa_ie {
         struct cfg80211_chan_def chandef;
@@ -1539,7 +1531,7 @@ ieee80211_have_rx_timestamp(struct ieee80211_rx_status *status)
                 return true;
         /* can't handle non-legacy preamble yet */
         if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
-            status->encoding != RX_ENC_LEGACY)
+            status->encoding == RX_ENC_LEGACY)
                 return true;
         return false;
 }
@@ -1794,8 +1786,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     enum ieee80211_agg_stop_reason reason);
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx);
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3bd5b81f5d81..f5f50150ba1c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1213,7 +1213,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
 static void ieee80211_if_free(struct net_device *dev)
 {
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static void ieee80211_if_setup(struct net_device *dev)
@@ -1221,7 +1220,8 @@ static void ieee80211_if_setup(struct net_device *dev)
         ether_setup(dev);
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops = &ieee80211_dataif_ops;
-        dev->destructor = ieee80211_if_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ieee80211_if_free;
 }
 
 static void ieee80211_if_setup_no_queue(struct net_device *dev)
@@ -1237,7 +1237,6 @@ static void ieee80211_iface_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
-        struct ieee80211_ra_tid *ra_tid;
         struct ieee80211_rx_agg *rx_agg;
 
         if (!ieee80211_sdata_running(sdata))
@@ -1253,15 +1252,7 @@ static void ieee80211_iface_work(struct work_struct *work)
         while ((skb = skb_dequeue(&sdata->skb_queue))) {
                 struct ieee80211_mgmt *mgmt = (void *)skb->data;
 
-                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
                         rx_agg = (void *)&skb->cb;
                         mutex_lock(&local->sta_mtx);
                         sta = sta_info_get_bss(sdata, rx_agg->addr);
@@ -1825,6 +1816,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 ret = dev_alloc_name(ndev, ndev->name);
                 if (ret < 0) {
                         ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                         return ret;
                 }
 
@@ -1914,7 +1906,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
                 ret = register_netdevice(ndev);
                 if (ret) {
-                        ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                         return ret;
                 }
         }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0ea9712bd99e..cc8e6ea1b27e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -601,7 +601,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        u32 rate_flags, rates = 0;
+        u32 rates = 0;
 
         sdata_assert_lock(sdata);
 
@@ -612,7 +612,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 return;
         }
         chan = chanctx_conf->def.chan;
-        rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
         rcu_read_unlock();
         sband = local->hw.wiphy->bands[chan->band];
         shift = ieee80211_vif_get_shift(&sdata->vif);
@@ -636,9 +635,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                  */
                 rates_len = 0;
                 for (i = 0; i < sband->n_bitrates; i++) {
-                        if ((rate_flags & sband->bitrates[i].flags)
-                            != rate_flags)
-                                continue;
                         rates |= BIT(i);
                         rates_len++;
                 }
@@ -2818,7 +2814,7 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                                 u32 *rates, u32 *basic_rates,
                                 bool *have_higher_than_11mbit,
                                 int *min_rate, int *min_rate_index,
-                                int shift, u32 rate_flags)
+                                int shift)
 {
         int i, j;
 
@@ -2846,8 +2842,6 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                         int brate;
 
                         br = &sband->bitrates[j];
-                        if ((rate_flags & br->flags) != rate_flags)
-                                continue;
 
                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
                         if (brate == rate) {
@@ -4398,40 +4392,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         return -ENOMEM;
         }
 
-        if (new_sta || override) {
-                err = ieee80211_prep_channel(sdata, cbss);
-                if (err) {
-                        if (new_sta)
-                                sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-        }
-
+        /*
+         * Set up the information for the new channel before setting the
+         * new channel. We can't - completely race-free - change the basic
+         * rates bitmap and the channel (sband) that it refers to, but if
+         * we set it up before we at least avoid calling into the driver's
+         * bss_info_changed() method with invalid information (since we do
+         * call that from changing the channel - only for IDLE and perhaps
+         * some others, but ...).
+         *
+         * So to avoid that, just set up all the new information before the
+         * channel, but tell the driver to apply it only afterwards, since
+         * it might need the new channel for that.
+         */
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
-                struct ieee80211_chanctx_conf *chanctx_conf;
                 const struct cfg80211_bss_ies *ies;
                 int shift = ieee80211_vif_get_shift(&sdata->vif);
-                u32 rate_flags;
-
-                rcu_read_lock();
-                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (WARN_ON(!chanctx_conf)) {
-                        rcu_read_unlock();
-                        sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
-                rcu_read_unlock();
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
                                     &rates, &basic_rates,
                                     &have_higher_than_11mbit,
                                     &min_rate, &min_rate_index,
-                                    shift, rate_flags);
+                                    shift);
 
                 /*
                  * This used to be a workaround for basic rates missing
@@ -4489,8 +4475,22 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         sdata->vif.bss_conf.sync_dtim_count = 0;
                 }
                 rcu_read_unlock();
+        }
 
-                /* tell driver about BSSID, basic rates and timing */
+        if (new_sta || override) {
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        if (new_sta)
+                                sta_info_free(local, new_sta);
+                        return -EINVAL;
+                }
+        }
+
+        if (new_sta) {
+                /*
+                 * tell driver about BSSID, basic rates and timing
+                 * this was set up above, before setting the channel
+                 */
                 ieee80211_bss_info_change_notify(sdata,
                         BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
                         BSS_CHANGED_BEACON_INT);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 35f4c7d7a500..3674fe3d67dc 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1613,12 +1613,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
          */
         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
             !ieee80211_has_morefrags(hdr->frame_control) &&
+            !ieee80211_is_back_req(hdr->frame_control) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-            /* PM bit is only checked in frames where it isn't reserved,
+            /*
+             * PM bit is only checked in frames where it isn't reserved,
              * in AP mode it's reserved in non-bufferable management frames
              * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             * BAR frames should be ignored as specified in
+             * IEEE 802.11-2012 10.2.1.2.
              */
             (!ieee80211_is_mgmt(hdr->frame_control) ||
              ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
@@ -2492,7 +2496,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 if (is_multicast_ether_addr(hdr->addr1)) {
                         mpp_addr = hdr->addr3;
                         proxied_addr = mesh_hdr->eaddr1;
-                } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+                } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+                            MESH_FLAGS_AE_A5_A6) {
                         /* has_a4 already checked in ieee80211_rx_mesh_check */
                         mpp_addr = hdr->addr4;
                         proxied_addr = mesh_hdr->eaddr2;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7cdf7a835bb0..403e3cc58b57 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2155,7 +2155,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         struct ieee80211_sta_rx_stats *cpurxs;
 
                         cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-                        sinfo->rx_packets += cpurxs->dropped;
+                        sinfo->rx_dropped_misc += cpurxs->dropped;
                 }
         }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5609cacb20d5..ea0747d6a6da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -116,6 +116,8 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_STOPPING           3
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+#define HT_AGG_STATE_START_CB           6
+#define HT_AGG_STATE_STOP_CB            7
 
 enum ieee80211_agg_stop_reason {
         AGG_STOP_DECLINED,
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c1ef22df865f..cc19614ff4e6 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -17,6 +17,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 
 #include "ieee80211_i.h"
 #include "michael.h"
@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
         michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+        if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
                 goto mic_fail;
 
         /* remove Michael MIC from payload */
@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
                                    skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_cmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
                                        skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_cmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
                 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
                                        skb->data + 24, skb->len - 24,
                                        mic) < 0 ||
-                    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_gmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index 06019dba4b10..bd88a9b80773 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -526,8 +526,6 @@ static void mac802154_wpan_free(struct net_device *dev)
         struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         mac802154_llsec_destroy(&sdata->sec);
-
-        free_netdev(dev);
 }
 
 static void ieee802154_if_setup(struct net_device *dev)
@@ -593,7 +591,8 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
                                         sdata->dev->dev_addr);
 
                 sdata->dev->header_ops = &mac802154_header_ops;
-                sdata->dev->destructor = mac802154_wpan_free;
+                sdata->dev->needs_free_netdev = true;
+                sdata->dev->priv_destructor = mac802154_wpan_free;
                 sdata->dev->netdev_ops = &mac802154_wpan_ops;
                 sdata->dev->ml_priv = &mac802154_mlme_wpan;
                 wpan_dev->promiscuous_mode = false;
@@ -608,7 +607,7 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
 
                 break;
         case NL802154_IFTYPE_MONITOR:
-                sdata->dev->destructor = free_netdev;
+                sdata->dev->needs_free_netdev = true;
                 sdata->dev->netdev_ops = &mac802154_monitor_ops;
                 wpan_dev->promiscuous_mode = true;
                 break;
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 257ec66009da..7b05fd1497ce 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1418,7 +1418,7 @@ static void mpls_ifup(struct net_device *dev, unsigned int flags)
                                 continue;
                         alive++;
                         nh_flags &= ~flags;
-                        WRITE_ONCE(nh->nh_flags, flags);
+                        WRITE_ONCE(nh->nh_flags, nh_flags);
                 } endfor_nexthops(rt);
 
                 WRITE_ONCE(rt->rt_nhn_alive, alive);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9799a50bc604..a8be9b72e6cd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -890,8 +890,13 @@ restart:
         }
 out:
         local_bh_enable();
-        if (last)
+        if (last) {
+                /* nf ct hash resize happened, now clear the leftover. */
+                if ((struct nf_conn *)cb->args[1] == last)
+                        cb->args[1] = 0;
+
                 nf_ct_put(last);
+        }
 
         while (i) {
                 i--;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 13875d599a85..1c5b14a6cab3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
                       u8 pf, unsigned int hooknum)
 {
         const struct sctphdr *sh;
-        struct sctphdr _sctph;
         const char *logmsg;
 
-        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
-        if (!sh) {
+        if (skb->len < dataoff + sizeof(struct sctphdr)) {
                 logmsg = "nf_ct_sctp: short packet ";
                 goto out_invalid;
         }
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             skb->ip_summed == CHECKSUM_NONE) {
+                if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
+                        logmsg = "nf_ct_sctp: failed to read header ";
+                        goto out_invalid;
+                }
+                sh = (const struct sctphdr *)(skb->data + dataoff);
                 if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                         logmsg = "nf_ct_sctp: bad CRC ";
                         goto out_invalid;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index ef0be325a0c6..6c72922d20ca 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
          * will delete entry from already-freed table.
          */
-        ct->status &= ~IPS_NAT_DONE_MASK;
+        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
         rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
                         nf_nat_bysource_params);
 
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e97e2fb53f0a..fbdbaa00dd5f 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                 else if (d > 0)
                         p = &parent->rb_right;
                 else {
-                        if (nft_set_elem_active(&rbe->ext, genmask)) {
-                                if (nft_rbtree_interval_end(rbe) &&
-                                    !nft_rbtree_interval_end(new))
-                                        p = &parent->rb_left;
-                                else if (!nft_rbtree_interval_end(rbe) &&
-                                         nft_rbtree_interval_end(new))
-                                        p = &parent->rb_right;
-                                else {
-                                        *ext = &rbe->ext;
-                                        return -EEXIST;
-                                }
+                        if (nft_rbtree_interval_end(rbe) &&
+                            !nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_left;
+                        } else if (!nft_rbtree_interval_end(rbe) &&
+                                   nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_right;
+                        } else if (nft_set_elem_active(&rbe->ext, genmask)) {
+                                *ext = &rbe->ext;
+                                return -EEXIST;
+                        } else {
+                                p = &parent->rb_left;
                         }
                 }
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ee841f00a6ec..7586d446d7dc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -62,6 +62,7 @@
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
 #include <linux/genetlink.h>
+#include <linux/net_namespace.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1415,7 +1416,8 @@ static void do_one_broadcast(struct sock *sk,
                 goto out;
         }
         NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
-        NETLINK_CB(p->skb2).nsid_is_set = true;
+        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
+                NETLINK_CB(p->skb2).nsid_is_set = true;
         val = netlink_broadcast_deliver(sk, p->skb2);
         if (val < 0) {
                 netlink_overrun(sk);
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 89193a634da4..04a3128adcf0 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -94,7 +94,6 @@ static void internal_dev_destructor(struct net_device *dev)
         struct vport *vport = ovs_internal_dev_get_vport(dev);
 
         ovs_vport_free(vport);
-        free_netdev(dev);
 }
 
 static void
@@ -156,7 +155,8 @@ static void do_setup(struct net_device *netdev)
         netdev->priv_flags &= ~IFF_TX_SKB_SHARING;
         netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                               IFF_PHONY_HEADROOM | IFF_NO_QUEUE;
-        netdev->destructor = internal_dev_destructor;
+        netdev->needs_free_netdev = true;
+        netdev->priv_destructor = internal_dev_destructor;
         netdev->ethtool_ops = &internal_dev_ethtool_ops;
         netdev->rtnl_link_ops = &internal_dev_link_ops;
 
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 21c28b51be94..2c9337946e30 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -236,7 +236,7 @@ static void gprs_setup(struct net_device *dev)
         dev->tx_queue_len       = 10;
 
         dev->netdev_ops         = &gprs_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /*
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 164b5ac094be..7dc5892671c8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -94,8 +94,10 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
                 k++;
         }
 
-        if (n)
+        if (n) {
+                err = -EINVAL;
                 goto err_out;
+        }
 
         return keys_ex;
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index f42008b29311..b062bc80c7cb 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -132,21 +132,21 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
                 }
         }
 
-        spin_lock_bh(&police->tcf_lock);
         if (est) {
                 err = gen_replace_estimator(&police->tcf_bstats, NULL,
                                             &police->tcf_rate_est,
                                             &police->tcf_lock,
                                             NULL, est);
                 if (err)
-                        goto failure_unlock;
+                        goto failure;
         } else if (tb[TCA_POLICE_AVRATE] &&
                    (ret == ACT_P_CREATED ||
                     !gen_estimator_active(&police->tcf_rate_est))) {
                 err = -EINVAL;
-                goto failure_unlock;
+                goto failure;
         }
 
+        spin_lock_bh(&police->tcf_lock);
         /* No failure allowed after this point */
         police->tcfp_mtu = parm->mtu;
         if (police->tcfp_mtu == 0) {
@@ -192,8 +192,6 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
 
         return ret;
 
-failure_unlock:
-        spin_unlock_bh(&police->tcf_lock);
 failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index a9708da28eb5..95238284c422 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1176,7 +1176,9 @@ void sctp_assoc_update(struct sctp_association *asoc,
 
                 asoc->ctsn_ack_point = asoc->next_tsn - 1;
                 asoc->adv_peer_ack_point = asoc->ctsn_ack_point;
-                if (!asoc->stream) {
+
+                if (sctp_state(asoc, COOKIE_WAIT)) {
+                        sctp_stream_free(asoc->stream);
                         asoc->stream = new->stream;
                         new->stream = NULL;
                 }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0e06a278d2a9..ba9ad32fc447 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
 {
+        struct sctp_init_chunk *chunkhdr, _chunkhdr;
         union sctp_addr saddr;
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
         struct sctp_association *asoc;
         struct sctp_transport *transport = NULL;
-        struct sctp_init_chunk *chunkhdr;
         __u32 vtag = ntohl(sctphdr->vtag);
-        int len = skb->len - ((void *)sctphdr - (void *)skb->data);
 
         *app = NULL; *tpp = NULL;
 
@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
          * discard the packet.
          */
         if (vtag == 0) {
-                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
-                if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
-                          + sizeof(__be32) ||
+                /* chunk header + first 4 octects of init header */
+                chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+                                              sizeof(struct sctphdr),
+                                              sizeof(struct sctp_chunkhdr) +
+                                              sizeof(__be32), &_chunkhdr);
+                if (!chunkhdr ||
                     chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                         goto out;
-                }
+
         } else if (vtag != asoc->c.peer_vtag) {
                 goto out;
         }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 8a08f13469c4..92e332e17391 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2454,16 +2454,11 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
          * stream sequence number shall be set to 0.
          */
 
-        /* Allocate storage for the negotiated streams if it is not a temporary
-         * association.
-         */
-        if (!asoc->temp) {
-                if (sctp_stream_init(asoc, gfp))
-                        goto clean_up;
+        if (sctp_stream_init(asoc, gfp))
+                goto clean_up;
 
-                if (sctp_assoc_set_id(asoc, gfp))
-                        goto clean_up;
-        }
+        if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
+                goto clean_up;
 
         /* ADDIP Section 4.1 ASCONF Chunk Procedures
          *
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 4f5e6cfc7f60..f863b5573e42 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2088,6 +2088,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
                 }
         }
 
+        /* Set temp so that it won't be added into hashtable */
+        new_asoc->temp = 1;
+
         /* Compare the tie_tag in cookie with the verification tag of
          * current association.
          */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f16c8d97b7f3..30aa0a529215 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4622,13 +4622,13 @@ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
 
         for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
              hash++, head++) {
-                read_lock(&head->lock);
+                read_lock_bh(&head->lock);
                 sctp_for_each_hentry(epb, &head->chain) {
                         err = cb(sctp_ep(epb), p);
                         if (err)
                                 break;
                 }
-                read_unlock(&head->lock);
+                read_unlock_bh(&head->lock);
         }
 
         return err;
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 24fedd4b117e..03f6b5840764 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -119,11 +119,9 @@ int xprt_rdma_bc_setup(struct rpc_xprt *xprt, unsigned int reqs)
 
         for (i = 0; i < (reqs << 1); i++) {
                 rqst = kzalloc(sizeof(*rqst), GFP_KERNEL);
-                if (!rqst) {
-                        pr_err("RPC:       %s: Failed to create bc rpc_rqst\n",
-                               __func__);
+                if (!rqst)
                         goto out_free;
-                }
+
                 dprintk("RPC:       %s: new rqst %p\n", __func__, rqst);
 
                 rqst->rq_xprt = &r_xprt->rx_xprt;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 16aff8ddc16f..d5b54c020dec 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2432,7 +2432,12 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         case -ENETUNREACH:
         case -EADDRINUSE:
         case -ENOBUFS:
-                /* retry with existing socket, after a delay */
+                /*
+                 * xs_tcp_force_close() wakes tasks with -EIO.
+                 * We need to wake them first to ensure the
+                 * correct error code.
+                 */
+                xprt_wake_pending_tasks(xprt, status);
                 xs_tcp_force_close(xprt);
                 goto out;
         }
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 312ef7de57d7..ab3087687a32 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
         }
 
         if (skb_cloned(_skb) &&
-            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
                 goto exit;
 
         /* Now reverse the concerned fields */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6a7fe7660551..c77ced0109b7 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -343,7 +343,7 @@ found:
  * are still connected to it and there's no way to inform "a polling
  * implementation" that it should let go of a certain wait queue
  *
- * In order to propagate a wake up, a wait_queue_t of the client
+ * In order to propagate a wake up, a wait_queue_entry_t of the client
  * socket is enqueued on the peer_wait queue of the server socket
  * whose wake function does a wake_up on the ordinary client socket
  * wait queue. This connection is established whenever a write (or
@@ -352,7 +352,7 @@ found:
  * was relayed.
  */
 
-static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags,
+static int unix_dgram_peer_wake_relay(wait_queue_entry_t *q, unsigned mode, int flags,
                                       void *key)
 {
         struct unix_sock *u;
@@ -999,7 +999,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct path path = { };
 
         err = -EINVAL;
-        if (sunaddr->sun_family != AF_UNIX)
+        if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+            sunaddr->sun_family != AF_UNIX)
                 goto out;
 
         if (addr_len == sizeof(short)) {
@@ -1110,6 +1111,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         unsigned int hash;
         int err;
 
+        err = -EINVAL;
+        if (alen < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         if (addr->sa_family != AF_UNSPEC) {
                 err = unix_mkname(sunaddr, alen, &hash);
                 if (err < 0)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 14d5f0c8c45f..9f0901f3e42b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -322,9 +322,9 @@ cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
 {
         struct cfg80211_sched_scan_request *pos;
 
-        ASSERT_RTNL();
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
 
-        list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
+        list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) {
                 if (pos->reqid == reqid)
                         return pos;
         }
@@ -398,13 +398,13 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
         trace_cfg80211_sched_scan_results(wiphy, reqid);
         /* ignore if we're not scanning */
 
-        rtnl_lock();
+        rcu_read_lock();
         request = cfg80211_find_sched_scan_req(rdev, reqid);
         if (request) {
                 request->report_results = true;
                 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
         }
-        rtnl_unlock();
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_results);
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7198373e2920..4992f1025c9d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
         if (iftype == NL80211_IFTYPE_MESH_POINT)
                 skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
 
+        mesh_flags &= MESH_FLAGS_AE;
+
         switch (hdr->frame_control &
                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
         case cpu_to_le16(IEEE80211_FCTL_TODS):
@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                              iftype != NL80211_IFTYPE_STATION))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                 return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
                                 skb_copy_bits(skb, hdrlen +
                                         offsetof(struct ieee80211s_hdr, eaddr1),
                                         tmp.h_dest, 2 * ETH_ALEN);
@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                      ether_addr_equal(tmp.h_source, addr)))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6)
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6)
                                 return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                 skb_copy_bits(skb, hdrlen +
                                         offsetof(struct ieee80211s_hdr, eaddr1),
                                         tmp.h_source, ETH_ALEN);
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 8ec8a3fcf8d4..574e6f32f94f 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -170,7 +170,7 @@ static int xfrm_dev_feat_change(struct net_device *dev)
 
 static int xfrm_dev_down(struct net_device *dev)
 {
-        if (dev->hw_features & NETIF_F_HW_ESP)
+        if (dev->features & NETIF_F_HW_ESP)
                 xfrm_dev_state_flush(dev_net(dev), dev, true);
 
         xfrm_garbage_collect(dev_net(dev));
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b00a1d5a7f52..ed4e52d95172 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1797,43 +1797,6 @@ free_dst:
         goto out;
 }
 
-#ifdef CONFIG_XFRM_SUB_POLICY
-static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
-{
-        if (!*target) {
-                *target = kmalloc(size, GFP_ATOMIC);
-                if (!*target)
-                        return -ENOMEM;
-        }
-
-        memcpy(*target, src, size);
-        return 0;
-}
-#endif
-
-static int xfrm_dst_update_parent(struct dst_entry *dst,
-                                  const struct xfrm_selector *sel)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->partner),
-                                   sel, sizeof(*sel));
-#else
-        return 0;
-#endif
-}
-
-static int xfrm_dst_update_origin(struct dst_entry *dst,
-                                  const struct flowi *fl)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
-#else
-        return 0;
-#endif
-}
-
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
                                 struct xfrm_policy **pols,
                                 int *num_pols, int *num_xfrms)
@@ -1905,16 +1868,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
         xdst = (struct xfrm_dst *)dst;
         xdst->num_xfrms = err;
-        if (num_pols > 1)
-                err = xfrm_dst_update_parent(dst, &pols[1]->selector);
-        else
-                err = xfrm_dst_update_origin(dst, fl);
-        if (unlikely(err)) {
-                dst_free(dst);
-                XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
-                return ERR_PTR(err);
-        }
-
         xdst->num_pols = num_pols;
         memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
         xdst->policy_genid = atomic_read(&pols[0]->genid);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index fc3c5aa38754..2e291bc5f1fc 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1383,6 +1383,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
         x->curlft.add_time = orig->curlft.add_time;
         x->km.state = orig->km.state;
         x->km.seq = orig->km.seq;
+        x->replay = orig->replay;
+        x->preplay = orig->preplay;
 
         return x;
 
diff --git a/scripts/gdb/linux/dmesg.py b/scripts/gdb/linux/dmesg.py
index f9b92ece7834..5afd1098e33a 100644
--- a/scripts/gdb/linux/dmesg.py
+++ b/scripts/gdb/linux/dmesg.py
@@ -23,10 +23,11 @@ class LxDmesg(gdb.Command):
         super(LxDmesg, self).__init__("lx-dmesg", gdb.COMMAND_DATA)
 
     def invoke(self, arg, from_tty):
-        log_buf_addr = int(str(gdb.parse_and_eval("log_buf")).split()[0], 16)
-        log_first_idx = int(gdb.parse_and_eval("log_first_idx"))
-        log_next_idx = int(gdb.parse_and_eval("log_next_idx"))
-        log_buf_len = int(gdb.parse_and_eval("log_buf_len"))
+        log_buf_addr = int(str(gdb.parse_and_eval(
+            "'printk.c'::log_buf")).split()[0], 16)
+        log_first_idx = int(gdb.parse_and_eval("'printk.c'::log_first_idx"))
+        log_next_idx = int(gdb.parse_and_eval("'printk.c'::log_next_idx"))
+        log_buf_len = int(gdb.parse_and_eval("'printk.c'::log_buf_len"))
 
         inf = gdb.inferiors()[0]
         start = log_buf_addr + log_first_idx
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index 6fd95f76bfae..a7a23b5541f8 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -20,6 +20,10 @@ config KEYS
 
           If you are unsure as to whether this is required, answer N.
 
+config KEYS_COMPAT
+        def_bool y
+        depends on COMPAT && KEYS
+
 config PERSISTENT_KEYRINGS
         bool "Enable register of persistent per-UID keyrings"
         depends on KEYS
@@ -89,9 +93,9 @@ config ENCRYPTED_KEYS
 config KEY_DH_OPERATIONS
        bool "Diffie-Hellman operations on retained keys"
        depends on KEYS
-       select MPILIB
        select CRYPTO
        select CRYPTO_HASH
+       select CRYPTO_DH
        help
          This option provides support for calculating Diffie-Hellman
          public keys and shared secrets using values stored as keys
diff --git a/security/keys/dh.c b/security/keys/dh.c
index e603bd912e4c..4755d4b4f945 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -8,34 +8,17 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#include <linux/mpi.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <crypto/hash.h>
+#include <crypto/kpp.h>
+#include <crypto/dh.h>
 #include <keys/user-type.h>
 #include "internal.h"
 
-/*
- * Public key or shared secret generation function [RFC2631 sec 2.1.1]
- *
- * ya = g^xa mod p;
- * or
- * ZZ = yb^xa mod p;
- *
- * where xa is the local private key, ya is the local public key, g is
- * the generator, p is the prime, yb is the remote public key, and ZZ
- * is the shared secret.
- *
- * Both are the same calculation, so g or yb are the "base" and ya or
- * ZZ are the "result".
- */
-static int do_dh(MPI result, MPI base, MPI xa, MPI p)
-{
-        return mpi_powm(result, base, xa, p);
-}
-
-static ssize_t mpi_from_key(key_serial_t keyid, size_t maxlen, MPI *mpi)
+static ssize_t dh_data_from_key(key_serial_t keyid, void **data)
 {
         struct key *key;
         key_ref_t key_ref;
@@ -56,19 +39,17 @@ static ssize_t mpi_from_key(key_serial_t keyid, size_t maxlen, MPI *mpi)
                 status = key_validate(key);
                 if (status == 0) {
                         const struct user_key_payload *payload;
+                        uint8_t *duplicate;
 
                         payload = user_key_payload_locked(key);
 
-                        if (maxlen == 0) {
-                                *mpi = NULL;
+                        duplicate = kmemdup(payload->data, payload->datalen,
+                                            GFP_KERNEL);
+                        if (duplicate) {
+                                *data = duplicate;
                                 ret = payload->datalen;
-                        } else if (payload->datalen <= maxlen) {
-                                *mpi = mpi_read_raw_data(payload->data,
-                                                         payload->datalen);
-                                if (*mpi)
-                                        ret = payload->datalen;
                         } else {
-                                ret = -EINVAL;
+                                ret = -ENOMEM;
                         }
                 }
                 up_read(&key->sem);
@@ -79,6 +60,29 @@ error:
         return ret;
 }
 
+static void dh_free_data(struct dh *dh)
+{
+        kzfree(dh->key);
+        kzfree(dh->p);
+        kzfree(dh->g);
+}
+
+struct dh_completion {
+        struct completion completion;
+        int err;
+};
+
+static void dh_crypto_done(struct crypto_async_request *req, int err)
+{
+        struct dh_completion *compl = req->data;
+
+        if (err == -EINPROGRESS)
+                return;
+
+        compl->err = err;
+        complete(&compl->completion);
+}
+
 struct kdf_sdesc {
         struct shash_desc shash;
         char ctx[];
@@ -89,6 +93,7 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
         struct crypto_shash *tfm;
         struct kdf_sdesc *sdesc;
         int size;
+        int err;
 
         /* allocate synchronous hash */
         tfm = crypto_alloc_shash(hashname, 0, 0);
@@ -97,16 +102,25 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
                 return PTR_ERR(tfm);
         }
 
+        err = -EINVAL;
+        if (crypto_shash_digestsize(tfm) == 0)
+                goto out_free_tfm;
+
+        err = -ENOMEM;
         size = sizeof(struct shash_desc) + crypto_shash_descsize(tfm);
         sdesc = kmalloc(size, GFP_KERNEL);
         if (!sdesc)
-                return -ENOMEM;
+                goto out_free_tfm;
         sdesc->shash.tfm = tfm;
         sdesc->shash.flags = 0x0;
 
         *sdesc_ret = sdesc;
 
         return 0;
+
+out_free_tfm:
+        crypto_free_shash(tfm);
+        return err;
 }
 
 static void kdf_dealloc(struct kdf_sdesc *sdesc)
@@ -120,14 +134,6 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc)
         kzfree(sdesc);
 }
 
-/* convert 32 bit integer into its string representation */
-static inline void crypto_kw_cpu_to_be32(u32 val, u8 *buf)
-{
-        __be32 *a = (__be32 *)buf;
-
-        *a = cpu_to_be32(val);
-}
-
 /*
  * Implementation of the KDF in counter mode according to SP800-108 section 5.1
  * as well as SP800-56A section 5.8.1 (Single-step KDF).
@@ -138,25 +144,39 @@ static inline void crypto_kw_cpu_to_be32(u32 val, u8 *buf)
  * 5.8.1.2).
  */
 static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
-                   u8 *dst, unsigned int dlen)
+                   u8 *dst, unsigned int dlen, unsigned int zlen)
 {
         struct shash_desc *desc = &sdesc->shash;
         unsigned int h = crypto_shash_digestsize(desc->tfm);
         int err = 0;
         u8 *dst_orig = dst;
-        u32 i = 1;
-        u8 iteration[sizeof(u32)];
+        __be32 counter = cpu_to_be32(1);
 
         while (dlen) {
                 err = crypto_shash_init(desc);
                 if (err)
                         goto err;
 
-                crypto_kw_cpu_to_be32(i, iteration);
-                err = crypto_shash_update(desc, iteration, sizeof(u32));
+                err = crypto_shash_update(desc, (u8 *)&counter, sizeof(__be32));
                 if (err)
                         goto err;
 
+                if (zlen && h) {
+                        u8 tmpbuffer[h];
+                        size_t chunk = min_t(size_t, zlen, h);
+                        memset(tmpbuffer, 0, chunk);
+
+                        do {
+                                err = crypto_shash_update(desc, tmpbuffer,
+                                                          chunk);
+                                if (err)
+                                        goto err;
+
+                                zlen -= chunk;
+                                chunk = min_t(size_t, zlen, h);
+                        } while (zlen);
+                }
+
                 if (src && slen) {
                         err = crypto_shash_update(desc, src, slen);
                         if (err)
@@ -179,7 +199,7 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
 
                         dlen -= h;
                         dst += h;
-                        i++;
+                        counter = cpu_to_be32(be32_to_cpu(counter) + 1);
                 }
         }
 
@@ -192,7 +212,7 @@ err:
 
 static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
                                  char __user *buffer, size_t buflen,
-                                 uint8_t *kbuf, size_t kbuflen)
+                                 uint8_t *kbuf, size_t kbuflen, size_t lzero)
 {
         uint8_t *outbuf = NULL;
         int ret;
@@ -203,7 +223,7 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
                 goto err;
         }
 
-        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen);
+        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen, lzero);
         if (ret)
                 goto err;
 
@@ -221,21 +241,26 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
                          struct keyctl_kdf_params *kdfcopy)
 {
         long ret;
-        MPI base, private, prime, result;
-        unsigned nbytes;
+        ssize_t dlen;
+        int secretlen;
+        int outlen;
         struct keyctl_dh_params pcopy;
-        uint8_t *kbuf;
-        ssize_t keylen;
-        size_t resultlen;
+        struct dh dh_inputs;
+        struct scatterlist outsg;
+        struct dh_completion compl;
+        struct crypto_kpp *tfm;
+        struct kpp_request *req;
+        uint8_t *secret;
+        uint8_t *outbuf;
         struct kdf_sdesc *sdesc = NULL;
 
         if (!params || (!buffer && buflen)) {
                 ret = -EINVAL;
-                goto out;
+                goto out1;
         }
         if (copy_from_user(&pcopy, params, sizeof(pcopy)) != 0) {
                 ret = -EFAULT;
-                goto out;
+                goto out1;
         }
 
         if (kdfcopy) {
@@ -244,104 +269,147 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
                 if (buflen > KEYCTL_KDF_MAX_OUTPUT_LEN ||
                     kdfcopy->otherinfolen > KEYCTL_KDF_MAX_OI_LEN) {
                         ret = -EMSGSIZE;
-                        goto out;
+                        goto out1;
                 }
 
                 /* get KDF name string */
                 hashname = strndup_user(kdfcopy->hashname, CRYPTO_MAX_ALG_NAME);
                 if (IS_ERR(hashname)) {
                         ret = PTR_ERR(hashname);
-                        goto out;
+                        goto out1;
                 }
 
                 /* allocate KDF from the kernel crypto API */
                 ret = kdf_alloc(&sdesc, hashname);
                 kfree(hashname);
                 if (ret)
-                        goto out;
+                        goto out1;
         }
 
-        /*
-         * If the caller requests postprocessing with a KDF, allow an
-         * arbitrary output buffer size since the KDF ensures proper truncation.
-         */
-        keylen = mpi_from_key(pcopy.prime, kdfcopy ? SIZE_MAX : buflen, &prime);
-        if (keylen < 0 || !prime) {
-                /* buflen == 0 may be used to query the required buffer size,
-                 * which is the prime key length.
-                 */
-                ret = keylen;
-                goto out;
+        memset(&dh_inputs, 0, sizeof(dh_inputs));
+
+        dlen = dh_data_from_key(pcopy.prime, &dh_inputs.p);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out1;
+        }
+        dh_inputs.p_size = dlen;
+
+        dlen = dh_data_from_key(pcopy.base, &dh_inputs.g);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out2;
         }
+        dh_inputs.g_size = dlen;
 
-        /* The result is never longer than the prime */
-        resultlen = keylen;
+        dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
+        if (dlen < 0) {
+                ret = dlen;
+                goto out2;
+        }
+        dh_inputs.key_size = dlen;
 
-        keylen = mpi_from_key(pcopy.base, SIZE_MAX, &base);
-        if (keylen < 0 || !base) {
-                ret = keylen;
-                goto error1;
+        secretlen = crypto_dh_key_len(&dh_inputs);
+        secret = kmalloc(secretlen, GFP_KERNEL);
+        if (!secret) {
+                ret = -ENOMEM;
+                goto out2;
         }
+        ret = crypto_dh_encode_key(secret, secretlen, &dh_inputs);
+        if (ret)
+                goto out3;
 
-        keylen = mpi_from_key(pcopy.private, SIZE_MAX, &private);
-        if (keylen < 0 || !private) {
-                ret = keylen;
-                goto error2;
+        tfm = crypto_alloc_kpp("dh", CRYPTO_ALG_TYPE_KPP, 0);
+        if (IS_ERR(tfm)) {
+                ret = PTR_ERR(tfm);
+                goto out3;
+        }
+
+        ret = crypto_kpp_set_secret(tfm, secret, secretlen);
+        if (ret)
+                goto out4;
+
+        outlen = crypto_kpp_maxsize(tfm);
+
+        if (!kdfcopy) {
+                /*
+                 * When not using a KDF, buflen 0 is used to read the
+                 * required buffer length
+                 */
+                if (buflen == 0) {
+                        ret = outlen;
+                        goto out4;
+                } else if (outlen > buflen) {
+                        ret = -EOVERFLOW;
+                        goto out4;
+                }
         }
 
-        result = mpi_alloc(0);
-        if (!result) {
+        outbuf = kzalloc(kdfcopy ? (outlen + kdfcopy->otherinfolen) : outlen,
+                         GFP_KERNEL);
+        if (!outbuf) {
                 ret = -ENOMEM;
-                goto error3;
+                goto out4;
         }
 
-        /* allocate space for DH shared secret and SP800-56A otherinfo */
-        kbuf = kmalloc(kdfcopy ? (resultlen + kdfcopy->otherinfolen) : resultlen,
-                       GFP_KERNEL);
-        if (!kbuf) {
+        sg_init_one(&outsg, outbuf, outlen);
+
+        req = kpp_request_alloc(tfm, GFP_KERNEL);
+        if (!req) {
                 ret = -ENOMEM;
-                goto error4;
+                goto out5;
         }
 
+        kpp_request_set_input(req, NULL, 0);
+        kpp_request_set_output(req, &outsg, outlen);
+        init_completion(&compl.completion);
+        kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
+                                 CRYPTO_TFM_REQ_MAY_SLEEP,
+                                 dh_crypto_done, &compl);
+
         /*
-         * Concatenate SP800-56A otherinfo past DH shared secret -- the
-         * input to the KDF is (DH shared secret || otherinfo)
+         * For DH, generate_public_key and generate_shared_secret are
+         * the same calculation
          */
-        if (kdfcopy && kdfcopy->otherinfo &&
-            copy_from_user(kbuf + resultlen, kdfcopy->otherinfo,
-                           kdfcopy->otherinfolen) != 0) {
-                ret = -EFAULT;
-                goto error5;
+        ret = crypto_kpp_generate_public_key(req);
+        if (ret == -EINPROGRESS) {
+                wait_for_completion(&compl.completion);
+                ret = compl.err;
+                if (ret)
+                        goto out6;
         }
 
-        ret = do_dh(result, base, private, prime);
-        if (ret)
-                goto error5;
-
-        ret = mpi_read_buffer(result, kbuf, resultlen, &nbytes, NULL);
-        if (ret != 0)
-                goto error5;
-
         if (kdfcopy) {
-                ret = keyctl_dh_compute_kdf(sdesc, buffer, buflen, kbuf,
-                                            resultlen + kdfcopy->otherinfolen);
-        } else {
-                ret = nbytes;
-                if (copy_to_user(buffer, kbuf, nbytes) != 0)
+                /*
+                 * Concatenate SP800-56A otherinfo past DH shared secret -- the
+                 * input to the KDF is (DH shared secret || otherinfo)
+                 */
+                if (copy_from_user(outbuf + req->dst_len, kdfcopy->otherinfo,
+                                   kdfcopy->otherinfolen) != 0) {
                         ret = -EFAULT;
+                        goto out6;
+                }
+
+                ret = keyctl_dh_compute_kdf(sdesc, buffer, buflen, outbuf,
+                                            req->dst_len + kdfcopy->otherinfolen,
+                                            outlen - req->dst_len);
+        } else if (copy_to_user(buffer, outbuf, req->dst_len) == 0) {
+                ret = req->dst_len;
+        } else {
+                ret = -EFAULT;
         }
 
-error5:
-        kzfree(kbuf);
-error4:
-        mpi_free(result);
-error3:
-        mpi_free(private);
-error2:
-        mpi_free(base);
-error1:
-        mpi_free(prime);
-out:
+out6:
+        kpp_request_free(req);
+out5:
+        kzfree(outbuf);
+out4:
+        crypto_free_kpp(tfm);
+out3:
+        kzfree(secret);
+out2:
+        dh_free_data(&dh_inputs);
+out1:
         kdf_dealloc(sdesc);
         return ret;
 }
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 0010955d7876..bb6324d1ccec 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -30,6 +30,7 @@
 #include <linux/scatterlist.h>
 #include <linux/ctype.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 #include <crypto/hash.h>
 #include <crypto/sha.h>
 #include <crypto/skcipher.h>
@@ -54,13 +55,7 @@ static int blksize;
 #define MAX_DATA_SIZE 4096
 #define MIN_DATA_SIZE  20
 
-struct sdesc {
-        struct shash_desc shash;
-        char ctx[];
-};
-
-static struct crypto_shash *hashalg;
-static struct crypto_shash *hmacalg;
+static struct crypto_shash *hash_tfm;
 
 enum {
         Opt_err = -1, Opt_new, Opt_load, Opt_update
@@ -141,23 +136,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc)
  */
 static int valid_master_desc(const char *new_desc, const char *orig_desc)
 {
-        if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) {
-                if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN)
-                        goto out;
-                if (orig_desc)
-                        if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN))
-                                goto out;
-        } else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) {
-                if (strlen(new_desc) == KEY_USER_PREFIX_LEN)
-                        goto out;
-                if (orig_desc)
-                        if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN))
-                                goto out;
-        } else
-                goto out;
+        int prefix_len;
+
+        if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
+                prefix_len = KEY_TRUSTED_PREFIX_LEN;
+        else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
+                prefix_len = KEY_USER_PREFIX_LEN;
+        else
+                return -EINVAL;
+
+        if (!new_desc[prefix_len])
+                return -EINVAL;
+
+        if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
+                return -EINVAL;
+
         return 0;
-out:
-        return -EINVAL;
 }
 
 /*
@@ -321,53 +315,38 @@ error:
         return ukey;
 }
 
-static struct sdesc *alloc_sdesc(struct crypto_shash *alg)
-{
-        struct sdesc *sdesc;
-        int size;
-
-        size = sizeof(struct shash_desc) + crypto_shash_descsize(alg);
-        sdesc = kmalloc(size, GFP_KERNEL);
-        if (!sdesc)
-                return ERR_PTR(-ENOMEM);
-        sdesc->shash.tfm = alg;
-        sdesc->shash.flags = 0x0;
-        return sdesc;
-}
-
-static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
+static int calc_hash(struct crypto_shash *tfm, u8 *digest,
                      const u8 *buf, unsigned int buflen)
 {
-        struct sdesc *sdesc;
-        int ret;
+        SHASH_DESC_ON_STACK(desc, tfm);
+        int err;
 
-        sdesc = alloc_sdesc(hmacalg);
-        if (IS_ERR(sdesc)) {
-                pr_info("encrypted_key: can't alloc %s\n", hmac_alg);
-                return PTR_ERR(sdesc);
-        }
+        desc->tfm = tfm;
+        desc->flags = 0;
 
-        ret = crypto_shash_setkey(hmacalg, key, keylen);
-        if (!ret)
-                ret = crypto_shash_digest(&sdesc->shash, buf, buflen, digest);
-        kfree(sdesc);
-        return ret;
+        err = crypto_shash_digest(desc, buf, buflen, digest);
+        shash_desc_zero(desc);
+        return err;
 }
 
-static int calc_hash(u8 *digest, const u8 *buf, unsigned int buflen)
+static int calc_hmac(u8 *digest, const u8 *key, unsigned int keylen,
+                     const u8 *buf, unsigned int buflen)
 {
-        struct sdesc *sdesc;
-        int ret;
+        struct crypto_shash *tfm;
+        int err;
 
-        sdesc = alloc_sdesc(hashalg);
-        if (IS_ERR(sdesc)) {
-                pr_info("encrypted_key: can't alloc %s\n", hash_alg);
-                return PTR_ERR(sdesc);
+        tfm = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(tfm)) {
+                pr_err("encrypted_key: can't alloc %s transform: %ld\n",
+                       hmac_alg, PTR_ERR(tfm));
+                return PTR_ERR(tfm);
         }
 
-        ret = crypto_shash_digest(&sdesc->shash, buf, buflen, digest);
-        kfree(sdesc);
-        return ret;
+        err = crypto_shash_setkey(tfm, key, keylen);
+        if (!err)
+                err = calc_hash(tfm, digest, buf, buflen);
+        crypto_free_shash(tfm);
+        return err;
 }
 
 enum derived_key_type { ENC_KEY, AUTH_KEY };
@@ -385,10 +364,9 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
                 derived_buf_len = HASH_SIZE;
 
         derived_buf = kzalloc(derived_buf_len, GFP_KERNEL);
-        if (!derived_buf) {
-                pr_err("encrypted_key: out of memory\n");
+        if (!derived_buf)
                 return -ENOMEM;
-        }
+
         if (key_type)
                 strcpy(derived_buf, "AUTH_KEY");
         else
@@ -396,8 +374,8 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
 
         memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
                master_keylen);
-        ret = calc_hash(derived_key, derived_buf, derived_buf_len);
-        kfree(derived_buf);
+        ret = calc_hash(hash_tfm, derived_key, derived_buf, derived_buf_len);
+        kzfree(derived_buf);
         return ret;
 }
 
@@ -480,12 +458,9 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
         u8 iv[AES_BLOCK_SIZE];
-        unsigned int padlen;
-        char pad[16];
         int ret;
 
         encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
-        padlen = encrypted_datalen - epayload->decrypted_datalen;
 
         req = init_skcipher_req(derived_key, derived_keylen);
         ret = PTR_ERR(req);
@@ -493,11 +468,10 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_decrypted_data(epayload);
 
-        memset(pad, 0, sizeof pad);
         sg_init_table(sg_in, 2);
         sg_set_buf(&sg_in[0], epayload->decrypted_data,
                    epayload->decrypted_datalen);
-        sg_set_buf(&sg_in[1], pad, padlen);
+        sg_set_page(&sg_in[1], ZERO_PAGE(0), AES_BLOCK_SIZE, 0);
 
         sg_init_table(sg_out, 1);
         sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
@@ -533,6 +507,7 @@ static int datablob_hmac_append(struct encrypted_key_payload *epayload,
         if (!ret)
                 dump_hmac(NULL, digest, HASH_SIZE);
 out:
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -561,8 +536,8 @@ static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
         ret = calc_hmac(digest, derived_key, sizeof derived_key, p, len);
         if (ret < 0)
                 goto out;
-        ret = memcmp(digest, epayload->format + epayload->datablob_len,
-                     sizeof digest);
+        ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
+                            sizeof(digest));
         if (ret) {
                 ret = -EINVAL;
                 dump_hmac("datablob",
@@ -571,6 +546,7 @@ static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
                 dump_hmac("calc", digest, HASH_SIZE);
         }
 out:
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -584,9 +560,14 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
         u8 iv[AES_BLOCK_SIZE];
-        char pad[16];
+        u8 *pad;
         int ret;
 
+        /* Throwaway buffer to hold the unused zero padding at the end */
+        pad = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL);
+        if (!pad)
+                return -ENOMEM;
+
         encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
         req = init_skcipher_req(derived_key, derived_keylen);
         ret = PTR_ERR(req);
@@ -594,13 +575,12 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_encrypted_data(epayload, encrypted_datalen);
 
-        memset(pad, 0, sizeof pad);
         sg_init_table(sg_in, 1);
         sg_init_table(sg_out, 2);
         sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
         sg_set_buf(&sg_out[0], epayload->decrypted_data,
                    epayload->decrypted_datalen);
-        sg_set_buf(&sg_out[1], pad, sizeof pad);
+        sg_set_buf(&sg_out[1], pad, AES_BLOCK_SIZE);
 
         memcpy(iv, epayload->iv, sizeof(iv));
         skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
@@ -612,6 +592,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                 goto out;
         dump_decrypted_data(epayload);
 out:
+        kfree(pad);
         return ret;
 }
 
@@ -722,6 +703,7 @@ static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
 out:
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
@@ -828,13 +810,13 @@ static int encrypted_instantiate(struct key *key,
         ret = encrypted_init(epayload, key->description, format, master_desc,
                              decrypted_datalen, hex_encoded_iv);
         if (ret < 0) {
-                kfree(epayload);
+                kzfree(epayload);
                 goto out;
         }
 
         rcu_assign_keypointer(key, epayload);
 out:
-        kfree(datablob);
+        kzfree(datablob);
         return ret;
 }
 
@@ -843,8 +825,7 @@ static void encrypted_rcu_free(struct rcu_head *rcu)
         struct encrypted_key_payload *epayload;
 
         epayload = container_of(rcu, struct encrypted_key_payload, rcu);
-        memset(epayload->decrypted_data, 0, epayload->decrypted_datalen);
-        kfree(epayload);
+        kzfree(epayload);
 }
 
 /*
@@ -902,7 +883,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
         rcu_assign_keypointer(key, new_epayload);
         call_rcu(&epayload->rcu, encrypted_rcu_free);
 out:
-        kfree(buf);
+        kzfree(buf);
         return ret;
 }
 
@@ -960,33 +941,26 @@ static long encrypted_read(const struct key *key, char __user *buffer,
 
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
 
         if (copy_to_user(buffer, ascii_buf, asciiblob_len) != 0)
                 ret = -EFAULT;
-        kfree(ascii_buf);
+        kzfree(ascii_buf);
 
         return asciiblob_len;
 out:
         up_read(&mkey->sem);
         key_put(mkey);
+        memzero_explicit(derived_key, sizeof(derived_key));
         return ret;
 }
 
 /*
- * encrypted_destroy - before freeing the key, clear the decrypted data
- *
- * Before freeing the key, clear the memory containing the decrypted
- * key data.
+ * encrypted_destroy - clear and free the key's payload
  */
 static void encrypted_destroy(struct key *key)
 {
-        struct encrypted_key_payload *epayload = key->payload.data[0];
-
-        if (!epayload)
-                return;
-
-        memzero_explicit(epayload->decrypted_data, epayload->decrypted_datalen);
-        kfree(key->payload.data[0]);
+        kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_encrypted = {
@@ -999,47 +973,17 @@ struct key_type key_type_encrypted = {
 };
 EXPORT_SYMBOL_GPL(key_type_encrypted);
 
-static void encrypted_shash_release(void)
-{
-        if (hashalg)
-                crypto_free_shash(hashalg);
-        if (hmacalg)
-                crypto_free_shash(hmacalg);
-}
-
-static int __init encrypted_shash_alloc(void)
+static int __init init_encrypted(void)
 {
         int ret;
 
-        hmacalg = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hmacalg)) {
-                pr_info("encrypted_key: could not allocate crypto %s\n",
-                        hmac_alg);
-                return PTR_ERR(hmacalg);
-        }
-
-        hashalg = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(hashalg)) {
-                pr_info("encrypted_key: could not allocate crypto %s\n",
-                        hash_alg);
-                ret = PTR_ERR(hashalg);
-                goto hashalg_fail;
+        hash_tfm = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(hash_tfm)) {
+                pr_err("encrypted_key: can't allocate %s transform: %ld\n",
+                       hash_alg, PTR_ERR(hash_tfm));
+                return PTR_ERR(hash_tfm);
         }
 
-        return 0;
-
-hashalg_fail:
-        crypto_free_shash(hmacalg);
-        return ret;
-}
-
-static int __init init_encrypted(void)
-{
-        int ret;
-
-        ret = encrypted_shash_alloc();
-        if (ret < 0)
-                return ret;
         ret = aes_get_sizes();
         if (ret < 0)
                 goto out;
@@ -1048,14 +992,14 @@ static int __init init_encrypted(void)
                 goto out;
         return 0;
 out:
-        encrypted_shash_release();
+        crypto_free_shash(hash_tfm);
         return ret;
 
 }
 
 static void __exit cleanup_encrypted(void)
 {
-        encrypted_shash_release();
+        crypto_free_shash(hash_tfm);
         unregister_key_type(&key_type_encrypted);
 }
 
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 595becc6d0d2..87cb260e4890 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -158,9 +158,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 
                 kfree(key->description);
 
-#ifdef KEY_DEBUGGING
-                key->magic = KEY_DEBUG_MAGIC_X;
-#endif
+                memzero_explicit(key, sizeof(*key));
                 kmem_cache_free(key_jar, key);
         }
 }
diff --git a/security/keys/internal.h b/security/keys/internal.h
index c0f8682eba69..91bc6214ae57 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -13,6 +13,7 @@
 #define _INTERNAL_H
 
 #include <linux/sched.h>
+#include <linux/wait_bit.h>
 #include <linux/cred.h>
 #include <linux/key-type.h>
 #include <linux/task_work.h>
diff --git a/security/keys/key.c b/security/keys/key.c
index 455c04d80bbb..83da68d98b40 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -660,14 +660,11 @@ not_found:
         goto error;
 
 found:
-        /* pretend it doesn't exist if it is awaiting deletion */
-        if (refcount_read(&key->usage) == 0)
-                goto not_found;
-
-        /* this races with key_put(), but that doesn't matter since key_put()
-         * doesn't actually change the key
+        /* A key is allowed to be looked up only if someone still owns a
+         * reference to it - otherwise it's awaiting the gc.
          */
-        __key_get(key);
+        if (!refcount_inc_not_zero(&key->usage))
+                goto not_found;
 
 error:
         spin_unlock(&key_serial_lock);
@@ -966,12 +963,11 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
         /* the key must be writable */
         ret = key_permission(key_ref, KEY_NEED_WRITE);
         if (ret < 0)
-                goto error;
+                return ret;
 
         /* attempt to update it if supported */
-        ret = -EOPNOTSUPP;
         if (!key->type->update)
-                goto error;
+                return -EOPNOTSUPP;
 
         memset(&prep, 0, sizeof(prep));
         prep.data = payload;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 447a7d5cee0f..ab0b337c84b4 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -99,7 +99,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
         /* pull the payload in if one was supplied */
         payload = NULL;
 
-        if (_payload) {
+        if (plen) {
                 ret = -ENOMEM;
                 payload = kvmalloc(plen, GFP_KERNEL);
                 if (!payload)
@@ -132,7 +132,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 
         key_ref_put(keyring_ref);
  error3:
-        kvfree(payload);
+        if (payload) {
+                memzero_explicit(payload, plen);
+                kvfree(payload);
+        }
  error2:
         kfree(description);
  error:
@@ -324,7 +327,7 @@ long keyctl_update_key(key_serial_t id,
 
         /* pull the payload in if one was supplied */
         payload = NULL;
-        if (_payload) {
+        if (plen) {
                 ret = -ENOMEM;
                 payload = kmalloc(plen, GFP_KERNEL);
                 if (!payload)
@@ -347,7 +350,7 @@ long keyctl_update_key(key_serial_t id,
 
         key_ref_put(key_ref);
 error2:
-        kfree(payload);
+        kzfree(payload);
 error:
         return ret;
 }
@@ -1093,7 +1096,10 @@ long keyctl_instantiate_key_common(key_serial_t id,
                 keyctl_change_reqkey_auth(NULL);
 
 error2:
-        kvfree(payload);
+        if (payload) {
+                memzero_explicit(payload, plen);
+                kvfree(payload);
+        }
 error:
         return ret;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 4d1678e4586f..de81793f9920 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -706,7 +706,7 @@ descend_to_keyring:
          * Non-keyrings avoid the leftmost branch of the root entirely (root
          * slots 1-15).
          */
-        ptr = ACCESS_ONCE(keyring->keys.root);
+        ptr = READ_ONCE(keyring->keys.root);
         if (!ptr)
                 goto not_this_keyring;
 
@@ -720,7 +720,7 @@ descend_to_keyring:
                 if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0)
                         goto not_this_keyring;
 
-                ptr = ACCESS_ONCE(shortcut->next_node);
+                ptr = READ_ONCE(shortcut->next_node);
                 node = assoc_array_ptr_to_node(ptr);
                 goto begin_node;
         }
@@ -740,7 +740,7 @@ descend_to_node:
         if (assoc_array_ptr_is_shortcut(ptr)) {
                 shortcut = assoc_array_ptr_to_shortcut(ptr);
                 smp_read_barrier_depends();
-                ptr = ACCESS_ONCE(shortcut->next_node);
+                ptr = READ_ONCE(shortcut->next_node);
                 BUG_ON(!assoc_array_ptr_is_node(ptr));
         }
         node = assoc_array_ptr_to_node(ptr);
@@ -752,7 +752,7 @@ begin_node:
 ascend_to_node:
         /* Go through the slots in a node */
         for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
-                ptr = ACCESS_ONCE(node->slots[slot]);
+                ptr = READ_ONCE(node->slots[slot]);
 
                 if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
                         goto descend_to_node;
@@ -790,13 +790,13 @@ ascend_to_node:
         /* We've dealt with all the slots in the current node, so now we need
          * to ascend to the parent and continue processing there.
          */
-        ptr = ACCESS_ONCE(node->back_pointer);
+        ptr = READ_ONCE(node->back_pointer);
         slot = node->parent_slot;
 
         if (ptr && assoc_array_ptr_is_shortcut(ptr)) {
                 shortcut = assoc_array_ptr_to_shortcut(ptr);
                 smp_read_barrier_depends();
-                ptr = ACCESS_ONCE(shortcut->back_pointer);
+                ptr = READ_ONCE(shortcut->back_pointer);
                 slot = shortcut->parent_slot;
         }
         if (!ptr)
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 2217dfec7996..86bced9fdbdf 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -809,15 +809,14 @@ long join_session_keyring(const char *name)
                 ret = PTR_ERR(keyring);
                 goto error2;
         } else if (keyring == new->session_keyring) {
-                key_put(keyring);
                 ret = 0;
-                goto error2;
+                goto error3;
         }
 
         /* we've got a keyring - now to install it */
         ret = install_session_keyring_to_cred(new, keyring);
         if (ret < 0)
-                goto error2;
+                goto error3;
 
         commit_creds(new);
         mutex_unlock(&key_session_mutex);
@@ -827,6 +826,8 @@ long join_session_keyring(const char *name)
 okay:
         return ret;
 
+error3:
+        key_put(keyring);
 error2:
         mutex_unlock(&key_session_mutex);
 error:
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 2ae31c5a87de..435e86e13879 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -70,7 +70,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int datalen,
         }
 
         ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -114,7 +114,7 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
         if (!ret)
                 ret = crypto_shash_final(&sdesc->shash, digest);
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -165,7 +165,7 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
                                   paramdigest, TPM_NONCE_SIZE, h1,
                                   TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -246,7 +246,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
         if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
                 ret = -EINVAL;
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -347,7 +347,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
         if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
                 ret = -EINVAL;
 out:
-        kfree(sdesc);
+        kzfree(sdesc);
         return ret;
 }
 
@@ -564,7 +564,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
                 *bloblen = storedsize;
         }
 out:
-        kfree(td);
+        kzfree(td);
         return ret;
 }
 
@@ -678,7 +678,7 @@ static int key_seal(struct trusted_key_payload *p,
         if (ret < 0)
                 pr_info("trusted_key: srkseal failed (%d)\n", ret);
 
-        kfree(tb);
+        kzfree(tb);
         return ret;
 }
 
@@ -703,7 +703,7 @@ static int key_unseal(struct trusted_key_payload *p,
                 /* pull migratable flag out of sealed key */
                 p->migratable = p->key[--p->key_len];
 
-        kfree(tb);
+        kzfree(tb);
         return ret;
 }
 
@@ -1037,12 +1037,12 @@ static int trusted_instantiate(struct key *key,
         if (!ret && options->pcrlock)
                 ret = pcrlock(options->pcrlock);
 out:
-        kfree(datablob);
-        kfree(options);
+        kzfree(datablob);
+        kzfree(options);
         if (!ret)
                 rcu_assign_keypointer(key, payload);
         else
-                kfree(payload);
+                kzfree(payload);
         return ret;
 }
 
@@ -1051,8 +1051,7 @@ static void trusted_rcu_free(struct rcu_head *rcu)
         struct trusted_key_payload *p;
 
         p = container_of(rcu, struct trusted_key_payload, rcu);
-        memset(p->key, 0, p->key_len);
-        kfree(p);
+        kzfree(p);
 }
 
 /*
@@ -1094,13 +1093,13 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         ret = datablob_parse(datablob, new_p, new_o);
         if (ret != Opt_update) {
                 ret = -EINVAL;
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
 
         if (!new_o->keyhandle) {
                 ret = -EINVAL;
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
 
@@ -1114,22 +1113,22 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
         ret = key_seal(new_p, new_o);
         if (ret < 0) {
                 pr_info("trusted_key: key_seal failed (%d)\n", ret);
-                kfree(new_p);
+                kzfree(new_p);
                 goto out;
         }
         if (new_o->pcrlock) {
                 ret = pcrlock(new_o->pcrlock);
                 if (ret < 0) {
                         pr_info("trusted_key: pcrlock failed (%d)\n", ret);
-                        kfree(new_p);
+                        kzfree(new_p);
                         goto out;
                 }
         }
         rcu_assign_keypointer(key, new_p);
         call_rcu(&p->rcu, trusted_rcu_free);
 out:
-        kfree(datablob);
-        kfree(new_o);
+        kzfree(datablob);
+        kzfree(new_o);
         return ret;
 }
 
@@ -1158,24 +1157,19 @@ static long trusted_read(const struct key *key, char __user *buffer,
         for (i = 0; i < p->blob_len; i++)
                 bufp = hex_byte_pack(bufp, p->blob[i]);
         if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
-                kfree(ascii_buf);
+                kzfree(ascii_buf);
                 return -EFAULT;
         }
-        kfree(ascii_buf);
+        kzfree(ascii_buf);
         return 2 * p->blob_len;
 }
 
 /*
- * trusted_destroy - before freeing the key, clear the decrypted data
+ * trusted_destroy - clear and free the key's payload
  */
 static void trusted_destroy(struct key *key)
 {
-        struct trusted_key_payload *p = key->payload.data[0];
-
-        if (!p)
-                return;
-        memset(p->key, 0, p->key_len);
-        kfree(key->payload.data[0]);
+        kzfree(key->payload.data[0]);
 }
 
 struct key_type key_type_trusted = {
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 26605134f17a..3d8c68eba516 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -86,10 +86,18 @@ EXPORT_SYMBOL_GPL(user_preparse);
  */
 void user_free_preparse(struct key_preparsed_payload *prep)
 {
-        kfree(prep->payload.data[0]);
+        kzfree(prep->payload.data[0]);
 }
 EXPORT_SYMBOL_GPL(user_free_preparse);
 
+static void user_free_payload_rcu(struct rcu_head *head)
+{
+        struct user_key_payload *payload;
+
+        payload = container_of(head, struct user_key_payload, rcu);
+        kzfree(payload);
+}
+
 /*
  * update a user defined key
  * - the key's semaphore is write-locked
@@ -112,7 +120,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
         prep->payload.data[0] = NULL;
 
         if (zap)
-                kfree_rcu(zap, rcu);
+                call_rcu(&zap->rcu, user_free_payload_rcu);
         return ret;
 }
 EXPORT_SYMBOL_GPL(user_update);
@@ -130,7 +138,7 @@ void user_revoke(struct key *key)
 
         if (upayload) {
                 rcu_assign_keypointer(key, NULL);
-                kfree_rcu(upayload, rcu);
+                call_rcu(&upayload->rcu, user_free_payload_rcu);
         }
 }
 
@@ -143,7 +151,7 @@ void user_destroy(struct key *key)
 {
         struct user_key_payload *upayload = key->payload.data[0];
 
-        kfree(upayload);
+        kzfree(upayload);
 }
 
 EXPORT_SYMBOL_GPL(user_destroy);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e67a526d1f30..819fd6858b49 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1106,10 +1106,8 @@ static int selinux_parse_opts_str(char *options,
 
         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
                                        GFP_KERNEL);
-        if (!opts->mnt_opts_flags) {
-                kfree(opts->mnt_opts);
+        if (!opts->mnt_opts_flags)
                 goto out_err;
-        }
 
         if (fscontext) {
                 opts->mnt_opts[num_mnt_opts] = fscontext;
@@ -1132,6 +1130,7 @@ static int selinux_parse_opts_str(char *options,
         return 0;
 
 out_err:
+        security_free_mnt_opts(opts);
         kfree(context);
         kfree(defcontext);
         kfree(fscontext);
diff --git a/sound/core/control.c b/sound/core/control.c
index c109b82eef4b..6362da17ac3f 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1577,7 +1577,7 @@ static ssize_t snd_ctl_read(struct file *file, char __user *buffer,
                 struct snd_ctl_event ev;
                 struct snd_kctl_event *kev;
                 while (list_empty(&ctl->events)) {
-                        wait_queue_t wait;
+                        wait_queue_entry_t wait;
                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
                                 err = -EAGAIN;
                                 goto __end_lock;
diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index 9602a7e38d8a..a73baa1242be 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -85,7 +85,7 @@ static int snd_hwdep_open(struct inode *inode, struct file * file)
         int major = imajor(inode);
         struct snd_hwdep *hw;
         int err;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if (major == snd_major) {
                 hw = snd_lookup_minor_data(iminor(inode),
diff --git a/sound/core/init.c b/sound/core/init.c
index 6bda8436d765..d61d2b3cd521 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -989,7 +989,7 @@ EXPORT_SYMBOL(snd_card_file_remove);
  */
 int snd_power_wait(struct snd_card *card, unsigned int power_state)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         int result = 0;
 
         /* fastpath */
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 36baf962f9b0..cd8b7bef8d06 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1554,7 +1554,7 @@ static int snd_pcm_oss_sync1(struct snd_pcm_substream *substream, size_t size)
         ssize_t result = 0;
         snd_pcm_state_t state;
         long res;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         runtime = substream->runtime;
         init_waitqueue_entry(&wait, current);
@@ -2387,7 +2387,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
         struct snd_pcm_oss_file *pcm_oss_file;
         struct snd_pcm_oss_setup setup[2];
         int nonblock;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         err = nonseekable_open(inode, file);
         if (err < 0)
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 5088d4b8db22..dd5254077ef7 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1904,7 +1904,7 @@ static int wait_for_avail(struct snd_pcm_substream *substream,
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         int is_playback = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         int err = 0;
         snd_pcm_uframes_t avail = 0;
         long wait_time, tout;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 13dec5ec93f2..faa2e2be6f2e 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1652,7 +1652,7 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream,
         struct snd_card *card;
         struct snd_pcm_runtime *runtime;
         struct snd_pcm_substream *s;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         int result = 0;
         int nonblock = 0;
 
@@ -2353,7 +2353,7 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
 static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)
 {
         int err;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if (pcm == NULL) {
                 err = -ENODEV;
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index ab890336175f..32588ad05653 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -368,7 +368,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
         int err;
         struct snd_rawmidi *rmidi;
         struct snd_rawmidi_file *rawmidi_file = NULL;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if ((file->f_flags & O_APPEND) && !(file->f_flags & O_NONBLOCK)) 
                 return -EINVAL;         /* invalid combination */
@@ -1002,7 +1002,7 @@ static ssize_t snd_rawmidi_read(struct file *file, char __user *buf, size_t coun
         while (count > 0) {
                 spin_lock_irq(&runtime->lock);
                 while (!snd_rawmidi_ready(substream)) {
-                        wait_queue_t wait;
+                        wait_queue_entry_t wait;
                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
                                 spin_unlock_irq(&runtime->lock);
                                 return result > 0 ? result : -EAGAIN;
@@ -1306,7 +1306,7 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf,
         while (count > 0) {
                 spin_lock_irq(&runtime->lock);
                 while (!snd_rawmidi_ready_append(substream, count)) {
-                        wait_queue_t wait;
+                        wait_queue_entry_t wait;
                         if (file->f_flags & O_NONBLOCK) {
                                 spin_unlock_irq(&runtime->lock);
                                 return result > 0 ? result : -EAGAIN;
@@ -1338,7 +1338,7 @@ static ssize_t snd_rawmidi_write(struct file *file, const char __user *buf,
         if (file->f_flags & O_DSYNC) {
                 spin_lock_irq(&runtime->lock);
                 while (runtime->avail != runtime->buffer_size) {
-                        wait_queue_t wait;
+                        wait_queue_entry_t wait;
                         unsigned int last_avail = runtime->avail;
                         init_waitqueue_entry(&wait, current);
                         add_wait_queue(&runtime->sleep, &wait);
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 01c4cfe30c9f..a8c2822e0198 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -179,7 +179,7 @@ int snd_seq_fifo_cell_out(struct snd_seq_fifo *f,
 {
         struct snd_seq_event_cell *cell;
         unsigned long flags;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if (snd_BUG_ON(!f))
                 return -EINVAL;
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index d4c61ec9be13..d6e9aacdc36b 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -227,7 +227,7 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
         struct snd_seq_event_cell *cell;
         unsigned long flags;
         int err = -EAGAIN;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         if (pool == NULL)
                 return -EINVAL;
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 2f836ca09860..884c3066b028 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1618,6 +1618,7 @@ static int snd_timer_user_tselect(struct file *file,
         if (err < 0)
                 goto __err;
 
+        tu->qhead = tu->qtail = tu->qused = 0;
         kfree(tu->queue);
         tu->queue = NULL;
         kfree(tu->tqueue);
@@ -1959,10 +1960,11 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
 
         tu = file->private_data;
         unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
+        mutex_lock(&tu->ioctl_lock);
         spin_lock_irq(&tu->qlock);
         while ((long)count - result >= unit) {
                 while (!tu->qused) {
-                        wait_queue_t wait;
+                        wait_queue_entry_t wait;
 
                         if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
                                 err = -EAGAIN;
@@ -1974,7 +1976,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                         add_wait_queue(&tu->qchange_sleep, &wait);
 
                         spin_unlock_irq(&tu->qlock);
+                        mutex_unlock(&tu->ioctl_lock);
                         schedule();
+                        mutex_lock(&tu->ioctl_lock);
                         spin_lock_irq(&tu->qlock);
 
                         remove_wait_queue(&tu->qchange_sleep, &wait);
@@ -1994,7 +1998,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                 tu->qused--;
                 spin_unlock_irq(&tu->qlock);
 
-                mutex_lock(&tu->ioctl_lock);
                 if (tu->tread) {
                         if (copy_to_user(buffer, &tu->tqueue[qhead],
                                          sizeof(struct snd_timer_tread)))
@@ -2004,7 +2007,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                          sizeof(struct snd_timer_read)))
                                 err = -EFAULT;
                 }
-                mutex_unlock(&tu->ioctl_lock);
 
                 spin_lock_irq(&tu->qlock);
                 if (err < 0)
@@ -2014,6 +2016,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
         }
  _error:
         spin_unlock_irq(&tu->qlock);
+        mutex_unlock(&tu->ioctl_lock);
         return result > 0 ? result : err;
 }
 
diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
index 4dae9ff9ef5a..0b1e4b34b299 100644
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -1782,7 +1782,7 @@ wavefront_should_cause_interrupt (snd_wavefront_t *dev,
                                   int val, int port, unsigned long timeout)
 
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
 
         init_waitqueue_entry(&wait, current);
         spin_lock_irq(&dev->irq_lock);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 58df440013c5..cbeebc0a9711 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2324,10 +2324,11 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
 
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
-        SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
-        SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
         SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
         SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+        SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+        SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+        SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -2342,6 +2343,7 @@ static const struct hda_model_fixup alc882_fixup_models[] = {
         {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
         {.id = ALC882_FIXUP_INV_DMIC, .name = "inv-dmic"},
         {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
+        {.id = ALC1220_FIXUP_GB_DUAL_CODECS, .name = "dual-codecs"},
         {}
 };
 
@@ -5852,7 +5854,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
         SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+        SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
@@ -5860,13 +5866,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
         SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+        SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
-        SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
         SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
         SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
@@ -6014,6 +6017,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
         {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
         {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
+        {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
         {}
 };
 #define ALC225_STANDARD_PINS \
@@ -6465,8 +6469,11 @@ static int patch_alc269(struct hda_codec *codec)
                 break;
         case 0x10ec0225:
         case 0x10ec0295:
+                spec->codec_variant = ALC269_TYPE_ALC225;
+                break;
         case 0x10ec0299:
                 spec->codec_variant = ALC269_TYPE_ALC225;
+                spec->gen.mixer_nid = 0; /* no loopback on ALC299 */
                 break;
         case 0x10ec0234:
         case 0x10ec0274:
@@ -7338,6 +7345,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
         {.id = ALC662_FIXUP_ASUS_MODE8, .name = "asus-mode8"},
         {.id = ALC662_FIXUP_INV_DMIC, .name = "inv-dmic"},
         {.id = ALC668_FIXUP_DELL_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
+        {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
         {}
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index faa3d38bac0b..6cefdf6c0b75 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1559,6 +1559,8 @@ static const struct snd_pci_quirk stac9200_fixup_tbl[] = {
                       "Dell Inspiron 1501", STAC_9200_DELL_M26),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f6,
                       "unknown Dell", STAC_9200_DELL_M26),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0201,
+                      "Dell Latitude D430", STAC_9200_DELL_M22),
         /* Panasonic */
         SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC),
         /* Gateway machines needs EAPD to be set on resume */
diff --git a/sound/pci/mixart/mixart_core.c b/sound/pci/mixart/mixart_core.c
index dccf3db48fe0..8bf2ce32d4a8 100644
--- a/sound/pci/mixart/mixart_core.c
+++ b/sound/pci/mixart/mixart_core.c
@@ -239,7 +239,7 @@ int snd_mixart_send_msg(struct mixart_mgr *mgr, struct mixart_msg *request, int
         struct mixart_msg resp;
         u32 msg_frame = 0; /* set to 0, so it's no notification to wait for, but the answer */
         int err;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         long timeout;
 
         init_waitqueue_entry(&wait, current);
@@ -284,7 +284,7 @@ int snd_mixart_send_msg_wait_notif(struct mixart_mgr *mgr,
                                    struct mixart_msg *request, u32 notif_event)
 {
         int err;
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         long timeout;
 
         if (snd_BUG_ON(!notif_event))
diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index fe4ba463b57c..1114166c685c 100644
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -781,7 +781,7 @@ static snd_pcm_uframes_t snd_ymfpci_capture_pointer(struct snd_pcm_substream *su
 
 static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
 {
-        wait_queue_t wait;
+        wait_queue_entry_t wait;
         int loops = 4;
 
         while (loops-- > 0) {
diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c
index 7ae46c2647d4..b7ef8c59b49a 100644
--- a/sound/soc/atmel/atmel-classd.c
+++ b/sound/soc/atmel/atmel-classd.c
@@ -301,6 +301,14 @@ static int atmel_classd_codec_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
+static int atmel_classd_codec_resume(struct snd_soc_codec *codec)
+{
+        struct snd_soc_card *card = snd_soc_codec_get_drvdata(codec);
+        struct atmel_classd *dd = snd_soc_card_get_drvdata(card);
+
+        return regcache_sync(dd->regmap);
+}
+
 static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 {
         return dev_get_regmap(dev, NULL);
@@ -308,6 +316,7 @@ static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 
 static struct snd_soc_codec_driver soc_codec_dev_classd = {
         .probe          = atmel_classd_codec_probe,
+        .resume         = atmel_classd_codec_resume,
         .get_regmap     = atmel_classd_codec_get_remap,
         .component_driver = {
                 .controls               = atmel_classd_snd_controls,
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index 6dd7578f0bb8..024d83fa6a7f 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -772,7 +772,7 @@ static int da7213_dai_event(struct snd_soc_dapm_widget *w,
                                 ++i;
                                 msleep(50);
                         }
-                } while ((i < DA7213_SRM_CHECK_RETRIES) & (!srm_lock));
+                } while ((i < DA7213_SRM_CHECK_RETRIES) && (!srm_lock));
 
                 if (!srm_lock)
                         dev_warn(codec->dev, "SRM failed to lock\n");
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index 9c365a7f758d..7899a2cdeb42 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1108,6 +1108,13 @@ static const struct dmi_system_id force_combo_jack_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform")
                 }
         },
+        {
+                .ident = "Thinkpad Helix 2nd",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix 2nd")
+                }
+        },
 
         { }
 };
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 2c9dedab5184..bc136d2bd7cd 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -202,7 +202,7 @@ static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
         if (ret < 0)
                 return ret;
 
-        ret = asoc_simple_card_init_mic(rtd->card, &priv->hp_jack, PREFIX);
+        ret = asoc_simple_card_init_mic(rtd->card, &priv->mic_jack, PREFIX);
         if (ret < 0)
                 return ret;
 
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index 58c525096a7c..498b15345b1a 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -413,8 +413,11 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
         u32 reply = header.primary & IPC_GLB_REPLY_STATUS_MASK;
         u64 *ipc_header = (u64 *)(&header);
         struct skl_sst *skl = container_of(ipc, struct skl_sst, ipc);
+        unsigned long flags;
 
+        spin_lock_irqsave(&ipc->dsp->spinlock, flags);
         msg = skl_ipc_reply_get_msg(ipc, *ipc_header);
+        spin_unlock_irqrestore(&ipc->dsp->spinlock, flags);
         if (msg == NULL) {
                 dev_dbg(ipc->dev, "ipc: rx list is empty\n");
                 return;
@@ -456,8 +459,10 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
                 }
         }
 
+        spin_lock_irqsave(&ipc->dsp->spinlock, flags);
         list_del(&msg->list);
         sst_ipc_tx_msg_reply_complete(ipc, msg);
+        spin_unlock_irqrestore(&ipc->dsp->spinlock, flags);
 }
 
 irqreturn_t skl_dsp_irq_thread_handler(int irq, void *context)
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 3a99712e44a8..64a0f8ed33e1 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -2502,7 +2502,7 @@ static int skl_tplg_get_manifest_tkn(struct device *dev,
 
                         if (ret < 0)
                                 return ret;
-                        tkn_count += ret;
+                        tkn_count = ret;
 
                         tuple_size += tkn_count *
                                 sizeof(struct snd_soc_tplg_vendor_string_elem);
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 6df3b317a476..4c9b5781282b 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -410,7 +410,7 @@ static int skl_free(struct hdac_ext_bus *ebus)
         struct skl *skl  = ebus_to_skl(ebus);
         struct hdac_bus *bus = ebus_to_hbus(ebus);
 
-        skl->init_failed = 1; /* to be sure */
+        skl->init_done = 0; /* to be sure */
 
         snd_hdac_ext_stop_streams(ebus);
 
@@ -428,8 +428,10 @@ static int skl_free(struct hdac_ext_bus *ebus)
 
         snd_hdac_ext_bus_exit(ebus);
 
+        cancel_work_sync(&skl->probe_work);
         if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
                 snd_hdac_i915_exit(&ebus->bus);
+
         return 0;
 }
 
@@ -566,6 +568,84 @@ static const struct hdac_bus_ops bus_core_ops = {
         .get_response = snd_hdac_bus_get_response,
 };
 
+static int skl_i915_init(struct hdac_bus *bus)
+{
+        int err;
+
+        /*
+         * The HDMI codec is in GPU so we need to ensure that it is powered
+         * up and ready for probe
+         */
+        err = snd_hdac_i915_init(bus);
+        if (err < 0)
+                return err;
+
+        err = snd_hdac_display_power(bus, true);
+        if (err < 0)
+                dev_err(bus->dev, "Cannot turn on display power on i915\n");
+
+        return err;
+}
+
+static void skl_probe_work(struct work_struct *work)
+{
+        struct skl *skl = container_of(work, struct skl, probe_work);
+        struct hdac_ext_bus *ebus = &skl->ebus;
+        struct hdac_bus *bus = ebus_to_hbus(ebus);
+        struct hdac_ext_link *hlink = NULL;
+        int err;
+
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                err = skl_i915_init(bus);
+                if (err < 0)
+                        return;
+        }
+
+        err = skl_init_chip(bus, true);
+        if (err < 0) {
+                dev_err(bus->dev, "Init chip failed with err: %d\n", err);
+                goto out_err;
+        }
+
+        /* codec detection */
+        if (!bus->codec_mask)
+                dev_info(bus->dev, "no hda codecs found!\n");
+
+        /* create codec instances */
+        err = skl_codec_create(ebus);
+        if (err < 0)
+                goto out_err;
+
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                err = snd_hdac_display_power(bus, false);
+                if (err < 0) {
+                        dev_err(bus->dev, "Cannot turn off display power on i915\n");
+                        return;
+                }
+        }
+
+        /* register platform dai and controls */
+        err = skl_platform_register(bus->dev);
+        if (err < 0)
+                return;
+        /*
+         * we are done probing so decrement link counts
+         */
+        list_for_each_entry(hlink, &ebus->hlink_list, list)
+                snd_hdac_ext_bus_link_put(ebus, hlink);
+
+        /* configure PM */
+        pm_runtime_put_noidle(bus->dev);
+        pm_runtime_allow(bus->dev);
+        skl->init_done = 1;
+
+        return;
+
+out_err:
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+                err = snd_hdac_display_power(bus, false);
+}
+
 /*
  * constructor
  */
@@ -593,6 +673,7 @@ static int skl_create(struct pci_dev *pci,
         snd_hdac_ext_bus_init(ebus, &pci->dev, &bus_core_ops, io_ops);
         ebus->bus.use_posbuf = 1;
         skl->pci = pci;
+        INIT_WORK(&skl->probe_work, skl_probe_work);
 
         ebus->bus.bdl_pos_adj = 0;
 
@@ -601,27 +682,6 @@ static int skl_create(struct pci_dev *pci,
         return 0;
 }
 
-static int skl_i915_init(struct hdac_bus *bus)
-{
-        int err;
-
-        /*
-         * The HDMI codec is in GPU so we need to ensure that it is powered
-         * up and ready for probe
-         */
-        err = snd_hdac_i915_init(bus);
-        if (err < 0)
-                return err;
-
-        err = snd_hdac_display_power(bus, true);
-        if (err < 0) {
-                dev_err(bus->dev, "Cannot turn on display power on i915\n");
-                return err;
-        }
-
-        return err;
-}
-
 static int skl_first_init(struct hdac_ext_bus *ebus)
 {
         struct skl *skl = ebus_to_skl(ebus);
@@ -684,20 +744,7 @@ static int skl_first_init(struct hdac_ext_bus *ebus)
         /* initialize chip */
         skl_init_pci(skl);
 
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
-                err = skl_i915_init(bus);
-                if (err < 0)
-                        return err;
-        }
-
-        skl_init_chip(bus, true);
-
-        /* codec detection */
-        if (!bus->codec_mask) {
-                dev_info(bus->dev, "no hda codecs found!\n");
-        }
-
-        return 0;
+        return skl_init_chip(bus, true);
 }
 
 static int skl_probe(struct pci_dev *pci,
@@ -706,7 +753,6 @@ static int skl_probe(struct pci_dev *pci,
         struct skl *skl;
         struct hdac_ext_bus *ebus = NULL;
         struct hdac_bus *bus = NULL;
-        struct hdac_ext_link *hlink = NULL;
         int err;
 
         /* we use ext core ops, so provide NULL for ops here */
@@ -729,7 +775,7 @@ static int skl_probe(struct pci_dev *pci,
 
         if (skl->nhlt == NULL) {
                 err = -ENODEV;
-                goto out_display_power_off;
+                goto out_free;
         }
 
         err = skl_nhlt_create_sysfs(skl);
@@ -760,56 +806,24 @@ static int skl_probe(struct pci_dev *pci,
         if (bus->mlcap)
                 snd_hdac_ext_bus_get_ml_capabilities(ebus);
 
+        snd_hdac_bus_stop_chip(bus);
+
         /* create device for soc dmic */
         err = skl_dmic_device_register(skl);
         if (err < 0)
                 goto out_dsp_free;
 
-        /* register platform dai and controls */
-        err = skl_platform_register(bus->dev);
-        if (err < 0)
-                goto out_dmic_free;
-
-        /* create codec instances */
-        err = skl_codec_create(ebus);
-        if (err < 0)
-                goto out_unregister;
-
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
-                err = snd_hdac_display_power(bus, false);
-                if (err < 0) {
-                        dev_err(bus->dev, "Cannot turn off display power on i915\n");
-                        return err;
-                }
-        }
-
-        /*
-         * we are done probling so decrement link counts
-         */
-        list_for_each_entry(hlink, &ebus->hlink_list, list)
-                snd_hdac_ext_bus_link_put(ebus, hlink);
-
-        /* configure PM */
-        pm_runtime_put_noidle(bus->dev);
-        pm_runtime_allow(bus->dev);
+        schedule_work(&skl->probe_work);
 
         return 0;
 
-out_unregister:
-        skl_platform_unregister(bus->dev);
-out_dmic_free:
-        skl_dmic_device_unregister(skl);
 out_dsp_free:
         skl_free_dsp(skl);
 out_mach_free:
         skl_machine_device_unregister(skl);
 out_nhlt_free:
         skl_nhlt_free(skl->nhlt);
-out_display_power_off:
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, false);
 out_free:
-        skl->init_failed = 1;
         skl_free(ebus);
 
         return err;
@@ -828,7 +842,7 @@ static void skl_shutdown(struct pci_dev *pci)
 
         skl = ebus_to_skl(ebus);
 
-        if (skl->init_failed)
+        if (!skl->init_done)
                 return;
 
         snd_hdac_ext_stop_streams(ebus);
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index a454f6035f3e..2a630fcb7f08 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -46,7 +46,7 @@ struct skl {
         struct hdac_ext_bus ebus;
         struct pci_dev *pci;
 
-        unsigned int init_failed:1; /* delayed init failed */
+        unsigned int init_done:1; /* delayed init status */
         struct platform_device *dmic_dev;
         struct platform_device *i2s_dev;
         struct snd_soc_platform *platform;
@@ -64,6 +64,8 @@ struct skl {
         const struct firmware *tplg;
 
         int supend_active;
+
+        struct work_struct probe_work;
 };
 
 #define skl_to_ebus(s)  (&(s)->ebus)
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index 66203d107a11..d3b0dc145a56 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -507,7 +507,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                 rbga = rbgx;
                                 adg->rbga_rate_for_441khz = rate / div;
                                 ckr |= brg_table[i] << 20;
-                                if (req_441kHz_rate)
+                                if (req_441kHz_rate &&
+                                    !(adg_mode_flags(adg) & AUDIO_OUT_48))
                                         parent_clk_name = __clk_get_name(clk);
                         }
                 }
@@ -522,7 +523,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                 rbgb = rbgx;
                                 adg->rbgb_rate_for_48khz = rate / div;
                                 ckr |= brg_table[i] << 16;
-                                if (req_48kHz_rate)
+                                if (req_48kHz_rate &&
+                                    (adg_mode_flags(adg) & AUDIO_OUT_48))
                                         parent_clk_name = __clk_get_name(clk);
                         }
                 }
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index 7d92a24b7cfa..d879c010cf03 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -89,6 +89,7 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         dev_dbg(dev, "ctu/mix path = 0x%08x", data);
 
         rsnd_mod_write(mod, CMD_ROUTE_SLCT, data);
+        rsnd_mod_write(mod, CMD_BUSIF_MODE, rsnd_get_busif_shift(io, mod) | 1);
         rsnd_mod_write(mod, CMD_BUSIF_DALIGN, rsnd_get_dalign(mod, io));
 
         rsnd_adg_set_cmd_timsel_gen2(mod, io);
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 1744015408c3..8c1f4e2e0c4f 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -343,6 +343,57 @@ u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io)
                 return 0x76543210;
 }
 
+u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod)
+{
+        enum rsnd_mod_type playback_mods[] = {
+                RSND_MOD_SRC,
+                RSND_MOD_CMD,
+                RSND_MOD_SSIU,
+        };
+        enum rsnd_mod_type capture_mods[] = {
+                RSND_MOD_CMD,
+                RSND_MOD_SRC,
+                RSND_MOD_SSIU,
+        };
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        struct rsnd_mod *tmod = NULL;
+        enum rsnd_mod_type *mods =
+                rsnd_io_is_play(io) ?
+                playback_mods : capture_mods;
+        int i;
+
+        /*
+         * This is needed for 24bit data
+         * We need to shift 8bit
+         *
+         * Linux 24bit data is located as 0x00******
+         * HW    24bit data is located as 0x******00
+         *
+         */
+        switch (runtime->sample_bits) {
+        case 16:
+                return 0;
+        case 32:
+                break;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(playback_mods); i++) {
+                tmod = rsnd_io_to_mod(io, mods[i]);
+                if (tmod)
+                        break;
+        }
+
+        if (tmod != mod)
+                return 0;
+
+        if (rsnd_io_is_play(io))
+                return  (0 << 20) | /* shift to Left */
+                        (8 << 16);  /* 8bit */
+        else
+                return  (1 << 20) | /* shift to Right */
+                        (8 << 16);  /* 8bit */
+}
+
 /*
  *      rsnd_dai functions
  */
diff --git a/sound/soc/sh/rcar/gen.c b/sound/soc/sh/rcar/gen.c
index 63b6d3c28021..4b0980728e13 100644
--- a/sound/soc/sh/rcar/gen.c
+++ b/sound/soc/sh/rcar/gen.c
@@ -236,6 +236,7 @@ static int rsnd_gen2_probe(struct rsnd_priv *priv)
                 RSND_GEN_M_REG(SRC_ROUTE_MODE0, 0xc,    0x20),
                 RSND_GEN_M_REG(SRC_CTRL,        0x10,   0x20),
                 RSND_GEN_M_REG(SRC_INT_ENABLE0, 0x18,   0x20),
+                RSND_GEN_M_REG(CMD_BUSIF_MODE,  0x184,  0x20),
                 RSND_GEN_M_REG(CMD_BUSIF_DALIGN,0x188,  0x20),
                 RSND_GEN_M_REG(CMD_ROUTE_SLCT,  0x18c,  0x20),
                 RSND_GEN_M_REG(CMD_CTRL,        0x190,  0x20),
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index dbf4163427e8..323af41ecfcb 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -73,6 +73,7 @@ enum rsnd_reg {
         RSND_REG_SCU_SYS_INT_EN0,
         RSND_REG_SCU_SYS_INT_EN1,
         RSND_REG_CMD_CTRL,
+        RSND_REG_CMD_BUSIF_MODE,
         RSND_REG_CMD_BUSIF_DALIGN,
         RSND_REG_CMD_ROUTE_SLCT,
         RSND_REG_CMDOUT_TIMSEL,
@@ -204,6 +205,7 @@ void rsnd_bset(struct rsnd_priv *priv, struct rsnd_mod *mod, enum rsnd_reg reg,
                     u32 mask, u32 data);
 u32 rsnd_get_adinr_bit(struct rsnd_mod *mod, struct rsnd_dai_stream *io);
 u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io);
+u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod);
 
 /*
  *      R-Car DMA
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 20b5b2ec625e..76a477a3ccb5 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -190,11 +190,13 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
         struct device *dev = rsnd_priv_to_dev(priv);
         struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        int is_play = rsnd_io_is_play(io);
         int use_src = 0;
         u32 fin, fout;
         u32 ifscr, fsrate, adinr;
         u32 cr, route;
         u32 bsdsr, bsisr;
+        u32 i_busif, o_busif, tmp;
         uint ratio;
 
         if (!runtime)
@@ -270,6 +272,11 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
                 break;
         }
 
+        /* BUSIF_MODE */
+        tmp = rsnd_get_busif_shift(io, mod);
+        i_busif = ( is_play ? tmp : 0) | 1;
+        o_busif = (!is_play ? tmp : 0) | 1;
+
         rsnd_mod_write(mod, SRC_ROUTE_MODE0, route);
 
         rsnd_mod_write(mod, SRC_SRCIR, 1);      /* initialize */
@@ -281,8 +288,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         rsnd_mod_write(mod, SRC_BSISR, bsisr);
         rsnd_mod_write(mod, SRC_SRCIR, 0);      /* cancel initialize */
 
-        rsnd_mod_write(mod, SRC_I_BUSIF_MODE, 1);
-        rsnd_mod_write(mod, SRC_O_BUSIF_MODE, 1);
+        rsnd_mod_write(mod, SRC_I_BUSIF_MODE, i_busif);
+        rsnd_mod_write(mod, SRC_O_BUSIF_MODE, o_busif);
+
         rsnd_mod_write(mod, SRC_BUSIF_DALIGN, rsnd_get_dalign(mod, io));
 
         rsnd_adg_set_src_timesel_gen2(mod, io, fin, fout);
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 135c5669f796..91e5c07911b4 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -302,7 +302,7 @@ static void rsnd_ssi_config_init(struct rsnd_mod *mod,
          * always use 32bit system word.
          * see also rsnd_ssi_master_clk_enable()
          */
-        cr_own = FORCE | SWL_32 | PDTA;
+        cr_own = FORCE | SWL_32;
 
         if (rdai->bit_clk_inv)
                 cr_own |= SCKP;
@@ -550,6 +550,13 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                 struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
                 u32 *buf = (u32 *)(runtime->dma_area +
                                    rsnd_dai_pointer_offset(io, 0));
+                int shift = 0;
+
+                switch (runtime->sample_bits) {
+                case 32:
+                        shift = 8;
+                        break;
+                }
 
                 /*
                  * 8/16/32 data can be assesse to TDR/RDR register
@@ -557,9 +564,9 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                  * see rsnd_ssi_init()
                  */
                 if (rsnd_io_is_play(io))
-                        rsnd_mod_write(mod, SSITDR, *buf);
+                        rsnd_mod_write(mod, SSITDR, (*buf) << shift);
                 else
-                        *buf = rsnd_mod_read(mod, SSIRDR);
+                        *buf = (rsnd_mod_read(mod, SSIRDR) >> shift);
 
                 elapsed = rsnd_dai_pointer_update(io, sizeof(*buf));
         }
@@ -709,6 +716,11 @@ static int rsnd_ssi_dma_remove(struct rsnd_mod *mod,
                                struct rsnd_priv *priv)
 {
         struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        struct rsnd_mod *ssi_parent_mod = rsnd_io_to_mod_ssip(io);
+
+        /* Do nothing for SSI parent mod */
+        if (ssi_parent_mod == mod)
+                return 0;
 
         /* PIO will request IRQ again */
         free_irq(ssi->irq, mod);
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 14fafdaf1395..512d238b79e2 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -144,7 +144,8 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
                                (rsnd_io_is_play(io) ?
                                 rsnd_runtime_channel_after_ctu(io) :
                                 rsnd_runtime_channel_original(io)));
-                rsnd_mod_write(mod, SSI_BUSIF_MODE,  1);
+                rsnd_mod_write(mod, SSI_BUSIF_MODE,
+                               rsnd_get_busif_shift(io, mod) | 1);
                 rsnd_mod_write(mod, SSI_BUSIF_DALIGN,
                                rsnd_get_dalign(mod, io));
         }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index aae099c0e502..754e3ef8d7ae 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2286,6 +2286,9 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
         list_for_each_entry(rtd, &card->rtd_list, list)
                 flush_delayed_work(&rtd->delayed_work);
 
+        /* free the ALSA card at first; this syncs with pending operations */
+        snd_card_free(card->snd_card);
+
         /* remove and free each DAI */
         soc_remove_dai_links(card);
         soc_remove_pcm_runtimes(card);
@@ -2300,9 +2303,7 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
         if (card->remove)
                 card->remove(card);
 
-        snd_card_free(card->snd_card);
         return 0;
-
 }
 
 /* removes a socdev */
diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
index dc48eedea92e..26ed23b18b77 100644
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -698,16 +698,18 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol,
         struct snd_usb_audio *chip = elem->head.mixer->chip;
         struct snd_us16x08_meter_store *store = elem->private_data;
         u8 meter_urb[64];
-        char tmp[sizeof(mix_init_msg2)] = {0};
 
         switch (kcontrol->private_value) {
-        case 0:
-                snd_us16x08_send_urb(chip, (char *)mix_init_msg1,
-                                     sizeof(mix_init_msg1));
+        case 0: {
+                char tmp[sizeof(mix_init_msg1)];
+
+                memcpy(tmp, mix_init_msg1, sizeof(mix_init_msg1));
+                snd_us16x08_send_urb(chip, tmp, 4);
                 snd_us16x08_recv_urb(chip, meter_urb,
                         sizeof(meter_urb));
                 kcontrol->private_value++;
                 break;
+        }
         case 1:
                 snd_us16x08_recv_urb(chip, meter_urb,
                         sizeof(meter_urb));
@@ -718,15 +720,18 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol,
                         sizeof(meter_urb));
                 kcontrol->private_value++;
                 break;
-        case 3:
+        case 3: {
+                char tmp[sizeof(mix_init_msg2)];
+
                 memcpy(tmp, mix_init_msg2, sizeof(mix_init_msg2));
                 tmp[2] = snd_get_meter_comp_index(store);
-                snd_us16x08_send_urb(chip, tmp, sizeof(mix_init_msg2));
+                snd_us16x08_send_urb(chip, tmp, 10);
                 snd_us16x08_recv_urb(chip, meter_urb,
                         sizeof(meter_urb));
                 kcontrol->private_value = 0;
                 break;
         }
+        }
 
         for (set = 0; set < 6; set++)
                 get_meter_levels_from_urb(set, store, meter_urb);
@@ -1135,7 +1140,7 @@ static const struct snd_us16x08_control_params eq_controls[] = {
                 .control_id = SND_US16X08_ID_EQLOWMIDWIDTH,
                 .type = USB_MIXER_U8,
                 .num_channels = 16,
-                .name = "EQ MidQLow Q",
+                .name = "EQ MidLow Q",
         },
         { /* EQ mid high gain */
                 .kcontrol_new = &snd_us16x08_eq_gain_ctl,
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 01eff6ce6401..d7b0b0a3a2db 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1364,7 +1364,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         /* Amanero Combo384 USB interface with native DSD support */
         case USB_ID(0x16d0, 0x071a):
                 if (fp->altsetting == 2) {
-                        switch (chip->dev->descriptor.bcdDevice) {
+                        switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
                         case 0x199:
                                 return SNDRV_PCM_FMTBIT_DSD_U32_LE;
                         case 0x19b:
diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h
index 6ebd3e6a1fd1..5e3c673fa3f4 100644
--- a/tools/arch/arm/include/uapi/asm/kvm.h
+++ b/tools/arch/arm/include/uapi/asm/kvm.h
@@ -27,6 +27,8 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 #define KVM_REG_SIZE(id)                                                \
         (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
 
@@ -114,6 +116,8 @@ struct kvm_debug_exit_arch {
 };
 
 struct kvm_sync_regs {
+        /* Used with KVM_CAP_ARM_USER_IRQ */
+        __u64 device_irq_level;
 };
 
 struct kvm_arch_memory_slot {
@@ -192,13 +196,17 @@ struct kvm_arch_memory_slot {
 #define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
+#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS   8
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT  10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
                         (0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK 0x3ff
 #define VGIC_LEVEL_INFO_LINE_LEVEL      0
 
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT    0
+#define   KVM_DEV_ARM_VGIC_CTRL_INIT            0
+#define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
+#define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
+#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
 
 /* KVM_IRQ_LINE irq field index values */
 #define KVM_ARM_IRQ_TYPE_SHIFT          24
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index c2860358ae3e..70eea2ecc663 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -39,6 +39,8 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 #define KVM_REG_SIZE(id)                                                \
         (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
 
@@ -143,6 +145,8 @@ struct kvm_debug_exit_arch {
 #define KVM_GUESTDBG_USE_HW             (1 << 17)
 
 struct kvm_sync_regs {
+        /* Used with KVM_CAP_ARM_USER_IRQ */
+        __u64 device_irq_level;
 };
 
 struct kvm_arch_memory_slot {
@@ -212,13 +216,17 @@ struct kvm_arch_memory_slot {
 #define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
+#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS 8
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT  10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
                         (0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK  0x3ff
 #define VGIC_LEVEL_INFO_LINE_LEVEL      0
 
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT    0
+#define   KVM_DEV_ARM_VGIC_CTRL_INIT            0
+#define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
+#define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
+#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
 
 /* Device Control API on vcpu fd */
 #define KVM_ARM_VCPU_PMU_V3_CTRL        0
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 4edbe4bb0e8b..07fbeb927834 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -29,6 +29,9 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_GUEST_DEBUG
 
+/* Not always available, but if it is, this is the correct offset.  */
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 struct kvm_regs {
         __u64 pc;
         __u64 cr;
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 7f4fd65e9208..3dd2a1d308dd 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -26,6 +26,8 @@
 #define KVM_DEV_FLIC_ADAPTER_REGISTER   6
 #define KVM_DEV_FLIC_ADAPTER_MODIFY     7
 #define KVM_DEV_FLIC_CLEAR_IO_IRQ       8
+#define KVM_DEV_FLIC_AISM               9
+#define KVM_DEV_FLIC_AIRQ_INJECT        10
 /*
  * We can have up to 4*64k pending subchannels + 8 adapter interrupts,
  * as well as up  to ASYNC_PF_PER_VCPU*KVM_MAX_VCPUS pfault done interrupts.
@@ -41,7 +43,14 @@ struct kvm_s390_io_adapter {
         __u8 isc;
         __u8 maskable;
         __u8 swap;
-        __u8 pad;
+        __u8 flags;
+};
+
+#define KVM_S390_ADAPTER_SUPPRESSIBLE 0x01
+
+struct kvm_s390_ais_req {
+        __u8 isc;
+        __u16 mode;
 };
 
 #define KVM_S390_IO_ADAPTER_MASK 1
@@ -110,6 +119,7 @@ struct kvm_s390_vm_cpu_machine {
 #define KVM_S390_VM_CPU_FEAT_CMMA       10
 #define KVM_S390_VM_CPU_FEAT_PFMFI      11
 #define KVM_S390_VM_CPU_FEAT_SIGPIF     12
+#define KVM_S390_VM_CPU_FEAT_KSS        13
 struct kvm_s390_vm_cpu_feat {
         __u64 feat[16];
 };
@@ -198,6 +208,10 @@ struct kvm_guest_debug_arch {
 #define KVM_SYNC_VRS    (1UL << 6)
 #define KVM_SYNC_RICCB  (1UL << 7)
 #define KVM_SYNC_FPRS   (1UL << 8)
+#define KVM_SYNC_GSCB   (1UL << 9)
+/* length and alignment of the sdnx as a power of two */
+#define SDNXC 8
+#define SDNXL (1UL << SDNXC)
 /* definition of registers in kvm_run */
 struct kvm_sync_regs {
         __u64 prefix;   /* prefix register */
@@ -218,8 +232,16 @@ struct kvm_sync_regs {
         };
         __u8  reserved[512];    /* for future vector expansion */
         __u32 fpc;              /* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */
-        __u8 padding[52];       /* riccb needs to be 64byte aligned */
+        __u8 padding1[52];      /* riccb needs to be 64byte aligned */
         __u8 riccb[64];         /* runtime instrumentation controls block */
+        __u8 padding2[192];     /* sdnx needs to be 256byte aligned */
+        union {
+                __u8 sdnx[SDNXL];  /* state description annex */
+                struct {
+                        __u64 reserved1[2];
+                        __u64 gscb[4];
+                };
+        };
 };
 
 #define KVM_REG_S390_TODPR      (KVM_REG_S390 | KVM_REG_SIZE_U32 | 0x1)
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 0fe00446f9ca..2701e5f8145b 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -202,6 +202,8 @@
 #define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */
 
+#define X86_FEATURE_MBA         ( 7*32+18) /* Memory Bandwidth Allocation */
+
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW  ( 8*32+ 0) /* Intel TPR Shadow */
 #define X86_FEATURE_VNMI        ( 8*32+ 1) /* Intel Virtual NMI */
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index 85599ad4d024..5dff775af7cd 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -36,6 +36,12 @@
 # define DISABLE_OSPKE          (1<<(X86_FEATURE_OSPKE & 31))
 #endif /* CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS */
 
+#ifdef CONFIG_X86_5LEVEL
+# define DISABLE_LA57   0
+#else
+# define DISABLE_LA57   (1<<(X86_FEATURE_LA57 & 31))
+#endif
+
 /*
  * Make sure to add features to the correct mask
  */
@@ -55,7 +61,7 @@
 #define DISABLED_MASK13 0
 #define DISABLED_MASK14 0
 #define DISABLED_MASK15 0
-#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE)
+#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57)
 #define DISABLED_MASK17 0
 #define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h
index fac9a5c0abe9..d91ba04dd007 100644
--- a/tools/arch/x86/include/asm/required-features.h
+++ b/tools/arch/x86/include/asm/required-features.h
@@ -53,6 +53,12 @@
 # define NEED_MOVBE     0
 #endif
 
+#ifdef CONFIG_X86_5LEVEL
+# define NEED_LA57      (1<<(X86_FEATURE_LA57 & 31))
+#else
+# define NEED_LA57      0
+#endif
+
 #ifdef CONFIG_X86_64
 #ifdef CONFIG_PARAVIRT
 /* Paravirtualized systems may not have PSE or PGE available */
@@ -98,7 +104,7 @@
 #define REQUIRED_MASK13 0
 #define REQUIRED_MASK14 0
 #define REQUIRED_MASK15 0
-#define REQUIRED_MASK16 0
+#define REQUIRED_MASK16 (NEED_LA57)
 #define REQUIRED_MASK17 0
 #define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/arch/x86/include/uapi/asm/kvm.h b/tools/arch/x86/include/uapi/asm/kvm.h
index 739c0c594022..c2824d02ba37 100644
--- a/tools/arch/x86/include/uapi/asm/kvm.h
+++ b/tools/arch/x86/include/uapi/asm/kvm.h
@@ -9,6 +9,9 @@
 #include <linux/types.h>
 #include <linux/ioctl.h>
 
+#define KVM_PIO_PAGE_OFFSET 1
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 2
+
 #define DE_VECTOR 0
 #define DB_VECTOR 1
 #define BP_VECTOR 3
diff --git a/tools/arch/x86/include/uapi/asm/vmx.h b/tools/arch/x86/include/uapi/asm/vmx.h
index 14458658e988..690a2dcf4078 100644
--- a/tools/arch/x86/include/uapi/asm/vmx.h
+++ b/tools/arch/x86/include/uapi/asm/vmx.h
@@ -76,7 +76,11 @@
 #define EXIT_REASON_WBINVD              54
 #define EXIT_REASON_XSETBV              55
 #define EXIT_REASON_APIC_WRITE          56
+#define EXIT_REASON_RDRAND              57
 #define EXIT_REASON_INVPCID             58
+#define EXIT_REASON_VMFUNC              59
+#define EXIT_REASON_ENCLS               60
+#define EXIT_REASON_RDSEED              61
 #define EXIT_REASON_PML_FULL            62
 #define EXIT_REASON_XSAVES              63
 #define EXIT_REASON_XRSTORS             64
@@ -90,6 +94,7 @@
         { EXIT_REASON_TASK_SWITCH,           "TASK_SWITCH" }, \
         { EXIT_REASON_CPUID,                 "CPUID" }, \
         { EXIT_REASON_HLT,                   "HLT" }, \
+        { EXIT_REASON_INVD,                  "INVD" }, \
         { EXIT_REASON_INVLPG,                "INVLPG" }, \
         { EXIT_REASON_RDPMC,                 "RDPMC" }, \
         { EXIT_REASON_RDTSC,                 "RDTSC" }, \
@@ -108,6 +113,8 @@
         { EXIT_REASON_IO_INSTRUCTION,        "IO_INSTRUCTION" }, \
         { EXIT_REASON_MSR_READ,              "MSR_READ" }, \
         { EXIT_REASON_MSR_WRITE,             "MSR_WRITE" }, \
+        { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
+        { EXIT_REASON_MSR_LOAD_FAIL,         "MSR_LOAD_FAIL" }, \
         { EXIT_REASON_MWAIT_INSTRUCTION,     "MWAIT_INSTRUCTION" }, \
         { EXIT_REASON_MONITOR_TRAP_FLAG,     "MONITOR_TRAP_FLAG" }, \
         { EXIT_REASON_MONITOR_INSTRUCTION,   "MONITOR_INSTRUCTION" }, \
@@ -115,20 +122,24 @@
         { EXIT_REASON_MCE_DURING_VMENTRY,    "MCE_DURING_VMENTRY" }, \
         { EXIT_REASON_TPR_BELOW_THRESHOLD,   "TPR_BELOW_THRESHOLD" }, \
         { EXIT_REASON_APIC_ACCESS,           "APIC_ACCESS" }, \
-        { EXIT_REASON_GDTR_IDTR,             "GDTR_IDTR" }, \
-        { EXIT_REASON_LDTR_TR,               "LDTR_TR" }, \
+        { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
+        { EXIT_REASON_GDTR_IDTR,             "GDTR_IDTR" }, \
+        { EXIT_REASON_LDTR_TR,               "LDTR_TR" }, \
         { EXIT_REASON_EPT_VIOLATION,         "EPT_VIOLATION" }, \
         { EXIT_REASON_EPT_MISCONFIG,         "EPT_MISCONFIG" }, \
         { EXIT_REASON_INVEPT,                "INVEPT" }, \
+        { EXIT_REASON_RDTSCP,                "RDTSCP" }, \
         { EXIT_REASON_PREEMPTION_TIMER,      "PREEMPTION_TIMER" }, \
+        { EXIT_REASON_INVVPID,               "INVVPID" }, \
         { EXIT_REASON_WBINVD,                "WBINVD" }, \
+        { EXIT_REASON_XSETBV,                "XSETBV" }, \
         { EXIT_REASON_APIC_WRITE,            "APIC_WRITE" }, \
-        { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
-        { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
-        { EXIT_REASON_MSR_LOAD_FAIL,         "MSR_LOAD_FAIL" }, \
-        { EXIT_REASON_INVD,                  "INVD" }, \
-        { EXIT_REASON_INVVPID,               "INVVPID" }, \
+        { EXIT_REASON_RDRAND,                "RDRAND" }, \
         { EXIT_REASON_INVPCID,               "INVPCID" }, \
+        { EXIT_REASON_VMFUNC,                "VMFUNC" }, \
+        { EXIT_REASON_ENCLS,                 "ENCLS" }, \
+        { EXIT_REASON_RDSEED,                "RDSEED" }, \
+        { EXIT_REASON_PML_FULL,              "PML_FULL" }, \
         { EXIT_REASON_XSAVES,                "XSAVES" }, \
         { EXIT_REASON_XRSTORS,               "XRSTORS" }
 
diff --git a/tools/include/linux/filter.h b/tools/include/linux/filter.h
index 390d7c9685fd..4ce25d43e8e3 100644
--- a/tools/include/linux/filter.h
+++ b/tools/include/linux/filter.h
@@ -208,6 +208,16 @@
                 .off   = OFF,                                   \
                 .imm   = IMM })
 
+/* Unconditional jumps, goto pc + off16 */
+
+#define BPF_JMP_A(OFF)                                          \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_JMP | BPF_JA,                      \
+                .dst_reg = 0,                                   \
+                .src_reg = 0,                                   \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Function call */
 
 #define BPF_EMIT_CALL(FUNC)                                     \
diff --git a/tools/include/uapi/linux/stat.h b/tools/include/uapi/linux/stat.h
index d538897b8e08..17b10304c393 100644
--- a/tools/include/uapi/linux/stat.h
+++ b/tools/include/uapi/linux/stat.h
@@ -48,17 +48,13 @@
  * tv_sec holds the number of seconds before (negative) or after (positive)
  * 00:00:00 1st January 1970 UTC.
  *
- * tv_nsec holds a number of nanoseconds before (0..-999,999,999 if tv_sec is
- * negative) or after (0..999,999,999 if tv_sec is positive) the tv_sec time.
- *
- * Note that if both tv_sec and tv_nsec are non-zero, then the two values must
- * either be both positive or both negative.
+ * tv_nsec holds a number of nanoseconds (0..999,999,999) after the tv_sec time.
  *
  * __reserved is held in case we need a yet finer resolution.
  */
 struct statx_timestamp {
         __s64   tv_sec;
-        __s32   tv_nsec;
+        __u32   tv_nsec;
         __s32   __reserved;
 };
 
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 282a60368b14..5f66697fe1e0 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -192,7 +192,8 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
                 "complete_and_exit",
                 "kvm_spurious_fault",
                 "__reiserfs_panic",
-                "lbug_with_loc"
+                "lbug_with_loc",
+                "fortify_panic",
         };
 
         if (func->bind == STB_WEAK)
diff --git a/tools/perf/Documentation/perf-probe.txt b/tools/perf/Documentation/perf-probe.txt
index e6c9902c6d82..165c2b1d4317 100644
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -240,9 +240,13 @@ Add a probe on schedule() function 12th line with recording cpu local variable:
  or
  ./perf probe --add='schedule:12 cpu'
 
- this will add one or more probes which has the name start with "schedule".
+Add one or more probes which has the name start with "schedule".
 
- Add probes on lines in schedule() function which calls update_rq_clock().
+ ./perf probe schedule*
+ or
+ ./perf probe --add='schedule*'
+
+Add probes on lines in schedule() function which calls update_rq_clock().
 
  ./perf probe 'schedule;update_rq_clock*'
  or
diff --git a/tools/perf/Documentation/perf-script-perl.txt b/tools/perf/Documentation/perf-script-perl.txt
index dfbb506d2c34..142606c0ec9c 100644
--- a/tools/perf/Documentation/perf-script-perl.txt
+++ b/tools/perf/Documentation/perf-script-perl.txt
@@ -39,7 +39,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 
 Most of the event's field values are passed as arguments to the
diff --git a/tools/perf/Documentation/perf-script-python.txt b/tools/perf/Documentation/perf-script-python.txt
index 54acba221558..51ec2d20068a 100644
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -149,10 +149,8 @@ def raw_syscalls__sys_enter(event_name, context, common_cpu,
                 print "id=%d, args=%s\n" % \
                 (id, args),
 
-def trace_unhandled(event_name, context, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm):
-                print_header(event_name, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm)
+def trace_unhandled(event_name, context, event_fields_dict):
+                print ' '.join(['%s=%s'%(k,str(v))for k,v in sorted(event_fields_dict.items())])
 
 def print_header(event_name, cpu, secs, nsecs, pid, comm):
         print "%-20s %5u %05u.%09u %8u %-20s " % \
@@ -321,7 +319,7 @@ So those are the essential steps in writing and running a script.  The
 process can be generalized to any tracepoint or set of tracepoints
 you're interested in - basically find the tracepoint(s) you're
 interested in by looking at the list of available events shown by
-'perf list' and/or look in /sys/kernel/debug/tracing events for
+'perf list' and/or look in /sys/kernel/debug/tracing/events/ for
 detailed event and field info, record the corresponding trace data
 using 'perf record', passing it the list of interesting events,
 generate a skeleton script using 'perf script -g python' and modify the
@@ -334,7 +332,7 @@ right place, you can have your script listed alongside the other
 scripts listed by the 'perf script -l' command e.g.:
 
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
   wakeup-latency                       system-wide min/max/avg wakeup latency
   rw-by-file <comm>                    r/w activity for a program, by file
@@ -383,8 +381,6 @@ source tree:
 
 ----
 # ls -al kernel-source/tools/perf/scripts/python
-
-root@tropicana:/home/trz/src/tip# ls -al tools/perf/scripts/python
 total 32
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:30 .
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:29 ..
@@ -399,7 +395,7 @@ otherwise your script won't show up at run-time), 'perf script -l'
 should show a new entry for your script:
 
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
   wakeup-latency                       system-wide min/max/avg wakeup latency
   rw-by-file <comm>                    r/w activity for a program, by file
@@ -437,7 +433,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 
 Most of the event's field values are passed as arguments to the
@@ -532,7 +528,7 @@ can implement a set of optional functions:
 gives scripts a chance to do setup tasks:
 
 ----
-def trace_begin:
+def trace_begin():
     pass
 ----
 
@@ -541,7 +537,7 @@ def trace_begin:
  as display results:
 
 ----
-def trace_end:
+def trace_end():
     pass
 ----
 
@@ -550,8 +546,7 @@ def trace_end:
  of common arguments are passed into it:
 
 ----
-def trace_unhandled(event_name, context, common_cpu, common_secs,
-        common_nsecs, common_pid, common_comm):
+def trace_unhandled(event_name, context, event_fields_dict):
     pass
 ----
 
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index cb0eda3925e6..3517e204a2b3 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -311,6 +311,10 @@ include::itrace.txt[]
         Set the maximum number of program blocks to print with brstackasm for
         each sample.
 
+--inline::
+        If a callgraph address belongs to an inlined function, the inline stack
+        will be printed. Each entry has function name and file/line.
+
 SEE ALSO
 --------
 linkperf:perf-record[1], linkperf:perf-script-perl[1],
diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index 8354d04b392f..1f4fbc9a3292 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -19,18 +19,18 @@ CFLAGS := $(EXTRA_CFLAGS) $(EXTRA_WARNINGS)
 
 include $(srctree)/tools/scripts/Makefile.arch
 
-$(call detected_var,ARCH)
+$(call detected_var,SRCARCH)
 
 NO_PERF_REGS := 1
 
 # Additional ARCH settings for ppc
-ifeq ($(ARCH),powerpc)
+ifeq ($(SRCARCH),powerpc)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS := -lunwind -lunwind-ppc64
 endif
 
 # Additional ARCH settings for x86
-ifeq ($(ARCH),x86)
+ifeq ($(SRCARCH),x86)
   $(call detected,CONFIG_X86)
   ifeq (${IS_64_BIT}, 1)
     CFLAGS += -DHAVE_ARCH_X86_64_SUPPORT -DHAVE_SYSCALL_TABLE -I$(OUTPUT)arch/x86/include/generated
@@ -43,12 +43,12 @@ ifeq ($(ARCH),x86)
   NO_PERF_REGS := 0
 endif
 
-ifeq ($(ARCH),arm)
+ifeq ($(SRCARCH),arm)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS = -lunwind -lunwind-arm
 endif
 
-ifeq ($(ARCH),arm64)
+ifeq ($(SRCARCH),arm64)
   NO_PERF_REGS := 0
   LIBUNWIND_LIBS = -lunwind -lunwind-aarch64
 endif
@@ -61,7 +61,7 @@ endif
 # Disable it on all other architectures in case libdw unwind
 # support is detected in system. Add supported architectures
 # to the check.
-ifneq ($(ARCH),$(filter $(ARCH),x86 arm))
+ifneq ($(SRCARCH),$(filter $(SRCARCH),x86 arm))
   NO_LIBDW_DWARF_UNWIND := 1
 endif
 
@@ -115,9 +115,9 @@ endif
 FEATURE_CHECK_CFLAGS-libbabeltrace := $(LIBBABELTRACE_CFLAGS)
 FEATURE_CHECK_LDFLAGS-libbabeltrace := $(LIBBABELTRACE_LDFLAGS) -lbabeltrace-ctf
 
-FEATURE_CHECK_CFLAGS-bpf = -I. -I$(srctree)/tools/include -I$(srctree)/tools/arch/$(ARCH)/include/uapi -I$(srctree)/tools/include/uapi
+FEATURE_CHECK_CFLAGS-bpf = -I. -I$(srctree)/tools/include -I$(srctree)/tools/arch/$(SRCARCH)/include/uapi -I$(srctree)/tools/include/uapi
 # include ARCH specific config
--include $(src-perf)/arch/$(ARCH)/Makefile
+-include $(src-perf)/arch/$(SRCARCH)/Makefile
 
 ifdef PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET
   CFLAGS += -DHAVE_ARCH_REGS_QUERY_REGISTER_OFFSET
@@ -228,12 +228,12 @@ ifeq ($(DEBUG),0)
 endif
 
 INC_FLAGS += -I$(src-perf)/util/include
-INC_FLAGS += -I$(src-perf)/arch/$(ARCH)/include
+INC_FLAGS += -I$(src-perf)/arch/$(SRCARCH)/include
 INC_FLAGS += -I$(srctree)/tools/include/uapi
 INC_FLAGS += -I$(srctree)/tools/include/
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/include/uapi
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/include/
-INC_FLAGS += -I$(srctree)/tools/arch/$(ARCH)/
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/include/uapi
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/include/
+INC_FLAGS += -I$(srctree)/tools/arch/$(SRCARCH)/
 
 # $(obj-perf)      for generated common-cmds.h
 # $(obj-perf)/util for generated bison/flex headers
@@ -355,7 +355,7 @@ ifndef NO_LIBELF
 
   ifndef NO_DWARF
     ifeq ($(origin PERF_HAVE_DWARF_REGS), undefined)
-      msg := $(warning DWARF register mappings have not been defined for architecture $(ARCH), DWARF support disabled);
+      msg := $(warning DWARF register mappings have not been defined for architecture $(SRCARCH), DWARF support disabled);
       NO_DWARF := 1
     else
       CFLAGS += -DHAVE_DWARF_SUPPORT $(LIBDW_CFLAGS)
@@ -380,7 +380,7 @@ ifndef NO_LIBELF
         CFLAGS += -DHAVE_BPF_PROLOGUE
         $(call detected,CONFIG_BPF_PROLOGUE)
       else
-        msg := $(warning BPF prologue is not supported by architecture $(ARCH), missing regs_query_register_offset());
+        msg := $(warning BPF prologue is not supported by architecture $(SRCARCH), missing regs_query_register_offset());
       endif
     else
       msg := $(warning DWARF support is off, BPF prologue is disabled);
@@ -406,7 +406,7 @@ ifdef PERF_HAVE_JITDUMP
   endif
 endif
 
-ifeq ($(ARCH),powerpc)
+ifeq ($(SRCARCH),powerpc)
   ifndef NO_DWARF
     CFLAGS += -DHAVE_SKIP_CALLCHAIN_IDX
   endif
@@ -487,7 +487,7 @@ else
 endif
 
 ifndef NO_LOCAL_LIBUNWIND
-  ifeq ($(ARCH),$(filter $(ARCH),arm arm64))
+  ifeq ($(SRCARCH),$(filter $(SRCARCH),arm arm64))
     $(call feature_check,libunwind-debug-frame)
     ifneq ($(feature-libunwind-debug-frame), 1)
       msg := $(warning No debug_frame support found in libunwind);
@@ -740,7 +740,7 @@ ifeq (${IS_64_BIT}, 1)
       NO_PERF_READ_VDSO32 := 1
     endif
   endif
-  ifneq ($(ARCH), x86)
+  ifneq ($(SRCARCH), x86)
     NO_PERF_READ_VDSOX32 := 1
   endif
   ifndef NO_PERF_READ_VDSOX32
@@ -769,7 +769,7 @@ ifdef LIBBABELTRACE
 endif
 
 ifndef NO_AUXTRACE
-  ifeq ($(ARCH),x86)
+  ifeq ($(SRCARCH),x86)
     ifeq ($(feature-get_cpuid), 0)
       msg := $(warning Your gcc lacks the __get_cpuid() builtin, disables support for auxtrace/Intel PT, please install a newer gcc);
       NO_AUXTRACE := 1
@@ -872,7 +872,7 @@ sysconfdir = $(prefix)/etc
 ETC_PERFCONFIG = etc/perfconfig
 endif
 ifndef lib
-ifeq ($(ARCH)$(IS_64_BIT), x861)
+ifeq ($(SRCARCH)$(IS_64_BIT), x861)
 lib = lib64
 else
 lib = lib
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 79fe31f20a17..5008f51a08a2 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -226,7 +226,7 @@ endif
 
 ifeq ($(config),0)
 include $(srctree)/tools/scripts/Makefile.arch
--include arch/$(ARCH)/Makefile
+-include arch/$(SRCARCH)/Makefile
 endif
 
 # The FEATURE_DUMP_EXPORT holds location of the actual
diff --git a/tools/perf/arch/Build b/tools/perf/arch/Build
index 109eb75cf7de..d9b6af837c7d 100644
--- a/tools/perf/arch/Build
+++ b/tools/perf/arch/Build
@@ -1,2 +1,2 @@
 libperf-y += common.o
-libperf-y += $(ARCH)/
+libperf-y += $(SRCARCH)/
diff --git a/tools/perf/arch/common.c b/tools/perf/arch/common.c
index 837067f48a4c..6b40e9f01740 100644
--- a/tools/perf/arch/common.c
+++ b/tools/perf/arch/common.c
@@ -26,6 +26,7 @@ const char *const arm64_triplets[] = {
 
 const char *const powerpc_triplets[] = {
         "powerpc-unknown-linux-gnu-",
+        "powerpc-linux-gnu-",
         "powerpc64-unknown-linux-gnu-",
         "powerpc64-linux-gnu-",
         "powerpc64le-linux-gnu-",
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index d05aec491cff..4761b0d7fcb5 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -2494,6 +2494,8 @@ int cmd_script(int argc, const char **argv)
                         "Enable kernel symbol demangling"),
         OPT_STRING(0, "time", &script.time_str, "str",
                    "Time span of interest (start,stop)"),
+        OPT_BOOLEAN(0, "inline", &symbol_conf.inline_name,
+                    "Show inline function"),
         OPT_END()
         };
         const char * const script_subcommands[] = { "record", "report", NULL };
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index a935b5023732..ad9324d1daf9 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1578,6 +1578,7 @@ static void print_header(int argc, const char **argv)
 static void print_footer(void)
 {
         FILE *output = stat_config.output;
+        int n;
 
         if (!null_run)
                 fprintf(output, "\n");
@@ -1590,7 +1591,9 @@ static void print_footer(void)
         }
         fprintf(output, "\n\n");
 
-        if (print_free_counters_hint)
+        if (print_free_counters_hint &&
+            sysctl__read_int("kernel/nmi_watchdog", &n) >= 0 &&
+            n > 0)
                 fprintf(output,
 "Some events weren't counted. Try disabling the NMI watchdog:\n"
 "       echo 0 > /proc/sys/kernel/nmi_watchdog\n"
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index d014350adc52..4b2a5d298197 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -681,6 +681,10 @@ static struct syscall_fmt {
         { .name     = "mlockall",   .errmsg = true,
           .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
         { .name     = "mmap",       .hexret = true,
+/* The standard mmap maps to old_mmap on s390x */
+#if defined(__s390x__)
+        .alias = "old_mmap",
+#endif
           .arg_scnprintf = { [0] = SCA_HEX,       /* addr */
                              [2] = SCA_MMAP_PROT, /* prot */
                              [3] = SCA_MMAP_FLAGS, /* flags */ }, },
diff --git a/tools/perf/pmu-events/Build b/tools/perf/pmu-events/Build
index 9213a1273697..999a4e878162 100644
--- a/tools/perf/pmu-events/Build
+++ b/tools/perf/pmu-events/Build
@@ -2,7 +2,7 @@ hostprogs := jevents
 
 jevents-y       += json.o jsmn.o jevents.o
 pmu-events-y    += pmu-events.o
-JDIR            =  pmu-events/arch/$(ARCH)
+JDIR            =  pmu-events/arch/$(SRCARCH)
 JSON            =  $(shell [ -d $(JDIR) ] &&                            \
                         find $(JDIR) -name '*.json' -o -name 'mapfile.csv')
 #
@@ -10,4 +10,4 @@ JSON		=  $(shell [ -d $(JDIR) ] &&				\
 # directory and create tables in pmu-events.c.
 #
 $(OUTPUT)pmu-events/pmu-events.c: $(JSON) $(JEVENTS)
-        $(Q)$(call echo-cmd,gen)$(JEVENTS) $(ARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V)
+        $(Q)$(call echo-cmd,gen)$(JEVENTS) $(SRCARCH) pmu-events/arch $(OUTPUT)pmu-events/pmu-events.c $(V)
diff --git a/tools/perf/tests/Build b/tools/perf/tests/Build
index af58ebc243ef..84222bdb8689 100644
--- a/tools/perf/tests/Build
+++ b/tools/perf/tests/Build
@@ -75,7 +75,7 @@ $(OUTPUT)tests/llvm-src-relocation.c: tests/bpf-script-test-relocation.c tests/B
         $(Q)sed -e 's/"/\\"/g' -e 's/\(.*\)/"\1\\n"/g' $< >> $@
         $(Q)echo ';' >> $@
 
-ifeq ($(ARCH),$(filter $(ARCH),x86 arm arm64 powerpc))
+ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 arm arm64 powerpc))
 perf-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o
 endif
 
diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
index e7664fe3bd33..8ba2c4618fe9 100644
--- a/tools/perf/tests/bp_signal.c
+++ b/tools/perf/tests/bp_signal.c
@@ -288,3 +288,17 @@ int test__bp_signal(int subtest __maybe_unused)
         return count1 == 1 && overflows == 3 && count2 == 3 && overflows_2 == 3 && count3 == 2 ?
                 TEST_OK : TEST_FAIL;
 }
+
+bool test__bp_signal_is_supported(void)
+{
+/*
+ * The powerpc so far does not have support to even create
+ * instruction breakpoint using the perf event interface.
+ * Once it's there we can release this.
+ */
+#ifdef __powerpc__
+        return false;
+#else
+        return true;
+#endif
+}
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index 9e08d297f1a9..3ccfd58a8c3c 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -97,10 +97,12 @@ static struct test generic_tests[] = {
         {
                 .desc = "Breakpoint overflow signal handler",
                 .func = test__bp_signal,
+                .is_supported = test__bp_signal_is_supported,
         },
         {
                 .desc = "Breakpoint overflow sampling",
                 .func = test__bp_signal_overflow,
+                .is_supported = test__bp_signal_is_supported,
         },
         {
                 .desc = "Number of exit events of a simple workload",
@@ -401,6 +403,11 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist)
                 if (!perf_test__matches(t, curr, argc, argv))
                         continue;
 
+                if (t->is_supported && !t->is_supported()) {
+                        pr_debug("%2d: %-*s: Disabled\n", i, width, t->desc);
+                        continue;
+                }
+
                 pr_info("%2d: %-*s:", i, width, t->desc);
 
                 if (intlist__find(skiplist, i)) {
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 1f14e7612cbb..94b7c7b02bde 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -229,6 +229,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
         unsigned char buf2[BUFSZ];
         size_t ret_len;
         u64 objdump_addr;
+        const char *objdump_name;
+        char decomp_name[KMOD_DECOMP_LEN];
         int ret;
 
         pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
@@ -289,9 +291,25 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
                 state->done[state->done_cnt++] = al.map->start;
         }
 
+        objdump_name = al.map->dso->long_name;
+        if (dso__needs_decompress(al.map->dso)) {
+                if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
+                                                 decomp_name,
+                                                 sizeof(decomp_name)) < 0) {
+                        pr_debug("decompression failed\n");
+                        return -1;
+                }
+
+                objdump_name = decomp_name;
+        }
+
         /* Read the object code using objdump */
         objdump_addr = map__rip_2objdump(al.map, al.addr);
-        ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
+        ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
+
+        if (dso__needs_decompress(al.map->dso))
+                unlink(objdump_name);
+
         if (ret > 0) {
                 /*
                  * The kernel maps are inaccurate - assume objdump is right in
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 32873ec91a4e..cf00ebad2ef5 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -83,7 +83,7 @@ int test__task_exit(int subtest __maybe_unused)
 
         evsel = perf_evlist__first(evlist);
         evsel->attr.task = 1;
-        evsel->attr.sample_freq = 0;
+        evsel->attr.sample_freq = 1;
         evsel->attr.inherit = 0;
         evsel->attr.watermark = 0;
         evsel->attr.wakeup_events = 1;
diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h
index 631859629403..577363809c9b 100644
--- a/tools/perf/tests/tests.h
+++ b/tools/perf/tests/tests.h
@@ -34,6 +34,7 @@ struct test {
                 int (*get_nr)(void);
                 const char *(*get_desc)(int subtest);
         } subtest;
+        bool (*is_supported)(void);
 };
 
 /* Tests */
@@ -99,6 +100,8 @@ const char *test__clang_subtest_get_desc(int subtest);
 int test__clang_subtest_get_nr(void);
 int test__unit_number__scnprint(int subtest);
 
+bool test__bp_signal_is_supported(void);
+
 #if defined(__arm__) || defined(__aarch64__)
 #ifdef HAVE_DWARF_UNWIND_SUPPORT
 struct thread;
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 59addd52d9cd..ddb2c6fbdf91 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -210,6 +210,8 @@ static int __hpp__sort_acc(struct hist_entry *a, struct hist_entry *b,
                         return 0;
 
                 ret = b->callchain->max_depth - a->callchain->max_depth;
+                if (callchain_param.order == ORDER_CALLER)
+                        ret = -ret;
         }
         return ret;
 }
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 683f8340460c..ddbd56df9187 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -239,10 +239,20 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
         const char *s = strchr(ops->raw, '+');
         const char *c = strchr(ops->raw, ',');
 
-        if (c++ != NULL)
+        /*
+         * skip over possible up to 2 operands to get to address, e.g.:
+         * tbnz  w0, #26, ffff0000083cd190 <security_file_permission+0xd0>
+         */
+        if (c++ != NULL) {
                 ops->target.addr = strtoull(c, NULL, 16);
-        else
+                if (!ops->target.addr) {
+                        c = strchr(c, ',');
+                        if (c++ != NULL)
+                                ops->target.addr = strtoull(c, NULL, 16);
+                }
+        } else {
                 ops->target.addr = strtoull(ops->raw, NULL, 16);
+        }
 
         if (s++ != NULL) {
                 ops->target.offset = strtoull(s, NULL, 16);
@@ -257,10 +267,27 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
 static int jump__scnprintf(struct ins *ins, char *bf, size_t size,
                            struct ins_operands *ops)
 {
+        const char *c = strchr(ops->raw, ',');
+
         if (!ops->target.addr || ops->target.offset < 0)
                 return ins__raw_scnprintf(ins, bf, size, ops);
 
-        return scnprintf(bf, size, "%-6.6s %" PRIx64, ins->name, ops->target.offset);
+        if (c != NULL) {
+                const char *c2 = strchr(c + 1, ',');
+
+                /* check for 3-op insn */
+                if (c2 != NULL)
+                        c = c2;
+                c++;
+
+                /* mirror arch objdump's space-after-comma style */
+                if (*c == ' ')
+                        c++;
+        }
+
+        return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64,
+                         ins->name, c ? c - ops->raw : 0, ops->raw,
+                         ops->target.offset);
 }
 
 static struct ins_ops jump_ops = {
@@ -1294,6 +1321,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
         char linkname[PATH_MAX];
         char *build_id_filename;
         char *build_id_path = NULL;
+        char *pos;
 
         if (dso->symtab_type == DSO_BINARY_TYPE__KALLSYMS &&
             !dso__is_kcore(dso))
@@ -1313,7 +1341,14 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
         if (!build_id_path)
                 return -1;
 
-        dirname(build_id_path);
+        /*
+         * old style build-id cache has name of XX/XXXXXXX.. while
+         * new style has XX/XXXXXXX../{elf,kallsyms,vdso}.
+         * extract the build-id part of dirname in the new style only.
+         */
+        pos = strrchr(build_id_path, '/');
+        if (pos && strlen(pos) < SBUILD_ID_SIZE - 2)
+                dirname(build_id_path);
 
         if (dso__is_kcore(dso) ||
             readlink(build_id_path, linkname, sizeof(linkname)) < 0 ||
@@ -1396,31 +1431,10 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
                                 sizeof(symfs_filename));
                 }
         } else if (dso__needs_decompress(dso)) {
-                char tmp[PATH_MAX];
-                struct kmod_path m;
-                int fd;
-                bool ret;
-
-                if (kmod_path__parse_ext(&m, symfs_filename))
-                        goto out;
-
-                snprintf(tmp, PATH_MAX, "/tmp/perf-kmod-XXXXXX");
-
-                fd = mkstemp(tmp);
-                if (fd < 0) {
-                        free(m.ext);
-                        goto out;
-                }
-
-                ret = decompress_to_file(m.ext, symfs_filename, fd);
-
-                if (ret)
-                        pr_err("Cannot decompress %s %s\n", m.ext, symfs_filename);
-
-                free(m.ext);
-                close(fd);
+                char tmp[KMOD_DECOMP_LEN];
 
-                if (!ret)
+                if (dso__decompress_kmodule_path(dso, symfs_filename,
+                                                 tmp, sizeof(tmp)) < 0)
                         goto out;
 
                 strcpy(symfs_filename, tmp);
@@ -1429,7 +1443,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
         snprintf(command, sizeof(command),
                  "%s %s%s --start-address=0x%016" PRIx64
                  " --stop-address=0x%016" PRIx64
-                 " -l -d %s %s -C %s 2>/dev/null|grep -v %s:|expand",
+                 " -l -d %s %s -C \"%s\" 2>/dev/null|grep -v \"%s:\"|expand",
                  objdump_path ? objdump_path : "objdump",
                  disassembler_style ? "-M " : "",
                  disassembler_style ? disassembler_style : "",
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index 168cc49654e7..e0148b081bdf 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -278,51 +278,6 @@ char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size)
         return bf;
 }
 
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size)
-{
-        char *id_name = NULL, *ch;
-        struct stat sb;
-        char sbuild_id[SBUILD_ID_SIZE];
-
-        if (!dso->has_build_id)
-                goto err;
-
-        build_id__sprintf(dso->build_id, sizeof(dso->build_id), sbuild_id);
-        id_name = build_id_cache__linkname(sbuild_id, NULL, 0);
-        if (!id_name)
-                goto err;
-        if (access(id_name, F_OK))
-                goto err;
-        if (lstat(id_name, &sb) == -1)
-                goto err;
-        if ((size_t)sb.st_size > size - 1)
-                goto err;
-        if (readlink(id_name, bf, size - 1) < 0)
-                goto err;
-
-        bf[sb.st_size] = '\0';
-
-        /*
-         * link should be:
-         * ../../lib/modules/4.4.0-rc4/kernel/net/ipv4/netfilter/nf_nat_ipv4.ko/a09fe3eb3147dafa4e3b31dbd6257e4d696bdc92
-         */
-        ch = strrchr(bf, '/');
-        if (!ch)
-                goto err;
-        if (ch - 3 < bf)
-                goto err;
-
-        free(id_name);
-        return strncmp(".ko", ch - 3, 3) == 0;
-err:
-        pr_err("Invalid build id: %s\n", id_name ? :
-                                         dso->long_name ? :
-                                         dso->short_name ? :
-                                         "[unknown]");
-        free(id_name);
-        return false;
-}
-
 #define dsos__for_each_with_build_id(pos, head) \
         list_for_each_entry(pos, head, node)    \
                 if (!pos->has_build_id)         \
diff --git a/tools/perf/util/build-id.h b/tools/perf/util/build-id.h
index 8a89b195c1fc..96690a55c62c 100644
--- a/tools/perf/util/build-id.h
+++ b/tools/perf/util/build-id.h
@@ -17,7 +17,6 @@ char *build_id_cache__kallsyms_path(const char *sbuild_id, char *bf,
                                     size_t size);
 
 char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size);
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size);
 
 int build_id__mark_dso_hit(struct perf_tool *tool, union perf_event *event,
                            struct perf_sample *sample, struct perf_evsel *evsel,
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 81fc29ac798f..b4204b43ed58 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -621,14 +621,19 @@ enum match_result {
 static enum match_result match_chain_srcline(struct callchain_cursor_node *node,
                                              struct callchain_list *cnode)
 {
-        char *left = get_srcline(cnode->ms.map->dso,
+        char *left = NULL;
+        char *right = NULL;
+        enum match_result ret = MATCH_EQ;
+        int cmp;
+
+        if (cnode->ms.map)
+                left = get_srcline(cnode->ms.map->dso,
                                  map__rip_2objdump(cnode->ms.map, cnode->ip),
                                  cnode->ms.sym, true, false);
-        char *right = get_srcline(node->map->dso,
+        if (node->map)
+                right = get_srcline(node->map->dso,
                                   map__rip_2objdump(node->map, node->ip),
                                   node->sym, true, false);
-        enum match_result ret = MATCH_EQ;
-        int cmp;
 
         if (left && right)
                 cmp = strcmp(left, right);
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index a96a99d2369f..4e7ab611377a 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -248,6 +248,64 @@ bool dso__needs_decompress(struct dso *dso)
                 dso->symtab_type == DSO_BINARY_TYPE__GUEST_KMODULE_COMP;
 }
 
+static int decompress_kmodule(struct dso *dso, const char *name, char *tmpbuf)
+{
+        int fd = -1;
+        struct kmod_path m;
+
+        if (!dso__needs_decompress(dso))
+                return -1;
+
+        if (kmod_path__parse_ext(&m, dso->long_name))
+                return -1;
+
+        if (!m.comp)
+                goto out;
+
+        fd = mkstemp(tmpbuf);
+        if (fd < 0) {
+                dso->load_errno = errno;
+                goto out;
+        }
+
+        if (!decompress_to_file(m.ext, name, fd)) {
+                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
+                close(fd);
+                fd = -1;
+        }
+
+out:
+        free(m.ext);
+        return fd;
+}
+
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        unlink(tmpbuf);
+        return fd;
+}
+
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        if (fd < 0) {
+                unlink(tmpbuf);
+                return -1;
+        }
+
+        strncpy(pathname, tmpbuf, len);
+        close(fd);
+        return 0;
+}
+
 /*
  * Parses kernel module specified in @path and updates
  * @m argument like:
@@ -335,6 +393,21 @@ int __kmod_path__parse(struct kmod_path *m, const char *path,
         return 0;
 }
 
+void dso__set_module_info(struct dso *dso, struct kmod_path *m,
+                          struct machine *machine)
+{
+        if (machine__is_host(machine))
+                dso->symtab_type = DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE;
+        else
+                dso->symtab_type = DSO_BINARY_TYPE__GUEST_KMODULE;
+
+        /* _KMODULE_COMP should be next to _KMODULE */
+        if (m->kmod && m->comp)
+                dso->symtab_type++;
+
+        dso__set_short_name(dso, strdup(m->name), true);
+}
+
 /*
  * Global list of open DSOs and the counter.
  */
@@ -381,7 +454,7 @@ static int do_open(char *name)
 
 static int __open_dso(struct dso *dso, struct machine *machine)
 {
-        int fd;
+        int fd = -EINVAL;
         char *root_dir = (char *)"";
         char *name = malloc(PATH_MAX);
 
@@ -392,15 +465,30 @@ static int __open_dso(struct dso *dso, struct machine *machine)
                 root_dir = machine->root_dir;
 
         if (dso__read_binary_type_filename(dso, dso->binary_type,
-                                            root_dir, name, PATH_MAX)) {
-                free(name);
-                return -EINVAL;
-        }
+                                            root_dir, name, PATH_MAX))
+                goto out;
 
         if (!is_regular_file(name))
-                return -EINVAL;
+                goto out;
+
+        if (dso__needs_decompress(dso)) {
+                char newpath[KMOD_DECOMP_LEN];
+                size_t len = sizeof(newpath);
+
+                if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
+                        fd = -dso->load_errno;
+                        goto out;
+                }
+
+                strcpy(name, newpath);
+        }
 
         fd = do_open(name);
+
+        if (dso__needs_decompress(dso))
+                unlink(name);
+
+out:
         free(name);
         return fd;
 }
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 12350b171727..bd061ba7b47c 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -244,6 +244,12 @@ bool is_supported_compression(const char *ext);
 bool is_kernel_module(const char *pathname, int cpumode);
 bool decompress_to_file(const char *ext, const char *filename, int output_fd);
 bool dso__needs_decompress(struct dso *dso);
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len);
+
+#define KMOD_DECOMP_NAME  "/tmp/perf-kmod-XXXXXX"
+#define KMOD_DECOMP_LEN   sizeof(KMOD_DECOMP_NAME)
 
 struct kmod_path {
         char *name;
@@ -259,6 +265,9 @@ int __kmod_path__parse(struct kmod_path *m, const char *path,
 #define kmod_path__parse_name(__m, __p) __kmod_path__parse(__m, __p, true , false)
 #define kmod_path__parse_ext(__m, __p)  __kmod_path__parse(__m, __p, false, true)
 
+void dso__set_module_info(struct dso *dso, struct kmod_path *m,
+                          struct machine *machine);
+
 /*
  * The dso__data_* external interface provides following functions:
  *   dso__data_get_fd
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index e4f7902d5afa..cda44b0e821c 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -273,8 +273,20 @@ struct perf_evsel *perf_evsel__new_cycles(void)
         struct perf_evsel *evsel;
 
         event_attr_init(&attr);
+        /*
+         * Unnamed union member, not supported as struct member named
+         * initializer in older compilers such as gcc 4.4.7
+         *
+         * Just for probing the precise_ip:
+         */
+        attr.sample_period = 1;
 
         perf_event_attr__set_max_precise_ip(&attr);
+        /*
+         * Now let the usual logic to set up the perf_event_attr defaults
+         * to kick in when we return and before perf_evsel__open() is called.
+         */
+        attr.sample_period = 0;
 
         evsel = perf_evsel__new(&attr);
         if (evsel == NULL)
diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
index e415aee6a245..583f3a602506 100644
--- a/tools/perf/util/evsel_fprintf.c
+++ b/tools/perf/util/evsel_fprintf.c
@@ -7,6 +7,7 @@
 #include "map.h"
 #include "strlist.h"
 #include "symbol.h"
+#include "srcline.h"
 
 static int comma_fprintf(FILE *fp, bool *first, const char *fmt, ...)
 {
@@ -168,6 +169,38 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
                         if (!print_oneline)
                                 printed += fprintf(fp, "\n");
 
+                        if (symbol_conf.inline_name && node->map) {
+                                struct inline_node *inode;
+
+                                addr = map__rip_2objdump(node->map, node->ip),
+                                inode = dso__parse_addr_inlines(node->map->dso, addr);
+
+                                if (inode) {
+                                        struct inline_list *ilist;
+
+                                        list_for_each_entry(ilist, &inode->val, list) {
+                                                if (print_arrow)
+                                                        printed += fprintf(fp, " <-");
+
+                                                /* IP is same, just skip it */
+                                                if (print_ip)
+                                                        printed += fprintf(fp, "%c%16s",
+                                                                           s, "");
+                                                if (print_sym)
+                                                        printed += fprintf(fp, " %s",
+                                                                           ilist->funcname);
+                                                if (print_srcline)
+                                                        printed += fprintf(fp, "\n  %s:%d",
+                                                                           ilist->filename,
+                                                                           ilist->line_nr);
+                                                if (!print_oneline)
+                                                        printed += fprintf(fp, "\n");
+                                        }
+
+                                        inline_node__delete(inode);
+                                }
+                        }
+
                         if (symbol_conf.bt_stop_list &&
                             node->sym &&
                             strlist__has_entry(symbol_conf.bt_stop_list,
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 314a07151fb7..b5baff3007bb 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -841,7 +841,7 @@ static int write_group_desc(int fd, struct perf_header *h __maybe_unused,
 
 /*
  * default get_cpuid(): nothing gets recorded
- * actual implementation must be in arch/$(ARCH)/util/header.c
+ * actual implementation must be in arch/$(SRCARCH)/util/header.c
  */
 int __weak get_cpuid(char *buffer __maybe_unused, size_t sz __maybe_unused)
 {
@@ -1469,8 +1469,16 @@ static int __event_process_build_id(struct build_id_event *bev,
 
                 dso__set_build_id(dso, &bev->build_id);
 
-                if (!is_kernel_module(filename, cpumode))
-                        dso->kernel = dso_type;
+                if (dso_type != DSO_TYPE_USER) {
+                        struct kmod_path m = { .name = NULL, };
+
+                        if (!kmod_path__parse_name(&m, filename) && m.kmod)
+                                dso__set_module_info(dso, &m, machine);
+                        else
+                                dso->kernel = dso_type;
+
+                        free(m.name);
+                }
 
                 build_id__sprintf(dso->build_id, sizeof(dso->build_id),
                                   sbuild_id);
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index d97e014c3df3..d7f31cb0a4cb 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -572,16 +572,7 @@ static struct dso *machine__findnew_module_dso(struct machine *machine,
                 if (dso == NULL)
                         goto out_unlock;
 
-                if (machine__is_host(machine))
-                        dso->symtab_type = DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE;
-                else
-                        dso->symtab_type = DSO_BINARY_TYPE__GUEST_KMODULE;
-
-                /* _KMODULE_COMP should be next to _KMODULE */
-                if (m->kmod && m->comp)
-                        dso->symtab_type++;
-
-                dso__set_short_name(dso, strdup(m->name), true);
+                dso__set_module_info(dso, m, machine);
                 dso__set_long_name(dso, strdup(filename), true);
         }
 
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 9d92af7d0718..40de3cb40d21 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -1219,7 +1219,7 @@ static int python_generate_script(struct pevent *pevent, const char *outfile)
         fprintf(ofp, "# be retrieved using Python functions of the form "
                 "common_*(context).\n");
 
-        fprintf(ofp, "# See the perf-trace-python Documentation for the list "
+        fprintf(ofp, "# See the perf-script-python Documentation for the list "
                 "of available functions.\n\n");
 
         fprintf(ofp, "import os\n");
diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index df051a52393c..ebc88a74e67b 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -56,7 +56,10 @@ static int inline_list__append(char *filename, char *funcname, int line_nr,
                 }
         }
 
-        list_add_tail(&ilist->list, &node->val);
+        if (callchain_param.order == ORDER_CALLEE)
+                list_add_tail(&ilist->list, &node->val);
+        else
+                list_add(&ilist->list, &node->val);
 
         return 0;
 }
@@ -200,12 +203,14 @@ static void addr2line_cleanup(struct a2l_data *a2l)
 
 #define MAX_INLINE_NEST 1024
 
-static void inline_list__reverse(struct inline_node *node)
+static int inline_list__append_dso_a2l(struct dso *dso,
+                                       struct inline_node *node)
 {
-        struct inline_list *ilist, *n;
+        struct a2l_data *a2l = dso->a2l;
+        char *funcname = a2l->funcname ? strdup(a2l->funcname) : NULL;
+        char *filename = a2l->filename ? strdup(a2l->filename) : NULL;
 
-        list_for_each_entry_safe_reverse(ilist, n, &node->val, list)
-                list_move_tail(&ilist->list, &node->val);
+        return inline_list__append(filename, funcname, a2l->line, node, dso);
 }
 
 static int addr2line(const char *dso_name, u64 addr,
@@ -230,36 +235,36 @@ static int addr2line(const char *dso_name, u64 addr,
 
         bfd_map_over_sections(a2l->abfd, find_address_in_section, a2l);
 
-        if (a2l->found && unwind_inlines) {
+        if (!a2l->found)
+                return 0;
+
+        if (unwind_inlines) {
                 int cnt = 0;
 
+                if (node && inline_list__append_dso_a2l(dso, node))
+                        return 0;
+
                 while (bfd_find_inliner_info(a2l->abfd, &a2l->filename,
                                              &a2l->funcname, &a2l->line) &&
                        cnt++ < MAX_INLINE_NEST) {
 
                         if (node != NULL) {
-                                if (inline_list__append(strdup(a2l->filename),
-                                                        strdup(a2l->funcname),
-                                                        a2l->line, node,
-                                                        dso) != 0)
+                                if (inline_list__append_dso_a2l(dso, node))
                                         return 0;
+                                // found at least one inline frame
+                                ret = 1;
                         }
                 }
+        }
 
-                if ((node != NULL) &&
-                    (callchain_param.order != ORDER_CALLEE)) {
-                        inline_list__reverse(node);
-                }
+        if (file) {
+                *file = a2l->filename ? strdup(a2l->filename) : NULL;
+                ret = *file ? 1 : 0;
         }
 
-        if (a2l->found && a2l->filename) {
-                *file = strdup(a2l->filename);
+        if (line)
                 *line = a2l->line;
 
-                if (*file)
-                        ret = 1;
-        }
-
         return ret;
 }
 
@@ -278,8 +283,6 @@ void dso__free_a2l(struct dso *dso)
 static struct inline_node *addr2inlines(const char *dso_name, u64 addr,
         struct dso *dso)
 {
-        char *file = NULL;
-        unsigned int line = 0;
         struct inline_node *node;
 
         node = zalloc(sizeof(*node));
@@ -291,7 +294,7 @@ static struct inline_node *addr2inlines(const char *dso_name, u64 addr,
         INIT_LIST_HEAD(&node->val);
         node->addr = addr;
 
-        if (!addr2line(dso_name, addr, &file, &line, dso, TRUE, node))
+        if (!addr2line(dso_name, addr, NULL, NULL, dso, TRUE, node))
                 goto out_free_inline_node;
 
         if (list_empty(&node->val))
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index e7ee47f7377a..502505cf236a 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -637,43 +637,6 @@ static int dso__swap_init(struct dso *dso, unsigned char eidata)
         return 0;
 }
 
-static int decompress_kmodule(struct dso *dso, const char *name,
-                              enum dso_binary_type type)
-{
-        int fd = -1;
-        char tmpbuf[] = "/tmp/perf-kmod-XXXXXX";
-        struct kmod_path m;
-
-        if (type != DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__GUEST_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                return -1;
-
-        if (type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                name = dso->long_name;
-
-        if (kmod_path__parse_ext(&m, name) || !m.comp)
-                return -1;
-
-        fd = mkstemp(tmpbuf);
-        if (fd < 0) {
-                dso->load_errno = errno;
-                goto out;
-        }
-
-        if (!decompress_to_file(m.ext, name, fd)) {
-                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
-                close(fd);
-                fd = -1;
-        }
-
-        unlink(tmpbuf);
-
-out:
-        free(m.ext);
-        return fd;
-}
-
 bool symsrc__possibly_runtime(struct symsrc *ss)
 {
         return ss->dynsym || ss->opdsec;
@@ -705,9 +668,11 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
         int fd;
 
         if (dso__needs_decompress(dso)) {
-                fd = decompress_kmodule(dso, name, type);
+                fd = dso__decompress_kmodule_fd(dso, name);
                 if (fd < 0)
                         return -1;
+
+                type = dso->symtab_type;
         } else {
                 fd = open(name, O_RDONLY);
                 if (fd < 0) {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 8f2b068ff756..e7a98dbd2aed 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1562,10 +1562,6 @@ int dso__load(struct dso *dso, struct map *map)
         if (!runtime_ss && syms_ss)
                 runtime_ss = syms_ss;
 
-        if (syms_ss && syms_ss->type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                if (dso__build_id_is_kmod(dso, name, PATH_MAX))
-                        kmod = true;
-
         if (syms_ss)
                 ret = dso__load_sym(dso, map, syms_ss, runtime_ss, kmod);
         else
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index f90e11a555b2..7755a5e0fe5e 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -39,6 +39,14 @@ static int __report_module(struct addr_location *al, u64 ip,
                 return 0;
 
         mod = dwfl_addrmodule(ui->dwfl, ip);
+        if (mod) {
+                Dwarf_Addr s;
+
+                dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+                if (s != al->map->start)
+                        mod = 0;
+        }
+
         if (!mod)
                 mod = dwfl_report_elf(ui->dwfl, dso->short_name,
                                       dso->long_name, -1, al->map->start,
@@ -168,12 +176,24 @@ frame_callback(Dwfl_Frame *state, void *arg)
 {
         struct unwind_info *ui = arg;
         Dwarf_Addr pc;
+        bool isactivation;
 
         if (!dwfl_frame_pc(state, &pc, NULL)) {
                 pr_err("%s", dwfl_errmsg(-1));
                 return DWARF_CB_ABORT;
         }
 
+        // report the module before we query for isactivation
+        report_module(pc, ui);
+
+        if (!dwfl_frame_pc(state, &pc, &isactivation)) {
+                pr_err("%s", dwfl_errmsg(-1));
+                return DWARF_CB_ABORT;
+        }
+
+        if (!isactivation)
+                --pc;
+
         return entry(pc, ui) || !(--ui->max_stack) ?
                DWARF_CB_ABORT : DWARF_CB_OK;
 }
@@ -220,7 +240,7 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
 
         err = dwfl_getthread_frames(ui->dwfl, thread->tid, frame_callback, ui);
 
-        if (err && !ui->max_stack)
+        if (err && ui->max_stack != max_stack)
                 err = 0;
 
         /*
diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
index f8455bed6e65..672c2ada9357 100644
--- a/tools/perf/util/unwind-libunwind-local.c
+++ b/tools/perf/util/unwind-libunwind-local.c
@@ -692,6 +692,17 @@ static int get_entries(struct unwind_info *ui, unwind_entry_cb_t cb,
 
                 while (!ret && (unw_step(&c) > 0) && i < max_stack) {
                         unw_get_reg(&c, UNW_REG_IP, &ips[i]);
+
+                        /*
+                         * Decrement the IP for any non-activation frames.
+                         * this is required to properly find the srcline
+                         * for caller frames.
+                         * See also the documentation for dwfl_frame_pc(),
+                         * which this code tries to replicate.
+                         */
+                        if (unw_is_signal_frame(&c) <= 0)
+                                --ips[i];
+
                         ++i;
                 }
 
diff --git a/tools/testing/selftests/bpf/bpf_endian.h b/tools/testing/selftests/bpf/bpf_endian.h
index 19d0604f8694..487cbfb89beb 100644
--- a/tools/testing/selftests/bpf/bpf_endian.h
+++ b/tools/testing/selftests/bpf/bpf_endian.h
@@ -1,23 +1,42 @@
 #ifndef __BPF_ENDIAN__
 #define __BPF_ENDIAN__
 
-#include <asm/byteorder.h>
+#include <linux/swab.h>
 
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-# define __bpf_ntohs(x)         __builtin_bswap16(x)
-# define __bpf_htons(x)         __builtin_bswap16(x)
-#elif __BYTE_ORDER == __BIG_ENDIAN
-# define __bpf_ntohs(x)         (x)
-# define __bpf_htons(x)         (x)
+/* LLVM's BPF target selects the endianness of the CPU
+ * it compiles on, or the user specifies (bpfel/bpfeb),
+ * respectively. The used __BYTE_ORDER__ is defined by
+ * the compiler, we cannot rely on __BYTE_ORDER from
+ * libc headers, since it doesn't reflect the actual
+ * requested byte order.
+ *
+ * Note, LLVM's BPF target has different __builtin_bswapX()
+ * semantics. It does map to BPF_ALU | BPF_END | BPF_TO_BE
+ * in bpfel and bpfeb case, which means below, that we map
+ * to cpu_to_be16(). We could use it unconditionally in BPF
+ * case, but better not rely on it, so that this header here
+ * can be used from application and BPF program side, which
+ * use different targets.
+ */
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+# define __bpf_ntohs(x)                 __builtin_bswap16(x)
+# define __bpf_htons(x)                 __builtin_bswap16(x)
+# define __bpf_constant_ntohs(x)        ___constant_swab16(x)
+# define __bpf_constant_htons(x)        ___constant_swab16(x)
+#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+# define __bpf_ntohs(x)                 (x)
+# define __bpf_htons(x)                 (x)
+# define __bpf_constant_ntohs(x)        (x)
+# define __bpf_constant_htons(x)        (x)
 #else
-# error "Fix your __BYTE_ORDER?!"
+# error "Fix your compiler's __BYTE_ORDER__?!"
 #endif
 
 #define bpf_htons(x)                            \
         (__builtin_constant_p(x) ?              \
-         __constant_htons(x) : __bpf_htons(x))
+         __bpf_constant_htons(x) : __bpf_htons(x))
 #define bpf_ntohs(x)                            \
         (__builtin_constant_p(x) ?              \
-         __constant_ntohs(x) : __bpf_ntohs(x))
+         __bpf_constant_ntohs(x) : __bpf_ntohs(x))
 
-#endif
+#endif /* __BPF_ENDIAN__ */
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 3773562056da..cabb19b1e371 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -49,6 +49,7 @@
 #define MAX_NR_MAPS     4
 
 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
+#define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
 
 struct bpf_test {
         const char *descr;
@@ -2615,6 +2616,30 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "direct packet access: test17 (pruning, alignment)",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
+                        BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+                        BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+                        BPF_JMP_A(-6),
+                },
+                .errstr = "misaligned packet access off 2+15+-4 size 4",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+        },
+        {
                 "helper access to packet: test1, valid packet_ptr range",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -3341,6 +3366,70 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
         },
         {
+                "alu ops on ptr_to_map_value_or_null, 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
+                "alu ops on ptr_to_map_value_or_null, 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
+                "alu ops on ptr_to_map_value_or_null, 3",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
                 "invalid memory access with multiple map_lookup_elem calls",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_1, 10),
@@ -4937,7 +5026,149 @@ static struct bpf_test tests[] = {
                 .fixup_map_in_map = { 3 },
                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
                 .result = REJECT,
-        }
+        },
+        {
+                "ld_abs: check calling conv, r1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_1, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R3 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_4, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R4 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_5, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R5 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r7",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_7, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "ld_ind: check calling conv, r1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_1, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_3, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R3 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_4, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R4 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_5, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R5 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r7",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_7, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
@@ -5059,9 +5290,9 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
 
         do_test_fixup(test, prog, map_fds);
 
-        fd_prog = bpf_load_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
-                                   prog, prog_len, "GPL", 0, bpf_vlog,
-                                   sizeof(bpf_vlog));
+        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+                                     prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
+                                     "GPL", 0, bpf_vlog, sizeof(bpf_vlog));
 
         expected_ret = unpriv && test->result_unpriv != UNDEF ?
                        test->result_unpriv : test->result;
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
new file mode 100644
index 000000000000..f4d1ff785d67
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
@@ -0,0 +1,21 @@
+#!/bin/sh
+# description: Register/unregister many kprobe events
+
+# ftrace fentry skip size depends on the machine architecture.
+# Currently HAVE_KPROBES_ON_FTRACE defined on x86 and powerpc
+case `uname -m` in
+  x86_64|i[3456]86) OFFS=5;;
+  ppc*) OFFS=4;;
+  *) OFFS=0;;
+esac
+
+echo "Setup up to 256 kprobes"
+grep t /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \
+head -n 256 | while read i; do echo p ${i}+${OFFS} ; done > kprobe_events ||:
+
+echo 1 > events/kprobes/enable
+echo 0 > events/kprobes/enable
+echo > kprobe_events
+echo "Waiting for unoptimizing & freeing"
+sleep 5
+echo "Done"
diff --git a/tools/testing/selftests/ntb/ntb_test.sh b/tools/testing/selftests/ntb/ntb_test.sh
index a676d3eefefb..13f5198ba0ee 100755
--- a/tools/testing/selftests/ntb/ntb_test.sh
+++ b/tools/testing/selftests/ntb/ntb_test.sh
@@ -305,7 +305,7 @@ function perf_test()
         echo "Running remote perf test $WITH DMA"
         write_file "" $REMOTE_PERF/run
         echo -n "  "
-        read_file $LOCAL_PERF/run
+        read_file $REMOTE_PERF/run
         echo "  Passed"
 
         _modprobe -r ntb_perf
diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
index d9c49f41515e..e79ccd6aada1 100644
--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
@@ -42,12 +42,12 @@ int test_body(void)
         printf("Check DSCR TM context switch: ");
         fflush(stdout);
         for (;;) {
-                rv = 1;
                 asm __volatile__ (
                         /* set a known value into the DSCR */
                         "ld      3, %[dscr1];"
                         "mtspr   %[sprn_dscr], 3;"
 
+                        "li      %[rv], 1;"
                         /* start and suspend a transaction */
                         "tbegin.;"
                         "beq     1f;"
diff --git a/usr/Kconfig b/usr/Kconfig
index c0c48507e44e..ad0543e21760 100644
--- a/usr/Kconfig
+++ b/usr/Kconfig
@@ -220,6 +220,7 @@ config INITRAMFS_COMPRESSION_LZ4
 endchoice
 
 config INITRAMFS_COMPRESSION
+        depends on INITRAMFS_SOURCE!=""
         string
         default ""      if INITRAMFS_COMPRESSION_NONE
         default ".gz"   if INITRAMFS_COMPRESSION_GZIP
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index 32c3295929b0..87940364570b 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -22,7 +22,7 @@
 #include <asm/kvm_hyp.h>
 
 #define vtr_to_max_lr_idx(v)            ((v) & 0xf)
-#define vtr_to_nr_pre_bits(v)           (((u32)(v) >> 26) + 1)
+#define vtr_to_nr_pre_bits(v)           ((((u32)(v) >> 26) & 7) + 1)
 
 static u64 __hyp_text __gic_v3_get_lr(unsigned int lr)
 {
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index a2d63247d1bb..e2e5effba2a9 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -879,6 +879,9 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pmd_t *pmd;
 
         pud = stage2_get_pud(kvm, cache, addr);
+        if (!pud)
+                return NULL;
+
         if (stage2_pud_none(*pud)) {
                 if (!cache)
                         return NULL;
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index 0a4283ed9aa7..63e0bbdcddcc 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -226,7 +226,13 @@ static unsigned long vgic_mmio_read_vcpuif(struct kvm_vcpu *vcpu,
 
         switch (addr & 0xff) {
         case GIC_CPU_CTRL:
-                val = vmcr.ctlr;
+                val = vmcr.grpen0 << GIC_CPU_CTRL_EnableGrp0_SHIFT;
+                val |= vmcr.grpen1 << GIC_CPU_CTRL_EnableGrp1_SHIFT;
+                val |= vmcr.ackctl << GIC_CPU_CTRL_AckCtl_SHIFT;
+                val |= vmcr.fiqen << GIC_CPU_CTRL_FIQEn_SHIFT;
+                val |= vmcr.cbpr << GIC_CPU_CTRL_CBPR_SHIFT;
+                val |= vmcr.eoim << GIC_CPU_CTRL_EOImodeNS_SHIFT;
+
                 break;
         case GIC_CPU_PRIMASK:
                 /*
@@ -267,7 +273,13 @@ static void vgic_mmio_write_vcpuif(struct kvm_vcpu *vcpu,
 
         switch (addr & 0xff) {
         case GIC_CPU_CTRL:
-                vmcr.ctlr = val;
+                vmcr.grpen0 = !!(val & GIC_CPU_CTRL_EnableGrp0);
+                vmcr.grpen1 = !!(val & GIC_CPU_CTRL_EnableGrp1);
+                vmcr.ackctl = !!(val & GIC_CPU_CTRL_AckCtl);
+                vmcr.fiqen = !!(val & GIC_CPU_CTRL_FIQEn);
+                vmcr.cbpr = !!(val & GIC_CPU_CTRL_CBPR);
+                vmcr.eoim = !!(val & GIC_CPU_CTRL_EOImodeNS);
+
                 break;
         case GIC_CPU_PRIMASK:
                 /*
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index 504b4bd0d651..e4187e52bb26 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -177,7 +177,18 @@ void vgic_v2_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
         struct vgic_v2_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v2;
         u32 vmcr;
 
-        vmcr  = (vmcrp->ctlr << GICH_VMCR_CTRL_SHIFT) & GICH_VMCR_CTRL_MASK;
+        vmcr = (vmcrp->grpen0 << GICH_VMCR_ENABLE_GRP0_SHIFT) &
+                GICH_VMCR_ENABLE_GRP0_MASK;
+        vmcr |= (vmcrp->grpen1 << GICH_VMCR_ENABLE_GRP1_SHIFT) &
+                GICH_VMCR_ENABLE_GRP1_MASK;
+        vmcr |= (vmcrp->ackctl << GICH_VMCR_ACK_CTL_SHIFT) &
+                GICH_VMCR_ACK_CTL_MASK;
+        vmcr |= (vmcrp->fiqen << GICH_VMCR_FIQ_EN_SHIFT) &
+                GICH_VMCR_FIQ_EN_MASK;
+        vmcr |= (vmcrp->cbpr << GICH_VMCR_CBPR_SHIFT) &
+                GICH_VMCR_CBPR_MASK;
+        vmcr |= (vmcrp->eoim << GICH_VMCR_EOI_MODE_SHIFT) &
+                GICH_VMCR_EOI_MODE_MASK;
         vmcr |= (vmcrp->abpr << GICH_VMCR_ALIAS_BINPOINT_SHIFT) &
                 GICH_VMCR_ALIAS_BINPOINT_MASK;
         vmcr |= (vmcrp->bpr << GICH_VMCR_BINPOINT_SHIFT) &
@@ -195,8 +206,19 @@ void vgic_v2_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 
         vmcr = cpu_if->vgic_vmcr;
 
-        vmcrp->ctlr = (vmcr & GICH_VMCR_CTRL_MASK) >>
-                        GICH_VMCR_CTRL_SHIFT;
+        vmcrp->grpen0 = (vmcr & GICH_VMCR_ENABLE_GRP0_MASK) >>
+                GICH_VMCR_ENABLE_GRP0_SHIFT;
+        vmcrp->grpen1 = (vmcr & GICH_VMCR_ENABLE_GRP1_MASK) >>
+                GICH_VMCR_ENABLE_GRP1_SHIFT;
+        vmcrp->ackctl = (vmcr & GICH_VMCR_ACK_CTL_MASK) >>
+                GICH_VMCR_ACK_CTL_SHIFT;
+        vmcrp->fiqen = (vmcr & GICH_VMCR_FIQ_EN_MASK) >>
+                GICH_VMCR_FIQ_EN_SHIFT;
+        vmcrp->cbpr = (vmcr & GICH_VMCR_CBPR_MASK) >>
+                GICH_VMCR_CBPR_SHIFT;
+        vmcrp->eoim = (vmcr & GICH_VMCR_EOI_MODE_MASK) >>
+                GICH_VMCR_EOI_MODE_SHIFT;
+
         vmcrp->abpr = (vmcr & GICH_VMCR_ALIAS_BINPOINT_MASK) >>
                         GICH_VMCR_ALIAS_BINPOINT_SHIFT;
         vmcrp->bpr  = (vmcr & GICH_VMCR_BINPOINT_MASK) >>
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 6fe3f003636a..030248e669f6 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -159,15 +159,24 @@ void vgic_v3_clear_lr(struct kvm_vcpu *vcpu, int lr)
 void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 {
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+        u32 model = vcpu->kvm->arch.vgic.vgic_model;
         u32 vmcr;
 
-        /*
-         * Ignore the FIQen bit, because GIC emulation always implies
-         * SRE=1 which means the vFIQEn bit is also RES1.
-         */
-        vmcr = ((vmcrp->ctlr >> ICC_CTLR_EL1_EOImode_SHIFT) <<
-                 ICH_VMCR_EOIM_SHIFT) & ICH_VMCR_EOIM_MASK;
-        vmcr |= (vmcrp->ctlr << ICH_VMCR_CBPR_SHIFT) & ICH_VMCR_CBPR_MASK;
+        if (model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                vmcr = (vmcrp->ackctl << ICH_VMCR_ACK_CTL_SHIFT) &
+                        ICH_VMCR_ACK_CTL_MASK;
+                vmcr |= (vmcrp->fiqen << ICH_VMCR_FIQ_EN_SHIFT) &
+                        ICH_VMCR_FIQ_EN_MASK;
+        } else {
+                /*
+                 * When emulating GICv3 on GICv3 with SRE=1 on the
+                 * VFIQEn bit is RES1 and the VAckCtl bit is RES0.
+                 */
+                vmcr = ICH_VMCR_FIQ_EN_MASK;
+        }
+
+        vmcr |= (vmcrp->cbpr << ICH_VMCR_CBPR_SHIFT) & ICH_VMCR_CBPR_MASK;
+        vmcr |= (vmcrp->eoim << ICH_VMCR_EOIM_SHIFT) & ICH_VMCR_EOIM_MASK;
         vmcr |= (vmcrp->abpr << ICH_VMCR_BPR1_SHIFT) & ICH_VMCR_BPR1_MASK;
         vmcr |= (vmcrp->bpr << ICH_VMCR_BPR0_SHIFT) & ICH_VMCR_BPR0_MASK;
         vmcr |= (vmcrp->pmr << ICH_VMCR_PMR_SHIFT) & ICH_VMCR_PMR_MASK;
@@ -180,17 +189,27 @@ void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 void vgic_v3_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
 {
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
+        u32 model = vcpu->kvm->arch.vgic.vgic_model;
         u32 vmcr;
 
         vmcr = cpu_if->vgic_vmcr;
 
-        /*
-         * Ignore the FIQen bit, because GIC emulation always implies
-         * SRE=1 which means the vFIQEn bit is also RES1.
-         */
-        vmcrp->ctlr = ((vmcr >> ICH_VMCR_EOIM_SHIFT) <<
-                        ICC_CTLR_EL1_EOImode_SHIFT) & ICC_CTLR_EL1_EOImode_MASK;
-        vmcrp->ctlr |= (vmcr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT;
+        if (model == KVM_DEV_TYPE_ARM_VGIC_V2) {
+                vmcrp->ackctl = (vmcr & ICH_VMCR_ACK_CTL_MASK) >>
+                        ICH_VMCR_ACK_CTL_SHIFT;
+                vmcrp->fiqen = (vmcr & ICH_VMCR_FIQ_EN_MASK) >>
+                        ICH_VMCR_FIQ_EN_SHIFT;
+        } else {
+                /*
+                 * When emulating GICv3 on GICv3 with SRE=1 on the
+                 * VFIQEn bit is RES1 and the VAckCtl bit is RES0.
+                 */
+                vmcrp->fiqen = 1;
+                vmcrp->ackctl = 0;
+        }
+
+        vmcrp->cbpr = (vmcr & ICH_VMCR_CBPR_MASK) >> ICH_VMCR_CBPR_SHIFT;
+        vmcrp->eoim = (vmcr & ICH_VMCR_EOIM_MASK) >> ICH_VMCR_EOIM_SHIFT;
         vmcrp->abpr = (vmcr & ICH_VMCR_BPR1_MASK) >> ICH_VMCR_BPR1_SHIFT;
         vmcrp->bpr  = (vmcr & ICH_VMCR_BPR0_MASK) >> ICH_VMCR_BPR0_SHIFT;
         vmcrp->pmr  = (vmcr & ICH_VMCR_PMR_MASK) >> ICH_VMCR_PMR_SHIFT;
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index da83e4caa272..bba7fa22a7f7 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -111,14 +111,18 @@ static inline bool irq_is_pending(struct vgic_irq *irq)
  * registers regardless of the hardware backed GIC used.
  */
 struct vgic_vmcr {
-        u32     ctlr;
+        u32     grpen0;
+        u32     grpen1;
+
+        u32     ackctl;
+        u32     fiqen;
+        u32     cbpr;
+        u32     eoim;
+
         u32     abpr;
         u32     bpr;
         u32     pmr;  /* Priority mask field in the GICC_PMR and
                        * ICC_PMR_EL1 priority field format */
-        /* Below member variable are valid only for GICv3 */
-        u32     grpen0;
-        u32     grpen1;
 };
 
 struct vgic_reg_attr {
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index a8d540398bbd..9120edf3c94b 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -184,7 +184,7 @@ int __attribute__((weak)) kvm_arch_set_irq_inatomic(
  * Called with wqh->lock held and interrupts disabled
  */
 static int
-irqfd_wakeup(wait_queue_t *wait, unsigned mode, int sync, void *key)
+irqfd_wakeup(wait_queue_entry_t *wait, unsigned mode, int sync, void *key)
 {
         struct kvm_kernel_irqfd *irqfd =
                 container_of(wait, struct kvm_kernel_irqfd, wait);